[cifs-protocol] Inability to use Win2k8 as a member server in Samba4 domain (was Clarify reserved bytes that are in fact used in LogonSamLogonEx response)

[Sebastian Canevari]

Hi Andrew,

We've concluded our investigation and the following change will be available in future versions of MS-NRPC (section 2.2.1.4.13):


ExpansionRoom:  If NTLMV1 is used, the first 8 bytes represent the LMOWF as specified in [MS-NLMP] section 3.3.1. If NTLMV2, the first 8 bytes are set to the KXKEY ([MS-NLMP] section 3.4.5.1). This MAY be set to zero.<27>


<27> Section 2.2.1.4.13: There is a security issue with ExpansionRoom. If the data in this field is known, the password can be generated. Because of this, it is recommended for implementers that this field be zero-filled.



Please let me know if this answers your request.

Thanks and regards,


Sebastian Canevari
Senior Support Escalation Engineer, US-CSS DSC PROTOCOL TEAM
7100 N Hwy 161, Irving, TX - 75039
"Las Colinas - LC2"
Tel: +1 469 775 7849
e-mail: sebastc at microsoft.com



-----Original Message-----
From: Andrew Bartlett [mailto:abartlet at samba.org] 
Sent: Tuesday, July 28, 2009 8:04 PM
To: Sebastian Canevari
Cc: Interoperability Documentation Help; pfif at tridgell.net; cifs-protocol at samba.org
Subject: RE: Inability to use Win2k8 as a member server in Samba4 domain (was Clarify reserved bytes that are in fact used in LogonSamLogonEx response)

On Tue, 2009-07-28 at 17:07 -0700, Sebastian Canevari wrote:
> Hi Andrew,
> 
> I'm working with the product group in confirming my findings.
> 
> I am pretty sure that the first two longs in  array ExpansionRoom in
> NETLOGON_VALIDATION_SAM_INFO4 (2.2.1.4.13 MS-NRPC) are used for the 
> LanmanSessionKey but like I said I need to confirm it with the product 
> group before giving you a definitive answer.

Indeed.  If I had looked more carefully at the Samba Team's netlogon IDL this would have been clear.  

This means that the actual problem here is unrelated.  Perhaps it needs a new case, but can you please reproduce the failure of Win2k8 to operate in a Samba4 domain, and see if you can tell us why this is the case.  We have been unable to identify any other differences in the protocol stream at this time. 

Andrew Bartlett

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Cisco Inc.