Guillaume Rousse a écrit :
For members of the domain, tough, the client first attempt a kerberos
auth, which fails, as he is not using print server FQDN, and doesn't
performs host name canonicalization.
Actually, from reading the logs, this is false: samba doesn't even
attempt to perform a kerberos auth when a share is accessed through a
non-FQDN name, but directly attempts NTLM:
[2009/02/11 16:59:46, 3]
smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1173)
Doing spnego session setup
[2009/02/11 16:59:46, 3]
smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1208)
NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows
2002 5.1] PrimaryDomain=[]
[2009/02/11 16:59:46, 10] smbd/sesssetup.c:check_spnego_blob_complete(1121)
check_spnego_blob_complete: needed_len = 180, pblob->length = 180
[2009/02/11 16:59:46, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(745)
Got user=[rousse] domain=[MSR-INRIA] workstation=[OBERKAMPF] len1=24
len2=24
[2009/02/11 16:59:46, 5] auth/auth_ntlmssp.c:auth_ntlmssp_set_challenge(68)
auth_context challenge set by NTLMSSP callback (NTLM2)
When using a FQDN, this becomes:
[2009/02/11 16:57:33, 3]
smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1173)
Doing spnego session setup
[2009/02/11 16:57:33, 3]
smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1208)
NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows
2002 5.1] PrimaryDomain=[]
[2009/02/11 16:57:33, 10] smbd/password.c:register_initial_vuid(194)
register_initial_vuid: allocated vuid = 114
[2009/02/11 16:57:33, 10] smbd/sesssetup.c:check_spnego_blob_complete(1121)
check_spnego_blob_complete: needed_len = 1365, pblob->length = 1365
[2009/02/11 16:57:33, 5] smbd/sesssetup.c:parse_spnego_mechanisms(749)
parse_spnego_mechanisms: Got OID 1 2 840 48018 1 2 2
[2009/02/11 16:57:33, 5] smbd/sesssetup.c:parse_spnego_mechanisms(749)
parse_spnego_mechanisms: Got OID 1 2 840 113554 1 2 2
[2009/02/11 16:57:33, 5] smbd/sesssetup.c:parse_spnego_mechanisms(749)
parse_spnego_mechanisms: Got OID 1 3 6 1 4 1 311 2 2 10
[2009/02/11 16:57:33, 3] smbd/sesssetup.c:reply_spnego_negotiate(800)
reply_spnego_negotiate: Got secblob of size 1299
[2009/02/11 16:57:33, 10]
libads/kerberos_verify.c:ads_secrets_verify_ticket(273)
Can someone enlighten me about this behaviour difference ?
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
