Re: [PATCH 0/2] ksmbd: NTLM pass-through to a domain controller

[ronnie sahlberg]

On Mon, 19 Oct 2026 at 03:53, Jan Koester <jan.koester@xxxxxxx> wrote:
>
> Hi,
>
> a ksmbd server joined to an Active Directory domain can authenticate
> domain users with Kerberos, but not with NTLM: it has no password hash
> for them, so the NTLMv2 response can't be checked locally. Clients that
> fall back to NTLM (access by IP address, machines outside the domain,
> mount.cifs with user name and password) are refused.
>
> Samba solves this by forwarding the response to a domain controller
> over NETLOGON (NetrLogonSamLogonEx on a schannel connection). These two
> patches give ksmbd the kernel half of that, and leave the NETLOGON client
> to user space, like the rest of ksmbd's user handling:
>
> 1/2 adds a KSMBD_USER_FLAG_PASSTHROUGH login flag. For such a user,
>     ksmbd_decode_ntlmssp_auth_blob() doesn't compute the response from a
>     local hash. It sends the server challenge, the user, domain and
>     workstation names and the NT/LM responses to user space in a new
>     KSMBD_EVENT_NTLM_AUTHEN_REQUEST event, then takes the session base
>     key from KSMBD_EVENT_NTLM_AUTHEN_RESPONSE and goes on with the
>     existing key exchange. Both events have a strict netlink policy and
>     are checked in ipc_validate_msg().
>
> 2/2 puts the workgroup, not the netbios name, into MsvAvNbDomainName and
>     MsvAvDnsDomainName of the challenge's target info. A domain
>     controller checks these when it verifies the NTLMv2 response (Samba
>     in NTLMv2_RESPONSE_verify_workstation()), so without this patch
>     every pass-through login fails with NT_STATUS_LOGON_FAILURE. The
>     patch also checks that the challenge blob fits the response buffer,
>     since the workgroup can be longer than the netbios name.
>
> Logins of users without the new flag are checked as before. The only
> change they see is the domain names in the challenge's target info
> (patch 2/2). ksmbd-tools doesn't set the flag yet. The user space side
> we tested with is sharedd/adconnect from FenrirOS: it marks domain users
> without a local hash as pass-through, and it answers the event through
> a NETLOGON schannel client, tested against a Samba 4.22 AD DC.
>
> I can send the matching ksmbd-tools change if the interface looks
> acceptable.

Please see https://github.com/cifsd-team/ksmbd-tools/pull/346
If added it will give you much improved DCE/RPC support instead of the
hand-marshalled
stuff and make it much easier to add additional DCE/RPC functions
you might need for this in ksmbd-tools.

>
> The series is based on v7.3-rc7.
>
> Jan Koester (2):
>   ksmbd: pass through NTLM authentication to a domain controller
>   ksmbd: put the workgroup into the NTLMSSP target info's domain names
>
>  fs/smb/server/auth.c          | 109 +++++++++++++++++++++++++++++++---
>  fs/smb/server/ksmbd_netlink.h |  41 +++++++++++++
>  fs/smb/server/smb2pdu.c       |  21 ++++++-
>  fs/smb/server/transport_ipc.c |  73 ++++++++++++++++++++++-
>  fs/smb/server/transport_ipc.h |   3 +
>  5 files changed, 236 insertions(+), 11 deletions(-)
>
>
> base-commit: 32c52ec87d6245ee2d12ed5dd509e40062939b50
> --
> 2.56.0
>
>