default security mechanism for 3.1

default security mechanism for 3.1

[Jeff Layton]

A printk warning was added to the kernel about the default security
mode changing in 3.1. As best I can tell though, that has not happened
even though the release is imminent. Are you still planning to change
that? If not, are you planning to fix the printk?

-- 
Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>

Re: default security mechanism for 3.1

[Suresh Jayaraman]

On 09/23/2011 05:46 PM, Jeff Layton wrote:
> A printk warning was added to the kernel about the default security
> mode changing in 3.1. As best I can tell though, that has not happened
> even though the release is imminent. Are you still planning to change
> that? If not, are you planning to fix the printk?
> 

Did you mean this one?
   http://www.spinics.net/lists/linux-cifs/msg03976.html

I remember Steve posted this patch sometime ago but I'm not seeing them
in the cifs development tree..


-Suresh

Re: default security mechanism for 3.1

[Jeff Layton]

On Fri, 23 Sep 2011 17:55:05 +0530
Suresh Jayaraman <sjayaraman-IBi9RG/b67k@public.gmane.org> wrote:

> On 09/23/2011 05:46 PM, Jeff Layton wrote:
> > A printk warning was added to the kernel about the default security
> > mode changing in 3.1. As best I can tell though, that has not happened
> > even though the release is imminent. Are you still planning to change
> > that? If not, are you planning to fix the printk?
> > 
> 
> Did you mean this one?
>    http://www.spinics.net/lists/linux-cifs/msg03976.html
> 
> I remember Steve posted this patch sometime ago but I'm not seeing them
> in the cifs development tree..
> 
> 
> -Suresh

Yeah, that's the one. Seems a little late to be adding these sorts of
behavior changes in 3.1 though, so I'm just wondering what the plan is.

I also have some concerns about defaulting to raw NTLMv2 auth since (at
least) win2k8 rejects unless you go in and tweak registry keys. It
would seem to me to be better to decide the default based on the
negotiation:

Set extended security bit in the NegProt by default

If the server sets it, then use NTLMSSP

If it doesn't then use old NTLM (or NTLMv2)

That means an overhaul of how sec_mode is handled though, since that's
currently decided too early to do it that way.

-- 
Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>

Re: default security mechanism for 3.1

[Suresh Jayaraman]

On 09/23/2011 07:13 PM, Jeff Layton wrote:
> On Fri, 23 Sep 2011 17:55:05 +0530
> Suresh Jayaraman <sjayaraman-IBi9RG/b67k@public.gmane.org> wrote:
> 
>> On 09/23/2011 05:46 PM, Jeff Layton wrote:
>>> A printk warning was added to the kernel about the default security
>>> mode changing in 3.1. As best I can tell though, that has not happened
>>> even though the release is imminent. Are you still planning to change
>>> that? If not, are you planning to fix the printk?
>>>
>>
>> Did you mean this one?
>>    http://www.spinics.net/lists/linux-cifs/msg03976.html
>>
>> I remember Steve posted this patch sometime ago but I'm not seeing them
>> in the cifs development tree..
> 
> Yeah, that's the one. Seems a little late to be adding these sorts of
> behavior changes in 3.1 though, so I'm just wondering what the plan is.
> 
> I also have some concerns about defaulting to raw NTLMv2 auth since (at
> least) win2k8 rejects unless you go in and tweak registry keys. It

Good point. May be we should just drop those warning messages for 3.1
and work on aim to make the sec_mode overhaul work for 3.2.. and
document the new behavior?

> would seem to me to be better to decide the default based on the
> negotiation:
> 
> Set extended security bit in the NegProt by default
> 
> If the server sets it, then use NTLMSSP
> 
> If it doesn't then use old NTLM (or NTLMv2)
> 
> That means an overhaul of how sec_mode is handled though, since that's
> currently decided too early to do it that way.
> 

-Suresh

Re: default security mechanism for 3.1

[Shirish Pargaonkar]

On Fri, Sep 23, 2011 at 8:43 AM, Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
> On Fri, 23 Sep 2011 17:55:05 +0530
> Suresh Jayaraman <sjayaraman-IBi9RG/b67k@public.gmane.org> wrote:
>
>> On 09/23/2011 05:46 PM, Jeff Layton wrote:
>> > A printk warning was added to the kernel about the default security
>> > mode changing in 3.1. As best I can tell though, that has not happened
>> > even though the release is imminent. Are you still planning to change
>> > that? If not, are you planning to fix the printk?
>> >
>>
>> Did you mean this one?
>>    http://www.spinics.net/lists/linux-cifs/msg03976.html
>>
>> I remember Steve posted this patch sometime ago but I'm not seeing them
>> in the cifs development tree..
>>
>>
>> -Suresh
>
> Yeah, that's the one. Seems a little late to be adding these sorts of
> behavior changes in 3.1 though, so I'm just wondering what the plan is.
>
> I also have some concerns about defaulting to raw NTLMv2 auth since (at
> least) win2k8 rejects unless you go in and tweak registry keys. It
> would seem to me to be better to decide the default based on the
> negotiation:
>
> Set extended security bit in the NegProt by default
>
> If the server sets it, then use NTLMSSP

Not sure if there are any cifs/smb servers that support
extended security mechanisms but ntlmssp not being
one of them, we ought to consider that such a setup
before choosing ntlmssp if the server set extended
security bit in negprot response.

>
> If it doesn't then use old NTLM (or NTLMv2)
>
> That means an overhaul of how sec_mode is handled though, since that's
> currently decided too early to do it that way.
>
> --
> Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: default security mechanism for 3.1

[Jeff Layton]

On Fri, 23 Sep 2011 10:14:32 -0500
Shirish Pargaonkar <shirishpargaonkar-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:

> On Fri, Sep 23, 2011 at 8:43 AM, Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
> > On Fri, 23 Sep 2011 17:55:05 +0530
> > Suresh Jayaraman <sjayaraman-IBi9RG/b67k@public.gmane.org> wrote:
> >
> >> On 09/23/2011 05:46 PM, Jeff Layton wrote:
> >> > A printk warning was added to the kernel about the default security
> >> > mode changing in 3.1. As best I can tell though, that has not happened
> >> > even though the release is imminent. Are you still planning to change
> >> > that? If not, are you planning to fix the printk?
> >> >
> >>
> >> Did you mean this one?
> >>    http://www.spinics.net/lists/linux-cifs/msg03976.html
> >>
> >> I remember Steve posted this patch sometime ago but I'm not seeing them
> >> in the cifs development tree..
> >>
> >>
> >> -Suresh
> >
> > Yeah, that's the one. Seems a little late to be adding these sorts of
> > behavior changes in 3.1 though, so I'm just wondering what the plan is.
> >
> > I also have some concerns about defaulting to raw NTLMv2 auth since (at
> > least) win2k8 rejects unless you go in and tweak registry keys. It
> > would seem to me to be better to decide the default based on the
> > negotiation:
> >
> > Set extended security bit in the NegProt by default
> >
> > If the server sets it, then use NTLMSSP
> 
> Not sure if there are any cifs/smb servers that support
> extended security mechanisms but ntlmssp not being
> one of them, we ought to consider that such a setup
> before choosing ntlmssp if the server set extended
> security bit in negprot response.
> 

Seems unlikely. If the server doesn't support NTLMSSP then it probably
won't allow login via any password mechanism. That said, it wouldn't
hurt to also fall back to non-NTLMSSP auth if the server doesn't list
NTLMSSP in the SPNEGO blob in the NEGOTIATE reply. That has a (slight)
chance of working...

> >
> > If it doesn't then use old NTLM (or NTLMv2)
> >
> > That means an overhaul of how sec_mode is handled though, since that's
> > currently decided too early to do it that way.
> >
> > --
> > Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
> > the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> >


-- 
Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>

Re: default security mechanism for 3.1

[Jeff Layton]

On Fri, 23 Sep 2011 14:12:46 -0500
Steve French <smfrench-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:

> At the conference I got some valuable data (needed for this patch) from
> discussions with other engineers (and some testing)
> 
> - extended security is supported by enough servers to use as the default
> - we can use the server turning off extended security as a trigger to go
> back to directly using ntlmv2 (not in ntlmssp)
> - if extended security is on then all known servers will support raw ntlmssp
> 
> So basically change would be:
> - turn on extended security in negotiate by default
> - fall back if server doesn't support it
> - otherwise send raw ntlmssp
> 

Ok, I'm assuming that it's too late to get this into 3.1 and this will
be 3.2 material? If so, can you fix the printk to reflect the correct
version that this will change?

-- 
Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>

Re: default security mechanism for 3.1

[Steve French]

Yes - I would have liked to change this but clearly too late.

On Fri, Sep 23, 2011 at 8:43 AM, Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
> On Fri, 23 Sep 2011 17:55:05 +0530
> Suresh Jayaraman <sjayaraman-IBi9RG/b67k@public.gmane.org> wrote:
>
>> On 09/23/2011 05:46 PM, Jeff Layton wrote:
>> > A printk warning was added to the kernel about the default security
>> > mode changing in 3.1. As best I can tell though, that has not happened
>> > even though the release is imminent. Are you still planning to change
>> > that? If not, are you planning to fix the printk?
>> >
>>
>> Did you mean this one?
>>    http://www.spinics.net/lists/linux-cifs/msg03976.html
>>
>> I remember Steve posted this patch sometime ago but I'm not seeing them
>> in the cifs development tree..
>>
>>
>> -Suresh
>
> Yeah, that's the one. Seems a little late to be adding these sorts of
> behavior changes in 3.1 though, so I'm just wondering what the plan is.
>
> I also have some concerns about defaulting to raw NTLMv2 auth since (at
> least) win2k8 rejects unless you go in and tweak registry keys. It
> would seem to me to be better to decide the default based on the
> negotiation:
>
> Set extended security bit in the NegProt by default
>
> If the server sets it, then use NTLMSSP
>
> If it doesn't then use old NTLM (or NTLMv2)
>
> That means an overhaul of how sec_mode is handled though, since that's
> currently decided too early to do it that way.
>
> --
> Jeff Layton <jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
>



-- 
Thanks,

Steve