diff options
| author | Stefan Metzmacher <metze@samba.org> | 2013-10-17 18:39:56 +0200 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2014-01-07 12:47:05 +0100 |
| commit | 6630c68cce8fbbd700e7d4cd92ec3ebb2a268f06 (patch) | |
| tree | b41559d352d37d9754c28f02eb2fe853c2f40a44 | |
| parent | de4f8f0825790452455a9d51e9d84d4d4a5c0d3b (diff) | |
| download | samba-6630c68cce8fbbd700e7d4cd92ec3ebb2a268f06.tar.gz samba-6630c68cce8fbbd700e7d4cd92ec3ebb2a268f06.tar.xz samba-6630c68cce8fbbd700e7d4cd92ec3ebb2a268f06.zip | |
lib/param: add "require strong key" option, defaulting to true
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
| -rw-r--r-- | docs-xml/smbdotconf/winbind/requirestrongkey.xml | 27 | ||||
| -rw-r--r-- | lib/param/loadparm.c | 1 | ||||
| -rw-r--r-- | lib/param/param_functions.c | 1 | ||||
| -rw-r--r-- | lib/param/param_table.c | 9 |
4 files changed, 38 insertions, 0 deletions
diff --git a/docs-xml/smbdotconf/winbind/requirestrongkey.xml b/docs-xml/smbdotconf/winbind/requirestrongkey.xml new file mode 100644 index 0000000000..de749bbb06 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/requirestrongkey.xml @@ -0,0 +1,27 @@ +<samba:parameter name="require strong key" + context="G" + type="boolean" + advanced="1" + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> +<description> + <para>This option controls whether winbindd requires support + for md5 strong key support for the netlogon secure channel.</para> + + <para>The following flags will be required NETLOGON_NEG_STRONG_KEYS, + NETLOGON_NEG_ARCFOUR and NETLOGON_NEG_AUTHENTICATED_RPC.</para> + + <para>You can set this to no if some domain controllers only support des. + This might allows weak crypto to be negotiated, may via downgrade attacks.</para> + + <para>The behavior can be controlled per netbios domain + by using 'require strong key:NETBIOSDOMAIN = no' as option.</para> + + <para>Note for active directory domain this option is hardcoded to 'yes'</para> + + <para>This option yields precedence to the <smbconfoption name="reject md5 servers"/> option.</para> + + <para>This option takes precedence to the <smbconfoption name="client schannel"/> option.</para> +</description> + +<value type="default">yes</value> +</samba:parameter> diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index df2ff6e11b..0e41aec4f8 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -2184,6 +2184,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) lpcfg_do_global_parameter(lp_ctx, "winbind separator", "\\"); lpcfg_do_global_parameter(lp_ctx, "winbind sealed pipes", "True"); + lpcfg_do_global_parameter(lp_ctx, "require strong key", "True"); lpcfg_do_global_parameter(lp_ctx, "winbindd socket directory", dyn_WINBINDD_SOCKET_DIR); lpcfg_do_global_parameter(lp_ctx, "winbindd privileged socket directory", dyn_WINBINDD_PRIVILEGED_SOCKET_DIR); lpcfg_do_global_parameter(lp_ctx, "ntp signd socket directory", dyn_NTP_SIGND_SOCKET_DIR); diff --git a/lib/param/param_functions.c b/lib/param/param_functions.c index 5b55c7dd42..d04bc0de91 100644 --- a/lib/param/param_functions.c +++ b/lib/param/param_functions.c @@ -205,6 +205,7 @@ FN_GLOBAL_BOOL(passdb_expand_explicit, bPassdbExpandExplicit) FN_GLOBAL_BOOL(passwd_chat_debug, bPasswdChatDebug) FN_GLOBAL_BOOL(registry_shares, bRegistryShares) FN_GLOBAL_BOOL(reject_md5_servers, bRejectMD5Servers) +FN_GLOBAL_BOOL(require_strong_key, bRequireStrongKey) FN_GLOBAL_BOOL(reset_on_zero_vc, bResetOnZeroVC) FN_GLOBAL_BOOL(rpc_big_endian, bRpcBigEndian) FN_GLOBAL_BOOL(stat_cache, bStatCache) diff --git a/lib/param/param_table.c b/lib/param/param_table.c index 0a07147db0..c79190c43c 100644 --- a/lib/param/param_table.c +++ b/lib/param/param_table.c @@ -4198,6 +4198,15 @@ static struct parm_struct parm_table[] = { .enum_list = NULL, .flags = FLAG_ADVANCED, }, + { + .label = "require strong key", + .type = P_BOOL, + .p_class = P_GLOBAL, + .offset = GLOBAL_VAR(bRequireStrongKey), + .special = NULL, + .enum_list = NULL, + .flags = FLAG_ADVANCED, + }, {N_("DNS options"), P_SEP, P_SEPARATOR}, { |