[cifs-protocol] Protocol changes in KB2992611 [115012312316449]

[Andrew Bartlett]

On Wed, 2015-02-04 at 06:43 +1300, Andrew Bartlett wrote:
> On Tue, 2015-02-03 at 15:37 +0000, Obaid Farooqi wrote:
> > Hi Andrew:
> > I am trying to reproduce the issue. So far I am unsuccessful. 
> 
> That is very odd.
> 
> > From the posts you mentioned, the credentials manager does not open if
> > a windows 8.1 machine is joined to Samba domain and kb2992611 is
> > applied? Just want to confirm I got this right.
> 
> Strictly, what we tested was all updates or Dec 2014 Update DVD vs no
> updates.  The users narrowed it down to this KB however.  This is Samba
> as an AD DC.

Also make sure that after the AD domain join, that you log in as a
domain user (we used Administrator). 

> > I am using Samba 4.1.6 that Ubuntu installs.
> 
> We reproduced with git master, but the customer and users reporting are
> running sernet-samba-4.1.11-9.el6.x86_64 on CentOS 6.5 and 4.2rc3
> respectively.  
> 
> Thanks,
> 
> Andrew Bartlett
> 
> > Regards,
> > Obaid Farooqi
> > Escalation Engineer | Microsoft
> > 
> > Exceeding your expectations is my highest priority.  If you would like to provide feedback on your case you may contact my manager at nkang at Microsoft dot com
> > 
> > -----Original Message-----
> > From: Andrew Bartlett [mailto:abartlet at samba.org] 
> > Sent: Monday, February 2, 2015 8:42 PM
> > To: Obaid Farooqi
> > Cc: MSSolve Case Email; cifs-protocol at samba.org
> > Subject: Re: [cifs-protocol] Protocol changes in KB2992611 [115012312316449]
> > 
> > On Tue, 2015-01-27 at 15:55 +1300, Andrew Bartlett wrote:
> > > I've got into our server with the (presumably) failing packet.  The 
> > > client appears to have started requiring that BACKUPKEY_BACKUP_GUID, 
> > > ie the ServerWrap protocol 7f752b10-178e-11d1-ab8f-00805f14db40 
> > > actually work (we do not implement it yet).
> > > 
> > > Before this update, the client is happy for this to fail, now it 
> > > persists with continuing to contact the server, and having this 
> > > operation fail.  This repeats and repeats.
> > > 
> > > I'm also quite curious as to why an update in 2014 is moving clients 
> > > to require use of the RC4 based protocol, given all the bad press that 
> > > cyrpto had got.  This failure is just after a successful call to the 
> > > ClientWrap protocol, which should be much better.
> > > 
> > > I await your thoughts,
> > 
> > Any news on this?  I'm planning on making an implementation of the ServerWrap protocol, but it would help to know what actually changed, so I know if this is likely to help.
> > 
> > Thanks,
> > 
> > Andrew Bartlett
> > --
> > Andrew Bartlett
> > http://samba.org/~abartlet/
> > Authentication Developer, Samba Team  http://samba.org
> > Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba
> > 
> > 
> > 
> > 
> > 
> 

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba