samba服务器挂载点停止了在CentOS 8安装上的工作，错误:未能为否定OID列表启动SPNEGO处理程序

Question

经过大约6个月的smb在主服务器上完美无缺地工作之后，它现在无法允许远程系统在/var/log/messages中挂载以下错误消息：

Jun 27 12:53:10 bike3 smbd[19385]: [2020/06/27 12:53:10.706872,  0] ../../source3/smbd/negprot.c:211(negprot_spnego)
Jun 27 12:53:10 bike3 smbd[19385]:  Failed to start SPNEGO handler for negprot OID list!

我使用的是非常基本的smb.conf配置，并且尝试过各种googled设置，但没有成功：

[global]
        workgroup = WORKGROUP
        security = user
        log level = 3
        map to guest = bad user
        dns proxy = no
; tested various combinations:
        client use spnego = no
        client ntlmv2 auth = no
        client min protocol = SMB2
        client max protocol = SMB3


[pictures]
       comment = pictures
       path = /mnt/pictures
       public = yes
       browsable = yes
       writable = yes
       guest ok = yes
       read only = no

我已经重新安装了所有samba包：

Reinstalled:
  samba-4.11.2-13.el8.x86_64                  samba-client-4.11.2-13.el8.x86_64            samba-client-libs-4.11.2-13.el8.x86_64      samba-common-4.11.2-13.el8.noarch
  samba-common-libs-4.11.2-13.el8.x86_64      samba-common-tools-4.11.2-13.el8.x86_64

我在Windows 10和中进行了测试，它们都失败了，错误相同，下面是log.smb中的日志级别3：

[2020/06/27 13:06:11.367462,  3] ../../lib/util/access.c:371(allow_access)
  Allowed connection from 192.168.xxx.xxx (192.168.xxx.xxx)
[2020/06/27 13:06:11.368276,  3] ../../source3/smbd/oplock.c:1414(init_oplocks)
  init_oplocks: initializing messages.
[2020/06/27 13:06:11.368563,  3] ../../source3/smbd/server_exit.c:244(exit_server_common)
  Server exit (failed to receive smb request)
[2020/06/27 13:06:11.372050,  3] ../../lib/util/access.c:371(allow_access)
  Allowed connection from 192.168.1.197 (192.168.1.197)
[2020/06/27 13:06:11.372676,  3] ../../source3/smbd/oplock.c:1414(init_oplocks)
  init_oplocks: initializing messages.
[2020/06/27 13:06:11.372763,  3] ../../source3/smbd/process.c:1956(process_smb)
  Transaction 0 of length 73 (0 toread)
[2020/06/27 13:06:11.372787,  3] ../../source3/smbd/process.c:1549(switch_message)
  switch message SMBnegprot (pid 21109) conn 0x0
[2020/06/27 13:06:11.373194,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [NT LM 0.12]
[2020/06/27 13:06:11.373220,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [SMB 2.002]
[2020/06/27 13:06:11.373237,  3] ../../source3/smbd/negprot.c:636(reply_negprot)
  Requested protocol [SMB 2.???]
[2020/06/27 13:06:11.373469,  3] ../../source3/smbd/smb2_negprot.c:294(smbd_smb2_request_process_negprot)
  Selected protocol SMB2_FF
[2020/06/27 13:06:11.373856,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'gssapi_spnego' registered
[2020/06/27 13:06:11.373880,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'gssapi_krb5' registered
[2020/06/27 13:06:11.373895,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'gssapi_krb5_sasl' registered
[2020/06/27 13:06:11.373911,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'spnego' registered
[2020/06/27 13:06:11.373929,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'schannel' registered
[2020/06/27 13:06:11.373954,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'naclrpc_as_system' registered
[2020/06/27 13:06:11.373970,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'sasl-EXTERNAL' registered
[2020/06/27 13:06:11.373984,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'ntlmssp' registered
[2020/06/27 13:06:11.374000,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'ntlmssp_resume_ccache' registered
[2020/06/27 13:06:11.374016,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'http_basic' registered
[2020/06/27 13:06:11.374031,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'http_ntlm' registered
[2020/06/27 13:06:11.374048,  3] ../../auth/gensec/gensec_start.c:988(gensec_register)
  GENSEC backend 'http_negotiate' registered
[2020/06/27 13:06:11.374124,  1] ../../auth/gensec/spnego.c:418(gensec_spnego_create_negTokenInit_step)
  gensec_spnego_create_negTokenInit_step: Failed to setup SPNEGO negTokenInit request
[2020/06/27 13:06:11.374149,  0] ../../source3/smbd/negprot.c:211(negprot_spnego)
  Failed to start SPNEGO handler for negprot OID list!
[2020/06/27 13:06:11.374316,  3] ../../source3/smbd/smb2_server.c:3266(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_NO_MEMORY] || at ../../source3/smbd/smb2_negprot.c:307
[2020/06/27 13:06:11.374367,  3] ../../source3/smbd/negprot.c:771(reply_negprot)
  Selected protocol SMB 2.???
[2020/06/27 13:06:11.377729,  3] ../../source3/smbd/server_exit.c:244(exit_server_common)
  Server exit (NT_STATUS_END_OF_FILE)

提前感谢您的帮助。

Answer 1

这是谷歌对这一错误的最高结果，所以即使这是一个year+的老版本，我也会抛出是什么解决了这个问题。

禁用FIPS法规。

可能有一种方法可以通过配置SAMBA来解决这个问题，SAMBA与FIPS兼容，但是对于我的用例来说，只禁用FIPS更快。

Edited，以包括我遵循的指示

如何：https://www.thegeekdiary.com/how-to-disable-fips-mode-on-centos-rhel-7/的功劳

1. 移除dracut-fips软件包。yum remove dracut-fips*
2. 备份FIPS initramfs。cp -p /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).backup注意:检查initramfs文件是否已经创建。此外，您可以使用另一个位置而不是/boot/来避免空间问题。
3. 重新创建initramfs文件：dracut -f或dracut -f -v /boot/initramfs-$(uname -r).img $(uname -r)
4. 从内核命令行禁用fips=1值。修改grub.cfg中当前内核的内核命令行，在/etc/fips=0/grub文件中的GRUB_CMDLINE_LINUX键中添加以下选项“fips=0”，然后重建grub.cfg文件: GRUB_CMDLINE_LINUX行的外观示例：

GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=vg_os/root rd.lvm.lv=vg_os/swap rhgb quiet fips=0"  

1. 对/etc/default/grub的更改需要按以下方式重新生成grub.cfg文件：grub2-mkconfig -o /boot/grub2/grub.cfg或如果您有基于UEFI的运行：grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg
2. 重新启动服务器以使更改生效：shutdown -r now
3. 在重新启动/proc/sys/crypto/ FIPS _enabled之后，检查fips是否处于强制模式。示例：cat /proc/sys/crypto/fips_enabled 0