linux-kernel - Re: [2.6 patch] remove smbfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 31 Jan 2008 09:26:40 +0100
From:	Radoslaw Szkodzinski (AstralStorm) <lkml@...ralstorm.puszkin.org>
To:	"Steve French" <smfrench@...il.com>
Cc:	"Jeff Layton" <jlayton@...hat.com>,
	"Adrian Bunk" <bunk@...nel.org>,
	"Guenter Kukkukk" <linux@...kukk.com>,
	samba-technical@...ts.samba.org, linux-kernel@...r.kernel.org,
	sfrench@...ba.org
Subject: Re: [2.6 patch] remove smbfs

On Wed, 30 Jan 2008 19:30:55 -0600
"Steve French" <smfrench@...il.com> wrote:

> On Jan 30, 2008 7:13 PM, Jeff Layton <jlayton@...hat.com> wrote:
> > On Thu, 31 Jan 2008 02:47:17 +0200
> > > > > > > In addition, cifs cannot completely replace smbfs atm.
> > > > > > > Even todays sold NAS-boxes (often running anchient
> > > > > > > samba-2.x.x) work only with smbfs on the client side.
> I am not convinced that this (mounting to older servers) would be a
> problem with the proper mount options but it is more intuitive for
> smbfs for some of the lanman servers.   I do want to make sure that we
> don't make it too easy to mount with insecure lanman (ie due to
> downgrade attacks) without the user at least doing that (specify weak
> lanman security explicitly).  Today the user has to explicitly specify
> sec=lanman which is confusing but at least makes explicit the weaker
> security.
> 
> There are four common issues with mounting to these very old servers:
> 1) remembering to mount specifying lanman security (sec=lanman)

I think it'd be nice to add an alias called oldsmb or similar for that
option in mount.cifs. It should only be needed for old win9x servers.

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)