Cross Realm SMB Signature Failure

[Jeremy Allison]

On Thu, May 03, 2007 at 10:54:16PM -0400, Michael B Allen wrote:
> When smbclient authenticates across realms (from MIT realm S.W.NET to
> W2K3 realm W.NET) I'm seeing the server is just echoing back the same
> signature sent by client. That signature of couse fails verification:
> 
> $ kinit -f ioplex at S.W.NET
> Password for ioplex at S.W.NET: 
> $ smbclient -k -U ioplex //dc1.w.net/tmp
> signing_good: BAD SIG: seq 1
> SMB Signature verification failed on incoming packet!
> session setup failed: Server packet had invalid SMB signature!
> 
> If I use a W.NET cred it works fine and ssh works in the other direction
> so I think the trust is good.
> 
> All enctypes are RC4. Haven't updated the W2K3 server since installing
> it. Trying that now ...
> 
> I'm using stock 3.0.23c-2 on CentOS 5.0 with an unmodified smb.conf.
> 
> Has anyone seen this before?

Yes - I have a fix for this in the current 3.0.25rc tree.

Jeremy.