From: pe...@nmti.com (Peter da Silva) Subject: Another problem with NT/WinDD/Samba Date: 1995/07/28 Message-ID: <id.2S_L1.E92@nmti.com>#1/1 X-Deja-AN: 107052190 sender: pe...@nmti.com (peter da silva) organization: Network/development platform support, NMTI newsgroups: comp.protocols.smb Security problem with NT, WinDD, and Samba. Situation: Multiple users concurrintly on an NT box. One user logs onto a Samba drive. A second user logs onto the same drive. NT doesn't request the password again. Either: 1. NT is reusing the same connection. 2. NT is reusing the password. 3. Samba is noting "this came from the same machine as last time, I trust it." Anyone got any ideas? Unlike the other user, I'm not having the problem with it providing access to all the homes. -- Peter da Silva (NIC: PJD2) `-_-' Network Management Technology Incorporated 'U` 1601 Industrial Blvd. Sugar Land, TX 77478 USA +1 713 274 5180 "Har du kramat din varg idag?"
From: jer...@netcom.com (Jeremy Allison) Subject: Re: Another problem with NT/WinDD/Samba Date: 1995/08/04 Message-ID: <jeremyDCt0Mz.4p0@netcom.com>#1/1 X-Deja-AN: 107566444 sender: jer...@netcom7.netcom.com references: <id.2S_L1.E92@nmti.com> <3vcdpd$d7n@news.austria.eu.net> <id.C21M1.BA5@nmti.com> organization: NETCOM On-line Communication Services (408 261-4700 guest) newsgroups: comp.protocols.smb I have been doing some analysis on a similar problem and I believe it is a Samba bug - not a WinDD problem. The good news is I have a fix ! I have recently upgraded to NT3.51 - this allows an su command to create two cmd windows on the same user session that are running in different user contexts. When I do this I find a problem as follows. In cmd 1) - running as user jra. C:\> net use x: \\server\jra The command completed successfully x: X:\> echo >testfile Checking on the UNIX server I find file testfile in my home directory is owned by jra - all well and good. Now I switch to cmd2) - running as administrator (note that samba has the usermap setup to do the mapping from username Administrator -> root). C:\> X: X:\> echo >test-admin Checking on the UNIX server I find file test-admin in my home directory is also owned by jra - not at all good ! Looking in the samba log I find that when the second create is done samba gives the message "skipping become_user, already done" (or similar words). I believe this may be similar to the problems seen by WinDD users mounting a Samba drive. Ok - it may be no different when accessing an NT drive I thought - so I repeated the same test after mounting a WinNT 3.51 NTFS share. This worked correctly - file testfile was owned by user jra, file test-admin is owned by Administrator. So I decided that NT must be sending the correct information - it is just that Samba doesn't interpret it correctly. After much grubbing aroung in samba debug logs I find the following :- When a new session is set up with SMBsession_setup_and_X samba looks at smb_pid and smb_uid to distinguish from an old session. The mistake it is making is that is assumes smb_uid is set by the redirector - in fact the redirector treats this as a read only field and it should be being set by samba. Now to the point of this article - I have a modified version of samba 1.9.14alpha11 that sets the smb_uid field to the known uid of the user that has been validated by the SMBsession_setup_and_X call (it also does some group manipulation). When a SMB requeest comes in it uses the supplied smb_uid to do the become_user() call before performing the request, instead of automatically becoming the user stored in the Connection struct. Note that it does not arbitrarily trust the client to supply a valid user id (can you say enormous security hole :-) but valides the supplied user id against the list of previously validated user id's, ie. the client must already have supplied the correct username/password pair before this uid will be accepted. This fixed version works correctly with the NT su program discussed above, but I have no access to WinDD for a test. Andrew is pretty busy at the moment (that is why alpha11 is the latest release) so I would appreciate it if people who have access to WinDD and are able to test a new version of samba would email me at jer...@netcom.com and I will send you my modified source tree. I will also send the patches to Andrew to integrate when he is able. If you could test this out or prahaps people who have contacted Tektronics to get them to investigate this problem could email me and put me in touch with TekTronics support I would appreciate it very much. Cheers, Jeremy Allison jer...@netcom.com