NTLMSSP, SPN and AIX CIFS

NTLMSSP, SPN and AIX CIFS

Today I had busy time trying to figure out why SMB/CIFS Windows Server 2008 share cannot be mounted in AIX.

AIX # mount -v cifs -n WindowsMachine.re.somewh.ere/sysaccount5/PassWd -o wrkgrp=SOMEGROUP,uid=11345,gid=22345,fmode=750 /projectA$  /tmp/123
There was an error connecting the share or the server.
Make sure the lsdev command shows that device nsmb0 is in
the Available state.  Also make sure that the share name,
user name and password are accurate.

Root cause of the problem

NTLMv2 negotiates using the SPN (when the system is joined to AD)

UNIX system joined with incorrect SPN to the AD. (SPN doesn’t match UNIX FQDN)

Symptom

In this case CIFS share can’t be mounted in AIX. (seems like that AIX CIFS package doesn’t support NTLMSSP yet.)

In Linux it can be mounted only with the “sec=ntlmssp” flag:

Linux # mount.cifs //WindowsMachine.re.somewh.ere/projectA$ /tmp/123 -o username=sysaccount5,password=PassWd,domain=SOMEGROUP,sec=ntlmssp
OK

Solution

To fix the situation set the following on Windows Server:

1. Local Security Policy
Security Settings -> Local Policies -> Security Options
Microsoft network server: Server SPN target name validation level: Off

2. Local Security Policy
Security Settings -> Local Policies -> Security Options
Network security: LAN Manager authentication level: Send LM & NTLM responses

For the point 2., I presume that this can be anything eventually, unless that AIX CIFS package indeed doesn’t support NTLMSSP.

If someone can confirm, feel free to comment.

OR rather join UNIX system with correct SPN. Unless it would be a long story for you :-)

4 (1)
Article Rating (1 Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
LVM: Unmirror/Mirror "rootvg" Volume Group
Viewed 3742 times since Mon, May 21, 2018
Topics: PowerHA / HACMP, Storage Adding a new volume group to an active PowerHA resource group
Viewed 2829 times since Mon, Jun 3, 2019
AIX, Networking↑ Adding and deleting a static network route using the command line
Viewed 2914 times since Fri, Apr 19, 2019
AIX Not all filesets for 6100-07_AIX_ML were found
Viewed 3230 times since Tue, Jul 17, 2018
Awesome Command to show top 15 processes using memory on AIX
Viewed 24135 times since Thu, Nov 29, 2018
Tunneling With SSH to Your Destination
Viewed 4586 times since Wed, May 30, 2018
Epoch & Unix Timestamp Conversion Tools
Viewed 63260 times since Fri, Jun 22, 2018
Altering LVM Configuration When a Disk is Not in ODM Anymore
Viewed 3359 times since Mon, Jun 3, 2019
SSH-COPY-ID on AIX. SSH remote AIX’s box without password
Viewed 17630 times since Thu, Feb 21, 2019
Checking HBA status on AIX
Viewed 18707 times since Fri, Oct 5, 2018