[Pkg-samba-maint] Bug#459941: Bug#459941: samba: security=share does not work any more

[Steve Langasek]

On Wed, Jan 09, 2008 at 11:26:47PM +0100, Francesco Potorti` wrote:
> >> The problem is that the setting
> >>  security = share
> >> does not work with Microsoft Windows 98 for shares requesting a
> >> password.  Samba keeps saying that the password is wrong.

> >Documented in NEWS.Debian:

> >samba (3.0.27a-2) unstable; urgency=low

> >  * Weak authentication methods are disabled by default

> >    Beginning with this version, plaintext authentication is disabled for

> I had read that doc.  I am not a samba expert, but as far as I can tell,
> I do not use plaintext authentication.  Indeed, I have
>    encrypt passwords = true
> in my config, which should be the opposite of plaintext.

Correct.

> >    However, if you need to connect to a Samba server that does not have
> >    encrypted password support enabled, or to another server that does not
> >    support NTLM authentication, you will need to set
> >    "client plaintext auth = yes" and "client lanman auth = yes" in smb.conf.

> Among the many tests that I have made before writing this bug report, I
> also tried those settings, without any observable change.

> I think that this bug should be reopened.

One of the notes in there was:

    The "lanman auth = no" setting will also cause lanman password hashes to
    be deleted from smbpasswd and prevent new ones from being written

Have you verified that you still have the lanman hashes in your samba
passdb?  pdbedit -L -w -u $share_auth_username will spit out the record for
the specified user; if the third field is all Xs, you no longer have a
lanman hash and will need to reset the password for the user as a result of
having accessed the account while samba was running with the new default
settings.

If you do have a password in that field, then I agree this bug should be
reopened.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                    http://www.debian.org/
slangasek at ubuntu.com                                     vorlon at debian.org