ntlmssp errors against El Capitan's SMB Server

[Jeremy Allison]

On Tue, Aug 16, 2016 at 11:28:07AM +0200, Christian Ambach wrote:
> Hi list,
> 
> I was trying to use smbclient against the SMB server included in MacOS X
> El Capitan, but it fails to authenticate with
> > NTLMSSP packet check failed due to short signature (0 bytes)!
> > NTLMSSP NTLM2 packet check failed due to invalid signature!
> 
> I am not a NTLMSSP expert, but looking at the attached capture it seems
> that Apple's SMB server does not provide a signature when asked to do so
> with the NTLMSSP_NEGOTIATE_SIGN flag.
> I suspect that this is another side-effect of the badlock hardenings?
> 
> Is there a config variable available to work around this?
> Can we detect that the server does not support the flag and not use it?

Trouble is the server is saying it *does* support the NTLMSSP_NEGOTIATE_SIGN
flag in the reply.

Can you get a Windows 8 or above client capture trace connecting to
this same server to see "what windows does (tm)".

Jeremy