Topic: Connecting a Windows 7 laptop to an SME server

[wbs316]

I was wondering if anyone has had a similar issue trying to utilise a Windows 7 machine with an SME server.

I have a client who has a number of Windows XP machines that I have configured successfully previously for use with their SME server.  The Windows XP machines are typically configured with a specific workgroup name, a user ID and password.  This user ID and password is also configured on the SME server so that when the user logs on to the Windows XP workstation the user ID and password is cached to the SME server.

I have attempted to configure a Windows 7 laptop in a similar fashion i.e. configuring the workgroup name and a user ID and password on the Windows 7 laptop that is the same as the user ID and password configured on the SME server.  While the Windows 7 laptop can see the SME server when browsing the network when an attempt is made to connect to the SME server the Windows 7 laptop produces a login ID and password window.  Despite using login IDs and passwords which I know are valid for the SME server I am unable to connect to the SME server and I also was not expecting the subsequent login ID and password window to appear.

Are there settings on the Windows 7 laptop that need to be adjusted.  Any help would be appreciated.

[Stefano]

wbs316:

please search the forums and bugzilla.. w7 will be fully supported only on SME8 as a completely different version of samba is needed

[piran]

I was wondering if anyone has had a similar issue trying to utilise a Windows 7 machine with an SME server.
Any help would be appreciated.

(in addition to Stefano's cogent advice)
My Win7 64bit workstation sees SME7 and iBays over
my intranet without issue. To actually connect to SME7
I use a PuTTY session from the W7 box and have also
set up the public/private passkey stuff along with
PuTTY's Pageant quick start utility. There's no problem
whatsoever, it's faultless, reliable and (AFAIK) it's all
pretty secure. I haven't stumbled over a problem.
Spend more time in SME's wiki.

[wbs316]

Thank you for your input.  I am not intimately familiar with SME server.  PuTTY session?  Is that a protocol that I add to the network on the Windows 7 box?  Do I need to make any adjustments to the SME server?

[idp_qbn]

Hi wbs316
I have an SME server in Server/Gateway mode. It is not a domain controller, just a workgroup server.
You can mix the two: some PCs connect to the domain, others just to the workgroup. Depends what you want to do.

I use a workgroup and connected my Win7 box by mapping a network drive to the server share, with no problems. I made it a permanent connection so now when I log on to my Win7 PC the network drive (the Samba Share) is available.

If you want to use a Domain, be aware there are differences between versions of Win 7  - the cheaper versions don't connect to domains. Be aware also of the differences between WinXP and Win7 as to where the NETLOGON.BAT file is stored and how it is handled.

By the way, PuTTY is a terminal program that allows you connect remotely to another computer. It is NOT a gui, it is a command line window - a bit like Windows Command Prompt window (or DOS Box). Google for PuTTY, download it and run it on your Windows PC. There are tutorials availble on the web - google them.

Good luck
Ian

[piran]

Thank you for your input.  I am not intimately familiar with SME server.  PuTTY session?  Is that a protocol that I add to the network on the Windows 7 box?  Do I need to make any adjustments to the SME server?

[PuTTY] ...first result.
http://www.google.co.uk/search?q=PuTTY

[SME wiki] ...so, get intimate.
http://wiki.contribs.org/SME_Server:Documentation

[passkey stuff] ...give it a proper read.
http://www.wellsi.com/sme/ssh/ssh.html

[NickR]

...
Are there settings on the Windows 7 laptop that need to be adjusted.  Any help would be appreciated.

Yes, it's very simple when you know how 

As administrator on the Win7 (or Vista, in fact) machine, go to:

control panel / administrative tools / local security policy / local policies / security options

Find the entry for: Network Security: LAN manager authentication level

Change it it to Send LM & NTLM responses

Reboot & you can login to your SME shares.

[piran]

As administrator on the Win7 (or Vista, in fact) machine, go to:
control panel / administrative tools / local security policy / local policies / security options
Find the entry for: Network Security: LAN manager authentication level
Change it it to Send LM & NTLM responses
Reboot & you can login to your SME shares.

Have the developers done a security audit on that method?

[NickR]

Have the developers done a security audit on that method?

Not sure what you're asking here.  All this does is to make Vista / Win 7 behave like XP / W2K does when using Samba.  If you're already running in a mixed environment, how does this impact on security?

[piran]

Not sure what you're asking here.  All this does is to make Vista / Win 7 behave like XP / W2K does when using Samba.  If you're already running in a mixed environment, how does this impact on security?

It's an automatic M$ unease of mine.
Making a W7 box behave like W2K rather negates
the additional security functionality put in by M$.
With a rootkit or trojan infection on that M$ box
does it make sense to reduce or relegate the
access procedure to SME? Just a bit uneasy,
I'd want to pass it up to the developers ...

[NickR]

But my point is that the OP's already running XP boxen that have this level of authentication to the SME, so I can't see modding the W7 box to be an additional security risk.

[piran]

I understood your point. I'm uneasy that a W7 box can be
easily modified down to a W2K level of sophistication that
SME can or will accept for its appropriate access.

[NickR]

Sure, & I agree in principle, however it doesn't negatively impact on all of the other good things in Win7.  Sometimes you have to accept that you can't be at the bleeding edge of good security practice on every box simultaneously.

[piran]

I'm not concerned about my W7 boxes though they are an
improvement on my W2K boxes. I didn't know about this mod -
never took up XP or Vista - moved directly from W2K to W7.
I am more concerned for my SME until this mod is positively
sanctioned by the developers. OP wants this on laptop too...

[NickR]

But all it does is to effectively (OK, I know it's a bit more) modify the password hashing algorithm to allow the older SMB authentication that the SME has to work.  I don't see why you feel that the SME developers are even going to be interested, given that it's simply toning down the default W7 hash to one that the SME is designed to deal with. AIUI, you need Samba V3.3 or 3.4 to use the default security model in Win7.

Looking back, I may have been overly aggressive in my suggested change & I think "Send LM & NTLM - use NTLMv2 session security if negotiated" should also work OK.