Arch Linux

vostok4

Member

Registered: 2010-12-16

Posts: 70

Samba Server Responding with "Bad SMB2 signature for message"

Last night my Windows 1809 PC's could no longer connect to my Samba server. I've been digging in on the Windows side separately, but recently I've been looking at the Samba side and noticed some odd behaviour.

Samba 4.9.3-1 and Kernel 4.19.8.arch1-1

If I run

smbclient -L localhost

on the server, I get the following response:

Bad SMB2 signature for message
[0000] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
[0000] 8A 30 5E 0A E4 C3 96 E9   3A AF 2A FE C1 1C 81 2E   .0^..... :.*.....
Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------

--- snipped ---

Of note is the "Bad SMB2 signature for message", each time I run the smbclient command I get a different output of bytes. I've only seen a few scattered reports of this problem a handful of years ago, so I'm wondering if it could be something that has changed recently. I also can see that same error in the smb.service log:

Dec 15 00:26:21 bank systemd[1]: Started Samba SMB Daemon.
Dec 15 00:26:23 bank smbd[3016]: [2018/12/15 00:26:23.966740,  0] ../libcli/smb/smb2_signing.c:171(smb2_signing_check_pdu)
Dec 15 00:26:23 bank smbd[3016]:   Bad SMB2 signature for message
Dec 15 00:26:23 bank smbd[3016]: [2018/12/15 00:26:23.966822,  0] ../lib/util/util.c:514(dump_data)
Dec 15 00:26:23 bank smbd[3016]:   [0000] E0 7D 45 65 9F 86 65 F8   C5 AA 16 21 75 B2 40 B1   .}Ee..e. ...!u.@.
Dec 15 00:26:23 bank smbd[3016]: [2018/12/15 00:26:23.966843,  0] ../lib/util/util.c:514(dump_data)
Dec 15 00:26:23 bank smbd[3016]:   [0000] E6 34 B8 E6 38 39 10 3A   5A 5E 08 D2 96 04 B5 27   .4..89.: Z^.....'

I've downgraded to the last kernel+samba+smbclient+libwbclient version that I know ran OK with these machines, but it didn't work. Is anyone else getting "Bad SMB2 signature for message" when running

smbclient -L localhost

?

My smb.conf:

───────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: /etc/samba/smb.conf
───────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ [global]
   2   │    workgroup = WORKGROUP
   3   │ 
   4   │    server string = little black server in the back of the office
   5   │ 
   6   │    server role = standalone server
   7   │ 
   8   │    dns proxy = no
   9   │ 
  10   │    logging = systemd
  11   │ 
  12   │    map to guest = Bad User
  13   │ 
  14   │    follow symlinks = yes
  15   │    wide links = yes
  16   │    unix extensions = no
  17   │ 
  18   │    mangled names = no
---
  35   │ [vault]
  36   │   browseable = yes
  37   │   read only = no
  38   │   create mask = 0777
  39   │   directory mask = 0777
  40   │   path = /vault
  41   │   guest ok = yes
---

vostok4

Member

Registered: 2010-12-16

Posts: 70

Re: Samba Server Responding with "Bad SMB2 signature for message"

Well, that was a journey.

I found a fix: downgrade to samba/smbclient/libwbclient to 4.8.5 from ALA; the last built release against 4.8.x. It was a last gasp effort, I was getting nowhere.

After downgrading and restarting the smbclient, all of a sudden every single Windows client can connect, and smbclient -L localhost no longer causes any errors at all.

I don't know what caused it, I will file a bug upstream after the holidays.