Using SPNEGO/SSPI in SMB

[samba-technical.10.overbored at spamgourmet.com]

On Fri, 2005-08-19 at 01:44 -0700,
samba-technical.10.overbored at spamgourmet.com wrote:
> Thus spake Michael B Allen - mba2000 at ioplex.com on 8/18/2005 11:33 PM:
> > On Thu, 18 Aug 2005 15:44:21 -0700
> > samba-technical.10.overbored at spamgourmet.com wrote:
> > 
> > 
> >>This is the corresponding SMB session setup requests/responses. Are 
> >>these entire security blobs just the direct outputs of the SSPI calls to 
> >>InitializeSecurityContext()/AcceptSecurityContext()?
> > 
> > 
> > Pretty much. I think GSSAPI handles everything from NegToken* down
> > but you might want to create a little Windows proggie that negotiates
> > a security context with itself and then hexdump the buffers to verify
> > what layers are handled exactly.
> > 
> > Mike
> 
> I did as you suggested. I got the NTLMSSP buffers outputted by 
> InitializeSecurityContext/AcceptSecurityContext from this program 
> (change "Kerberos" to "NTLM"):
> 
> http://www.pluralsight.com/samplecontent/sspi_auth.cpp
> 
> I compared these to my Ethereal dumps. It turns out that the portion of 
> the Security Blob that is under the section of the Ethereal's dissection 
> called "NTLMSSP" (see my screenshots). Everything in the Security Blob 
> outside that is a mystery!
> 
> So, can anybody pinpoint what all that other stuff is, and how to 
> generate it? (Using Windows APIs, perhaps?) Also, the entire Security 
> Blob in the protocol negotiation response (the SPNEGO stuff) is just as 
> mysterious.

Try 'Negotiate' or 'GSS-SPNEGO' as the mech.  

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Samba Developer, SuSE Labs, Novell Inc.        http://suse.de
Authentication Developer, Samba Team           http://samba.org
Student Network Administrator, Hawker College  http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba-technical/attachments/20050819/36d768fd/attachment-0001.bin