unsubscribe

[Erwin Baeyens]

On 08/06/17 16:35, Christian Garling wrote:
>
> Hello list,
>
> a few days ago we migrated our shares to a DFS cluster, also we 
> disabled SMBv1 protocol. Now we are no longer able to connect to the 
> shares with our linux workstations. The setup looks like this:
>
> linux workstation -----> AD server (Windows Server 2008 R2) -----> 
> file server (Windows Server 2016, running in 2008 R2 compat mode)
>
> I have searched the web for a solution on the last few days. Mostly it 
> came down to this:
>
> Take care that smbclient, cifs-utils and keyutils is installed. Also 
> have these lines in /etc/request-key.conf:
>
> create  cifs.spnego     *       *               /usr/sbin/cifs.upcall %k
> create  dns_resolver    *       *               /usr/sbin/cifs.upcall %k
>
> My setup satisfies these requirements. I have tried the connection 
> with these commands (I replaced our domain with example.com):
>
> mount -v -t cifs //office.example.com/technik /mnt/dfs -o 
> username=c.garling,domain=OFFICE,vers=2.0
> mount -v -t cifs //office.example.com/technik /mnt/dfs -o 
> username=c.garling,domain=OFFICE,vers=2.1
>
> If I do so I can see this in tcpdump:
>
> 100.392000390 192.168.23.107 -> 192.168.15.6 SMB2 172 Negotiate 
> Protocol Request
> 100.393121936 192.168.15.6 -> 192.168.23.107 SMB2 318 Negotiate 
> Protocol Response
> 100.393223968 192.168.23.107 -> 192.168.15.6 SMB2 190 Session Setup 
> Request, NTLMSSP_NEGOTIATE
> 100.394178092 192.168.15.6 -> 192.168.23.107 SMB2 390 Session Setup 
> Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
> 100.394295512 192.168.23.107 -> 192.168.15.6 SMB2 494 Session Setup 
> Request, NTLMSSP_AUTH, User: OFFICE\c.garling
> 100.397795864 192.168.15.6 -> 192.168.23.107 SMB2 142 Session Setup 
> Response
> 100.397895000 192.168.23.107 -> 192.168.15.6 SMB2 198 Tree Connect 
> Request Tree: \\office.example.com\technik
> 100.398866908 192.168.15.6 -> 192.168.23.107 SMB2 143 Tree Connect 
> Response, Error: STATUS_BAD_NETWORK_NAME
>
> My client directly tries to connect to the share on 192.168.15.6, but 
> this is the AD server that should forward to 192.168.15.17 which is 
> the file server.
>
> I also traced the connection attempt with wireshark. In the request 
> sent from my workstation I found this message in the flags:
>
> "This host does NOT support DFS."
>
> We re-enabled SMBv1 for testing purposes. With SMBv1 the connection to 
> the DFS works with the command above but vers=1.0.
>
> I can not figure out why DFS does not work when vers=2.0 or vers=2.1 
> will be used. We tested some different distros (Linux Mint 18.1, 
> Debian 8, Debian 9, Gentoo) with different kernel versions.
>
> Please ask me for further information, if I missed something.
>
> Any help is welcome!
>
> Regards, Christian Garling
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.samba.org/pipermail/smb-clients/attachments/20170608/ad8fd112/attachment.html>