NTLM and NTLMv2 in Liferay Portal 6.2

Issue

• The question is whether Liferay Portal 6.2 supports NTLM and NTLMv2

Environment

• Liferay Portal 6.2

Resolution

• The library used in Liferay Portal 6.2 supports both NTLM and NTLMv2
• There is a property that can be set in portal-ext.properties to control the LMCompatibility in the client (the NtlmFilter will load it and apply): jcifs.smb.lmCompatibility
  Please see the Java CIFS Client Library documentation (under the Less Commonly Used Properties section):

  This client can perform NTLM and LMv2 authentication. The default behavior is to use NTLM version 1. This can be changed by using this property with an integer that specifies the "level" of security:

  • 0,1 – Sends LM and NTLM responses. This is the default behavior.
  • 2 – Sends only the NTLM response. This is more secure than Levels 0 and 1, because it eliminates the cryptographically-weak LM response.
  • 3,4,5 – Sends only the LMv2 response. This offers a higher level of security.

  These values mirror those used with the Windows registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa used for the same purpose. See the page entitled The NTLM Authentication Protocol for a technical description of these authentication mechanisms.

  This must be set to 0 for older versions of Samba (3.0.x) as it seems they do not support raw NTLMSSP and currently JCIFS does not support SPNEGO.

• This property setting may not be needed at all, because as per http://davenport.sourceforge.net/ntlm.html#ntlmVersion2

  (...) In all levels, NTLM2 session security is supported and negotiated when available (most available documentation indicates that NTLM2 session security is only enabled on levels 1 and above, but it is seen in practice with Level 0 as well) (...)

Additional Information

• Considering the above-mentioned, the preferred way would be using Kerberos instead of NTLM.
• Java CIFS Client Library documentation
• The NTLM Authentication Protocol