similar to: NTLM protocol question

Hi, I'm getting "Permission denied" error while connecting to a EMC Celerra (version 7) server from samba client on unix machine. Looking at the packet capture it is observed that samba client is authenticating with "anonymous" instead of the user name that has been provided. Here are flags received from EMC Celerra 7 server as part of "Session Setup AndX Response,

Hi, I'm getting "Permission denied" error while connecting to a EMC cifs share from samba client on unix machine. Looking at the packet capture it is observed that ?samba client is authenticating with "anonymous" instead of the user name that has been provided. Here are flags received from EMC server as part of ?"Session Setup AndX Response, NTLMSSP_CHALLENGE,

I must be missing something- Are these Windows clients?  Or are these Linux clients authenticating against Samba ? if they were linux clients then yes I could see sssd or other authentication components besides winbind coming into play. And in that case yes you would have sssd work with winbind to enable caching of credentials. Is the event log entry below from the server ?   Is it from

There are roughly 20 DC's, spread across multiple different physical locations. It is indeed a replication issue. All of them are windows and we can get authenticated by any of them, randomly. Don't ask me why... they're managed by the "windows' guys"... I've already tried all sorts of possible combinations for the various NTLM-related parameters and it always fail

This issue right here told me exactly what I needed to understand this authentication process:https://pagure.io/SSSD/sssd/issue/3228 - The client talks to the DC to try and get a cifs ticket for my samba server's princpal name;- In case the client can't get the ticket for any reason, it falls back to NTLM <- windows client decision, nothing can be done about it by Samba/SSSD; Once I

Hi, I'm wondering if samba supports NTLMv2, particullary NTLMv2 session security. But I can't even get NTLM-only to work :(. I'm trying to increase lmcompatibilitylevel, but I can't connect to the samba server anymore when I set it to 2 or higher ("Send NTLM authenication only"). I'm using HEAD CVS of today, and my smb.conf looks like this: [global]

Hi, We are having problems setting up a squid cache server to use NTLMv2 authentication to authenticate users against AD. We have narrowed the problems down to being a problem between samba and squid when using NTLMv2. It constantly moans about the password being wrong when using squid, but doing a direct samba auth works fine. We have (believedly) narrowed it down to this: the domain requires

How is your sssd settup (sssd.conf) configured? When someone connects via samba, the underlying linux/unix file system routines need to have some what of understanding the windows users and groups.   This isn't for authentication  but is instead to make sure that the file permissions can be managed and enforced. My experience - at least when I had classic domain Samba controllers-  was

Samba 3.6.5 client does not train down to plain NTLM if there is no "client ntlmv2 auth = no" statement in the smb.conf file. If the server is configured for just plain NTLM (not NTLMv2), the client will receive a login error, without the smb.conf statement. I know that smbclient 3.6.5 defaults to "client ntlmv2 auth = yes", but the lack of it should be able to login as just

Hi, I have encountered a problem and I don't know how or if I can work around the problem. I setup squid to use NTLM to auth against a 2003 machine. On windows 2003 there is a security option called: "Network Security: LAN Manager authentication level properties", now the default option for this setting is: "Send NTLM response only". If I use the defaults, I can connect

Ok, I finally could try it out, and it seems to actually work, but You need samba 4.7 on all machines, not only AD, but also server with freeradius. I didn't get a chance to test it locally, that is samba AD + freeradius on the same server. Setup: 4.7.6 AD server and 4.6.2 samba member + freeradius didn't work (got simple "nt_status_wrong_password") but: 4.7.6 AD and 4.7.1

Hello, after I started to use dovecot as a backend for exim4 SMTP authentication on my main mailserver, I noticed that some clients don't advertise unicode support and so they can't log in. To fix the problem the attached patch allows use of OEM encoding in NTLM messages. Please consider applying. Best regards. P.S. I want to release exim4 patch in the near future, probably when Timo

Hello, I've done some further testing, and I have to correct myself. I was (kind of obviously as I think about it) wrong about samba on the freeradius server requiring v. 4.7. What makes all the difference is the method used by mschap. Traditionally in freeradius in mods-available/mschap you'll use something like: ntlm_auth = "/path/to/ntlm_auth --request-nt-key

​Hello, I compiled Samba 4.8.2 from the git repository to upgrade my existing samba install, however I'm not sure it has gone correctly and I am having a problem authorizing radius clients that previously succeeded using mschapv2 I set the option in smb.conf ntlm auth = mschapv2-and-ntlmv2-only but running testparm gives me an error set_variable_helper(mschapv2-and-ntlmv2-only): value is not

On 26 March 2018 at 14:31, Kacper Wirski via samba <samba at lists.samba.org> wrote: > Also I just facepalmed, as I double checked smb.conf right after sending > mail, and in samba 4.7 there are new options available for "ntlm auth", as > stated in docs: > > |mschapv2-and-ntlmv2-only| - Only allow NTLMv1 when the client promises > that it is providing MSCHAPv2

Hi, thank you very much for testing everything out. Great work! One question: passchange - which application are working with passchange on radius ? In the moment every user with an expired password is NOT able to use services using radius for authentication (WLAN,VPN). Is there any documentation available ? Bye, Peer On 27.03.2018 22:40, Kacper Wirski via samba wrote: > Hello, > >

The domain controler is Windows. The file Server is Linux/Samba. The clients are Windows. I've tested the access on a dozen different windows machines. Three of them used NTLM and failed. All the others used kerberos and succeeded. They're all in the same network, same domain. Maybe it's the windows version? But they're all Window 8 or 10, not a great deal of a difference between

Hey there! Can you guys tell me about what's the status of docs of NTLM/NTLMv2 provided by Microsoft? Let me explain why I need that: we had here a discussion on a local college about "free x proprietary software", and the Microsoft guy (always them, right?) told us about a case where he claimed that Firefox sent one user username and password through the network without

How old is the scanner ?   Did you check for a firmware update for it?    NTLM has been around for so long that it is hard to imagine anything that has to have LANMAN support. On 10/02/17 19:08, ToddAndMargo via samba wrote: >> On 10/02/17 17:16, ToddAndMargo via samba wrote: >>> Hi All, >>> >>> Server: >>>    Fedora 26 >>>   

> On 10/02/17 17:16, ToddAndMargo via samba wrote: >> Hi All, >> >> Server: >>    Fedora 26 >>    samba-4.6.8-0.fc26.x86_64 >> >> Workstations (5 of them): >>    XP Pro SP3 >> >> >> I set all five of my customer XP workstations to >> >> Send NTLMv2 response only\\refuse LM and NTLM >> >> and turned off