question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Ignored auth_protocol results NTLM_USER_FILE error

See original GitHub issue

Hi, Im encountering an issue when trying to authenticate a remote server. I’m using the High level API and have the following configured:

  • for the register_session:
register_session(
            server=hostname,
            username=user,
            password=password,
            port=445,
            encrypt=encrypt,
            auth_protocol='ntlm')
  • client config:
smbclient.ClientConfig(username=user, password=password, require_secure_negotiate=verify, domain_controller=dc)

where the username, password, and all other variables were verified and correct.

The issue: Even though the auth_protocol was set to ntlm the request first attempts to use negotiate and then falls back to ntlm (we do not support Kerberos at the moment). The problem with it is that the username field is not being passed to the ntlm request and then fails on

Logs

[smbprotocol.connection] - Negotiated dialect: (785) SMB_3_1_1
 python logging: INFO [smbprotocol.connection] - Connection require signing: True
 python logging: INFO [smbprotocol.session] - Initialising session with username: None
 python logging: DEBUG [smbprotocol.session] - Decoding SPNEGO token containing supported auth mechanisms
 python logging: DEBUG [spnego.negotiate] - SPNEGO step input: YHYGBisGAQUFAqBsMGqgPDA6BgorBgEEAYI3AgIeBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKoZIhvcSAQICAwYKKwYBBAGCNwICCqMqMCigJhskbm90X2RlZmluZWRfaW5fUkZDNDE3OEBwbGVhc2VfaWdub3Jl
 python logging: DEBUG [spnego.negotiate] - Failed to create gssapi context for SPNEGO protocol ntlm: SpnegoError (16): Operation not supported or available, Context: Retrieving NTLM store without NTLM_USER_FILE set to a filepath
Exception message is [Traceback (most recent call last):
   File "/usr/local/lib/python3.9/site-packages/smbprotocol/session.py", line 275, in connect
    out_token = context.step(in_token)
   File "/usr/local/lib/python3.9/site-packages/spnego/negotiate.py", line 119, in step
    mech_token_in, mech_list_mic, is_spnego = self._step_spnego_input(in_token=in_token)
   File "/usr/local/lib/python3.9/site-packages/spnego/negotiate.py", line 159, in _step_spnego_input
    mech_list = self._rebuild_context_list(mech_types=in_token.mech_types)
   File "/usr/local/lib/python3.9/site-packages/spnego/negotiate.py", line 374, in _rebuild_context_list
    raise BadMechanismError(context_msg="Unable to negotiate common mechanism", base_error=last_err)
 spnego.exceptions.BadMechanismError: SpnegoError (1): SpnegoError (16): Operation not supported or available, Context: Retrieving NTLM store without NTLM_USER_FILE set to a filepath, Context: Unable to negotiate common mechanism

Good to know:

  • We have NTLM and LM disabled on our server but NTLMv2 enabled.
  • We are using the latest version of the smbprotocol package (1.5.1)

Thanks.

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:15 (8 by maintainers)

github_iconTop GitHub Comments

2reactions
jborean93commented, Aug 15, 2021

The PR https://github.com/jborean93/smbprotocol/pull/133 should fix this particular problem.

1reaction
jborean93commented, Aug 15, 2021

1.6.2 has just been published on PyPI with this fix https://pypi.org/project/smbprotocol/1.6.2/.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Authentication failure from non-Windows NTLM or Kerberos ...
This article provides a solution to several authentication failure issues in which NTLM and Kerberos servers can't authenticate Windows 7 and ...
Read more >
The NTLM Authentication Protocol and Security Support ...
Indicates that the NTLM2 signing and sealing scheme should be used for protecting authenticated communications. Note that this refers to a particular session ......
Read more >
NTLM Vulnerabilities Review - CalCom
This blog post will explain NTLM's main security weaknesses. From common attack techniques to specific vulnerabilities.
Read more >
Pass NTLM with Postman - windows authentication
Confirmed with Fiddler that Postman wasn't sending any authentication headers through. The only work-around was to use Fiddler to do auth. – Jason...
Read more >
NTLM authentication: What it is and why it's risky
The NTLM authentication protocol, especially v1, poses a serious security threat to any IT environment where it remains enabled. I don't ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found