4 ms·
Is this going to break things like SAMBA?
by gmiller123456 3y ago
Is this going to break things like SAMBA?
- woleium 3y agoIirc samba preferentially uses Kerberos for auth, falling back to NTLM. I’m sure a lot of folks use NTLM though.
- creeble 3y agoLike just about every home NAS in the world. Wonder what’s going to happen there?
- jeroenhd 3y agoThe linked article says Microsoft will offer a setting to enable NTLM again. They only seem to be changing the default for now. My guess is that Windows 11 will disable NTLM out of the box and perhaps Windows 12 will disable it entirely.
- acdha 3y agoWhat would be nice would be if they could allow it only for RFC 1918 addresses with a IP TTL of one – allow the local doughnut shop to keep their old printer a bit longer with a warning but force slacker corp not to keeping procrastinating.
- jeroenhd 3y agoIf this does happen, I wouldn't be surprised if someone would start selling dirt cheap "printer upgrade boxes" in the form of small Linux computers with two ethernet ports (or maybe a USB port and an ethernet port, and a WiFi access point especially for the printer) that just run Samba. If the printer is directly attached to the box, they wouldn't even introduce severe security vulnerabilities. Hell, this could be sold as some kind of firewall solution with a $3/mo "enterprise" subscription. Someone can make money with this!
- woleium 3y agoLike this? https://www.aliexpress.com/item/1005002604130322.html https://www.aliexpress.com/item/1005002604130322.html
- jeroenhd 3y agoYes, but more modern. This thing features operating systems old enough that I doubt the protocols it speaks to computers is modern enough to be secure. I knew these devices were out there, but not every network printer works as well over USB as it does over the network.
- woleium 3y agoI’ve done one of these recently, and I ended up using an old raspberry pi 3b. It was less costly than any of the alternatives I could find.
- projektfu 3y agoI'm wondering more about Workgroup networking. I can understand dumping it for domain controllers, but what authentication is used on domain-less networks?
- smileybarry 3y agoIt's in the article: (and the whole reason for finally killing off NTLM) > However, Microsoft is now working on two new Kerberos features: IAKerb (Initial and Pass Through Authentication Using Kerberos) and Local KDC (Local Key Distribution Center). > "The local KDC for Kerberos is built on top of the local machine's Security Account Manager so remote authentication of local user accounts can be done using Kerberos," Microsoft's Matthew Palko explained. > "This leverages IAKerb to allow Windows to pass Kerberos messages between remote local machines without having to add support for other enterprise services like DNS, netlogon, or DCLocator. IAKerb also does not require us to open new ports on the remote machine to accept Kerberos messages."
- projektfu 3y agoThanks, I skimmed. I wonder if there are other ad-hoc Kerberos systems like this.
- smileybarry 3y agoAFAIK there aren't, and that's the reason for that huge chasm between proper Kerberos and NTLM. I think the old Windows 7-era Home Group was somewhat of a mashup between the two with account syncing, but might've been on top of NTLM anyway.
- jeroenhd 3y agoSamba has supported Kerberos for a while. I'm sure there's some IoT shit that will break with NTLM disabled, but I believe maintained servers shouldn't be impacted.
- wtallis 3y agoDoesn't Samba only support Kerberos as part of a full Active Directory deployment? Switching to Kerberos authentication is not just a matter of flipping a switch, it drastically raises the minimum required infrastructure.
- jeroenhd 3y agoThat's definitely the most common way to deploy Samba with Kerberos, but I don't think it's strictly necessary: https://blog.dan.drown.org/kerberos-for-windows-without-ad/ https://blog.dan.drown.org/kerberos-for-windows-without-ad/
- wtallis 3y agoFrom what I've been able to dig up, the situation has been getting worse over time so workarounds that worked circa Samba 4.8 or 4.9 are not effective on current distros.
- wannacboatmovie 3y agoNo. NTLM is an ancient protocol that dates back to Windows NT 3.1 in 1993. That's thirty years ago. Microsoft has been actively telling customers to "please stop using this" for over 10 years. Enough time has passed. NTLM is the Telnet of file sharing. There was a time and place for it and that time has passed.
- jeroenhd 3y agoMicrosoft has said the same about SMB2 but people still turn that back on because of old NASes and printers. Most guides for Samba still seem to be written with NTLM in mind. Any Linux/*BSD based consumer NAS may break, as well as many hobbyist NAS setups. Microsoft is right to get rid of these old, vulnerable protocols, but there may still be an impact.
- wannacboatmovie 3y agoIf NAS builders can't cope with this change maybe they shouldn't be in the NAS business.
- jeroenhd 3y agoMany of them probably shouldn't, but if customers buy a new computer and their old workflow doesn't work on the new one, they're going to blame and "fix" the new computer rather than replace additional hardware.
- IntelMiner 3y agoIsn't SMB2 meant to be the "mostly good" one introduced in Vista? SMBv1 was an absolute shit-show. A lot of early devices only supported it using hacked up ancient GPL violating Samba builds
- jeroenhd 3y agoSMBv2 is better but still not great. SMBv3 is pretty good. SMBv1 is a security risk that should've been deleted from the Windows source code long ago.
- NelsonMinar 3y agoI'm wondering about Sonos v1 systems. They require some ancient login protocol from the server (NTLM v1?) that breaks every year or two. Sonos will never update their system to modernize it. The dumbest thing is it's just read only access for effectively a public account.
- TedDoesntTalk 3y ago> Sonos will never update their system to modernize it Why not?
- baq 3y agoThey don't have to.
- NelsonMinar 3y agoYou'd have to ask them, but the Sonos v1 systems are abandoned. We're all supposed to buy new hardware.