2017年4月23日 星期日

Server requested LANMAN password (share-level security) but ‘client lanman auth’ is disabled

Q:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 4.4.4]
Server requested LANMAN password (share-level security) but ‘client lanman auth’ is disabled
tree connect failed: NT_STATUS_ACCESS_DENIED
A: vim smb.conf
lanman auth = yes
client lanman auth = yes
#server端跟client端都使用lanman認證。
———————————————
經驗
client ntlmv2 auth (G)
This parameter determines whether or not smbclient(8) will attempt to authenticate itself to servers using the NTLMv2 encrypted password response.
If enabled, only an NTLMv2 and LMv2 response (both much more secure than earlier versions) will be sent. Many servers (including NT4 < SP4, Win9x and Samba 2.2) are not compatible with NTLMv2. Similarly, if enabled, NTLMv1, client lanman auth and client plaintext auth authentication will be disabled. This also disables share-level authentication. If disabled, an NTLM response (and possibly a LANMAN response) will be sent by the client, depending on the value of client lanman auth. Note that some sites (particularly those following 'best practice' security polices) only allow NTLMv2 responses, and not the weaker LM or NTLM. Default: client ntlmv2 auth = no