From: Nathan Shearer <mail@nathanshearer.ca>
To: Steve French <smfrench@gmail.com>
Cc: CIFS <linux-cifs@vger.kernel.org>
Subject: Re: Forced to authenticate with "pre-Windows 2000" logon names
Date: Thu, 1 Aug 2019 08:45:29 -0600 [thread overview]
Message-ID: <edb2974c-e985-6f76-b711-801812bf8072@nathanshearer.ca> (raw)
In-Reply-To: <CAH2r5msB+OY42b8yqERpzsjeJpnKYpMHeQdu3RPaGPbJBJs-1w@mail.gmail.com>
Hi Steve, thanks for looking into this.
The file server(s) I tried are members of a domain. One is a plain file
server only, and the other is a domain controller, both are updated
Windows Server 2012 installs. My linux system is not a member of the
domain, and is an updated Gentoo install:
# cat /proc/fs/cifs/DebugData | grep Version
CIFS Version 2.20
# cat /proc/version
Linux version 5.2.2 (root@varws03) (gcc version 8.3.0 (Gentoo 8.3.0-r1
p1.1)) #1 SMP PREEMPT Thu Jul 25 09:08:17 MDT 2019
The actual command I am using right now to mount the share only works
with the pre-windows 2000 logon name (18 characters):
# mount -v -t cifs -o
username=xx-xxxx-xxxxxxxxxx,password=xxxxxxxxxxxxxxxxxxxxxxxx,domain=xxxxxxxx-xxx,vers=3.0
'//192.168.100.10/Test Share' /mnt/temp0
If I use the regular logon name (23 characters) I get these errors:
# mount -v -t cifs -o
username=xx-xxxx-xxxxxxxxxxyyyyy,password=xxxxxxxxxxxxxxxxxxxxxxxx,domain=xxxxxxxx-xxx,vers=3.0
'//192.168.100.10/Test Share' /mnt/temp0
mount.cifs kernel mount options:
ip=192.168.100.10,unc=\\192.168.100.10\Test
Share,vers=3.0,user=xx-xxxx-xxxxxxxxxxyyyyy,domain=xxxxxxxx-xxx,pass=********
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
/var/log/messeges
Aug 1 08:43:06 testclient01 kernel: CIFS: Attempting to mount
//192.168.100.10/Test Share
Aug 1 08:43:07 testclient01 kernel: Status code returned 0xc000006d
STATUS_LOGON_FAILURE
Aug 1 08:43:07 testclient01 kernel: CIFS VFS: Send error in SessSetup = -13
Aug 1 08:43:07 testclient01 kernel: CIFS VFS: cifs_mount failed
w/return code = -13
Is the domain considered part of the 32 character username character
limit? My domain is 12 characters, full logon name with the domain would
be 35 characters (including the \ separator), while the pre-windows 2000
name would be 31 characters with the \ separator.
On 8/1/19 1:50 AM, Steve French wrote:
> I tried some experiments today with longer usernames (e.g. 32
> characters, which is the maximum allowed on the Linux distros I
> tried). mounting with 32 character usernames worked fine (at least
> to Samba). I wouldn't expect anything different to Windows.
>
> I don't remember any recent change to add this support so as long as
> you are running a kernel from the last three or four years, hard to
> guess what is the issue (if you have evidence like a wireshark trace
> or debugging information showing the username getting
> remapped/corrupted when passed down that might be helpful)
>
> Can you see the module version (modinfo cifs or "cat
> /proc/fs/cifs/DebugData | grep Version") and the kernel version
> ("uname -a")?
>
>
> On Wed, Jul 31, 2019 at 2:39 PM Nathan Shearer <mail@nathanshearer.ca> wrote:
>> I spent the last two days trying to mount a windows share, and it turns
>> out it was not a problem with:
>>
>> * share permissions
>> * filesystem permissions
>> * incorrect password
>> * firewalls
>> * antivirus software
>> * smb version
>>
>> But was in fact an issue with the username. The username I had was 23
>> characters, which is longer than the "pre-Windows 2000" logon name which
>> is what cifs was using, even with smb vers=3.0. The error was always
>> status code 0xc000006d STATUS_LOGON_FAILURE which this time was actually
>> an authentication problem since the client was using the wrong username.
>>
>> Is there any plan to support windows usernames in samba/cifs that are
>> *post* windows 2000 era?
>>
>> # mount.cifs -V
>> mount.cifs version: 6.9
>>
>
prev parent reply other threads:[~2019-08-01 14:45 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-31 18:16 Forced to authenticate with "pre-Windows 2000" logon names Nathan Shearer
2019-08-01 7:50 ` Steve French
2019-08-01 14:45 ` Nathan Shearer [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=edb2974c-e985-6f76-b711-801812bf8072@nathanshearer.ca \
--to=mail@nathanshearer.ca \
--cc=linux-cifs@vger.kernel.org \
--cc=smfrench@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).