RE: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain controllers

From: Murad Talukdar (talukdar_m_at_subway.com)
Date: 05/06/05

  • Next message: Wes Johns: "RE: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain controllers" 
    Date: Fri, 06 May 2005 09:06:13 +1000
To: "'Soluk, Kirk'" <kmsoluk@umich.edu>

    Thanks Kirk
    That was my worry here. Will have to rethink this.
    As an answer to someone who asked about connecting directly over tcp/ip, the
    printing functions are fine, it's the scanning side of things that can use
    either SMB or ftp. We don't have capacity for ftp (yet!) but look to be
    heading that way.
    Thanks also to Bob for the excellent article.
    As we grow, the potential for there being more savvy users who go unnoticed
    is greater and therefore more worrisome when it comes to things like this.

    Murad

    -----Original Message-----
    From: Soluk, Kirk [mailto:kmsoluk@umich.edu]
    Sent: Friday, May 06, 2005 1:20 AM
    To: Murad Talukdar; ?????? ??????
    Cc: focus-ms@securityfocus.com
    Subject: RE: To disable SMB packet and secure channel signing enforcement on
    Windows Server 2003-based domain controllers

    It's a negotiation. If the two ends (running NT4 SP3 or higher) have
    signing "enabled", they'll negotiate it.
    The problem is that any MITM can simply do a downgrade attack and say
    "don't negotiate". So "enabling" signing (but not requiring it) doesn't
    help you wrt a malicious MITM.

    -----Original Message-----
    From: Murad Talukdar [mailto:talukdar_m@subway.com]
    Sent: Wednesday, May 04, 2005 11:26 PM
    To: '?????? ??????'
    Cc: focus-ms@securityfocus.com
    Subject: RE: To disable SMB packet and secure channel signing
    enforcement on Windows Server 2003-based domain controllers

    Excellent. This is now working according to Laura's/????? ?????
    settings.
    Thanks to everyone. I've learnt a lot from this single issue.
    One last question, with the whenever possible option. According to ?????
    ?????, the DCs will now communicate insecurely with my printer, but does
    this mean it would communicate insecurely with some 'unknown' machine
    too.
    What I'm trying to work out, I guess, is how does it 'decide' when it
    should communicate insecurely--what test does it carry out? Is it
    treating the scanner as a member server or a client?
    As the whole worry here is MITM's --are there ones which could be
    utilized now that I have set the network server to digitally sign always
    but the clients and the members to do it whenever possible?
    I'm thinking the risk is greatly reduced but is it removed 'completely'?

    Murad
    -----Original Message-----
    From: ?????? ?????? [mailto:morsin@eastbridge.tula.ru]
    Sent: Wednesday, May 04, 2005 10:52 PM
    To: Murad Talukdar
    Subject: Re: To disable SMB packet and secure channel signing
    enforcement on Windows Server 2003-based domain controllers

    ----- Original Message -----
    > 1. From Administrative Tools open Domain Controller Security Policy 2.

    > Smile
    > 3. Select \Security Settings\Local Policies\Security Options folder.
    4. In
    > the details pane, double-click Microsoft network server: Digitally
    sign
    > communications (always), and then click Disabled to prevent SMB packet
    > signing from being required. 5. Click OK. 6. In the details pane,
    > double-click Domain member: Digitally encrypt or sign secure channel
    data
    > (always), and then click Disabled to prevent secure channel signing
    from
    > being required. 7. Click OK.

    1. Return back to "Enabled" secure channel ecnryption requirement. SMB
    file
    sharing has nothing to do woth it. Secure Channel is used by domain
    member
    computers to pass user authentication information to DCs.
    2. There are companion settings "Digitally sign communications (always)"
    and

    "Digitally sign communications (when possible)" for both servers and
    workstations. Set first to "Disabled" and second to "Enabled" and your
    DCs
    will communicate securely with users and insecurely with your printer.

    ------------------------------------------------------------------------ 

    ---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Wes Johns: "RE: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain controllers"

    Relevant Pages