Win2k3 SP1, virtual hosting and NTLMv2 failures

Andrew Bartlett abartlet at
Fri Sep 23 02:04:03 GMT 2005

In testing Samba4, I noticed that we were failing the RPC-SAMLOGON test,
don't normally see either in a SamLogon reply, instead we expect

NTLMv2 includes data that could be used to prevent certain MITM (man in
the middle) attacks, such as the target hostname.  In the past, it
appears this data was parsed but not validated, and now it is being

So, if the SamLogon as presented by the member server to the PDC
contains a target netbios name different to the account name, the login
is rejected with LOGON_FAILURE.  No doubt things are more complex than
this, but it would appear to impact on virtual hosting setups.  The
impact on trusted domains also needs to be carefully examined.

The vunrability closed by Win2k3 SP1 has been one of my pet peeves for
too long, and it's nice to see it starting to be closed.  To create a
secure setup, the client must validate that the 'target information'
returned in an NTLMSSP challenge is the same as the server the user
contacted.  It then includes this same (or different) target information
in the NTLMv2 reply, as part of the hashed data.  The DC can then verify
that this machine account is permitted to use that name.

If either the clients start constructing this target information
themselves, or validating this information, various 'virtual hosting'
setups will break.  Assuming this hasn't just been removed from
Microsoft's own functionality, we will need to find out how to add our
aliases to the list of valid names.  It may be as simple as a
construction on servicePrincipalName.

More immediately, this also impacts NTLMv2 without NTLMSSP, where the
client already constructs this information. 

The NOT_FOUND errors are caused by user at REALM style logins, and I need
to look into this further.

Andrew Bartlett
Andrew Bartlett                      
Samba Developer, SuSE Labs, Novell Inc.
Authentication Developer, Samba Team 
Student Network Administrator, Hawker College
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :

More information about the samba-technical mailing list