MIME-Version: 1.0
References: <CAJjP=Bt52AW_w2sKnM=MbckPkH1hevPMJVWm_Wf+wThmR72YTg@mail.gmail.com>
In-Reply-To: <CAJjP=Bt52AW_w2sKnM=MbckPkH1hevPMJVWm_Wf+wThmR72YTg@mail.gmail.com>
From:   Steve French <smfrench@gmail.com>
Date:   Mon, 10 Jan 2022 11:31:16 -0600
Message-ID: <CAH2r5mt_2f==5reyc0HmMLvYJVmP4Enykwauo+LQoFGFbVFeRQ@mail.gmail.com>
Subject: Re: Possible regression: unable to mount CIFS 1.0 shares from older
 machines since 76a3c92ec9e0668e4cd0e9ff1782eb68f61a179c
To:     Davyd McColl <davydm@gmail.com>
Cc:     CIFS <linux-cifs@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

I want to make sure that we don't have an unrelated regression
involved here since NTLMv2 replaced NTLMv1 over 20 years ago (googling
this e.g. I see "NTLMv2, introduced in Windows NT 4.0 SP4 and natively
supported in Windows 2000")  and should be the default for Windows
NT4, Windows 2000 etc. as well as any version of Samba from the last
15 years+.  I have significant concerns with adding mechanisms that
were asked to be disabled ~19 years ago e.g. see
https://support.microsoft.com/en-us/topic/security-guidance-for-ntlmv1-and-lm-network-authentication-da2168b6-4a31-0088-fb03-f081acde6e73
due to security concerns.

Can we double check that there are not other issues involved in your example?

The concerns about NTLMv1 security concerns (and why it should never
be used) are very persuasive e.g. many articles like
https://miriamxyra.com/2017/11/08/stop-using-lan-manager-and-ntlmv1/

On Mon, Jan 10, 2022 at 7:48 AM Davyd McColl <davydm@gmail.com> wrote:
>
> Good day
>
> I'm following advice from the thread at
> https://bugzilla.kernel.org/show_bug.cgi?id=215375 as to how to report
> this, so please bear with me and redirect me as necessary.
>
> Since commit 76a3c92ec9e0668e4cd0e9ff1782eb68f61a179c, I'm unable to
> mount a CIFS 1.0 share ( from a media player: mede8er med600x3d, which
> runs some older linux). Apparently I'm not the only one, according to
> that thread, though the other affected party there is windows-based.
>
> I first logged this in the Gentoo bugtracker
> (https://bugs.gentoo.org/821895) and a reversion patch is available
> there for the time being.
>
> I understand that some of the encryption methods upon which the
> original feature relied are to be removed and, as such, the ability to
> mount these older shares was removed. This is sure to affect anyone
> running older Windows virtual machines (or older, internally-visible
> windows hosts) in addition to anyone attempting to connect to shares
> from esoteric devices like mine.
>
> Whilst I understand the desire to clean up code and remove dead
> branches, I'd really appreciate it if this particular feature remains
> available either by kernel configuration (which suits me fine, but is
> likely to be a hassle for anyone running a binary distribution) or via
> boot parameters. In the mean-time, I'm updating my own sync software
> to support this older device because if I can't sync media to the
> player, the device is not very useful to me.
>
> Thanks
> -d


-- 
Thanks,

Steve