FS#62521 - [samba] Network printer does not authenticates
Attached to Project:
Arch Linux
Opened by dmiranda (dmiranda) - Wednesday, 01 May 2019, 19:24 GMT
Last edited by Tobias Powalowski (tpowa) - Monday, 28 March 2022, 07:32 GMT
Opened by dmiranda (dmiranda) - Wednesday, 01 May 2019, 19:24 GMT
Last edited by Tobias Powalowski (tpowa) - Monday, 28 March 2022, 07:32 GMT
|
Details
I upgraded the cups package to the last version. Printing
looks good in the first seconds and it seems as if the dox
are sent over the network. Then a dialog window pops up
reading "Authentication required for printing document
"..."." The dialog contains a field "negotiate" and a
checkbox "Remember password". It doesn't matter what I enter
into the "negotiate" text box, none seems right, neither the
local user's or root's passwd, nor the passwd of the account
creds' passwd I'm supplied with. The only option that makes
the dialog vanish is Cancel. A look into the printer queue
then shows an entry reading "Tree connect failed
(NT_STATUS_ACCESS_DENIED)".
A look into /etc/cups/printer.conf tells me that "AuthInfoRequired none" has changed to "AuthInfoRequired negotiate". When I stop cups and the change that entry back to "none", start cups, the same happens again: The dialog pops up and the entry in /etc/cups/printers.conf has been overwritten and reads "AuthInfoRequired negotiate" again. Steps to reproduce: -Add samba printer that requires authentication. -Print a document Upstream bug report: https://github.com/apple/cups/issues/5573 |
This task depends upon
Seens that it's necessary to build Samba with MIT Kerberos Support
From the release notes for the 4.10 release at https://www.samba.org/samba/history/samba-4.10.0.html, there is an interesting snippet included.
talloc with extra-x86_64-build
tdb with extra-x86_64-build
tevent with extra-x86_64-build -- -I ../talloc/talloc-2.1.16-1-x86_64.pkg.tar.xz
ldb with extra-x86_64-build -- -I ../tdb/tdb-1.3.18-2-x86_64.pkg.tar.xz -I ../talloc/talloc-2.1.16-1-x86_64.pkg.tar.xz -I ../tevent/tevent-1\:0.9.39-2-x86_64.pkg.tar.xz
samba-git with extra-x86_64-build -- -I ../tdb/tdb-1.3.18-2-x86_64.pkg.tar.xz -I ../talloc/talloc-2.1.16-1-x86_64.pkg.tar.xz -I ../tevent/tevent-1\:0.9.39-2-x86_64.pkg.tar.xz -I ../ldb/ldb-1\:1.4.6-1-x86_64.pkg.tar.xz
This is the last commit that can be built with ldb 1.4.6 before switching to ldb 1.5.4
Pls. fix this problem (The solution is very simple).
./configure --enable-fhs \
--prefix=/usr \
--sysconfdir=/etc \
--sbindir=/usr/bin \
--libdir=/usr/lib \
--libexecdir=/usr/lib/samba \
--localstatedir=/var \
--with-configdir=/etc/samba \
--with-lockdir=/var/cache/samba \
--with-sockets-dir=/run/samba \
--with-piddir=/run \
--with-ads \
--with-ldap \
--with-winbind \
--with-acl-support \
--with-systemd \
--systemd-install-services \
--enable-gnutls \
--with-pam \
--with-pammodulesdir=/usr/lib/security \
--bundled-libraries=!tdb,!talloc,!pytalloc-util,!tevent,!popt,!ldb,!pyldb-util \
--with-shared-modules=${_samba4_idmap_modules},${_samba4_pdb_modules},${_samba4_auth_modules} \
--disable-rpath-install \
--with-system-mitkrb5 --with-experimental-mit-ad-dc
So the next binary build automaticly has it active, right?
Just compiled latest samba without "--with-system-mitkrb5 --with-experimental-mit-ad-dc" . Could print from an arch client after authentication with a valid samba user. Didn't have AuthInfoRequired set in /etc/cups/printers.conf.
pacman -Q talloc tdb tevent ldb samba libwbclient smbclient
talloc 2.3.1-1
tdb 1.4.3-1
tevent 1:0.10.2-1
ldb 1:2.0.8-1
samba 4.11.6-1
libwbclient 4.11.6-1
smbclient 4.11.6-1
I add patches to compile. tdb can be installed from testing repo.
I wouldn't like to see experimental and insecure feature enabled:
https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC#Experimental_Feature
MIT Kerberos. Since the time of the release a number of issues, including security issues, have been found by real-world use.
updated all my Computers,
to what is in the normal repositories 4.10.10-2
yes now printing works again (by magic?),
so it seems the problem is solved somehow...
I try to boot Windows later and test if printing from Windows to Linux now also works again.
Just a comment to: "I wouldn't like to see experimental and insecure feature enabled:"
Yes, agree, but it was enabled before and The absolute top rule is: DO NOT break userspace. No discussion about it. People use this stuff to earn a living. Not working is not an option.
https://git.archlinux.org/svntogit/packages.git/commit/trunk?h=packages/samba&id=b5ffb98d77dad1dd2454d01a836096b803ef5e17
While I understand the need to strengthen security, in the context of a LAN-only setup (allow /24 except router), this breaks things that cannot be fixed. I agree that Kyocera (and others) is to blame, but that renders my MFP Scanner useless until FTP is set up. Not sure with BIG files via E-Mail, apart from that it's just the wrong service for file handling.
Unfortunately, neither "server min protocol = CORE" nor "client min protocol = CORE" do fix that for me – any idea why?
I also get "NT_STATUS_INVALID_PARAMETER_MIX" when trying to force max protocol on smbclient ("-m NT1" or "-m CORE", to debug and find a suitable parameter combination – any idea why?
Anyway, I now switched to Scan2Mail and uninstalled Samba completely so I can no longer test.