sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-08-04 08:22:08 +03:00
Code Activity

allow users to disable the NetWkstaUserLogon call in server level

Browse Source 
security by changing a setting in local.h or adding it to their
Makefile. See comment in local.h
This commit is contained in:
Andrew Tridgell
-
parent 7a88bed4a5
commit cc10fdf758
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
source/include/local.h
View File

@ -25,6 +25,16 @@
*/ */
#define PRINTCAP_NAME "/etc/printcap" #define PRINTCAP_NAME "/etc/printcap"
/* this affects server level security. With this set (recommended)
samba will do a full NetWkstaUserLogon to confirm that the client
really should have login rights. This can cause problems with
machines in trust relationships in which case you can disable it
here, but be warned, we have heard that some NT machines will then
allow anyone in with any password! Make sure you test it. */
#ifndef USE_NETWKSTAUSERLOGON
#define USE_NETWKSTAUSERLOGON 1
#endif
/* define what facility to use for syslog */ /* define what facility to use for syslog */
#ifndef SYSLOG_FACILITY #ifndef SYSLOG_FACILITY
#define SYSLOG_FACILITY LOG_DAEMON #define SYSLOG_FACILITY LOG_DAEMON

2
source/smbd/password.c
View File

@ -1589,6 +1589,7 @@ BOOL server_validate(char *user, char *domain,
} }
#if USE_NETWKSTAUSERLOGON
if (!cli_NetWkstaUserLogon(&cli,user,local_machine)) { if (!cli_NetWkstaUserLogon(&cli,user,local_machine)) {
DEBUG(1,("password server %s failed NetWkstaUserLogon\n", cli.desthost)); DEBUG(1,("password server %s failed NetWkstaUserLogon\n", cli.desthost));
cli_tdis(&cli); cli_tdis(&cli);
@ -1608,6 +1609,7 @@ BOOL server_validate(char *user, char *domain,
cli_tdis(&cli); cli_tdis(&cli);
return False; return False;
} }
#endif
DEBUG(3,("password server %s accepted the password\n", cli.desthost)); DEBUG(3,("password server %s accepted the password\n", cli.desthost));