NTLM packet signing gone bad - fixed by Samba restart

[Dave Daugherty]

Thanks Andrew,

That’s a good clue and I believe I saw a reference to that fix in a post 3.5.5 release note.  I will follow up on it later this weekend.

Dave


> From: Andrew Bartlett [mailto:abartlet at samba.org]
> Sent: Friday, June 24, 2011 6:46 PM
> 
> This sounds like the issue with the session key on the netlogon
> connection from winbind being wrong.
> 
> The symptoms are just like this, and I believe a fix was made.  We
> would
> create a new schannel connection, changing the key, but still decrypt
> with the old netlogon/schannel session key.  (Because once
> re-negotiated, the key would change for all connections, including
> existing connections).
> 
> The fix was to move to a SamLogonEx variant that didn't double-encrypt
> the user's session key with the schannel session key, or to always read
> the session key from a TDB before each use.
> 
> I'm sure one of the developers who was directly involved can remember
> the bug number, and what release it was fixed in.
>