sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

CVE-2020-25722 s4/provision: add host/ SPNs at the start

Browse Source 
There are two reasons for this. Firstly, leaving SPNs unclaimed is
dangerous, as someone else could grab them first. Secondly, in some
circumstances (self join) we try to add a DNS/ SPN a little bit later
in provision. Under the rules we are introducing for CVE-2020-25722,
this will make our later attempts to add HOST/ fail.

This causes a few errors in samba4.blackbox.dbcheck.* tests, which
assert that revivified old domains match stored reference versions.
Now they don't, because they have servicePrincipalNames.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Douglas Bagnall 2021-10-28 09:45:36 +13:00 committed by Jule Anger
parent 8cde237090
commit 0a555cf097
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
selftest/knownfail.d/cve-2020-25722-provision Normal file
View File

@ -0,0 +1,4 @@
samba4.blackbox.dbcheck.release-4-0-0
samba4.blackbox.dbcheck.release-4-0-0.quick
samba4.blackbox.upgradeprovision.release-4-0-0
samba4.blackbox.functionalprep.check_databases_same

9
source4/setup/provision_self_join.ldif
View File

@ -15,11 +15,16 @@ localPolicyFlags: 0
operatingSystem: Samba
operatingSystemVersion: ${SAMBA_VERSION_STRING}
sAMAccountName: ${NETBIOSNAME}$
# The "servicePrincipalName" updates are now handled by the "samba_spnupdate"
# script
userAccountControl: 532480
clearTextPassword:: ${MACHINEPASS_B64}
objectSid: ${DOMAINSID}-${DCRID}
# While some "servicePrincipalName" updates might be handled by the
# "samba_spnupdate" script, we need to get the basics in here before
# we add any others.
servicePrincipalName: HOST/${DNSNAME}
servicePrincipalName: HOST/${NETBIOSNAME}
servicePrincipalName: HOST/${DNSNAME}/${DNSNAME}
dn: CN=RID Set,CN=${NETBIOSNAME},OU=Domain Controllers,${DOMAINDN}
objectClass: rIDSet