Hi, this is your Linux kernel regression tracker speaking. Top-posting for once, to make this easy accessible to everyone. Davyd, Ronnie, and/or Steve: What the status here? It seems after some productive debugging back and forth it seems everyone forgot about this. Or was progress made somewhere and I just missed it? Ciao, Thorsten #regzbot poke On 12.01.22 06:49, Davyd McColl wrote: > Hi Ronnie > > The regular fstab line for this mount is: > > //mede8er/mede8er /mnt/mede8er-smb cifs > noauto,guest,users,uid=daf,gid=daf,iocharset=utf8,vers=1.0,nobrl,sec=none > 0 0 > > Altering the end of the options from "sec=none" to > "username=guest,sec=ntlmssp" or "guest,sec=ntlmssp" results in failure > to mount > (tested on my patched kernel, which still supports the original fstab > line), with dmesg containing: > > [45753.525219] CIFS: VFS: Use of the less secure dialect vers=1.0 is > not recommended unless required for acc > ess to very old servers > [45753.525222] CIFS: Attempting to mount \\mede8er\mede8er > [45756.861351] CIFS: VFS: Unable to select appropriate authentication method! > [45756.861361] CIFS: VFS: \\mede8er Send error in SessSetup = -22 > [45756.861395] CIFS: VFS: cifs_mount failed w/return code = -22 > > There is no way that I know of to set up users for smb auth on this > device - it only supports guest connections. > > -d > > > On Wed, 12 Jan 2022 at 04:32, ronnie sahlberg <ronniesahlberg@xxxxxxxxx> wrote: >> >> Thanks for the network traces. >> >> In the traces, both win11 and linux are not using even NTLM but the >> even older "share password" authentication mode where you specify a >> password for the share in the TreeConnect command. >> That is something I think we should not support at all. >> >> What is the exact mount command line you use? >> Can you try mounting the share using a username and ntlmssp ? >> I.e. username=your-user,sec=ntlmssp on the mount command >> >> regards >> ronnie sahlberg >> >> On Wed, Jan 12, 2022 at 6:57 AM Davyd McColl <davydm@xxxxxxxxx> wrote: >>> >>> Hi Steve >>> >>> As requested, wireshark captures to the device in question, as well as >>> the fstab entry I have for the device: >>> - win11, browsing with explorer >>> - win11, net use >>> - unpatched linux 5.16.0 attempt to mount >>> - patched linux 5.16.0 successful mount >>> - fstab entry - note that I have to specify samba version 1.0 as the >>> default has changed and the mount fails otherwise. Explicitly >>> specifying 2.0 errors and suggests that I should select a different >>> version. >>> >>> -d >>> >>> On Tue, 11 Jan 2022 at 00:13, Steve French <smfrench@xxxxxxxxx> wrote: >>>> >>>> I would be surprised if Windows 11 still negotiates (with default >>>> registry settings) SMB1 much less NTLMv1 in SMB1, but I have not tried >>>> Windows 11 with an NTLMv1 only server (they are hard to find - I may >>>> have an original NT4 and an NT3.5 CD somewhere - might be possible to >>>> install a VM with NT3.5 but that is really really old and not sure I >>>> can find those CDs). >>>> >>>> Is it possible to send me the wireshark trace (or other network trace) >>>> of the failing mount from Linux and also the one with the succeeding >>>> NET USE from Windows 11 to the same server? >>>> >>>> Hopefully it is something unrelated to NTLMv1, there has been a LOT of >>>> pushback across the world, across products in making sure no one uses >>>> SMB1 anymore. See e.g. >>>> https://techcommunity.microsoft.com/t5/storage-at-microsoft/stop-using-smb1/ba-p/425858 >>>> and https://twitter.com/nerdpyle/status/776900804712148993 >>>> >>>> On Mon, Jan 10, 2022 at 2:30 PM Davyd McColl <davydm@xxxxxxxxx> wrote: >>>>> >>>>> I don't understand. I tracked down the exact commit where the issue >>>>> occurs with a 2 hour git bisect. This was after first confirming that >>>>> my older 5.14 kernel did not display the symptoms. I can still connect >>>>> to the share via windows 11 explorer. I don't know what else I need to >>>>> do here to show where the issue was introduced? >>>>> >>>>> Apologies for bouncing mails - literally no email client I have seems >>>>> to be capable of plaintext emails, so every time I forget, I have to >>>>> find a browser with the gmail web interface to reply. >>>>> >>>>> -d >>>>> >>>>> On Mon, 10 Jan 2022 at 19:31, Steve French <smfrench@xxxxxxxxx> wrote: >>>>>> >>>>>> I want to make sure that we don't have an unrelated regression >>>>>> involved here since NTLMv2 replaced NTLMv1 over 20 years ago (googling >>>>>> this e.g. I see "NTLMv2, introduced in Windows NT 4.0 SP4 and natively >>>>>> supported in Windows 2000") and should be the default for Windows >>>>>> NT4, Windows 2000 etc. as well as any version of Samba from the last >>>>>> 15 years+. I have significant concerns with adding mechanisms that >>>>>> were asked to be disabled ~19 years ago e.g. see >>>>>> https://support.microsoft.com/en-us/topic/security-guidance-for-ntlmv1-and-lm-network-authentication-da2168b6-4a31-0088-fb03-f081acde6e73 >>>>>> due to security concerns. >>>>>> >>>>>> Can we double check that there are not other issues involved in your example? >>>>>> >>>>>> The concerns about NTLMv1 security concerns (and why it should never >>>>>> be used) are very persuasive e.g. many articles like >>>>>> https://miriamxyra.com/2017/11/08/stop-using-lan-manager-and-ntlmv1/ >>>>>> >>>>>> On Mon, Jan 10, 2022 at 7:48 AM Davyd McColl <davydm@xxxxxxxxx> wrote: >>>>>>> >>>>>>> Good day >>>>>>> >>>>>>> I'm following advice from the thread at >>>>>>> https://bugzilla.kernel.org/show_bug.cgi?id=215375 as to how to report >>>>>>> this, so please bear with me and redirect me as necessary. >>>>>>> >>>>>>> Since commit 76a3c92ec9e0668e4cd0e9ff1782eb68f61a179c, I'm unable to >>>>>>> mount a CIFS 1.0 share ( from a media player: mede8er med600x3d, which >>>>>>> runs some older linux). Apparently I'm not the only one, according to >>>>>>> that thread, though the other affected party there is windows-based. >>>>>>> >>>>>>> I first logged this in the Gentoo bugtracker >>>>>>> (https://bugs.gentoo.org/821895) and a reversion patch is available >>>>>>> there for the time being. >>>>>>> >>>>>>> I understand that some of the encryption methods upon which the >>>>>>> original feature relied are to be removed and, as such, the ability to >>>>>>> mount these older shares was removed. This is sure to affect anyone >>>>>>> running older Windows virtual machines (or older, internally-visible >>>>>>> windows hosts) in addition to anyone attempting to connect to shares >>>>>>> from esoteric devices like mine. >>>>>>> >>>>>>> Whilst I understand the desire to clean up code and remove dead >>>>>>> branches, I'd really appreciate it if this particular feature remains >>>>>>> available either by kernel configuration (which suits me fine, but is >>>>>>> likely to be a hassle for anyone running a binary distribution) or via >>>>>>> boot parameters. In the mean-time, I'm updating my own sync software >>>>>>> to support this older device because if I can't sync media to the >>>>>>> player, the device is not very useful to me. >>>>>>> >>>>>>> Thanks >>>>>>> -d >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> Thanks, >>>>>> >>>>>> Steve >>>>> >>>>> >>>>> >>>>> -- >>>>> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- >>>>> If you say that getting the money is the most important thing >>>>> You will spend your life completely wasting your time >>>>> You will be doing things you don't like doing >>>>> In order to go on living >>>>> That is, to go on doing things you don't like doing >>>>> >>>>> Which is stupid. >>>>> >>>>> - Alan Watts >>>>> https://www.youtube.com/watch?v=-gXTZM_uPMY >>>>> >>>>> Quidquid latine dictum sit, altum sonatur. >>>> >>>> >>>> >>>> -- >>>> Thanks, >>>> >>>> Steve >>> >>> >>> >>> -- >>> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- >>> If you say that getting the money is the most important thing >>> You will spend your life completely wasting your time >>> You will be doing things you don't like doing >>> In order to go on living >>> That is, to go on doing things you don't like doing >>> >>> Which is stupid. >>> >>> - Alan Watts >>> https://www.youtube.com/watch?v=-gXTZM_uPMY >>> >>> Quidquid latine dictum sit, altum sonatur. > > >
