similar to: Samba 3.6.5 not working with EMC server that only supports NTLM

One of our customers uses EMC SAN disks. Newer EMC software no longer supports the SMB_COM_QUERY_INFORMATION_DISK command. It was deprecated by Microsoft. Our SMB scanning no longer works from earlier devices running smbclient 3.0.37. EMC is going to re-enable the command for a few months but they want us to move to newer commands. Is this actually deprecated in the SMB world ? Can someone

I have been searching for weeks for information to our problem, trying to connect our smbclient 3.6.5 to a MAC running 10.9.5 server, and I finally came across the reason. It appears with Maverick, Apple will only accept SMB2 signed signatures. The problem with the 3.6.5 client is, it never supported SMB2, thus will not write the SMB2 signatures. I can add "client signing = disabled" to

Ok, I finally could try it out, and it seems to actually work, but You need samba 4.7 on all machines, not only AD, but also server with freeradius. I didn't get a chance to test it locally, that is samba AD + freeradius on the same server. Setup: 4.7.6 AD server and 4.6.2 samba member + freeradius didn't work (got simple "nt_status_wrong_password") but: 4.7.6 AD and 4.7.1

Hi We have a problem with the one way trusts between the DEV and PROD domains (Windows 2003). Microsoft told me to use NTLM instead of kerberos. Is there a way to force samba to use NTLM (or NTLMv2) instead of kerberos? Regards Urs

Hi, I'm wondering if samba supports NTLMv2, particullary NTLMv2 session security. But I can't even get NTLM-only to work :(. I'm trying to increase lmcompatibilitylevel, but I can't connect to the samba server anymore when I set it to 2 or higher ("Send NTLM authenication only"). I'm using HEAD CVS of today, and my smb.conf looks like this: [global]

Also I just facepalmed, as I double checked smb.conf right after sending mail, and in samba 4.7 there are new options available for "ntlm auth", as stated in docs: |mschapv2-and-ntlmv2-only| - Only allow NTLMv1 when the client promises that it is providing MSCHAPv2 authentication (such as the |ntlm_auth| tool). So that is is I suppose that special "flag" that is used by

Hey there! Can you guys tell me about what's the status of docs of NTLM/NTLMv2 provided by Microsoft? Let me explain why I need that: we had here a discussion on a local college about "free x proprietary software", and the Microsoft guy (always them, right?) told us about a case where he claimed that Firefox sent one user username and password through the network without

Hai,   Since im still having problems reading the man smb.conf about the NTLM settings, im asking here. How do i allow NTLM auth for my proxy.   I have been playing around with :           client NTLMv2 auth         raw NTLMv2 auth         ntlm auth         lanman auth   i’ve added the proxy user to the winbind_privileged group. and did set the needed rights. chgrp winbindd_priv

Hi, We are having problems setting up a squid cache server to use NTLMv2 authentication to authenticate users against AD. We have narrowed the problems down to being a problem between samba and squid when using NTLMv2. It constantly moans about the password being wrong when using squid, but doing a direct samba auth works fine. We have (believedly) narrowed it down to this: the domain requires

Whenever a client uses kerberos as authentication, it succeeds. Whenever a client uses NTLM as authentication, it fails (logs bellow) since SSSD can't support NTLM. Thus my question: what can I do to prevent NTLM from being used?? [2018/10/09 17:49:29.507046,  2] ../source3/auth/auth.c:332(auth_check_ntlm_password)  check_ntlm_password:  Authentication for user [MYUSER] -> [MYUSER] FAILED

We are trying to use Russian(Cyrillic) names in smbclient 4.3.3 but that does not seem to work. Previously we had a problem in 4.0.7 which the location of upcase.dat changed from 3.6.5. In 4.3.3, we don't see it trying to access that file, nor do I believe that file needs to be delivered anymore. Is there a new way to configure the printer to use Russian user names ? Mike

ok, tested it, and it works. so to summarize: on samba ad 4.7.x  in smb.conf "ntlm auth" is set to "mschapv2-and-ntlmv2-only" fr + samba domain member (4.6 and 4.7) in mods-available/mschap you have to add to ntlm_auth --allow-mschapv2 to the whole string OR just use winbind method, which sets correct flag without explicitly adding it. with those settings ntlmv1 is blocked

Hello all, as I promised some days ago here is NTLM (aka SPA, aka MSN) authentication support patchset. It contains common code in src/lib-ntlm directory, Samba compatible NTLM password scheme and authentication mechanism itself. All patches are against 1.0-test30. Please take a look. Best regards. -- Andrey Panin | Linux and UNIX system administrator pazke at donpac.ru | PGP key:

The domain controler is Windows. The file Server is Linux/Samba. The clients are Windows. I've tested the access on a dozen different windows machines. Three of them used NTLM and failed. All the others used kerberos and succeeded. They're all in the same network, same domain. Maybe it's the windows version? But they're all Window 8 or 10, not a great deal of a difference between

​Hello, I compiled Samba 4.8.2 from the git repository to upgrade my existing samba install, however I'm not sure it has gone correctly and I am having a problem authorizing radius clients that previously succeeded using mschapv2 I set the option in smb.conf ntlm auth = mschapv2-and-ntlmv2-only but running testparm gives me an error set_variable_helper(mschapv2-and-ntlmv2-only): value is not

Hi, I'm not sure what NTLM version is used as default by authentication between Outlook and dovecot and I couldn't find it out with a packet sniffer. I think its NTLMv2 but I'm not sure so I'm asking here. I know that NTLMv1 is not secure against a man in the middle. _____________________________________________________________________ Der WEB.DE SmartSurfer hilft bis zu 70%

Single DC? If a single DC then there should not be any replication issues - that would only be between domain controllers and the event logs would indicate that.   I have 2 Windows DC's with a mix of Samba member servers. As far as I know, the domain member does not need client NTLM auth to be enabled to talk to the DC but I am not 100% sure.  You may want to try reenabling it and

Hello, I can definately confirm that it's working. My basic setup is: 1) Samba 4.7.6 AD DC (2 of them), compiled from source, on centos 7 2) Freeradius 3.0.13 + samba 4.6.2 as domain member, packages straight from centos repo. // I  tested also on freeradius 3.0.14 and samba 4.7.x smb.conf on the DC is pretty basic, most important is obviously in [globall]:         ntlm auth =

Hi, I have encountered a problem and I don't know how or if I can work around the problem. I setup squid to use NTLM to auth against a 2003 machine. On windows 2003 there is a security option called: "Network Security: LAN Manager authentication level properties", now the default option for this setting is: "Send NTLM response only". If I use the defaults, I can connect

Hi, I'm getting "Permission denied" error while connecting to a EMC cifs share from samba client on unix machine. Looking at the packet capture it is observed that ?samba client is authenticating with "anonymous" instead of the user name that has been provided. Here are flags received from EMC server as part of ?"Session Setup AndX Response, NTLMSSP_CHALLENGE,