Thursday, 5 April 2007

Error: SMB signing is mandatory and we have disabled

when attempting to mount a windows machine from a linux machine using following command:
mount -t smbfs //machine/share /root/smb_mnt -o username=administrator,password=mypass

Following error occurs:
cli_negprot: SMB signing is mandatory and we have disabled it.26595: protocol negotiation failed SMB connection failed

Even after editing the "smb.conf" file and setting the option 'client signing = yes' does not resolve issue.

Cause:
Server Message Block (SMB) signing is a security mechanism in the SMB protocol and is also known as security signatures. SMB signing is designed to help improve the security of the SMB protocol. if SMB is disabled on Linux then, make sure its also disabled on Windows machine (Workstation/Server).

For Windows Server :This is due to a security policy in Windows 2003 Server that forces the connections to be encrypted.

Resolution for Windows Workstation:
Go to following registry key on the Windows machine and set it to "0" disable.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\LanManWorkstation\ParametersValue Name:

EnableSecuritySignature Data Type: REG_DWORD Data: 0 (disable)

Resolution for Windows Server :
If it's a windows 2003 Server then :
Go to Administrative Tools -> Domain Controller Security Policy. Then select Local Policies -> Security Options and find and disable both these policies:
1. Microsoft network server: Digitally sign communications (always)
2. Microsoft network server: Digitally sign communications (if client agrees)
After the changes, just run the command 'gpupdate' to refresh the policy changes you made.

More information read the following MS article
http://support.microsoft.com/kb/887429

Disclaimer: Please peform the steps at your own risk.

No comments:

Post a Comment