Re: [PATCH 0/2] ksmbd: NTLM pass-through to a domain controller

[Stefan Metzmacher <metze@samba.org>]

Hi Jan,

>> a ksmbd server joined to an Active Directory domain can authenticate
>> domain users with Kerberos, but not with NTLM: it has no password hash
>> for them, so the NTLMv2 response can't be checked locally. Clients that
>> fall back to NTLM (access by IP address, machines outside the domain,
>> mount.cifs with user name and password) are refused.
>>
>> Samba solves this by forwarding the response to a domain controller
>> over NETLOGON (NetrLogonSamLogonEx on a schannel connection). These two
>> patches give ksmbd the kernel half of that, and leave the NETLOGON client
>> to user space, like the rest of ksmbd's user handling:
>>
>> 1/2 adds a KSMBD_USER_FLAG_PASSTHROUGH login flag. For such a user,
>>      ksmbd_decode_ntlmssp_auth_blob() doesn't compute the response from a
>>      local hash. It sends the server challenge, the user, domain and
>>      workstation names and the NT/LM responses to user space in a new
>>      KSMBD_EVENT_NTLM_AUTHEN_REQUEST event, then takes the session base
>>      key from KSMBD_EVENT_NTLM_AUTHEN_RESPONSE and goes on with the
>>      existing key exchange. Both events have a strict netlink policy and
>>      are checked in ipc_validate_msg().
>>
>> 2/2 puts the workgroup, not the netbios name, into MsvAvNbDomainName and
>>      MsvAvDnsDomainName of the challenge's target info. A domain
>>      controller checks these when it verifies the NTLMv2 response (Samba
>>      in NTLMv2_RESPONSE_verify_workstation()), so without this patch
>>      every pass-through login fails with NT_STATUS_LOGON_FAILURE. The
>>      patch also checks that the challenge blob fits the response buffer,
>>      since the workgroup can be longer than the netbios name.
>>
>> Logins of users without the new flag are checked as before. The only
>> change they see is the domain names in the challenge's target info
>> (patch 2/2). ksmbd-tools doesn't set the flag yet. The user space side
>> we tested with is sharedd/adconnect from FenrirOS: it marks domain users
>> without a local hash as pass-through, and it answers the event through
>> a NETLOGON schannel client, tested against a Samba 4.22 AD DC.
>>
>> I can send the matching ksmbd-tools change if the interface looks
>> acceptable.
> Okay, Please send a PR to ksmbd-tools. Wang is also currently
> implementing AD/DC features in ksmbd and might be interested, so I'm
> adding him to CC.

why making this NTLM specific, I think it would be good to the whole session setup
blob exchange to userspace, so that authentication is not used in kernel at all?
And it will also help when IAKERB and other things will be implemented later.
It would also be good to have the infrastructure working with winbindd being
the bridge to the domain.

What exactly is "sharedd/adconnect from FenrirOS"?

And Wang, what are the AD/DC features?

metze
> Thanks for the patches!