smbspool without authentication no longer works?

[Andreas Hasenack]

On Thu, Nov 28, 2019 at 3:11 PM Andreas Hasenack <andreas at canonical.com> wrote:
>
> Hi,
>
> is smbspool supposed to work without authentication, in the case the
> printer is shared like that?
>
> I've been tracking some bug reports about printing no longer working
> with samba 4.8 or higher. The last one where I got this command below
> to work was 4.7.6:
>
> ubuntu at bionic-smb-printer:~$ /usr/lib/cups/backend/smb
> smb://10.10.1.6/ds216laser 34 root page 1 options .bashrc;echo
> Kerberos auth with 'root at WORKGROUP' (WORKGROUP\root) to access
> '10.10.1.6' not possible
> ERROR: Session setup failed: NT_STATUS_ACCESS_DENIED
> DEBUG: get_exit_code(cli=0x561bb8db7d70,
> nt_status=NT_STATUS_ACCESS_DENIED [c0000022])
> ATTR: auth-info-required=negotiate
> DEBUG: Connected with NTLMSSP...
>
> ubuntu at bionic-smb-printer:~$ echo $?
> 0
>
> With, say, 4.10.7, I get:
> root at nsnx:~# /usr/lib/cups/backend/smb smb://10.10.1.6/ds216laser 34
> root page 1 options .bashrc; r=$?;echo;echo $r
> kerberos_ccache_is_valid: Failed to get default principal from ccache:
> FILE:/tmp/krb5cc_0
> DEBUG: This backend requires credentials!
> DEBUG: get_exit_code(nt_status=NT_STATUS_ACCESS_DENIED [c0000022])
> ATTR: auth-info-required=none
> DEBUG: Unable to connect to CIFS host: NT_STATUS_ACCESS_DENIED
> 2
>
> If I pass "anonymous" as the username, or even a blank space (!), then it works:
> root at nsnx:~# /usr/lib/cups/backend/smb smb://\ @10.10.1.6/ds216laser
> 34 root page 1 options .bashrc; r=$?;echo;echo $r
> DEBUG: SMB connection established.
>
> 0

It's weird, the code seems to explicitly prevent unauthenticated
access and gives up if auth_info_required is "none" for example, but
after that exit point it has attempts (never reached) using
passwordless NTLMSSP with the current unix username, and even guest
auth with a blank user and password.