Home / server / Questions / 643127
Accepted
jdw
Asked: 2014-11-10 12:43:42 +0800 CST

How are SMB credentials negotiated?

  • 772

I have a local USB drive mounted into a Linux box on my home network. I have samba installed and it shares a directory of that USB drive and I can connect to that share from my Windows box with the user/pass I have set up with smbpasswd for that user. That all works.

My concern is how those credentials are passed on the wire from my Windows box to my Linux box. I have captured the SMB transactions with Wireshark and I do not detect my credentials in any of the packets, but I do not have enough knowledge of the SMB protocol to dissect exactly where the authentication takes place.

Can someone explain to me how the credentials are passed in this scenario and whether I should expect to see them on the wire?

Thanks

samba

1 Answers

  1. Best Answer

    The basis is the CIFS/SMB protocol

    Unless you're using Kerberos, the mechanism may still be NTLM:

    1. A user accesses a client computer and provides a domain name, user name, and password. The client computes a cryptographic hash of the password and discards the actual password.
    2. The client sends the user name to the server (in plaintext).
    3. The server generates a 16-byte random number, called a challenge or nonce, and sends it to the client.
    4. The client encrypts this challenge with the hash of the user's password and returns the result to the server. This is called the response.

    etc.

    • 2