In agreement with Susan here--how long does it take to get with the program?
I spoke to someone who used to work for Ricoh and he said as far as he was
aware there is no way to get them to sign. And that the line about hoping to
have one(in the uhh, near future) was one of those projects that you
shouldn't hold your breath for. Unless you look good when you're blue....ahh
I love salespeak...like doubletalk only moreso...
ftp, here we come.
Murad
-----Original Message-----
From: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]
[mailto:sbradcpa@pacbell.net]
Sent: Wednesday, May 11, 2005 3:01 AM
To: kenneth@subway.com
Cc: Free, Bob; focus-ms@securityfocus.com; Murad Talukdar
Subject: Re: To disable SMB packet and secure channel signing enforcement on
Windows Server 2003-based domain controllers
Printer/Scanner/Copier shopping during the last week......
Ricoh copier/printer/scanner .... to be leased in the near future and
thus a brand new machine and getting the technical details.....the guy
tells me the following....
"You cannot do smb to a Windows 2003 server, we have issues with
that..you can however, smb scan to a XP machine"
"This is a 2004 model and we didn't anticpate the Server 2003 security
requirements" [that was my personal favorite]
"We'll have a version of the Ricoh that handles SMB on the Windows 2003
server in about a month"
Konica does only does FTP and does not do SMB....
You were saying about 'go to those vendors and demand'? They don't even
have the equipment that supports it.
Susan
Wes Johns wrote:
The client states how it can connect and then the least common
denominator is used. By turning smb signing off you are also open to
session hijacking. So one could steal your session to a file server and
access files using your account.
Thank You
Wesley Johns MCSE:Security, CEH, CISSP, ISSAP
Microsoft Consulting Services
Phone 214-458-5551
Email: Wesleyj@microsoft.com
IM: Wesley_johns@hotmail.com
-----Original Message-----
From: Free, Bob [mailto:RWF4@pge.com]
Sent: Thursday, May 05, 2005 10:51 AM
To: focus-ms@securityfocus.com
Cc: Murad Talukdar
Subject: RE: To disable SMB packet and secure channel signing
enforcement on Windows Server 2003-based domain controllers
how does it 'decide' when it should communicate insecurely
Murad-
In his own inimitable way Mark Minasi had a very nice little write-up on
this very subject in his mid-April newsletter(#46) he entitled "How SMB
Signing Works: An "Alcoholics Anonymous" Protocol"
You could sign up to see the archive at
http://www.minasi.com/archive.htm
I found it to be an intriguing presentation of the subject so I saved so
I saved that portion off as a separate doc. I'll send you a copy.
-----Original Message-----
From: Murad Talukdar [mailto:talukdar_m@subway.com]
Sent: Wednesday, May 04, 2005 8:26 PM
To: '?????? ??????'
Cc: focus-ms@securityfocus.com
Subject: RE: To disable SMB packet and secure channel signing
enforcement on Windows Server 2003-based domain controllers
Excellent. This is now working according to Laura's/????? ?????
settings.
Thanks to everyone. I've learnt a lot from this single issue.
One last question, with the whenever possible option. According to ?????
?????, the DCs will now communicate insecurely with my printer, but does
this mean it would communicate insecurely with some 'unknown' machine
too.
What I'm trying to work out, I guess, is how does it 'decide' when it
should
communicate insecurely--what test does it carry out? Is it treating the
scanner as a member server or a client?
As the whole worry here is MITM's --are there ones which could be
utilized
now that I have set the network server to digitally sign always but the
clients and the members to do it whenever possible?
I'm thinking the risk is greatly reduced but is it removed 'completely'?
Murad
-----Original Message-----
From: ?????? ?????? [mailto:morsin@eastbridge.tula.ru]
Sent: Wednesday, May 04, 2005 10:52 PM
To: Murad Talukdar
Subject: Re: To disable SMB packet and secure channel signing
enforcement on
Windows Server 2003-based domain controllers
----- Original Message -----
1. From Administrative Tools open Domain Controller Security Policy 2.
Smile
3. Select \Security Settings\Local Policies\Security Options folder.
4. In
the details pane, double-click Microsoft network server: Digitally
sign
communications (always), and then click Disabled to prevent SMB packet
signing from being required. 5. Click OK. 6. In the details pane,
double-click Domain member: Digitally encrypt or sign secure channel
data
(always), and then click Disabled to prevent secure channel signing
from
being required. 7. Click OK.
1. Return back to "Enabled" secure channel ecnryption requirement. SMB
file
sharing has nothing to do woth it. Secure Channel is used by domain
member
computers to pass user authentication information to DCs.
2. There are companion settings "Digitally sign communications (always)"
and
"Digitally sign communications (when possible)" for both servers and
workstations. Set first to "Disabled" and second to "Enabled" and your
DCs
will communicate securely with users and insecurely with your printer.
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
--
Dear Mr. Aitel:
http://msmvps.com/bradley/archive/2005/04/13/42009.aspx
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
