7 ms·
Microsoft plans to kill off NTLM authentication in Windows 11
- gmiller123456 3y agoIs this going to break things like SAMBA?
- woleium 3y agoIirc samba preferentially uses Kerberos for auth, falling back to NTLM. I’m sure a lot of folks use NTLM though.
- creeble 3y agoLike just about every home NAS in the world. Wonder what’s going to happen there?
- jeroenhd 3y agoThe linked article says Microsoft will offer a setting to enable NTLM again. They only seem to be changing the default for now. My guess is that Windows 11 will disable NTLM out of the box and perhaps Windows 12 will disable it entirely.
- acdha 3y agoWhat would be nice would be if they could allow it only for RFC 1918 addresses with a IP TTL of one – allow the local doughnut shop to keep their old printer a bit longer with a warning but force slacker corp not to keeping procrastinating.
- jeroenhd 3y agoIf this does happen, I wouldn't be surprised if someone would start selling dirt cheap "printer upgrade boxes" in the form of small Linux computers with two ethernet ports (or maybe a USB port and an ethernet port, and a WiFi access point especially for the printer) that just run Samba. If the printer is directly attached to the box, they wouldn't even introduce severe security vulnerabilities. Hell, this could be sold as some kind of firewall solution with a $3/mo "enterprise" subscription. Someone can make money with this!
- woleium 3y agoLike this? https://www.aliexpress.com/item/1005002604130322.html https://www.aliexpress.com/item/1005002604130322.html
- jeroenhd 3y agoYes, but more modern. This thing features operating systems old enough that I doubt the protocols it speaks to computers is modern enough to be secure. I knew these devices were out there, but not every network printer works as well over USB as it does over the network.
- woleium 3y agoI’ve done one of these recently, and I ended up using an old raspberry pi 3b. It was less costly than any of the alternatives I could find.
- projektfu 3y agoI'm wondering more about Workgroup networking. I can understand dumping it for domain controllers, but what authentication is used on domain-less networks?
- smileybarry 3y agoIt's in the article: (and the whole reason for finally killing off NTLM) > However, Microsoft is now working on two new Kerberos features: IAKerb (Initial and Pass Through Authentication Using Kerberos) and Local KDC (Local Key Distribution Center). > "The local KDC for Kerberos is built on top of the local machine's Security Account Manager so remote authentication of local user accounts can be done using Kerberos," Microsoft's Matthew Palko explained. > "This leverages IAKerb to allow Windows to pass Kerberos messages between remote local machines without having to add support for other enterprise services like DNS, netlogon, or DCLocator. IAKerb also does not require us to open new ports on the remote machine to accept Kerberos messages."
- projektfu 3y agoThanks, I skimmed. I wonder if there are other ad-hoc Kerberos systems like this.
- smileybarry 3y agoAFAIK there aren't, and that's the reason for that huge chasm between proper Kerberos and NTLM. I think the old Windows 7-era Home Group was somewhat of a mashup between the two with account syncing, but might've been on top of NTLM anyway.
- jeroenhd 3y agoSamba has supported Kerberos for a while. I'm sure there's some IoT shit that will break with NTLM disabled, but I believe maintained servers shouldn't be impacted.
- wtallis 3y agoDoesn't Samba only support Kerberos as part of a full Active Directory deployment? Switching to Kerberos authentication is not just a matter of flipping a switch, it drastically raises the minimum required infrastructure.
- jeroenhd 3y agoThat's definitely the most common way to deploy Samba with Kerberos, but I don't think it's strictly necessary: https://blog.dan.drown.org/kerberos-for-windows-without-ad/ https://blog.dan.drown.org/kerberos-for-windows-without-ad/
- wtallis 3y agoFrom what I've been able to dig up, the situation has been getting worse over time so workarounds that worked circa Samba 4.8 or 4.9 are not effective on current distros.
- wannacboatmovie 3y agoNo. NTLM is an ancient protocol that dates back to Windows NT 3.1 in 1993. That's thirty years ago. Microsoft has been actively telling customers to "please stop using this" for over 10 years. Enough time has passed. NTLM is the Telnet of file sharing. There was a time and place for it and that time has passed.
- jeroenhd 3y agoMicrosoft has said the same about SMB2 but people still turn that back on because of old NASes and printers. Most guides for Samba still seem to be written with NTLM in mind. Any Linux/*BSD based consumer NAS may break, as well as many hobbyist NAS setups. Microsoft is right to get rid of these old, vulnerable protocols, but there may still be an impact.
- wannacboatmovie 3y agoIf NAS builders can't cope with this change maybe they shouldn't be in the NAS business.
- jeroenhd 3y agoMany of them probably shouldn't, but if customers buy a new computer and their old workflow doesn't work on the new one, they're going to blame and "fix" the new computer rather than replace additional hardware.
- IntelMiner 3y agoIsn't SMB2 meant to be the "mostly good" one introduced in Vista? SMBv1 was an absolute shit-show. A lot of early devices only supported it using hacked up ancient GPL violating Samba builds
- jeroenhd 3y agoSMBv2 is better but still not great. SMBv3 is pretty good. SMBv1 is a security risk that should've been deleted from the Windows source code long ago.
- NelsonMinar 3y agoI'm wondering about Sonos v1 systems. They require some ancient login protocol from the server (NTLM v1?) that breaks every year or two. Sonos will never update their system to modernize it. The dumbest thing is it's just read only access for effectively a public account.
- TedDoesntTalk 3y ago> Sonos will never update their system to modernize it Why not?
- baq 3y agoThey don't have to.
- NelsonMinar 3y agoYou'd have to ask them, but the Sonos v1 systems are abandoned. We're all supposed to buy new hardware.
- ezconnect 3y agoIs the future of windows only online?
- gustavus 3y agoWelcome to the new Windows virtual experience, where you can connect all of your Windows devices in a joined ecosystem, and here's the best part you no longer have to worry about paying the full price of a computer, instead you'll be able to pay a small monthly subscription to get a premium Windows Connected Computing Experience(TM). You'll be able to do all the things you normally do* at a fraction of the price of buying a full machine, and best of all if there are any issues the Microsoft Experience Team will ship you a new device absolutely free of charge.** Welcome to the Windows future where you get the experience you deserve. * Noted not all activities are applicable to all people some activities may violate our terms of service and result in a closing of your account without these activites include but are not limited to, the production of tools or services that would result in loss of revenue for the Microsoft corporation, developing free or open source (FOSS) software without an authorized Microsoft FOSS developer license, publishing misinformation, false or libelous claims about the Microsoft corporation or products, and other activities as determined by Microsoft. ** Free in this case is exclusive of necessary fees, surcharges, and shipping and handeling related expenses. Welcome to the Windows future where you get the experience you deserve. P.S. Please don't create the torment nexus
- bob1029 3y agoWindows 365 (enterprise) is actually really nice. I started using it to manage an org transition @ work, but I am thinking I might also set up a personal instance at this point. The dream is to throw away 100% of my desktops and run with just a MacBook and a decent external monitor. I don't have the patience to manage hardcore/gamer hardware anymore.
- candiddevmike 3y agoAs a contractor, Windows 365 is incredible. Give me it any day over VPNs, Citrix, VMware, etc.
- 3y ago
- gustavus 3y agoI felt a great disturbance in the force as if thousands of pen-testers and grey hats cried out in agony as their go to means of breaking enterprise networks was lost.
- jeroenhd 3y agoDon't worry, that printer from 2003 the CEO has an emotional connection to probably requires the entire network to keep NTLM enabled. The moment Microsoft rolls out a "turn NTLM back on" checkbox, the internet will be flooded with "how to fix printer not working on Windows 11" articles that will linger at least as long as the stupid "just disable SELinux if you run into any kind of error" articles are sticking around.
- hackmiester 3y agoWe use CUPS as a proxy to allow us to upgrade the rest of the network. :)
- philipov 3y agoTo be fair, finding a good printer is hard. Mid-range enterprise printers manufactured before 2006 are in great demand, because of the progress of enshittification by the industry.
- acdha 3y agoOr you can buy a Brother and spend your time on anything else. Let markets do their thing!
- nickpeterson 3y agoCan confirm, I bought a brother color laser for home use years back and it has been a tank.
- stevehawk 3y agoBrother recently adopted the same anticonsumer tactics as everyone else
- garganzol 3y agoWhat is the replacement for single sign-on? NTLM was kind of useful because some web browsers supported pass-through NTLM authentication, making website login process a breathe.
- folmar 3y agoNormal Kerberos. For SSO NTLM was a fallback with no SSO power only.
- cryptonector 3y agoFor the line of sight issues that Kerberos doesn't normally deal with MSFT is adding an implementation of IAKERB, which is a Kerberos-related protocol by which an application server can proxy messages between the client and the Kerberos KDCs on behalf of the client.
- bodeadly 3y agoThe blog article doesn't actually say the IAKERB impl will proxy to KDCs. Strangely it is entirely specific to Windows 11 and by extension Windows clients. There is no mention of Windows Server. So it's not crystal clear to me that the implementation will be able to authenticate domain accounts. Maybe it will only authenticate against the "LocalKDC" on top of the local SAM just to work around the issue of being able to log into a machine without line-of-site to a KDC (or NTLM or VM console) and nothing more.
- cryptonector 3y ago> The blog article doesn't actually say the IAKERB impl will proxy to KDCs. But that's all IAKERB does. There's two use cases here: proxying to the local, SAM-backed KDC for workgroup mode authen., and proxying to domain controller KDCs for RDP and RAS and what not where the [K]DCs are not reachable directly by the client. (There's a third use case that they don't currently seem to intend to support, which is when you try to authenticate to a Windows system by IP instead of by name. In that case they could extend IAKERB to use the Microsoft user-to-user Kerberos protocol to discover the server's name.) > Strangely it is entirely specific to Windows 11 and by extension Windows clients. There is no mention of Windows Server. Steve Syfuhs addressed this on twitter: there's only one Windows now, so there's no need to mention "Windows Server" because "Windows Server" == Windows.
- josephcsible 3y agoHow will file and printer sharing work with computers that are only in a workgroup and not a domain?
- olyjohn 3y agoJust use OneDrive! You think they give a shit about your local file and printer sharing that is only used by nerds like us?
- opan 3y agoWindows has an ssh service you can enable now, so you can get sftp going easily enough for file sharing.
- jiggawatts 3y agoDo you hear yourself? This is like someone asking for Linux scripting advice and being told that there is VB Script for Linux now!
- cryptonector 3y agoThey are replacing NTLM, not just killing it off, but it's not a drop-in replacement and so apps that use NTLM will need some remediation. In particular you'll still be able to do the workgroup thing.
- josephcsible 3y agoWhat is its replacement for file sharing in workgroups, though?
- cryptonector 3y agoEvery server runs a local KDC backed by the local SAM, so when you authenticate to a server in workgroup mode you'll be using Kerberos over IAKERB to do an AS exchange (think `kinit`) followed by the AP exchange. So you still get standalone username & password authentication.
- sebstefan 3y agoSo for the uninitiated, what was the issue with NTLM that makes everyone happy they're switching to kerberos?
- 31337Logic 3y agoFor the uninitiated, NTLM authn is so weak that you could break it just by sneezing near it.
- pluto_modadic 3y agoit's a superposition of two states: - insecure and you know it - insecure and you don't know it until you sneeze and someone's stolen everything.
- tg16 3y agoI'm a Security Architect dealing with the pain of an old environment with a default NTLM configuration so i'll chime in: - NTLM doesn't sign packets. If you can intercept an NTLM auth request you can forward that authentication attempt to another resource and impersonate the user without needing to know or crack their password. You simply MitM the challenge-response between the client and the server. This is called NTLM relaying and is a core issue of NTLM, though some protocols have additional verification such as SMB signing, which is not enforced by default. - NTLM has relatively weak hashes, though this is far from the biggest issue with NTLM. - NTLM (unlike Kerberos), uses a single hash for all authentication. If you can compromise this hash, you can impersonate the user anywhere. With Kerberos, each auth event generates a signed with a narrow validity period that grants access to a tuple of user, device, and resource. Meaning if you compromise a user's Kerberos tickets, you can only impersonate them on services that they already had a ticket for at the time, and for only a few hours in until those tickets expire. The NTLM hash itself is the proof-of-identity for all NTLM auth, and this can be recovered in memory or on disk for local accounts. - NTLM, combined with older broadcast name resolution protocols (namely LLMNR, NBT-NS mDNS, and WPAD) can be very easily intercepted and abused for NTLM relaying due to the lack of signing. It is trivial in most Windows environments to run Responder.py and get an administrative session on pretty much everything. Unless the enterprise has taken steps to harden against NTLM relaying (which is difficult both for compatibility issues and the sheer number of required changes), they're going to be vulnerable to it. My current environment has top of the line network monitoring, SIEM, and EDR, but it's still very easy to slip under the radar with NTLM relaying if you know what you're doing.
- yread 3y agoWill Firefox finally implement Negotiate then?
- cryptonector 3y agoFirefox already does implement RFC 4559.
- msla 3y agoNTLM is being replaced by Kerberos. Kerberos has requirements about clocks being synchronized such that clock skew will prevent authentication. I rather doubt that Microsoft has made Windows any more punctual about setting its damned clock even if you give it a time server and tell it to set its time from the network. Even if the behavior I observed was somehow rare, there's still the matter of local IT "gurus" needing to punch holes in firewalls sufficient to enable NTP and/or being punctual about setting clocks. This is going to be fun.
- pixl97 3y agoI've always loved that the time set by time.windows.com (I think that's the default that comes with Windows) always seems to be 2 to 3 minutes off the time set by the NTP.org pools. Really easy to get outside of the Kerberos 300 second allowance.
- throw0101b 3y agoWill this effect Wifi that uses (P)EAP-MSCHAPv2?
- Johnie 3y agoAt first, I read that as Windows 1.1. I thought this was an old article.
- cryptonector 3y agoI'm late to this party so this comment will be buried, but I hope it's useful to someone. MSFT will be replacing some of the NTLM functionality with something called IAKERB, which is a GSS-API mechanism (aka, an SSP in Windows terminology) that allows the server application to proxy Kerberos messages between the client and the Kerberos key distribution centers (KDCs), and this will replace two things that NTLM provides: - support for cases where there is no direct line of sight between the client and the KDCs - support for using username & password local to the server by having the server have its own local KDC The only NTLM feature not provided by the new thing is the ability to InitializeSecurityContext() without naming the target service. This is why it's not entirely a drop-in replacement, and NTLM-using applications do need remediation for this (and, along the way, to replace uses of the NTLM SSP with the Negotiate SSP). Because the apps always know a name for the target, there is no reason that this remediation should be hard. Therefore you can consider all the NTLM functionality replaced by IAKERB. EDIT: I don't mind downvotes, but if I'm trying to provide useful technical information and you disagree with it it, it might be useful to say so because a) I might be wrong, b) you might be wrong, c) others might learn something.