Allow SMB 1 with LANMAN authentication with Samba

Question

I need to connect a DOS machine to a Samba share. On Ubuntu 16.04 (Xenial), this is no problem, I just have to add lanman auth=yes to smb.conf and re-generate the password hashes with smbpasswd. It seems on Ubuntu 19.10 this is broken. Even after this procedure, pdbedit -L -w shows 32 times X where the LANMAN hash should be. If I copy the TDB-Database (in /var/lib/samba/private) from an Ubuntu Xenial machine, the newer Samba-Version even overwrites the correct LMHASH with 32*X. There is no error message and the option lanman auth=yes is still accepted by testparm, so this seems to be a bug. Is there a way to activate LM-Hashes on newer Ubuntu versions?

Answer 1

Finally solved it:

[global]
   server min protocol = NT1
   ntlm auth = yes
   lanman auth = yes

and setting a new password by

sudo smbpasswd username

solved it as suggested by Morbius1.

But I had two more things to consider:

1. Setting the same password as it was before wont reset the hash.

2. The passwords maximal length is 14 character. With longer passwords the hash will not be set.

The hash can be checked with

pdbedit -L -W

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX stands for not set.

Solution is also there Ubuntu 20.04 "NO LanMan password set for user"

Answer 2

In order for lanman auth = yes to work, you must also set ntlm auth = yes for newer versions of Samba. [Edit: Of course, regenerating the password with smbpasswd after setting this is also required as noted in your question.]

I had encountered the same issue on FreeBSD, and stumbled across this email list message in my search, and am now able to poke around in my ZFS network share with Microsoft Network Client 3.0 in MS-DOS 6.22:

Samba 4.7 changed 'lanman auth' to first honour 'ntlm auth', so you must set that as well.

I'll prepare a documentation update.

I've also confirmed that lanman passwords are still generated in our test environment.

Andrew Bartlett