1

tl;dr smbclient -I 1.2.3.4 '\\hostname-abc\share1' prints Cannot do GSE to an IP address with final status NT_STATUS_LOGON_FAILURE. What is GSE?


Running the following smbclient command

smbclient -I 1.2.3.4 '\\host-unix1\share1' --command=ls -A /tmp/auth

where file /tmp/auth is

username = user1
password = passw0rd!
domain   = DOMAIN1

The SMB server host-unix1 at IP address 1.2.3.4 is a Unix server. Additional authentication is provided by a separate Active Directory Domain Controller, Windows Server 2012, for domain DOMAIN1.

Passing --debuglevel=99 to smbclient results in additional log messages

...
negotiated dialect[SMB3_11] against server[1.2.3.4]
...
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gse_krb5
Cannot do GSE to an IP address
Failed to start GENSEC client mech gse_krb5: NT_STATUS_INVALID_PARAMETER
Starting GENSEC submechanism ntlmssp
...
Got NTLMSSP neg_flags=0x60890215
  NTLMSSP_NEGOTIATE_UNICODE
  NTLMSSP_REQUEST_TARGET
  NTLMSSP_NEGOTIATE_SIGN
  NTLMSSP_NEGOTIATE_NTLM
  NTLMSSP_TARGET_TYPE_DOMAIN
  NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
  NTLMSSP_NEGOTIATE_TARGET_INFO
  NTLMSSP_NEGOTIATE_128
  NTLMSSP_NEGOTIATE_KEY_EXCH
NTLMSSP: Set final flags:
Got NTLMSSP neg_flags=0x62080215
  NTLMSSP_NEGOTIATE_UNICODE
  NTLMSSP_REQUEST_TARGET
  NTLMSSP_NEGOTIATE_SIGN
  NTLMSSP_NEGOTIATE_NTLM
  NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
  NTLMSSP_NEGOTIATE_VERSION
  NTLMSSP_NEGOTIATE_128
  NTLMSSP_NEGOTIATE_KEY_EXCH
NTLMSSP Sign/Seal - Initialising with flags:
Got NTLMSSP neg_flags=0x62080215
  NTLMSSP_NEGOTIATE_UNICODE
  NTLMSSP_REQUEST_TARGET
  NTLMSSP_NEGOTIATE_SIGN
  NTLMSSP_NEGOTIATE_NTLM
  NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY
  NTLMSSP_NEGOTIATE_VERSION
  NTLMSSP_NEGOTIATE_128
  NTLMSSP_NEGOTIATE_KEY_EXCH
SPNEGO login failed: The attempted logon is invalid. This is either due to a bad username or authentication information.
  • using smbclient 4.7.6 with Likewise commercial SMB server
JamesThomasMoon
  • 6,169
  • 7
  • 37
  • 63
  • 1
    As a side note: `--debuglevel=99` is invalid, per `man smbclient` the value that the options accepts is in range [0..10]. Although, apparently smbclient just implicitly interpreted it as `10`. Regarding the topic: by any occasion, do you happen to have a line `auth methods =` in your `smb.conf` file? In my case I have a `auth methods = winbind`, and if I remove the line, the SPNEGO error goes away and smbclient works *(tho in my case I probably might need a workaround that would keep this deprecated option in place, but I figured it might work for you)*. – Hi-Angel Apr 20 '21 at 09:52

0 Answers0