From 6630c68cce8fbbd700e7d4cd92ec3ebb2a268f06 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 17 Oct 2013 18:39:56 +0200 Subject: lib/param: add "require strong key" option, defaulting to true Signed-off-by: Stefan Metzmacher Reviewed-by: Andrew Bartlett --- docs-xml/smbdotconf/winbind/requirestrongkey.xml | 27 ++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 docs-xml/smbdotconf/winbind/requirestrongkey.xml (limited to 'docs-xml') diff --git a/docs-xml/smbdotconf/winbind/requirestrongkey.xml b/docs-xml/smbdotconf/winbind/requirestrongkey.xml new file mode 100644 index 0000000000..de749bbb06 --- /dev/null +++ b/docs-xml/smbdotconf/winbind/requirestrongkey.xml @@ -0,0 +1,27 @@ + + + This option controls whether winbindd requires support + for md5 strong key support for the netlogon secure channel. + + The following flags will be required NETLOGON_NEG_STRONG_KEYS, + NETLOGON_NEG_ARCFOUR and NETLOGON_NEG_AUTHENTICATED_RPC. + + You can set this to no if some domain controllers only support des. + This might allows weak crypto to be negotiated, may via downgrade attacks. + + The behavior can be controlled per netbios domain + by using 'require strong key:NETBIOSDOMAIN = no' as option. + + Note for active directory domain this option is hardcoded to 'yes' + + This option yields precedence to the option. + + This option takes precedence to the option. + + +yes + -- cgit