[Samba] NTLMSSP Sign/Seal - using NTLM1

[Rowland Penny]

On 10/07/2023 21:21, Vincent via samba wrote:
> Hello,
> 
> We have a customer that is using Samba version 4.7.12 and Windows 10
> clients. When they initiate connections, they are very slow to authenticate
> (several minutes). It does not readily appear there are network
> connectivity issues.
> 
> Of possible note, the following log sequence is, repeatedly, observed
> within the Samba debug logs:
> 
> [2023/07/06 11:14:15.676774,  3, pid=2118992, effective(0, 0), real(0, 0)]
> ../auth/ntlmssp/ntlmssp_sign.c:509(ntlmssp_sign_reset)
>    NTLMSSP Sign/Seal - Initialising with flags:
> [2023/07/06 11:14:15.676783,  3, pid=2118992, effective(0, 0), real(0, 0)]
> ../auth/ntlmssp/ntlmssp_util.c:69(debug_ntlmssp_flags)
>    Got NTLMSSP neg_flags=0x62008a15
>      NTLMSSP_NEGOTIATE_UNICODE
>      NTLMSSP_REQUEST_TARGET
>      NTLMSSP_NEGOTIATE_SIGN
>      NTLMSSP_NEGOTIATE_NTLM
>      NTLMSSP_ANONYMOUS
>      NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>      NTLMSSP_NEGOTIATE_VERSION
>      NTLMSSP_NEGOTIATE_128
>      NTLMSSP_NEGOTIATE_KEY_EXCH
> [2023/07/06 11:14:15.676809,  5, pid=2118992, effective(0, 0), real(0, 0)]
> ../auth/ntlmssp/ntlmssp_sign.c:633(ntlmssp_sign_reset)
>    *NTLMSSP Sign/Seal - using NTLM1*
> [2023/07/06 11:14:15.786392,  3, pid=2118992, effective(0, 0), real(0, 0)]
> ../source3/libsmb/cliconnect.c:1678(cli_session_setup_creds_done_spnego)
>    SPNEGO login failed: The request is not supported.
> 
> What would cause the client to use NTLM1 for signing and sealing? Is this
> due to the NTLMSSP_NEGOTIATE_SEAL flag not being set? Is this even an
> issue? I presume it may be problematic, due to the subsequent "SPNEGO login
> failed" message.
> 
> Thank you,
> 
> Vincent

I am sorry, but we are going to need a lot more info before we can even 
begin to get to the bottom of this, but I will say that Samba 4.7.6 is 
ancient from the Samba point of view.

Rowland