Re: [PATCH 0/2] ksmbd: NTLM pass-through to a domain controller

[Namjae Jeon]

On Mon, Oct 19, 2026 at 2:53 AM Jan Koester <jan.koester@xxxxxxx> wrote:
>
> Hi,
>
> a ksmbd server joined to an Active Directory domain can authenticate
> domain users with Kerberos, but not with NTLM: it has no password hash
> for them, so the NTLMv2 response can't be checked locally. Clients that
> fall back to NTLM (access by IP address, machines outside the domain,
> mount.cifs with user name and password) are refused.
>
> Samba solves this by forwarding the response to a domain controller
> over NETLOGON (NetrLogonSamLogonEx on a schannel connection). These two
> patches give ksmbd the kernel half of that, and leave the NETLOGON client
> to user space, like the rest of ksmbd's user handling:
>
> 1/2 adds a KSMBD_USER_FLAG_PASSTHROUGH login flag. For such a user,
>     ksmbd_decode_ntlmssp_auth_blob() doesn't compute the response from a
>     local hash. It sends the server challenge, the user, domain and
>     workstation names and the NT/LM responses to user space in a new
>     KSMBD_EVENT_NTLM_AUTHEN_REQUEST event, then takes the session base
>     key from KSMBD_EVENT_NTLM_AUTHEN_RESPONSE and goes on with the
>     existing key exchange. Both events have a strict netlink policy and
>     are checked in ipc_validate_msg().
>
> 2/2 puts the workgroup, not the netbios name, into MsvAvNbDomainName and
>     MsvAvDnsDomainName of the challenge's target info. A domain
>     controller checks these when it verifies the NTLMv2 response (Samba
>     in NTLMv2_RESPONSE_verify_workstation()), so without this patch
>     every pass-through login fails with NT_STATUS_LOGON_FAILURE. The
>     patch also checks that the challenge blob fits the response buffer,
>     since the workgroup can be longer than the netbios name.
>
> Logins of users without the new flag are checked as before. The only
> change they see is the domain names in the challenge's target info
> (patch 2/2). ksmbd-tools doesn't set the flag yet. The user space side
> we tested with is sharedd/adconnect from FenrirOS: it marks domain users
> without a local hash as pass-through, and it answers the event through
> a NETLOGON schannel client, tested against a Samba 4.22 AD DC.
>
> I can send the matching ksmbd-tools change if the interface looks
> acceptable.
Okay, Please send a PR to ksmbd-tools. Wang is also currently
implementing AD/DC features in ksmbd and might be interested, so I'm
adding him to CC.
Thanks for the patches!