| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
| | |
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
primaryGroupID (rid). This is consistant with the move from 'rid' to ntSid
for the primary user identifier.
Also cope with legacy installations where primaryGroupID might have been
stored as 0.
Andrew Bartlett
|
| |
| |
| |
| |
| |
| | |
entropy - use sys_random() instead.
Andrew Bartlett
|
| | |
|
| |
| |
| |
| |
| | |
Remove admonition in ServerType - Until someone gives me a replacement for it
I consider it a non-issue.
|
| | |
|
| | |
|
| |
| |
| |
| |
| | |
that is now possible to, for example, load a module which contains
an auth method into a binary without the auth/ subsystem built in.
|
| | |
|
| |
| |
| |
| |
| | |
on the security entries sent.
Jeremy.
|
| |
| |
| |
| |
| | |
struct in the correct place.
Jeremy.
|
| |
| |
| |
| | |
Jeremy.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
structure-memcpy for DATA_BLOB parameters to using a pointer to that DATA_BLOB.
auth_sam calls some of these functions, so I've cleaned it all up to use this
format now.
Also clean up some debug statements to make them easier to read.
Andrew Bartlett
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
With big thanks to tpot for the ethereal disector, and for the base code
behind this, we now fully support NTLMv2 as a client.
In particular, we support it with direct domain logons (tested with ntlm_auth
--diagnostics), with 'old style' session setups, and with NTLMSSP.
In fact, for NTLMSSP we recycle one of the parts of the server's reply directly...
(we might need to parse for unicode issues later).
In particular, a Win2k domain controller now supplies us with a session key
for this password, which means that doman joins, and non-spnego SMB signing
are now supported with NTLMv2!
Andrew Bartlett
|
| |
| |
| |
| | |
users and groups.
|
| | |
|
| |
| |
| |
| |
| |
| | |
LMv2 response less than 24 bytes is just silly.
Andrew Bartlett
|
| |
| |
| |
| |
| |
| | |
same here.
Andrew Bartlett
|
| |
| |
| |
| |
| |
| | |
one element longer than the domain sid.
Andrew Bartlett
|
| | |
|
| | |
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
- auth with ntlmv2 and lmv2 but deliberately break the ntlmv2 hash
- auth with ntlmv2 and lmv2 but deliberately break the lmv2 hash
- auth with ntlm and lm but deliberately break the ntlm hash
- auth with ntlm and lm but deliberately break the lm hash
My theory is that the NTLM or NTLMv2 field must be correct and if it is,
it doesn't matter what the value of the LM or LMv2 field is.
Fixed cosmetic test name display bug.
|
| |
| |
| |
| | |
Now the build farm will no doubt find more.
|
| |
| |
| |
| |
| |
| |
| | |
then we weren't always correctly detecting that it had a valid stat struct
and so might now return a 'file existed'. Finally realized this when installing
the W2K resource kit as a test case.
Jeremy.
|
| | |
|
| | |
|
| |
| |
| |
| | |
to link during configure checks.
|
| |
| |
| |
| | |
Volker
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
important once we start doing schannel, as there would be a lot more
roundtrips for the second PIPE open and bind. With this patch logging
in to a member server is a matter of two (three if you count the
ack...) packets between us and the DC.
Volker
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| | |
the other infrastructure with name owners etc in place. If anybody is
really going to tackle winsrepld, it will probably not be hard to put
the additional info back.
Volker
|
| | |
|
| |
| |
| |
| | |
Andrew Bartlett
|
| |
| |
| |
| |
| |
| |
| |
| | |
this world than 'status more entires'...
Also move all the cases to 'NT_STATUS_EQUAL()' to test it.
Andrew Bartlett
|
| |
| |
| |
| |
| | |
are identical - noticed by "Dr. Tilo Levante" <tilo@levante.de>.
Jeremy.
|
| |
| |
| |
| | |
Jeremy.
|
| | |
|
| |
| |
| |
| | |
Jeremy.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
(well, under certain conditions :-)
There is no length limit on the size of the authentication response added
into the MD5 hash. (We had previously limited this to lengths like 40, 44 or
64 in attempts to make sense of what the SNIA spec tells us).
Instead, the entire authentication response is added in.
Currently, this only works on a Win2k domain members with a Samba PDC,
becouse our NTLMv2 code currently fails against an Win2k PDC.
However, this splits the problem in half - particularly as the NTLMv2 format
is known, and even has an ethereal disector! (thanks tpot).
Andrew Bartlett
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
lp_workgroup(), for all other server this is global_myname().
This is the name of the domain for accounts on *this* system, and getting
this wrong caused interesting bugs with 'take ownership' on member servers
and standalone servers at Snap.
(They lookup the username that they got, then convert that to a SID - but
becouse the domain out of the smbpasswd entry was wrong, we would fail the
lookup).
Andrew Bartlett
|
| | |
|
| | |
|