[Samba] Server Mandatory SMB Signing Not Working

[Andrew Bartlett]

On Sun, 2021-08-08 at 19:08 -0400, Philip Cunio via samba wrote:
> We have just implemented the requirement for SMB signing to be
> mandatory. I
> 
> have made the required changes to smb.conf but it is not working.
> Windows
> 
> clients requiring SMB signing as mandatory can not connect. If we
> remove
> 
> that requirement, the client can connect. We are running SAMBA 4.10.6
> on
> 
> AIX 7.1 TL5. Below is the pertinent information from 
> /etc/samba/smb.conf:
> 
> 
> 
>  [global]

>         map to guest = Bad Password

This is the issue.  If we map to guest, then there is no authentication
handshake to build SMB signing onto (this isn't certificate based -
like HTTPS which allows anonymous browsing, it is all derived from the
password as the shared secret).

You will need fully authenticated shares to get SMB signing. 

I trust this clarifies things,

Andrew Bartlett
-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions