Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4702 > unrolled thread

Call for testing: upcoming samba security update

Back to article view | Back to linux.debian.security

Contents

  Call for testing: upcoming samba security update Salvatore Bonaccorso <carnil@debian.org> - 2016-04-12 22:30 +0200
    Re: Call for testing: upcoming samba security update Chris Boot <crb@tiger-computing.co.uk> - 2016-04-14 11:50 +0200
      Re: Call for testing: upcoming samba security update Chris Boot <crb@tiger-computing.co.uk> - 2016-04-14 14:40 +0200
      Re: Call for testing: upcoming samba security update Virgo Pärna <virgo.parna@mail.ee> - 2016-04-14 15:50 +0200
        Re: Call for testing: upcoming samba security update "oeh univie edv lists" <edv-lists@oeh.univie.ac.at> - 2016-04-14 18:40 +0200
          Re: Call for testing: upcoming samba security update Virgo Pärna <virgo.parna@mail.ee> - 2016-04-16 07:40 +0200
            Re: Call for testing: upcoming samba security update Virgo Pärna <virgo.parna@mail.ee> - 2016-04-19 14:00 +0200
        Re: Call for testing: upcoming samba security update "Birgit Berger (UV Wien)" <birgit.berger@oeh.univie.ac.at> - 2016-04-14 18:50 +0200
    Re: Call for testing: upcoming samba security update Vladislav Kurz <vladislav.kurz@webstep.net> - 2016-04-14 12:10 +0200
      Re: Call for testing: upcoming samba security update Paul Wise <pabs@debian.org> - 2016-04-14 14:10 +0200

#4702 — Call for testing: upcoming samba security update

[Multipart message — attachments visible in raw view] — view raw

Hi

The upcoming Samba update is bigger than usual since for Jessie an
update is needed to 4.2. We want to expose the package a bit more for
additional testing. Please test the packages found on

	https://people.debian.org/~carnil/tmp/samba/

(no apt repository available for these test packages at this time)

If you find a problem introduced by updating to these packages, please
report the problem directly to team@security.debian.org, and including
abartlet@samba.org and sathieu@debian.org.

The update is planned to be released already tomorrow, 2016-04-13.

Regards,
Salvatore, on behalf of the Debian security team

[toc] | [next] | [standalone]

#4723

On 12/04/16 21:27, Salvatore Bonaccorso wrote:
> Hi
> 
> The upcoming Samba update is bigger than usual since for Jessie an
> update is needed to 4.2. We want to expose the package a bit more for
> additional testing. Please test the packages found on

[snip]

Hi folks,

So I missed the testing window and the updates are now out. There are a
few problems, mostly with the NEWS.Debian file, which may lead to
confusion and/or further issues.

Firstly:

>     Finally, two important configuration options should be considered,
>     that we were unable to silently change defaults for:
>     - smb signing = required
>     - ntlm auth = no
> 
>     Without smb signing = required, Man in the Middle attacks are
>     still possible against our file server and classic/NT4-like/Samba3
>     Domain controller.  (It is now enforced on our AD DC.)

There is no parameter named "smb signing" in smb.conf, and Samba rightly
complains:

> [2016/04/14 09:43:53,  0] ../lib/param/loadparm.c:743(lpcfg_map_parameter)
>   Unknown parameter encountered: "smb signing"
> [2016/04/14 09:43:53,  0] ../lib/param/loadparm.c:1626(lpcfg_do_global_parameter)
>   Ignoring unknown parameter "smb signing"

I suspect you meant one/several of "client ipc signing", "client
signing" and/or "server signing" instead. Can you please clarify?

Secondly:

When running a Samba 4 DC, the shift from 4.1 to 4.2 brings some major
changes with it and people's smb.conf will need changing. The "server
services" line needs "winbind" replacing with "winbindd", and the user
must ensure the winbind package is installed. Otherwise, Samba will
silently fail to provide a working DC.

I will report these bugs on the samba package once I finish putting out
some fires caused by all of this...

HTH,
Chris

-- 
Chris Boot

Tiger Computing Ltd
ISO27001:2013 Certified

Tel: 01600 483 484
Web: https://www.tiger-computing.co.uk

Registered in England. Company number: 3389961
Registered address: Wyastone Business Park,
 Wyastone Leys, Monmouth, NP25 3SR

[toc] | [prev] | [next] | [standalone]

#4727

On 14/04/16 10:02, Chris Boot wrote:
> Firstly:
> 
>>     Finally, two important configuration options should be considered,
>>     that we were unable to silently change defaults for:
>>     - smb signing = required
>>     - ntlm auth = no
>>
>>     Without smb signing = required, Man in the Middle attacks are
>>     still possible against our file server and classic/NT4-like/Samba3
>>     Domain controller.  (It is now enforced on our AD DC.)
> 
> There is no parameter named "smb signing" in smb.conf, and Samba rightly
> complains:
> 
>> [2016/04/14 09:43:53,  0] ../lib/param/loadparm.c:743(lpcfg_map_parameter)
>>   Unknown parameter encountered: "smb signing"
>> [2016/04/14 09:43:53,  0] ../lib/param/loadparm.c:1626(lpcfg_do_global_parameter)
>>   Ignoring unknown parameter "smb signing"
> 
> I suspect you meant one/several of "client ipc signing", "client
> signing" and/or "server signing" instead. Can you please clarify?

Someone has pointed out to me by private mail that this has been fixed
in an updated NEWS entry, and there is a bug open about it:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820983

https://anonscm.debian.org/cgit/pkg-samba/samba.git/commit/?h=stable-update&id=cbcad2a543a28926ee712cf299dbdc03da351cb0

Please can we make sure that this makes it into the inevitable deb8u3
update?

I'm filing a bug about the AD DC winbind issue now.

Cheers,
Chris

-- 
Chris Boot

Tiger Computing Ltd
ISO27001:2013 Certified

Tel: 01600 483 484
Web: https://www.tiger-computing.co.uk

Registered in England. Company number: 3389961
Registered address: Wyastone Business Park,
 Wyastone Leys, Monmouth, NP25 3SR

[toc] | [prev] | [next] | [standalone]

#4728

On Thu, 14 Apr 2016 10:02:22 +0100, Chris Boot <crb@tiger-computing.co.uk> wrote:
>
> When running a Samba 4 DC, the shift from 4.1 to 4.2 brings some major
> changes with it and people's smb.conf will need changing. The "server
> services" line needs "winbind" replacing with "winbindd", and the user
> must ensure the winbind package is installed. Otherwise, Samba will
> silently fail to provide a working DC.
>

	So that's why my upgrade ended with disaster and reverting to
previous version.

-- 
Virgo Pärna 
virgo.parna@mail.ee

[toc] | [prev] | [next] | [standalone]

#4730

[Multipart message — attachments visible in raw view] — view raw

This doesn't sound very reassuring. Is it better to wait to update samba
4.1.17 to 4.2.10 on jessie?

How do I revert to previous version 4.1.17 if the update fails? Are there
any instructions how do that?

KR birgit

Virgo Pärna <virgo.parna@mail.ee> schreibt:
>On Thu, 14 Apr 2016 10:02:22 +0100, Chris Boot
><crb@tiger-computing.co.uk> wrote:
>>
>> When running a Samba 4 DC, the shift from 4.1 to 4.2 brings some major
>> changes with it and people's smb.conf will need changing. The "server
>> services" line needs "winbind" replacing with "winbindd", and the user
>> must ensure the winbind package is installed. Otherwise, Samba will
>> silently fail to provide a working DC.
>>
>
>	So that's why my upgrade ended with disaster and reverting to
>previous version.
>
>-- 
>Virgo Pärna 
>virgo.parna@mail.ee
>

[toc] | [prev] | [next] | [standalone]

#4741

On Thu, 14 Apr 2016 18:26:43 +0100, oeh univie edv lists <edv-lists@oeh.univie.ac.at> wrote:
>
> [-- Type: text/plain, Encoding: quoted-printable --]
>
> This doesn't sound very reassuring. Is it better to wait to update samba
> 4.1.17 to 4.2.10 on jessie?
>

	I'll have to find time to try update again with changes that
were suggested (server services part and winbind package). Then I could
be certain that this was the reason, why sama would no longer start up.

> How do I revert to previous version 4.1.17 if the update fails? Are there
> any instructions how do that?
>


	I added
Package: samba samba-common samba-common-bin samba-libs python-samba
samba-dsdb-modules samba-vfs-modules smbclient libsmbclient
Pin: version 2:4.1.17+dfsg-2+deb8u2
Pin-Priority: 1000

Package: libldb1 python-ldb
Pin: version 2:1.1.17-2+deb8u1
Pin-Priority: 1000

into /etc/apt/preferences

then removed samba and then reinstalled.

-- 
Virgo Pärna 
virgo.parna@mail.ee

[toc] | [prev] | [next] | [standalone]

#4744

On Sat, 16 Apr 2016 05:34:02 +0000 (UTC), Virgo Pärna <virgo.parna@mail.ee> wrote:
>
> 	I'll have to find time to try update again with changes that
> were suggested (server services part and winbind package). Then I could
> be certain that this was the reason, why sama would no longer start up.
>

	And I can confirm, that installing winbind package resulted in
working Samba. And it is actually mentioned in Samba 4.2 release notes,
but I missed it. 
	And that problem only affects Samba AD Domain Controllers.

-- 
Virgo Pärna 
virgo.parna@mail.ee

[toc] | [prev] | [next] | [standalone]

#4731

[Multipart message — attachments visible in raw view] — view raw

is it better to wait to update samba 4.1.17 to 4.2.10 on jessie?

How do I revert to previous version if the update fails? Are there any
instructions how  to that?

KR birgit

Virgo Pärna <virgo.parna@mail.ee> schreibt:
>On Thu, 14 Apr 2016 10:02:22 +0100, Chris Boot
><crb@tiger-computing.co.uk> wrote:
>>
>> When running a Samba 4 DC, the shift from 4.1 to 4.2 brings some major
>> changes with it and people's smb.conf will need changing. The "server
>> services" line needs "winbind" replacing with "winbindd", and the user
>> must ensure the winbind package is installed. Otherwise, Samba will
>> silently fail to provide a working DC.
>>
>
>	So that's why my upgrade ended with disaster and reverting to
>previous version.
>
>-- 
>Virgo Pärna 
>virgo.parna@mail.ee
>
>

[toc] | [prev] | [next] | [standalone]

#4724

Hi,

I have noticed that samba-common-bin now depends on samba. It didn't before 
the upgrade. Is there any special reason for that? I just need nmblookup on 
some servers (and smbclient/cifs) but not the server package.

-- 
Best Regards
        Vladislav Kurz

[toc] | [prev] | [next] | [standalone]

#4726

On Thu, Apr 14, 2016 at 6:03 PM, Vladislav Kurz wrote:

> I have noticed that samba-common-bin now depends on samba. It didn't before
> the upgrade. Is there any special reason for that? I just need nmblookup on
> some servers (and smbclient/cifs) but not the server package.

This has been fixed in the latest update.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web