0

I set up a share in Ubuntu with read/write permissions using system-config-samba. I configured my user to also be a smbuser.

On all of my other systems (2 Win10, 1 Win8, 1 Ubuntu) I am prompted to enter a username and password (as I should be since guest ok = no in smb.conf and there is only one valid user).

The problem is that Win Server 2012 doesn't get this prompt and worse, can somehow bypass the authentication and read all of the shares on the target machine.

At first I thought it might've been a glitch with the username in Server 2012 being the same as the Ubuntu machine & smbuser but even after changing the Win server username, the problem still exists.

Any way I look at it this appears to be a massive security breach of some kind. I've already verified that there are no stored credentials that may be getting used.

smb.conf includes:

usershare allow guests = no
username map = /etc/samba/smbusers
security = user
encrypt passwords = yes
guest ok = no
guest account = nobody

[ShareName]
    path = /media/[user]/[ext4_drive]/[share folder]
    writeable = yes
    browseable = yes
    guest ok = no
    valid users = [user]

Update:

/var/log/samba/log:

[2015/10/29 14:49:30.544283,  2] ../source3/param/loadparm.c:3581(do_section)
  Processing section "[public]"
[2015/10/29 14:49:30.544373,  0] ../source3/param/loadparm.c:3188(lp_do_parameter)
  Global parameter usershare allow guests found in service section!
[2015/10/29 14:49:30.544402,  0] ../source3/param/loadparm.c:3188(lp_do_parameter)
  Global parameter username map found in service section!
[2015/10/29 14:49:30.544428,  0] ../source3/param/loadparm.c:3188(lp_do_parameter)
  Global parameter security found in service section!
[2015/10/29 14:49:30.544452,  0] ../source3/param/loadparm.c:3188(lp_do_parameter)
  Global parameter encrypt passwords found in service section!
[2015/10/29 14:49:30.544489,  0] ../source3/param/loadparm.c:2376(service_ok)
  WARNING: No path in service public - making it unavailable!
[2015/10/29 14:49:30.544513,  1] ../source3/param/loadparm.c:2383(service_ok)
  NOTE: Service public is flagged unavailable.
[2015/10/29 14:49:30.544537,  2] ../source3/param/loadparm.c:3581(do_section)
  Processing section "[printers]"
[2015/10/29 14:49:30.544577,  0] ../source3/param/loadparm.c:2363(service_ok)
  WARNING: [printers] service MUST be printable!
[2015/10/29 14:49:30.544603,  0] ../source3/param/loadparm.c:2376(service_ok)
  WARNING: No path in service printers - making it unavailable!
[2015/10/29 14:49:30.544626,  1] ../source3/param/loadparm.c:2383(service_ok)
  NOTE: Service printers is flagged unavailable.
[2015/10/29 14:49:30.544650,  2] ../source3/param/loadparm.c:3581(do_section)

  Processing section "[ShareName]"
[2015/10/29 14:49:30.544677,  0] ../source3/param/loadparm.c:3188(lp_do_parameter)
  Global parameter security found in service section!
[2015/10/29 14:49:30.544860,  2] ../source3/lib/interface.c:341(add_interface)
  added interface eth1 ip=[IP] bcast=[BCAST] netmask=[MASK]
[2015/10/29 14:51:50.380113,  2] ../source3/smbd/open.c:972(open_file)

  [USER] opened file test.txt read=No write=No (numopen=3)
[2015/10/29 14:51:50.381445,  2] ../source3/smbd/close.c:780(close_normal_file)
  [USER] closed file test.txt (numopen=2) NT_STATUS_OK
[2015/10/29 14:51:51.428034,  2] ../source3/smbd/open.c:972(open_file)
  [USER] opened file test.txt read=Yes write=No (numopen=2)
[2015/10/29 14:51:51.433698,  2] ../source3/smbd/open.c:972(open_file)
  [USER] opened file test - Copy.txt read=Yes write=Yes (numopen=3)
[2015/10/29 14:52:06.492354,  2] ../source3/smbd/close.c:780(close_normal_file)
  [USER] closed file test.txt (numopen=3) NT_STATUS_OK
[2015/10/29 14:52:06.492925,  2] ../source3/smbd/close.c:780(close_normal_file)
  [USER] closed file test - Copy.txt (numopen=2) NT_STATUS_OK
1

You had to find what credential the windows machine is using. You can try with two different (and complementary) methods:

  1. create a file from the Win2012 machine and, on the Linux box, find which user own the newly created file
  2. enable samba log adding the log level = 2 directive in your /etc/samba/smb.conf file. Then, have a look under /var/log/samba/

After finding the credential user by the Win2012 machine it should be easy to understand what it's happening.

  • That was helpful. It looks like somehow the old username (still used on ubuntu share host) is remembered in the WinServer and is getting used. How can I find where that is coming from and clear it? Still not sure how it ever got authenticated though. – Enigma Oct 29 '15 at 18:57
  • Try the following: login as Administrator, remove the affected user and its profile, then recreate it. Logging in, Samba should now ask for a user/password combo. Alternatively, you can delete the affected username via smbpasswd -x <username> command, forcing the Windows user to enter some alternative credentials. – shodanshok Oct 29 '15 at 19:05
0

The nature of the problem was that both the username and password were the same across the Ubuntu system and Windows Server.

Not sure if that is a convenience or a security hole.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.