Re: [PATCH 0/2] ksmbd: NTLM pass-through to a domain controller

[Namjae Jeon]

On Mon, Oct 19, 2026 at 7:43 PM Stefan Metzmacher <metze@xxxxxxxxx> wrote:
>
> Hi Jan,
>
> >> a ksmbd server joined to an Active Directory domain can authenticate
> >> domain users with Kerberos, but not with NTLM: it has no password hash
> >> for them, so the NTLMv2 response can't be checked locally. Clients that
> >> fall back to NTLM (access by IP address, machines outside the domain,
> >> mount.cifs with user name and password) are refused.
> >>
> >> Samba solves this by forwarding the response to a domain controller
> >> over NETLOGON (NetrLogonSamLogonEx on a schannel connection). These two
> >> patches give ksmbd the kernel half of that, and leave the NETLOGON client
> >> to user space, like the rest of ksmbd's user handling:
> >>
> >> 1/2 adds a KSMBD_USER_FLAG_PASSTHROUGH login flag. For such a user,
> >>      ksmbd_decode_ntlmssp_auth_blob() doesn't compute the response from a
> >>      local hash. It sends the server challenge, the user, domain and
> >>      workstation names and the NT/LM responses to user space in a new
> >>      KSMBD_EVENT_NTLM_AUTHEN_REQUEST event, then takes the session base
> >>      key from KSMBD_EVENT_NTLM_AUTHEN_RESPONSE and goes on with the
> >>      existing key exchange. Both events have a strict netlink policy and
> >>      are checked in ipc_validate_msg().
> >>
> >> 2/2 puts the workgroup, not the netbios name, into MsvAvNbDomainName and
> >>      MsvAvDnsDomainName of the challenge's target info. A domain
> >>      controller checks these when it verifies the NTLMv2 response (Samba
> >>      in NTLMv2_RESPONSE_verify_workstation()), so without this patch
> >>      every pass-through login fails with NT_STATUS_LOGON_FAILURE. The
> >>      patch also checks that the challenge blob fits the response buffer,
> >>      since the workgroup can be longer than the netbios name.
> >>
> >> Logins of users without the new flag are checked as before. The only
> >> change they see is the domain names in the challenge's target info
> >> (patch 2/2). ksmbd-tools doesn't set the flag yet. The user space side
> >> we tested with is sharedd/adconnect from FenrirOS: it marks domain users
> >> without a local hash as pass-through, and it answers the event through
> >> a NETLOGON schannel client, tested against a Samba 4.22 AD DC.
> >>
> >> I can send the matching ksmbd-tools change if the interface looks
> >> acceptable.
> > Okay, Please send a PR to ksmbd-tools. Wang is also currently
> > implementing AD/DC features in ksmbd and might be interested, so I'm
> > adding him to CC.
>
> why making this NTLM specific, I think it would be good to the whole session setup
> blob exchange to userspace, so that authentication is not used in kernel at all?
> And it will also help when IAKERB and other things will be implemented later.
> It would also be good to have the infrastructure working with winbindd being
> the bridge to the domain.
I prefer keeping the current patch's approach for now. I'd like to
stick to minimal changes rather than making a drastic refactoring. As
for IAKERB, we can revisit and discuss any necessary structural
changes when we actually reach the point of implementing it.

>
> What exactly is "sharedd/adconnect from FenrirOS"?
>
> And Wang, what are the AD/DC features?
Active Directory Domain Controller Support.
>
> metze
> > Thanks for the patches!
>