Samba update now requires authentication for Windows 10 machine access

[swerdna]

@crmrhm

Interesting indeed. I tried [Yast ==> Firewall ==> Custom Rules ==> External Zone + Source Network = w.x.y.z/24 + Protocol = UDP] with samba 4.2.4-34.1 with no change in behavior. For w.x.y.z, I used the router’s IP address, 192.168.1.1. That did not help. I then updated to samba 4.4.2-4.1 and still no access. I added a rule with w.x.y.z = 192.168.1.153, the Win10 machine’s current local IP address, but still no access.

Are either of those the correct Source Network IPs?

I hunted through the router’s settings for anything that might block UDP, but found nothing. Did I likely miss anything?

Does your win10 share have a password? I can access Win10 if there is a password but cannot access the one machine with no password.

I must say, YaST2 does a splendid job moving between these three samba versions.

Regards,
Howard

I used like this (for w.x.y.z/24) ==> 192.168.1.0/24 (which IIRC it means the whole subnet) but it should be ok to use 192.168.1.153 (with no /24) but not so ok if the IP can change.

[swerdna]

And it takes a good 10 mins to “see” the change (or reboot both computers for quicker response).

[crmrhm]

@swerdna

I used like this (for w.x.y.z/24) ==> 192.168.1.0/24 (which IIRC it means the whole subnet) but it should be ok to use 192.168.1.153 (with no /24) but not so ok if the IP can change.

I changed the rules to be for 192.168.1.0/24 and 192.168.1.153 (with no /24), but still get authentication requested, then denied access to the no-password machine. Connecting to a Win10 machine with a password works.
Based on the discussion at 11841 – NT_STATUS_ACCESS_DENIED when accessing windows public share with 4.3.8, I did

howard@X41base-oS132:~> smbclient -U% //E550win10/De550 -mSMB3
Domain=[E550WIN10] OS=] Server=]
smb: \> 

Then doing “ls” lists the partition contents. Any way to get that partition to then show in Dolphin? Even then, bit of a clunky workaround, but better than no access.
Thanks,
Howard

[swerdna]

@crmrhm

I changed the rules to be for 192.168.1.0/24 and 192.168.1.153 (with no /24), but still get authentication requested, then denied access to the no-password machine. Connecting to a Win10 machine with a password works.
Based on the discussion at 11841 – NT_STATUS_ACCESS_DENIED when accessing windows public share with 4.3.8, I did

howard@X41base-oS132:~> smbclient -U% //E550win10/De550 -mSMB3
Domain=[E550WIN10] OS=] Server=]
smb: \> 

Then doing “ls” lists the partition contents. Any way to get that partition to then show in Dolphin? Even then, bit of a clunky workaround, but better than no access.
Thanks,
Howard

It doesn’t work for me. I translated your paths into my shares’ paths but got NT_STATUS_ACCESS_DENIED

[crmrhm]

@swerdna

It doesn’t work for me. I translated your paths into my shares’ paths but got NT_STATUS_ACCESS_DENIED

That was the result that led to the bug report at 11841 – NT_STATUS_ACCESS_DENIED when accessing windows public share with 4.3.8.

Hopefully this will get patched soon. Meanwhile, I went back to 4.1.23-31.1, and it works correctly in Dolphin.
Howard

[tsu2]

@crmrhm

Our Windows 10 machines have the recent April monthly update, and it caused no change for samba 4.1.23-31.1, so I think that is not the issue. The denied access comes with an update to samba 4.2.4-34.1.

It’s really true - no password. It is a local account.

Thanks,
Howard

I thought that MSWindows closed this security hole a very long time ago… Except for the built-in Guest account which is disabled by default with advice never to enable it. Is this the account you’re using or an account you created (And BTW - If you were able to create a Local Account without password somehow, that you have removed “Local Logon” permissions in the Local Security Policy to prevent someone from remoting into your machine and owning it).

Maybe the security hole you’ve been using might have finally been noticed and fixed?

TSU

[crmrhm]

Just had a similar experience on a 13.1 32-bit KDE system in this same workgroup. A security update from samba 4.1.22-3.51.1 to 4.2.4-3.54.2 caused Dolphin to open an authentication window trying to connect to the no-password Windows 10 machine. No credentials worked. Prior to the update, samba connected correctly without authentication. Reverted to 4.1.22-3.51.1 and things work again.

Some patches are mentioned at https://bugzilla.samba.org/show_bug.cgi?id=11841, but they seem to not really fix the problems.

Howard