[Samba] RequireSecuritySignature=1 and public share with guest not working

[Rowland Penny]

On 16/03/15 07:56, Olszewski, Raphael wrote:
> Hi Louis
>
> Thank you!
> As i wrote in my first post, i tried even with these settings:
>          client max protocol = SMB3
>          client min protocol = SMB2
>          client signing = required
>          server signing = required
> But it was not working - as soon I use RequireSecuritySignature=1 on the client.
>
> It seems for that the client is stopping communication since the Win7-client expects something from samba.
> net use t: \\samba\pub<file:///\\samba\pub>
>                 systemerror 1240
>
> MS knowledgebase article speek about enable plain text passwords. But this is wrong since I do not change this password-setting, just require signing.
>
> Is somebody out there, who knows, how to setup samba for using RequireSecuritySignature=1 on Windows Clients?
>
> Greetz  Raphael
> ___________________________________________
> -----Ursprüngliche Nachricht-----
> Von: L.P.H. van Belle [mailto:belle at bazuin.nl]
> Gesendet: Freitag, 13. März 2015 16:21
> An: samba at lists.samba.org
> Cc: Olszewski, Raphael
> Betreff: RE: [Samba] RequireSecuritySignature=1 and public share with guest not working
>
> check the output of :
>
> echo "\n" | testparm -vv | grep signing
> and
> echo "\n" | testparm -vv | grep protocol
>
> for my the default is :
> client max protocol = NT1
>
> but i dont use signing.
>
> but i "think" you need to set the client signing = manadatory and client max protocol = SMB2
>
> ( from man smb.conf )
>
> but if anyone know this better on the list, please correct me.
> Im not sure in this one, never used it..
>
>
> Greetz,
>
> Louis
>
>
>> -----Oorspronkelijk bericht-----
>> Van: r.olszewski at ssc-services.de
>> [mailto:samba-bounces at lists.samba.org] Namens Olszewski, Raphael
>> Verzonden: vrijdag 13 maart 2015 15:57
>> Aan: samba at lists.samba.org
>> Onderwerp: Re: [Samba] RequireSecuritySignature=1 and public share with
>> guest not working
>>
>> Hi Louis
>> I explicitly have to change on win7-client the parameter
>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWor
>> kstation\Parameters]
> >from RequireSecuritySignature=0   =>   RequireSecuritySignature=1
>> and then I have the problem.
>> Before everything is working.
>> All solutions in the wide web just tell me to set
>> RequireSecuritySignature=0, but this is NOT the solution for me since I
>> have to activate RequireSecuritySignature=1 My question originally is:
>> Why it is failing then? Or what I have to do, that this is working with
>> RequireSecuritySignature=1?
>>
>> Raphael

Hi, what I am struggling to understand here is, whilst you are allowing 
anybody the machine doesn't know to connect, you want to allow only 
users from some machines to connect, is this correct ?

If so, have you investigated the 'hosts allow' parameter ?

Rowland