sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-08-26 01:49:31 +03:00
Code Activity

CVE-2016-2112: docs-xml: add "ldap server require strong auth" option

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
This commit is contained in:
Stefan Metzmacher
2015-12-21 12:03:56 +01:00
parent dedba1f070
commit 0cd2acef79
5 changed files with 51 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml Normal file
View File

@ -0,0 +1,28 @@
<samba:parameter name="ldap server require strong auth"
context="G"
type="enum"
enumlist="enum_ldap_server_require_strong_auth_vals"
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
<description>
<para>
The <smbconfoption name="ldap server require strong auth"/> defines whether
the ldap server requires ldap traffic to be signed or signed and encrypted (sealed).
Possible values are <emphasis>no</emphasis>, <emphasis>allow_sasl_over_tls</emphasis>
and <emphasis>yes</emphasis>.
</para>
<para>A value of <emphasis>no</emphasis> allows simple and sasl binds over
all transports.</para>
<para>A value of <emphasis>allow_sasl_over_tls</emphasis> allows simple and sasl binds
(without sign or seal) over TLS encrypted connections. Unencrypted connections only
allow sasl binds with sign or seal.</para>
<para>A value of <emphasis>yes</emphasis> allows only simple binds
over TLS encrypted connections. Unencrypted connections only
allow sasl binds with sign or seal.</para>
<para>Note the default will change to <constant>yes</constant> with Samba 4.5.</para>
</description>
<value type="default">no</value>
</samba:parameter>

2
lib/param/loadparm.c
View File

@ -2810,6 +2810,8 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
lpcfg_do_global_parameter(lp_ctx, "client ldap sasl wrapping", "sign");
lpcfg_do_global_parameter(lp_ctx, "ldap server require strong auth", "no");
lpcfg_do_global_parameter(lp_ctx, "follow symlinks", "yes");
lpcfg_do_global_parameter(lp_ctx, "machine password timeout", "604800");

6
lib/param/loadparm.h
View File

@ -204,6 +204,12 @@ enum printing_types {PRINT_BSD,PRINT_SYSV,PRINT_AIX,PRINT_HPUX,
#define ADS_AUTH_SASL_FORCE 0x0080
#define ADS_AUTH_USER_CREDS 0x0100
enum ldap_server_require_strong_auth {
LDAP_SERVER_REQUIRE_STRONG_AUTH_NO,
LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS,
LDAP_SERVER_REQUIRE_STRONG_AUTH_YES,
};
/* DNS update settings */
enum dns_update_settings {DNS_UPDATE_OFF, DNS_UPDATE_ON, DNS_UPDATE_SIGNED};

12
lib/param/param_table.c
View File

@ -223,6 +223,18 @@ static const struct enum_list enum_ldap_sasl_wrapping[] = {
{-1, NULL}
};
static const struct enum_list enum_ldap_server_require_strong_auth_vals[] = {
{ LDAP_SERVER_REQUIRE_STRONG_AUTH_NO, "No" },
{ LDAP_SERVER_REQUIRE_STRONG_AUTH_NO, "False" },
{ LDAP_SERVER_REQUIRE_STRONG_AUTH_NO, "0" },
{ LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS,
"allow_sasl_over_tls" },
{ LDAP_SERVER_REQUIRE_STRONG_AUTH_YES, "Yes" },
{ LDAP_SERVER_REQUIRE_STRONG_AUTH_YES, "True" },
{ LDAP_SERVER_REQUIRE_STRONG_AUTH_YES, "1" },
{-1, NULL}
};
static const struct enum_list enum_ldap_ssl[] = {
{LDAP_SSL_OFF, "no"},
{LDAP_SSL_OFF, "off"},

3
source3/param/loadparm.c
View File

@ -741,6 +741,9 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)
Globals.client_ldap_sasl_wrapping = ADS_AUTH_SASL_SIGN;
Globals.ldap_server_require_strong_auth =
LDAP_SERVER_REQUIRE_STRONG_AUTH_NO;
/* This is what we tell the afs client. in reality we set the token
* to never expire, though, when this runs out the afs client will
* forget the token. Set to 0 to get NEVERDATE.*/