STATUS_ACCESS_DENIED - cannot connect. Does the SambaLibrary not support Windows Server 2016 default file share?

[nddipiazza]

I'm running on an app that uses the SMBLibrary with Mono framework on Mac OSX.

Mono JIT compiler version 5.10.1.47 (2017-12/8eb8f7d5e74 Fri Apr 13 20:18:12 EDT 2018)
Copyright (C) 2002-2014 Novell, Inc, Xamarin Inc and Contributors. www.mono-project.com
	TLS:           normal
	SIGSEGV:       altstack
	Notification:  kqueue
	Architecture:  amd64
	Disabled:      none
	Misc:          softdebug 
	Interpreter:   yes
	LLVM:          yes(3.6.0svn-mono-master/8b1520c8aae)
	GC:            sgen (concurrent by default)

Hi. I have a little SambaFetcher web app that I use to connect to smb when the smbj library doesn't work.

I have noticed that on a Windows Server 2016 default windows share, I cannot connect to the SmbTree.

Here is my code https://github.com/nddipiazza/SambaFetcher/tree/SambaLibrary

When I connect I get a blocking error:

STATUS_ACCESS_DENIED

I'm definitely entering the right credentials.

Is this because of Smb3? Is there some limitation that I'm hitting here with the SambaLibrary?

Here is a wireshark packet capture: https://drive.google.com/open?id=1fSxzgIjZX9mu77t4CbR1zHOEt7XnGNCw

First a response comes back:

NT Status: STATUS_MORE_PROCESSING_REQUIRED (0xc0000016)

then comes back a

NT Status: STATUS_ACCESS_DENIED (0xc0000022)

Trying to figure out what i need to do to get this to authenticate. When I was working on this a few months ago it was working fine, no sure what i'm messing up.

[TalAloni]

Hi,
Assuming you are entering the right credentials and use the correct authentication parameters, the only thing left is message signing (either SMB signing or NTLM MIC), which SMB2Client does not currently support.
IIRC SMB signing was not required to connect to Windows Server in the past, but perhaps Microsoft changed this in a later update)

[nddipiazza]

Yep that is the answer. https://blogs.technet.microsoft.com/josebda/2010/12/01/the-basics-of-smb-signing-covering-both-smb1-and-smb2/ It is only enabled by default on domain controllers! (which i happen to be doing my testing against)

…

On Sat, Apr 13, 2019, 3:29 PM TalAloni ***@***.***> wrote: Hi, Assuming you are entering the right credentials and use the correct authentication parameters, the only thing left is message signing (either SMB signing or NTLM MIC), which SMB2Client does not currently support. IIRC SMB signing was not required to connect to Windows Server in the past, but perhaps Microsoft changed this in a later update) — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#20 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACIpOUcp29V39V84Zb0bkK8-GHwCgQg3ks5vgj4RgaJpZM4cuHQD> .

[nddipiazza]

Is it a huge change to add this? I can imagine some of my higher security customers will end up wanting this.
I know you turn out changes like magic on this thing so I figured I'd ask

[TalAloni]

The infrastructure was already in place, so it was only a few lines of code to add SMB signing to the SMB2 client. I've tested it briefly and pushed it to master.

[nddipiazza]

dude... you are amazing!!

[nddipiazza]

Confirmed. Works as expected.