| blob | c86137b15bcb304fbf307bb622fc5c58d24bb84b |
1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
5 <!-- entities files to use -->
6 <!ENTITY % global_entities SYSTEM '../entities/global.entities'>
7 %global_entities;
9 ]>
11 <chapter id="primer">
12 <title>Networking Primer</title>
14 <?latex \pagenumbering{arabic} ?>
16 <para>
17 You are about to use the equivalent of a microscope to look at the information
18 that runs through the veins of a Windows network. We do more to observe the information than
19 to interrogate it. When you are done with this chapter, you should have a good understanding
20 of the types of information that flow over the network. Do not worry, this is not
21 a biology lesson. We won't lose you in unnecessary detail. Think to yourself, <quote>This
22 is easy,</quote> then tackle each exercise without fear.
23 </para>
25 <para>
26 Samba can be configured with a minimum of complexity. Simplicity should be mastered
27 before you get too deeply into complexities. Let's get moving, we have work to do.
28 </para>
30 <sect1>
31 <title>Requirements and Notes</title>
32 <para>
33 Successful completion of this chapter requires two Microsoft Windows 9x/Me Workstations,
34 as well as two Microsoft Windows XP Professional Workstations, each equipped with an Ethernet
35 card connected using a hub. Also required is one additional server (either Windows
36 NT4 Server, Windows 2000 Server, or a Samba-3 on UNIX/Linux server) running a network
37 sniffer and analysis application (ethereal is a good choice). All work should be undertaken
38 on a quiet network where there is no other traffic. It is best to use a dedicated hub
39 with only the machines under test connected at the time of the exercises.
40 </para>
42 <para><indexterm>
43 <primary>Ethereal</primary>
44 </indexterm>
45 Ethereal has become the network protocol analyzer of choice for many network administrators.
46 You may find more information regarding this tool from the
47 <ulink url="http://www.ethereal.com">Ethereal</ulink> Web site. Ethereal installation
48 files for Windows may be obtained from the Ethereal Web site. Ethereal is provided with
49 SUSE and Red Hat Linux distributions, as well as many other Linux distributions. It may
50 not be installed on your system by default. If it is not installed, you may also need
51 to install the <command>libpcap </command> software before you can install or use Ethereal.
52 Please refer to the instructions for your operating system or to the Ethereal Web site
53 for information regarding the installation and operation of Ethereal.
54 </para>
56 <para>
57 To obtain <command>ethereal</command> for your system, please visit the Ethereal
58 <ulink url="http://www.ethereal.com/download.html#binaries">download site.</ulink>
59 </para>
61 <note><para>
62 The successful completion of this chapter requires that you capture network traffic
63 using <command>ethereal</command>. It is recommended that you use a hub, not an
64 etherswitch. It is necessary for the device used to act as a repeater, not as a
65 filter. Ethernet switches may filter out traffic that is not directed at the machine
66 that is used to monitor traffic; this would not allow you to complete the projects.
67 </para></note>
69 <para>
70 <indexterm><primary>network</primary><secondary>captures</secondary></indexterm>
71 Do not worry too much if you do not have access to all this equipment; network captures
72 from the exercises are provided on the enclosed CD-ROM. This makes it possible to dive directly
73 into the analytical part of the exercises if you so desire.
74 </para>
76 <para><indexterm>
77 <primary>network</primary>
78 <secondary>sniffer</secondary>
79 </indexterm><indexterm>
80 <primary>protocol analysis</primary>
81 </indexterm>
82 Please do not be alarmed at the use of a high-powered analysis tool (ethereal) in this
83 first chapter. We expose you only to a minimum of detail necessary to complete
84 the exercises in this chapter. If you choose to use any other network sniffer and protocol
85 analysis tool, be advised that it may not allow you to examine the contents of
86 recently added security protocols used by Windows 200x/XP.
87 </para>
89 <para>
90 You could just skim through the exercises and try to absorb the key points made.
91 The exercises provide all the information necessary to convince the die-hard network
92 engineer. You possibly do not require so much convincing and may just want to move on,
93 in which case you should at least read <link linkend="chap01conc"/>.
94 </para>
96 <para>
97 <link linkend="chap01qa"/> also provides useful information
98 that may help you to avoid significantly time-consuming networking problems.
99 </para>
100 </sect1>
102 <sect1>
103 <title>Introduction</title>
105 <para>
106 The purpose of this chapter is to create familiarity with key aspects of Microsoft Windows
107 network computing. If you want a solid technical grounding, do not gloss over these exercises.
108 The points covered are recurrent issues on the Samba mailing lists.
109 </para>
111 <para><indexterm>
112 <primary>network</primary>
113 <secondary>broadcast</secondary>
114 </indexterm>
115 You can see from these exercises that Windows networking involves quite a lot of network
116 broadcast traffic. You can look into the contents of some packets, but only to see
117 some particular information that the Windows client sends to a server in the course of
118 establishing a network connection.
119 </para>
121 <para>
122 To many people, browsing is everything that happens when one uses Microsoft Internet Explorer.
123 It is only when you start looking at network traffic and noting the protocols
124 and types of information that are used that you can begin to appreciate the complexities of
125 Windows networking and, more importantly, what needs to be configured so that it can work.
126 Detailed information regarding browsing is provided in the recommended
127 preparatory reading.
128 </para>
130 <para>
131 Recommended preparatory reading: <emphasis>The Official Samba-3 HOWTO and Reference Guide</emphasis> (TOSHARG)
132 Chapter 9, <quote>Network Browsing,</quote> and Chapter 3, <quote>Server Types and
133 Security Modes.</quote>
134 </para>
136 <sect2>
137 <title>Assignment Tasks</title>
139 <para><indexterm>
140 <primary>browsing</primary>
141 </indexterm>
142 You are about to witness how Microsoft Windows computer networking functions. The
143 exercises step through identification of how a client machine establishes a
144 connection to a remote Windows server. You observe how Windows machines find
145 each other (i.e., how browsing works), and how the two key types of user identification
146 (share mode security and user mode security) are affected.
147 </para>
149 <para><indexterm>
150 <primary>network</primary>
151 <secondary>analyzer</secondary>
152 </indexterm>
153 The networking protocols used by MS Windows networking when working with Samba
154 use TCP/IP as the transport protocol. The protocols that are specific to Windows
155 networking are encapsulated in TCP/IP. The network analyzer we use (ethereal)
156 is able to show you the contents of the TCP/IP packets (or messages).
157 </para>
159 <procedure id="chap01tasks">
160 <title>Chapter 1 &smbmdash; Tasks</title>
162 <step><para><indexterm>
163 <primary>network</primary>
164 <secondary>trace</secondary>
165 </indexterm><indexterm>
166 <primary>host announcement</primary>
167 </indexterm><indexterm>
168 <primary>name resolution</primary>
169 </indexterm>
170 Examine network traces to witness SMB broadcasts, host announcements,
171 and name resolution processes.
172 </para></step>
174 <step><para>
175 Examine network traces to witness how share mode security functions.
176 </para></step>
178 <step><para>
179 Examine network traces to witness the use of user mode security.
180 </para></step>
182 <step><para>
183 Review traces of network logons for a Windows 9x/Me client as well as
184 a Domain logon for a Windows XP Professional client.
185 </para></step>
186 </procedure>
188 </sect2>
189 </sect1>
191 <sect1>
192 <title>Exercises</title>
194 <para>
195 <indexterm><primary>ethereal</primary></indexterm>
196 You are embarking on a course of discovery. The first part of the exercise requires
197 two MS Windows 9x/Me systems. We called one machine <constant>WINEPRESSME</constant> and the
198 other <constant>MILGATE98</constant>. Each needs an IP address; we used <literal>10.1.1.10</literal>
199 and <literal>10.1.1.11</literal>. The test machines need to be networked via a <emphasis>hub</emphasis>. A UNIX/Linux
200 machine is required to run <command>ethereal</command> to enable the network activity to be captured.
201 It is important that the machine from which network activity is captured must not interfere with
202 the operation of the Windows workstations. It is helpful for this machine to be passive (does not
203 send broadcast information) to the network.
204 </para>
206 <para>
207 For these exercises, our test environment consisted of a SUSE 8.2 Professional Linux Workstation running
208 VMWare 3.2. The following VMWare images were prepared:
209 </para>
211 <itemizedlist>
212 <listitem><para>Windows 98 &smbmdash; name: MILGATE98.</para></listitem>
213 <listitem><para>Windows Me &smbmdash; name: WINEPRESSME.</para></listitem>
214 <listitem><para>Windows XP Professional &smbmdash; name: LightrayXP.</para></listitem>
215 <listitem><para>Samba-3.0.2 running on a SUSE Enterprise Linux 8.0 machine.</para></listitem>
216 </itemizedlist>
218 <para>
219 Choose a workgroup name (MIDEARTH) for each exercise.
220 </para>
222 <para>
223 <indexterm><primary>ethereal</primary></indexterm>
224 The network captures provided on the CD-ROM at the back of this book were captured using <constant>ethereal</constant>
225 version <literal>0.9.10</literal>. A later version suffices without problems, but an earlier version may not
226 expose all the information needed. Each capture file has been decoded and listed as a trace file. A summary of all
227 packets has also been included. This makes it possible for you to do all the studying you like without the need to
228 perform the time-consuming equipment configuration and test work. This is a good time to point out the value
229 that can be derived from this book really does warrant your taking sufficient time to practice each exercise with
230 care and attention to detail.
231 </para>
233 <sect2>
234 <title>Single Machine Broadcast Activity</title>
236 <para>
237 In this section, we start a single Windows 9x/Me machine, then monitor network activity for 30 minutes.
238 </para>
240 <procedure>
241 <step><para>
242 Start the machine from which network activity will be monitored (using <command>ethereal</command>).
243 Launch <command>ethereal</command>, click
244 <menuchoice>
245 <guimenu>Capture</guimenu>
246 <guimenuitem>Start</guimenuitem>
247 </menuchoice>.
248 </para>
250 <para>
251 Click the following:
252 <orderedlist>
253 <listitem>Update list of packets in real time</listitem>
254 <listitem>Automatic scrolling in live capture</listitem>
255 <listitem>Enable MAC name resolution </listitem>
256 <listitem>Enable network name resolution </listitem>
257 <listitem>Enable transport name resolution</listitem>
258 </orderedlist>
259 Click <guibutton>OK</guibutton>.
260 </para></step>
262 <step><para>
263 Start the Windows 9x/Me machine to be monitored. Let it run for a full 30 minutes. While monitoring,
264 do not press any keyboard keys, do not click any on-screen icons or menus; and do not answer any dialog boxes.
265 </para></step>
267 <step><para>
268 At the conclusion of 30 minutes, stop the capture. Save the capture to a file so you can go back to it later.
269 Leave this machine running in preparation for the task in <link linkend="secondmachine"/>.
270 </para></step>
272 <step><para>
273 Analyze the capture. Identify each discrete message type that was captured. Note what transport protocol
274 was used. Identify the timing between messages of identical types.
275 </para></step>
277 </procedure>
279 <sect3>
280 <title>Findings</title>
282 <para>
283 The summary of the first 10 minutes of the packet capture should look like <link linkend="pktcap01"/>.
284 A screenshot of a later stage of the same capture is shown in <link linkend="pktcap02"/>.
285 </para>
287 <image id="pktcap01">
288 <imagefile scale="53">WINREPRESSME-Capture</imagefile>
289 <imagedescription>Windows Me &smbmdash; Broadcasts &smbmdash; The First 10 Minutes</imagedescription>
290 </image>
292 <image id="pktcap02">
293 <imagedescription>Windows Me &smbmdash; Later Broadcast Sample</imagedescription>
294 <imagefile scale="57">WINREPRESSME-Capture2</imagefile>
295 </image>
297 <para><indexterm>
298 <primary>Local Master Browser</primary>
299 <see>LMB</see>
300 </indexterm><indexterm>
301 <primary>LMB</primary>
302 </indexterm>
303 Broadcast messages observed are shown in <link linkend="capsstats01"/>.
304 Actual observations vary a little, but not by much.
305 Early in the startup process, the Windows Me machine broadcasts its name for two reasons;
306 first to ensure that its name would not result in a name clash, and second to establish its
307 presence with the Local Master Browser (LMB).
308 </para>
310 <table id="capsstats01">
311 <title>Windows Me &smbmdash; Startup Broadcast Capture Statistics</title>
312 <tgroup cols="4">
313 <colspec align="left" colwidth="3*"/>
314 <colspec align="center"/>
315 <colspec align="center"/>
316 <colspec align="left" colwidth="3*"/>
317 <thead>
318 <row>
319 <entry>Message</entry>
320 <entry>Type</entry>
321 <entry>Num</entry>
322 <entry>Notes</entry>
323 </row>
324 </thead>
325 <tbody>
326 <row>
327 <entry>WINEPRESSME<00></entry>
328 <entry>Reg</entry>
329 <entry>8</entry>
330 <entry>4 lots of 2, 0.6 sec apart.</entry>
331 </row>
332 <row>
333 <entry>WINEPRESSME<03></entry>
334 <entry>Reg</entry>
335 <entry>8</entry>
336 <entry>4 lots of 2, 0.6 sec apart.</entry>
337 </row>
338 <row>
339 <entry>WINEPRESSME<20></entry>
340 <entry>Reg</entry>
341 <entry>8</entry>
342 <entry>4 lots of 2, 0.75 sec apart.</entry>
343 </row>
344 <row>
345 <entry>MIDEARTH<00></entry>
346 <entry>Reg</entry>
347 <entry>8</entry>
348 <entry>4 lots of 2, 0.75 sec apart.</entry>
349 </row>
350 <row>
351 <entry>MIDEARTH<1d></entry>
352 <entry>Reg</entry>
353 <entry>8</entry>
354 <entry>4 lots of 2, 0.75 sec apart.</entry>
355 </row>
356 <row>
357 <entry>MIDEARTH<1e></entry>
358 <entry>Reg</entry>
359 <entry>8</entry>
360 <entry>4 lots of 2, 0.75 sec apart.</entry>
361 </row>
362 <row>
363 <entry>MIDEARTH<1b></entry>
364 <entry>Qry</entry>
365 <entry>84</entry>
366 <entry>300 sec apart at stable operation.</entry>
367 </row>
368 <row>
369 <entry>__MSBROWSE__</entry>
370 <entry>Reg</entry>
371 <entry>8</entry>
372 <entry>Registered after winning election to Browse Master.</entry>
373 </row>
374 <row>
375 <entry>JHT<03></entry>
376 <entry>Reg</entry>
377 <entry>8</entry>
378 <entry>4 x 2. This is the name of the user that logged onto Windows.</entry>
379 </row>
380 <row>
381 <entry>Host Announcement WINEPRESSME</entry>
382 <entry>Ann</entry>
383 <entry>2</entry>
384 <entry>Observed at 10 sec.</entry>
385 </row>
386 <row>
387 <entry>Domain/Workgroup Announcement MIDEARTH</entry>
388 <entry>Ann</entry>
389 <entry>18</entry>
390 <entry>300 sec apart at stable operation.</entry>
391 </row>
392 <row>
393 <entry>Local Master Announcement WINEPRESSME</entry>
394 <entry>Ann</entry>
395 <entry>18</entry>
396 <entry>300 sec apart at stable operation.</entry>
397 </row>
398 <row>
399 <entry>Get Backup List Request</entry>
400 <entry>Qry</entry>
401 <entry>12</entry>
402 <entry>6 x 2 early in startup, 0.5 sec apart.</entry>
403 </row>
404 <row>
405 <entry>Browser Election Request</entry>
406 <entry>Ann</entry>
407 <entry>10</entry>
408 <entry>5 x 2 early in startup.</entry>
409 </row>
410 <row>
411 <entry>Request Announcement WINEPRESSME</entry>
412 <entry>Ann</entry>
413 <entry>4</entry>
414 <entry>Early in startup.</entry>
415 </row>
416 </tbody>
417 </tgroup>
418 </table>
420 <para><indexterm>
421 <primary>election</primary>
422 </indexterm><indexterm>
423 <primary>browse master</primary>
424 </indexterm>
425 From the packet trace, it should be noted that no messages were propagated over TCP/IP;
426 all employed UDP/IP. When steady state operation has been achieved, there is a cycle
427 of various announcements, re-election of a browse master, and name queries. These create
428 the symphony of announcements by which network browsing is made possible.
429 </para>
431 <para><indexterm>
432 <primary>CIFS</primary>
433 </indexterm>
434 For detailed information regarding the precise behavior of the CIFS/SMB protocols, the
435 reader is referred to the book <quote>Implementing CIFS: The Common Internet File System,</quote>
436 by Christopher Hertel, Publisher: Prentice Hall PTR, ISBN: 013047116X.
437 </para>
439 </sect3>
441 </sect2>
443 <sect2 id="secondmachine">
444 <title>Second Machine Startup Broadcast Interaction</title>
446 <para>
447 At this time, the machine you used to capture the single system startup trace should still be running.
448 The objective of this task is to identify the interaction of two machines in respect to broadcast activity.
449 </para>
451 <procedure>
452 <step><para>
453 On the machine from which network activity will be monitored (using <command>ethereal</command>),
454 launch <command>ethereal</command> and click
455 <menuchoice>
456 <guimenu>Capture</guimenu>
457 <guimenuitem>Start</guimenuitem>
458 </menuchoice>.
459 </para>
461 <para>
462 Click:
463 <orderedlist>
464 <listitem>Update list of packets in real time</listitem>
465 <listitem>Automatic scrolling in live capture</listitem>
466 <listitem>Enable MAC name resolution </listitem>
467 <listitem>Enable network name resolution </listitem>
468 <listitem>Enable transport name resolution</listitem>
469 </orderedlist>
470 Click <guibutton>OK</guibutton>.
471 </para></step>
473 <step><para>
474 Start the second Windows 9x/Me machine. Let it run for 15-20 minutes. While monitoring, do not press
475 any keyboard keys, do not click any on-screen icons or menus, and do not answer any dialog boxes.
476 </para></step>
478 <step><para>
479 At the conclusion of the capture time, stop the capture. Be sure to save the captured data so you
480 can examine the network data capture again at a later date should that be necessary.
481 </para></step>
483 <step><para>
484 Analyze the capture trace, taking note of the transport protocols used, the types of messages observed,
485 and what interaction took place between the two machines. Leave both machines running for the next task.
486 </para></step>
487 </procedure>
489 <sect3>
490 <title>Findings</title>
492 <para>
493 <link linkend="capsstats02"/> summarizes capture statistics observed. As in the previous case,
494 all announcements used UDP/IP broadcasts. Also, as was observed with the last example, the second
495 Windows 9x/Me machine broadcasts its name on startup to ensure that there exists no name clash
496 (i.e., the name is already registered by another machine) on the network segment. Those wishing
497 to explore the inner details of the precise mechanism of how this functions should refer to
498 the book <quote>Implementing CIFS: The Common Internet File System,</quote> referred to previously.
499 </para>
501 <table id="capsstats02">
502 <title>Second Machine (Windows 98) &smbmdash; Capture Statistics</title>
503 <tgroup cols="4">
504 <colspec align="left" colwidth="3*"/>
505 <colspec align="center"/>
506 <colspec align="center"/>
507 <colspec align="left" colwidth="3*"/>
508 <thead>
509 <row>
510 <entry>Message</entry>
511 <entry>Type</entry>
512 <entry>Num</entry>
513 <entry>Notes</entry>
514 </row>
515 </thead>
516 <tbody>
517 <row>
518 <entry>MILGATE98<00></entry>
519 <entry>Reg</entry>
520 <entry>8</entry>
521 <entry>4 lots of 2, 0.6 sec apart.</entry>
522 </row>
523 <row>
524 <entry>MILGATE98<03></entry>
525 <entry>Reg</entry>
526 <entry>8</entry>
527 <entry>4 lots of 2, 0.6 sec apart.</entry>
528 </row>
529 <row>
530 <entry>MILGATE98<20></entry>
531 <entry>Reg</entry>
532 <entry>8</entry>
533 <entry>4 lots of 2, 0.75 sec apart.</entry>
534 </row>
535 <row>
536 <entry>MIDEARTH<00></entry>
537 <entry>Reg</entry>
538 <entry>8</entry>
539 <entry>4 lots of 2, 0.75 sec apart.</entry>
540 </row>
541 <row>
542 <entry>MIDEARTH<1d></entry>
543 <entry>Reg</entry>
544 <entry>8</entry>
545 <entry>4 lots of 2, 0.75 sec apart.</entry>
546 </row>
547 <row>
548 <entry>MIDEARTH<1e></entry>
549 <entry>Reg</entry>
550 <entry>8</entry>
551 <entry>4 lots of 2, 0.75 sec apart.</entry>
552 </row>
553 <row>
554 <entry>MIDEARTH<1b></entry>
555 <entry>Qry</entry>
556 <entry>18</entry>
557 <entry>900 sec apart at stable operation.</entry>
558 </row>
559 <row>
560 <entry>JHT<03></entry>
561 <entry>Reg</entry>
562 <entry>2</entry>
563 <entry>This is the name of the user that logged onto Windows.</entry>
564 </row>
565 <row>
566 <entry>Host Announcement MILGATE98</entry>
567 <entry>Ann</entry>
568 <entry>14</entry>
569 <entry>Every 120 sec.</entry>
570 </row>
571 <row>
572 <entry>Domain/Workgroup Announcement MIDEARTH</entry>
573 <entry>Ann</entry>
574 <entry>6</entry>
575 <entry>900 sec apart at stable operation.</entry>
576 </row>
577 <row>
578 <entry>Local Master Announcement WINEPRESSME</entry>
579 <entry>Ann</entry>
580 <entry>6</entry>
581 <entry>Insufficient detail to determine frequency.</entry>
582 </row>
583 </tbody>
584 </tgroup>
585 </table>
587 <para>
588 <indexterm><primary>host announcement</primary></indexterm>
589 <indexterm><primary>Local Master Announcement</primary></indexterm>
590 <indexterm><primary>Workgroup Announcement</primary></indexterm>
591 Observation of the contents of Host Announcements, Domain/Workgroup Announcements,
592 and Local Master Announcements is instructive. These messages convey a significant
593 level of detail regarding the nature of each machine that is on the network. An example
594 dissection of a Host Announcement is given in <link linkend="hostannounce"/>.
595 </para>
597 </sect3>
599 <image id="hostannounce">
600 <imagedescription>Typical Windows 9x/Me Host Announcement</imagedescription>
601 <imagefile scale="55">HostAnnouncment</imagefile>
602 </image>
604 </sect2>
606 <sect2>
607 <title>Simple Windows Client Connection Characteristics</title>
609 <para>
610 The purpose of this exercise is to discover how Microsoft Windows clients create (establish)
611 connections with remote servers. The methodology involves analysis of a key aspect of how
612 Windows clients access remote servers: the session setup protocol.
613 </para>
615 <procedure>
616 <step><para>
617 Configure a Windows 9x/Me machine (MILGATE98) with a share called <constant>Stuff</constant>.
618 Create a <parameter>Full Access</parameter> control password on this share.
619 </para></step>
621 <step><para>
622 Configure another Windows 9x/Me machine (WINEPRESSME) as a client. Make sure that it exports
623 no shared resources.
624 </para></step>
626 <step><para>
627 Start both Windows 9x/Me machines and allow them to stabilize for 10 minutes. Log on to both
628 machines using a user name (JHT) of your choice. Wait approximately two minutes before proceeding.
629 </para></step>
631 <step><para>
632 Start ethereal (or the network sniffer of your choice).
633 </para></step>
635 <step><para>
636 From the WINEPRESSME machine, right-click <guimenu>Network Neighborhood</guimenu>, select
637 <guimenuitem>Explore</guimenuitem>, select
638 <menuchoice>
639 <guimenuitem>My Network Places</guimenuitem>
640 <guimenuitem>Entire Network</guimenuitem>
641 <guimenuitem>MIDEARTH</guimenuitem>
642 <guimenuitem>MILGATE98</guimenuitem>
643 <guimenuitem>Stuff</guimenuitem>
644 </menuchoice>.
645 Enter the password you set for the <constant>Full Control</constant> mode for the
646 <constant>Stuff</constant> share.
647 </para></step>
649 <step><para>
650 When the share called <constant>Stuff</constant> is being displayed, stop the capture.
651 Save the captured data in case it is needed for later analysis.
652 </para></step>
654 <step><para>
655 <indexterm><primary>session setup</primary></indexterm>
656 From the top of the packets captured, scan down to locate the first packet that has
657 interpreted as <constant>Session Setup AndX, User: anonymous; Tree Connect AndX,
658 Path: \\MILGATE98\IPC$</constant>.
659 </para></step>
661 <step><para><indexterm>
662 <primary>Session Setup</primary>
663 </indexterm><indexterm>
664 <primary>Tree Connect</primary>
665 </indexterm>
666 In the dissection (analysis) panel, expand the <constant>SMB, Session Setup AndX Request,
667 and Tree Connect AndX Request</constant>. Examine both operations. Identify the name of
668 the user Account and what password was used. The Account name should be empty.
669 This is a <constant>NULL</constant> session setup packet.
670 </para></step>
672 <step><para>
673 Return to the packet capture sequence. There will be a number of packets that have been
674 decoded of the type <constant>Session Setup AndX</constant>. Locate the last such packet
675 that was targeted at the <constant>\\MILGATE98\IPC$</constant> service.
676 </para></step>
678 <step><para>
679 <indexterm><primary>password length</primary></indexterm>
680 <indexterm><primary>User Mode</primary></indexterm>
681 Dissect this packet as per the one above. This packet should have a password length
682 of 24 (characters) and should have a password field, the contents of which is a
683 long hexadecimal number. Observe the name in the Account field. This is a User Mode
684 session setup packet.
685 </para></step>
686 </procedure>
688 <sect3>
689 <title>Findings and Comments</title>
691 <para>
692 <indexterm><primary>IPC$</primary></indexterm>
693 The <constant>IPC$</constant> share serves a vital purpose<footnote>TOSHARG, Sect 4.5.1</footnote>
694 in SMB/CIFS based networking. A Windows client connects to this resource to obtain the list of
695 resources that are available on the server. The server responds with the shares and print queues that
696 are available. In most but not all cases, the connection is made with a <constant>NULL</constant>
697 username and a <constant>NULL</constant> password.
698 </para>
700 <para>
701 <indexterm><primary>account credentials</primary></indexterm>
702 The two packets examined are material evidence with respect to how Windows clients may
703 interoperate with Samba. Samba requires every connection setup to be authenticated using
704 valid UNIX account credentials (UID/GID). This means that even a <constant>NULL</constant>
705 session setup can be established only by automatically mapping it to a valid UNIX
706 account.
707 </para>
709 <para>
710 <indexterm><primary>NULL session</primary></indexterm><indexterm>
711 <primary>guest account</primary>
712 </indexterm>
713 <indexterm><primary>nobody</primary></indexterm>
714 Samba has a special name for the <constant>NULL</constant>, or empty, user account.
715 It calls that the <smbconfoption><name>guest account</name></smbconfoption>. The
716 default value of this parameter is <constant>nobody</constant>; however, this can be
717 changed to map the function of the guest account to any other UNIX identity. Some
718 UNIX administrators prefer to map this account to the system default anonymous
719 FTP account. A sample NULL Session Setup AndX packet dissection is shown in
720 <link linkend="nullconnect"/>.
721 </para>
723 <image id="nullconnect">
724 <imagedescription>Typical Windows 9x/Me NULL SessionSetUp AndX Request</imagedescription>
726 <imagefile scale="65">NullConnect</imagefile>
727 </image>
729 <para>
730 <indexterm><primary>nobody</primary></indexterm>
731 <indexterm><primary>/etc/passwd</primary></indexterm>
732 <indexterm><primary>guest account</primary></indexterm>
733 When a UNIX/Linux system does not have a <constant>nobody</constant> user account
734 (<filename>/etc/passwd</filename>), the operation of the <constant>NULL</constant>
735 account cannot validate and thus connections that utilize the guest account
736 fail. This breaks all ability to browse the Samba server and is a common
737 problem reported on the Samba mailing list. A sample User Mode Session Setup AndX
738 is shown in <link linkend="userconnect"/>.
739 </para>
741 <image id="userconnect">
742 <imagedescription>Typical Windows 9x/Me User SessionSetUp AndX Request</imagedescription>
743 <imagefile scale="65">UserConnect</imagefile>
744 </image>
746 <para>
747 <indexterm><primary>encrypted</primary></indexterm>
748 The User Mode connection packet contains the account name and the domain name.
749 The password is provided in Microsoft encrypted form, and its length is shown
750 as 24 characters. This is the length of Microsoft encrypted passwords.
751 </para>
753 </sect3>
755 </sect2>
757 <sect2>
758 <title>Windows 200x/XP Client Interaction with Samba-3</title>
760 <para>
761 By now you may be asking, <quote>Why did you choose to work with Windows 9x/Me?</quote>
762 </para>
764 <para>
765 First, we want to demonstrate the simple case. This book is not intended to be a detailed treatise
766 on the Windows networking protocols, but rather to provide prescriptive guidance for deployment of Samba.
767 Second, by starting out with the simple protocol, it can be demonstrated that the more complex case mostly
768 follows the same principles.
769 </para>
771 <para>
772 The following exercise demonstrates the case that even MS Windows XP Professional with up-to-date service
773 updates also uses the <constant>NULL</constant> account, as well as user accounts. Simply follow the procedure
774 to complete this exercise.
775 </para>
777 <para>
778 To complete this exercise, you need a Windows XP Professional client that has been configured as
779 a Domain Member of either a Samba controlled domain or a Windows NT4 or 200x Active Directory domain.
780 Here we do not provide details for how to configure this, as full coverage is provided later in this book.
781 </para>
783 <procedure>
785 <step><para>
786 Start your Domain Controller. Also, start the ethereal monitoring machine, launch ethereal,
787 and then wait for the next step to complete.
788 </para></step>
790 <step><para>
791 Start the Windows XP Client and wait five minutes before proceeding.
792 </para></step>
794 <step><para>
795 On the machine from which network activity will be monitored (using <command>ethereal</command>),
796 launch <command>ethereal</command> and click
797 <menuchoice>
798 <guimenu>Capture</guimenu>
799 <guimenuitem>Start</guimenuitem>
800 </menuchoice>.
801 </para>
803 <para>
804 Click:
805 <orderedlist>
806 <listitem>Update list of packets in real time</listitem>
807 <listitem>Automatic scrolling in live capture</listitem>
808 <listitem>Enable MAC name resolution </listitem>
809 <listitem>Enable network name resolution </listitem>
810 <listitem>Enable transport name resolution</listitem>
811 </orderedlist>
812 Click <guibutton>OK</guibutton>.
813 </para></step>
815 <step><para>
816 On the Windows XP Professional client: Press <guimenu>Ctrl-Alt-Delete</guimenu> to bring
817 up the domain logon screen. Log in using valid credentials for a domain user account.
818 </para></step>
820 <step><para>
821 Now proceed to connect to the Domain Controller as follows:
822 <menuchoice>
823 <guimenu>Start</guimenu>
824 <guimenuitem>(right-click) My Network Places</guimenuitem>
825 <guimenuitem>Explore</guimenuitem>
826 <guimenuitem>{Left Panel} [+] Entire Network</guimenuitem>
827 <guimenuitem>{Left Panel} [+] Microsoft Windows Network</guimenuitem>
828 <guimenuitem>{Left Panel} [+] Midearth</guimenuitem>
829 <guimenuitem>{Left Panel} [+] Frodo</guimenuitem>
830 <guimenuitem>{Left Panel} [+] data</guimenuitem>
831 </menuchoice>. Close the explorer window.
832 </para>
834 <para>
835 In this step, our domain name is <constant>Midearth</constant>, the domain controller is called
836 <constant>Frodo</constant>, and we have connected to a share called <constant>data</constant>.
837 </para></step>
839 <step><para>
840 Stop the capture on the <command>ethereal</command> monitoring machine. Be sure to save the captured data
841 to a file so that you can refer to it again later.
842 </para></step>
844 <step><para>
845 If desired, the Windows XP Professional client and the Domain Controller are no longer needed for exercises
846 in this chapter.
847 </para></step>
849 <step><para>
850 <indexterm><primary>NTLMSSP_AUTH</primary></indexterm>
851 <indexterm><primary>session setup</primary></indexterm>
852 From the top of the packets captured, scan down to locate the first packet that has
853 interpreted as <constant>Session Setup AndX Request, NTLMSSP_AUTH</constant>.
854 </para></step>
856 <step><para>
857 <indexterm><primary>GSS-API</primary></indexterm>
858 <indexterm><primary>SPNEGO</primary></indexterm>
859 <indexterm><primary>NTLMSSP</primary></indexterm>
860 In the dissection (analysis) panel, expand the <constant>SMB, Session Setup AndX Request</constant>.
861 Expand the packet decode information, beginning at the <constant>Security Blob:</constant>
862 entry. Expand the <constant>GSS-API -> SPNEGO -> netTokenTarg -> responseToken -> NTLMSSP</constant>
863 keys. This should reveal that this is a <constant>NULL</constant> session setup packet.
864 The <constant>User name: NULL</constant> indicates this. An example decode is shown in
865 <link linkend="XPCap01"/>.
866 </para></step>
868 <step><para>
869 Return to the packet capture sequence. There will be a number of packets that have been
870 decoded of the type <constant>Session Setup AndX Request</constant>. Click the last such packet that
871 has been decoded as <constant>Session Setup AndX Request, NTLMSSP_AUTH</constant>.
872 </para></step>
874 <step><para>
875 <indexterm><primary>encrypted password</primary></indexterm>
876 In the dissection (analysis) panel, expand the <constant>SMB, Session Setup AndX Request</constant>.
877 Expand the packet decode information, beginning at the <constant>Security Blob:</constant>
878 entry. Expand the <constant>GSS-API -> SPNEGO -> netTokenTarg -> responseToken -> NTLMSSP</constant>
879 keys. This should reveal that this is a <constant>User Mode</constant> session setup packet.
880 The <constant>User name: jht</constant> indicates this. An example decode is shown in
881 <link linkend="XPCap02"/>. In this case the user name was <constant>jht</constant>. This packet
882 decode includes the <constant>Lan Manager Response:</constant> and the <constant>NTLM Response:</constant>.
883 The value of these two parameters is the Microsoft encrypted password hashes, respectively, the LanMan
884 password and then the NT (case-preserving) password hash.
885 </para></step>
887 <step><para>
888 <indexterm><primary>password length</primary></indexterm>
889 <indexterm><primary>User Mode</primary></indexterm>
890 The passwords are 24 characters long hexadecimal numbers. This packet confirms that this is a User Mode
891 session setup packet.
892 </para></step>
894 </procedure>
896 <image id="XPCap01">
897 <imagedescription>Typical Windows XP NULL Session Setup AndX Request</imagedescription>
898 <imagefile scale="70">WindowsXP-NullConnection</imagefile>
899 </image>
901 <image id="XPCap02">
902 <imagedescription>Typical Windows XP User Session Setup AndX Request</imagedescription>
903 <imagefile scale="70">WindowsXP-UserConnection</imagefile>
904 </image>
906 <sect3>
907 <title>Discussion</title>
909 <para><indexterm>
910 <primary>NULL-Session</primary>
911 </indexterm>
912 This exercise demonstrates that, while the specific protocol for the Session Setup AndX is handled
913 in a more sophisticated manner by recent MS Windows clients, the underlying rules or principles
914 remain the same. Thus it is demonstrated that MS Windows XP Professional clients still use a
915 <constant>NULL-Session</constant> connection to query and locate resources on an advanced network
916 technology server (one using Windows NT4/200x or Samba). It also demonstrates that an authenticated
917 connection must be made before resources can be used.
918 </para>
920 </sect3>
922 </sect2>
924 <sect2>
925 <title>Conclusions to Exercises</title>
927 <para>
928 In summary, the following points have been established in this chapter:
929 </para>
931 <itemizedlist>
932 <listitem><para>
933 When NetBIOS over TCP/IP protocols are enabled, MS Windows networking employs broadcast
934 oriented messaging protocols to provide knowledge of network services.
935 </para></listitem>
937 <listitem><para>
938 Network browsing protocols query information stored on Browse Masters that manage
939 information provided by NetBIOS Name Registrations and by way of on-going Host
940 Announcements and Workgroup Announcements.
941 </para></listitem>
943 <listitem><para>
944 All Samba servers must be configured with a mechanism for mapping the <constant>NULL-Session</constant>
945 to a valid but non-privileged UNIX system account.
946 </para></listitem>
948 <listitem><para>
949 The use of Microsoft encrypted passwords is built right into the fabric of Windows
950 networking operations. Such passwords cannot be provided from the UNIX <filename>/etc/passwd</filename>
951 database and thus must be stored elsewhere on the UNIX system in a manner that Samba can
952 use. Samba-2.x permitted such encrypted passwords to be stored in the <constant>smbpasswd</constant>
953 file or in an LDAP database. Samba-3 permits that use of multiple different <parameter>passdb backend</parameter>
954 databases, in concurrent deploy. Refer to <emphasis>TOSHARG</emphasis>, Chapter 10, <quote>Account Information Databases.</quote>
955 </para></listitem>
956 </itemizedlist>
958 </sect2>
960 </sect1>
962 <sect1 id="chap01conc">
963 <title>Dissection and Discussion</title>
965 <para>
966 <indexterm><primary>guest account</primary></indexterm>
967 The exercises demonstrate the use of the <constant>guest</constant> account, the way that
968 MS Windows clients and servers resolve computer names to a TCP/IP address, and how connections
969 between a client and a server are established.
970 </para>
972 <para>
973 Those wishing background information regarding NetBIOS name types should refer to
974 the Microsoft Knowledge Base Article
975 <ulink url="http://support.microsoft.com/support/kb/articles/Q102/78/8.asp">Q102878.</ulink>
976 </para>
978 <sect2>
979 <title>Technical Issues</title>
981 <para>
982 <indexterm><primary>guest account</primary></indexterm>
983 Network browsing involves SMB broadcast announcements, SMB enumeration requests,
984 connections to the <constant>IPC$</constant> share, share enumerations, and SMB connection
985 setup processes. The use of anonymous connections to a Samba server involve the use of
986 the <parameter>guest account</parameter> that must map to a valid UNIX UID.
987 </para>
989 </sect2>
991 </sect1>
993 <sect1 id="chap01qa">
994 <title>Questions and Answers</title>
996 <para>
997 The questions and answers given in this section are designed to highlight important aspects of Microsoft
998 Windows networking.
999 </para>
1001 <qandaset defaultlabel="chap01qa" type="number">
1002 <qandaentry>
1003 <question>
1005 <para>
1006 What is the significance of the MIDEARTH<1b> type query?
1007 </para>
1009 </question>
1010 <answer>
1012 <para>
1013 <indexterm><primary>Domain Master Browser</primary><see>DMB</see></indexterm>
1014 <indexterm><primary>DMB</primary></indexterm>
1015 This is a broadcast announcement by which the Windows machine is attempting to
1016 locate a Domain Master Browser (DMB) in the event that it might exist on the network.
1017 Refer to <emphasis>TOSHARG</emphasis> Chapter 9, Section 9.7, <quote>Technical Overview of Browsing</quote>
1018 for details regarding the function of the DMB and its role in network browsing.
1019 </para>
1021 </answer>
1022 </qandaentry>
1024 <qandaentry>
1025 <question>
1027 <para>
1028 What is the significance of the MIDEARTH<1d> type name registration?
1029 </para>
1031 </question>
1032 <answer>
1034 <para>
1035 <indexterm><primary>Local Master Browser</primary><see>LMB</see></indexterm>
1036 <indexterm><primary>LMB</primary></indexterm>
1037 This name registration records the machine IP addresses of the Local Master Browsers (LMBs).
1038 Network clients can query this name type to obtain a list of browser servers from the
1039 Master Browser.
1040 </para>
1042 <para>
1043 The LMB is responsible for monitoring all host announcements on the local network and for
1044 collating the information contained within them. Using this information, it can provide answers to other Windows
1045 network clients that request information such as:
1046 </para>
1048 <itemizedlist>
1049 <listitem><para>
1050 The list of machines known to the LMB (i.e., the browse list)
1051 </para></listitem>
1053 <listitem><para>
1054 The IP addresses of all Domain Controllers known for the Domain
1055 </para></listitem>
1057 <listitem><para>
1058 The IP addresses of LMBs
1059 </para></listitem>
1061 <listitem><para>
1062 The IP address of the DMB (if one exists)
1063 </para></listitem>
1065 <listitem><para>
1066 The IP address of the LMB on the local segment
1067 </para></listitem>
1068 </itemizedlist>
1070 </answer>
1071 </qandaentry>
1073 <qandaentry>
1074 <question>
1076 <para>
1077 What is the role and significance of the <01><02>__MSBROWSE__<02><01>
1078 name registration?
1079 </para>
1081 </question>
1082 <answer>
1084 <para>
1085 <indexterm><primary>Browse Master</primary></indexterm>
1086 This name is registered by the Browse Master to broadcast and receive domain announcements.
1087 Its scope is limited to the local network segment, or subnet. By querying this name type,
1088 Master Browsers on networks that have multiple domains can find the names of Master Browsers
1089 for each domain.
1090 </para>
1092 </answer>
1093 </qandaentry>
1095 <qandaentry>
1096 <question>
1098 <para>
1099 What is the significance of the MIDEARTH<1e> type name registration?
1100 </para>
1102 </question>
1103 <answer>
1105 <para>
1106 <indexterm><primary>Browser Election Service</primary></indexterm>
1107 This name is registered by all Browse Masters in a domain or workgroup. The registration
1108 name type is known as the Browser Election Service. Master Browsers register themselves
1109 with this name type so that Domain Master Browsers can locate them to perform cross-subnet
1110 browse list updates. This name type is also used to initiate elections for Master Browsers.
1111 </para>
1113 </answer>
1114 </qandaentry>
1116 <qandaentry>
1117 <question>
1119 <para>
1120 <indexterm><primary>guest account</primary></indexterm>
1121 What is the significance of the <parameter>guest account</parameter> in smb.conf?
1122 </para>
1124 </question>
1125 <answer>
1127 <para>
1128 This parameter specifies the default UNIX account to which MS Windows networking
1129 NULL session connections are mapped. The default name for the UNIX account used for
1130 this mapping is called <constant>nobody</constant>. If the UNIX/Linux system that
1131 is hosting Samba does not have a <constant>nobody</constant> account and an alternate
1132 mapping has not been specified, network browsing will not work at all.
1133 </para>
1135 <para>
1136 It should be noted that the <parameter>guest account</parameter> is essential to
1137 Samba operation. Either the operating system must have an account called <constant>nobody</constant>
1138 or there must be an entry in the &smb.conf; file with a valid UNIX account. For example,
1139 <smbconfoption><name>guest account</name><value>ftp</value></smbconfoption>.
1140 </para>
1142 </answer>
1143 </qandaentry>
1145 <qandaentry>
1146 <question>
1148 <para>
1149 Is it possible to reduce network broadcast activity with Samba-3?
1150 </para>
1152 </question>
1153 <answer>
1155 <para>
1156 <indexterm><primary>WINS</primary></indexterm>
1157 <indexterm><primary>NetBIOS</primary></indexterm>
1158 Yes, there are two ways to do this. The first involves use of WINS (See <emphasis>TOSHARG</emphasis>, Chapter 9,
1159 Section 9.5, <quote>WINS &smbmdash; The Windows Inter-networking Name Server</quote>), the
1160 alternate method involves disabling the use of NetBIOS over TCP/IP. This second method requires
1161 a correctly configured DNS server (see <emphasis>TOSHARG</emphasis>, Chapter 9, Section 9.3, <quote>Discussion</quote>).
1162 </para>
1164 <para>
1165 <indexterm><primary>broadcast</primary></indexterm>
1166 <indexterm><primary>NetBIOS</primary><secondary>Node Type</secondary></indexterm>
1167 <indexterm><primary>Hybrid</primary></indexterm>
1168 The use of WINS reduces network broadcast traffic. The reduction is greatest when all network
1169 clients are configured to operate in <parameter>Hybrid Mode</parameter>. This can be effected through
1170 use of DHCP to set the NetBIOS node type to type 8 for all network clients. Additionally, it is
1171 beneficial to configure Samba to use <smbconfoption><name>name resolve order</name><value>wins host
1172 bcast</value></smbconfoption>.
1173 </para>
1175 <note><para>
1176 Use of SMB without NetBIOS is possible only on Windows 200x/XP Professional clients and servers, as
1177 well as with Samba-3.
1178 </para></note>
1180 </answer>
1181 </qandaentry>
1183 <qandaentry>
1184 <question>
1186 <para>
1187 Can I just use plain-text passwords with Samba?
1188 </para>
1190 </question>
1191 <answer>
1193 <para>
1194 Yes, you can configure Samba to use plain-text passwords, though this does create a few problems.
1195 </para>
1197 <para>
1198 First, the use of <filename>/etc/passwd</filename> based plain-text passwords requires that registry
1199 modifications be made on all MS Windows client machines to enable plain-text passwords support. This
1200 significantly diminishes the security of MS Windows client operation. Many network administrators
1201 are bitterly opposed to doing this.
1202 </para>
1204 <para>
1205 Second, Microsoft has not maintained plain-text password support since the default setting was made
1206 disabling this. When network connections are dropped by the client it is not be possible to re-establish
1207 the connection automatically. Users need to log off and then log on again. Plain-text password support
1208 may interfere with recent enhancements that are part of the Microsoft move toward a more secure computing
1209 environment.
1210 </para>
1212 <para>
1213 Samba-3 supports Microsoft encrypted passwords. Be advised not to reintroduce plain-text password handling.
1214 Just create user accounts by running: <command>smbpasswd -a 'username'</command>
1215 </para>
1217 <para>
1218 It is not possible to add a user to the <parameter>passdb backend</parameter> database unless there is
1219 a UNIX system account for that user. On systems that run <command>winbindd</command> to access the Samba
1220 PDC/BDC to provide Windows user and group accounts, the <parameter>idmap uid, idmap gid</parameter> ranges
1221 set in the &smb.conf; file provide the local UID/GIDs needed for local identity management purposes.
1222 </para>
1224 </answer>
1225 </qandaentry>
1227 <qandaentry>
1228 <question>
1230 <para>
1231 What parameter in the &smb.conf; file is used to enable the use of encrypted passwords?
1232 </para>
1234 </question>
1235 <answer>
1237 <para>
1238 The parameter in the &smb.conf; file that controls this behavior is known as <parameter>encrypt
1239 passwords</parameter>. The default setting for this in Samba-3 is <constant>Yes (Enabled)</constant>.
1240 </para>
1242 </answer>
1243 </qandaentry>
1245 <qandaentry>
1246 <question>
1248 <para>
1249 Is it necessary to specify <smbconfoption><name>encrypt passwords</name><value>Yes</value></smbconfoption>
1250 when Samba-3 is configured as a Domain Member?
1251 </para>
1253 </question>
1254 <answer>
1256 <para>
1257 No. This is the default behavior.
1258 </para>
1260 </answer>
1261 </qandaentry>
1263 <qandaentry>
1264 <question>
1266 <para>
1267 Is it necessary to specify a <parameter>guest account</parameter> when Samba-3 is configured
1268 as a Domain Member server?
1269 </para>
1271 </question>
1272 <answer>
1274 <para>
1275 Yes. This is a local function on the server. The default setting is to use the UNIX account
1276 <constant>nobody</constant>. If this account does not exist on the UNIX server, then it is
1277 necessary to provide a <smbconfoption><name>guest account</name><value>an_account</value></smbconfoption>,
1278 where <constant>an_account</constant> is a valid local UNIX user account.
1279 </para>
1281 </answer>
1282 </qandaentry>
1283 </qandaset>
1285 </sect1>
1287 </chapter>