From c9299bd6a4e86dbec10ab7741056f331a18c44a0 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 19 Mar 2015 13:09:21 -0700 Subject: [PATCH] docs: Mark 'client use spnego principal' as deprecated and also a bad idea. Bug 10888 - smbclient doesn't ignore "not_defined_in_RFC4178@please_ignore" https://bugzilla.samba.org/show_bug.cgi?id=10888 Signed-off-by: Jeremy Allison Reviewed-by: Stefan (metze) Metzmacher --- docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml | 7 +++++++ lib/param/param_table.c | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml b/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml index 6ec1eb11165..792a7386f36 100644 --- a/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml +++ b/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml @@ -14,6 +14,10 @@ servers known only by IP address. Kerberos relies on names, so ordinarily cannot function in this situation. + This is a VERY BAD IDEA for security reasons, and so this + parameter SHOULD NOT BE USED. It will be removed in a future + version of Samba. + If disabled, Samba will use the name used to look up the server when asking the KDC for a ticket. This avoids situations where a server may impersonate another, soliciting authentication @@ -23,6 +27,9 @@ Note that Windows XP SP2 and later versions already follow this behaviour, and Windows Vista and later servers no longer supply this 'rfc4178 hint' principal on the server side. + + This parameter is deprecated in Samba 4.2.1 and will be removed + (along with the functionality) in a later release of Samba. no diff --git a/lib/param/param_table.c b/lib/param/param_table.c index d78b4d1f664..8b44733dbed 100644 --- a/lib/param/param_table.c +++ b/lib/param/param_table.c @@ -765,7 +765,7 @@ struct parm_struct parm_table[] = { .offset = GLOBAL_VAR(client_use_spnego_principal), .special = NULL, .enum_list = NULL, - .flags = FLAG_ADVANCED, + .flags = FLAG_ADVANCED | FLAG_DEPRECATED, }, { .label = "username",