enterprise-support team mailing list archive

[Bryan Quigley <bryan.quigley@xxxxxxxxxxxxx>]

Public bug reported:

With the recent security update to 4.3.8 on Ubuntu 14.04 some Mac OS X
10.11 were unable to connect to shares.   The shares were still
accessible fine via Windows 10 machines.

Samba versions that broke: 2:4.3.8+dfsg-0ubuntu0.14.04.2
Samba version that works: 2:4.1.6+dfsg-1ubuntu2.14.04.13

The error message (If you turn up log level to 2) in the /log.IPADDRESSOFMAC:
[2016/04/19 14:06:15.555081, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password) 
check_ntlm_password: Authentication for user [GUEST] -> [GUEST] FAILED with error NT_STATUS_NO_SUCH_USER 
[2016/04/19 14:06:15.555119, 1] ../auth/ntlmssp/ntlmssp_server.c:910(ntlmssp_server_postauth) 
ntlmssp_server_postauth: invalid NTLMSSP_MIC for user=[GUEST] domain=[] workstation=[workstation] 
[2016/04/19 14:06:15.555134, 1] ../lib/util/util.c:559(dump_data) 
[0000] hex removed` 
[2016/04/19 14:06:15.555163, 1] ../lib/util/util.c:559(dump_data) 
[0000] hex removed
[2016/04/19 14:06:15.555190, 2] ../auth/gensec/spnego.c:708(gensec_spnego_server_negTokenTarg) 
SPNEGO login failed: NT_STATUS_INVALID_PARAMETER

This seems very similar to https://www.mail-archive.com/debian-bugs-
dist@xxxxxxxxxxxxxxxx/msg1414417.html.

The Samba config is a very simple one, with all users just connecting as guest.  Some excerpts:
map to guest = bad user 
[files]
	public = yes
	delete readonly = yes
	writeable = yes
	path = /removed/

Workaround. Reverting packages worked, but is complicated, make yourself
root- sudo -i (because you can break pam!).

Download needed packages from:
https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689
https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294692

You likely should have packages libkdc2-heimdal and libhdb9-heimdal in
/var/cache/apt/archive so install the old version of them.

(something like)
wget https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689/+files/libpam-winbind_4.1.6+dfsg-1ubuntu2.14.04.13_amd64.deb https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689/+files/libwbclient0_4.1.6+dfsg-1ubuntu2.14.04.13_amd64.deb https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689/+files/python-samba_4.1.6+dfsg-1ubuntu2.14.04.13_amd64.deb https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689/+files/samba_4.1.6+dfsg-1ubuntu2.14.04.13_amd64.deb https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689/+files/samba-common-bin_4.1.6+dfsg-1ubuntu2.14.04.13_amd64.deb https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689/+files/samba-libs_4.1.6+dfsg-1ubuntu2.14.04.13_amd64.deb https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689/+files/samba-vfs-modules_4.1.6+dfsg-1ubuntu2.14.04.13_amd64.deb https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689/+files/smbclient_4.1.6+dfsg-1ubuntu2.14.04.13_amd64.deb https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689/+files/winbind_4.1.6+dfsg-1ubuntu2.14.04.13_amd64.deb  https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294692/+files/samba-common_4.1.6+dfsg-1ubuntu2.14.04.13_all.deb https://launchpad.net/~ubuntu-security/+archive/ubuntu/ppa/+build/9294689/+files/samba-dsdb-modules_4.1.6+dfsg-1ubuntu2.14.04.13_amd64.deb

Then sudo dpkg -i *.deb them.   Then go through and fix any remaining
missing packages, unconfigured packages.

** Affects: samba (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: samba (Debian)
     Importance: Unknown
         Status: Unknown

-- 
You received this bug notification because you are a member of Ubuntu
Server/Client Support Team, which is subscribed to samba in Ubuntu.
Matching subscriptions: Ubuntu Server/Client Support Team
https://bugs.launchpad.net/bugs/1572301

Title:
  Regression with 4.3.8 upgrade, Mac OS X machines can't connect

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1572301/+subscriptions