linux-kernel - Re: Possible regression: unable to mount CIFS 1.0 shares from older machines since 76a3c92ec9e0668e4cd0e9ff1782eb68f61a179c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 4 Mar 2022 07:43:27 +0100
From:   Thorsten Leemhuis <regressions@...mhuis.info>
To:     Steve French <smfrench@...il.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Davyd McColl <davydm@...il.com>,
        ronnie sahlberg <ronniesahlberg@...il.com>,
        CIFS <linux-cifs@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        "regressions@...ts.linux.dev" <regressions@...ts.linux.dev>
Subject: Re: Possible regression: unable to mount CIFS 1.0 shares from older
 machines since 76a3c92ec9e0668e4cd0e9ff1782eb68f61a179c

On 03.03.22 02:27, Steve French wrote:
> We have been looking to see if we could setup some VMs for something
> that old, and we are willing to test against it if it could
> realistically be setup, but it has been harder than expected.  Ronnie
> had some ideas and we are willing to experiment more but realistically
> it is very hard to deal with 'legacy museum style' unless we have some
> VMs available for old systems.
> 
> Feel free to contact Ronnie and me or Shyam etc (offline if easier) if
> you have ideas on how to setup something like this.   We don't want to
> be encouraging SMB1, but certainly not NTLMv1 auth with SMB1 given its
> security weaknesses (especially given the particular uses hackers have
> made of 25+ year old NTLMv1 weaknesses).

Linus, Steve, thx for your option on this. I not sure if "museum style
equipment" really applies here, as the hardware seems to be sold in
2013/2014 and according to the reporter even got a update in 2016. But
whatever, yes, it's niche thing and what the hw manufacturer did there
was a bad idea.

Anyway, I'll stop tracking this then.

#regzbot invalid: to niche/risky/old, see Linus and Steve's messages for
details

> On Wed, Mar 2, 2022 at 6:51 PM Linus Torvalds
> <torvalds@...ux-foundation.org> wrote:
>>
>> On Tue, Mar 1, 2022 at 10:58 PM Thorsten Leemhuis
>> <regressions@...mhuis.info> wrote:
>>>
>>> Thx for the update. I pointed Linus towards this thread two times now,
>>> but he didn't comment on it afaics. CCing him now, maybe that will to
>>> the trick.
>>
>> So I have to admit that I think it's a 20+ year old legacy and
>> insecure protocol that nobody should be using.
>>
>> When the maintainer can't really even test it, and it really has been
>> deprecated that long, I get the feeling that somebody who wants it to
>> be maintained will need to do that job himself.
>>
>> This seems to be a _very_ niche thing, possibly legacy museum style
>> equipment, and maybe using an older kernel ends up being the answer if
>> nobody steps up and maintains it as an external patch.
>>
>>              Linus
> 
> 
>