1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-05 09:18:06 +03:00
Commit Graph

50 Commits

Author SHA1 Message Date
Isaac Boukris
32eb7f3966 Remove depracated "ldap ssl ads" smb.conf option
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14462

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Isaac Boukris <iboukris@samba.org>
Autobuild-Date(master): Tue Aug 11 10:53:05 UTC 2020 on sn-devel-184
2020-08-11 10:53:05 +00:00
Isaac Boukris
9ec83caeb5 Decouple ldap-ssl-ads from ldap-ssl option
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14439

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2020-07-13 10:41:37 +00:00
Gary Lockyer
3149ea0a8a CVE-2020-10704: libcli ldap_message: Add search size limits to ldap_decode
Add search request size limits to ldap_decode calls.

The ldap server uses the smb.conf variable
"ldap max search request size" which defaults to 250Kb.
For cldap the limit is hard coded as 4096.

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-05-04 02:59:32 +00:00
Gary Lockyer
d7e5213818 CVE-2020-10704: smb.conf: Add max ldap request sizes
Add two new smb.conf parameters to control the maximum permitted ldap
request size.

Adds:
   ldap max anonymous request size       default 250Kb
   ldap max authenticated request size   default 16Mb

Credit to OSS-Fuzz

REF: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20454
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14334

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-05-04 02:59:32 +00:00
Ralph Boehme
24905ba82d docs-xml: remove explicit "constant"
The constant mark applied to types "string" and "ustring". The previous patches
in this patchset already markes all string options as either constant or
substituted, but it's still possible to add options or change existing ones to
be neither constant nor substituted.

In order to enforce strings to be either constant or substitued, remove the
explicit constant marker. Instead, any option that is not marked as substituted
is implicitly made constant.

This patch doesn't change behaviour and all generated files are the same before
and after this change.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:37 +00:00
Ralph Boehme
6f618b7c95 smbdotconf: mark "ldap user suffix" with constant="1"
Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned
directly, variable substitution isn't supported anyway, so we can just mark this
const.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:37 +00:00
Ralph Boehme
9ed8292a7b smbdotconf: mark "ldap machine suffix" with constant="1"
Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned
directly, variable substitution isn't supported anyway, so we can just mark this
const.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:37 +00:00
Ralph Boehme
b48d30e0e1 smbdotconf: mark "ldap idmap suffix" with constant="1"
Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned
directly, variable substitution isn't supported anyway, so we can just mark this
const.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:37 +00:00
Ralph Boehme
71e9c6e48b smbdotconf: mark "ldap group suffix" with constant="1"
Due to the use of append_ldap_suffix() where Globals.ldap_suffix is returned
directly, variable substitution isn't supported anyway, so we can just mark this
const.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:36 +00:00
Ralph Boehme
ca2e49fe42 smbdotconf: mark "ldap suffix" with constant="1"
Due to the use of append_ldap_suffix() where Globals.ldap_suffix was used
directly in the dependent options like "ldap group suffix", we can just mark
this option as const thereby removing substitution from "ldap suffix".

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:36 +00:00
Ralph Boehme
050c28364a smbdotconf: mark "ldap admin dn" with constant="1"
All the other LDAP related options like "ldap user suffix" don't support
variable substitution, so I guess it's safe to remove support for it from this
one as well.

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-27 10:25:36 +00:00
Mathieu Parent
eaa44d819d Spelling fixes s/retreiving/retrieving/
Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2019-09-01 22:21:27 +00:00
Björn Jacke
98ba88a7e4 params: mark "ldap ssl ads" as deprecated
Signed-off-by: Bjoern Jacke <bjacke@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2018-01-13 08:24:08 +01:00
Karolin Seeger
a592bdc51c docs: Add missing spaces in man smb.conf.
Signed-off-by: Karolin Seeger <kseeger@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Feb  9 23:58:02 CET 2017 on sn-devel-144
2017-02-09 23:58:02 +01:00
Marc Muehlfeld
976be8fe39 man: Wrong option for parameter ldap ssl in smb.conf man page
- "ldap ssl" does not accept the value "yes"
- Replaced "start_tls" with "start tls".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12023

Signed-off-by: Marc Muehlfeld <mmuehlfeld@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
2016-08-04 18:26:07 +02:00
Stefan Metzmacher
6e22abd977 CVE-2016-2112: docs-xml: change the default of "ldap server require strong auth" to "yes"
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
2016-04-12 19:25:25 +02:00
Stefan Metzmacher
0cd2acef79 CVE-2016-2112: docs-xml: add "ldap server require strong auth" option
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12 19:25:25 +02:00
Justin Maggard
8c2609f318 Change default LDAP page size to 1000.
This matches Windows' Active Directory maximum page size.

Signed-off-by: Justin Maggard <jmaggard@netgear.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
2016-01-15 00:54:26 +01:00
Michael Adam
f1846fb163 param: turn ldap idmap suffix into a generated function
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31 01:55:30 +02:00
Michael Adam
a5ddd036d2 param: turn ldap idmap suffix into a generated function
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31 01:55:30 +02:00
Michael Adam
e65b7ec877 param: turn ldap user suffix into a generated function
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31 01:55:29 +02:00
Michael Adam
d4fd07dedc param: turn ldap group suffix into a generated function
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31 01:55:29 +02:00
Michael Adam
63e3c75374 docs:smbdotconf: add enumlist property to parameters where missing
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31 01:55:29 +02:00
Michael Adam
64b720d284 docs:smbdotconf: make formatting of headers uniform.
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31 01:55:29 +02:00
Michael Adam
4a6a010e78 docs:smbdotconf: remove swat-specific flags.
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
2015-05-02 00:56:31 +02:00
Volker Lendecke
23390f1fee Docs: Remove some ntdb references
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2015-03-17 11:30:51 +01:00
Andrew Bartlett
afe02d12f4 winbindd: Change value of "ldap sasl wrapping" to sign
This is to disrupt MITM attacks between us and our DC

Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2014-09-30 12:32:05 +02:00
Garming Sam
d4822272c6 docs: insert meta data for ldap user suffix parameter - mark do not generate function
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-02-03 00:47:24 +01:00
Garming Sam
46da271af1 docs: insert meta data for ldap machine suffix parameter - mark do not generate function
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-02-03 00:47:23 +01:00
Garming Sam
a32400d2c4 docs: insert meta data for ldap idmap suffix parameter - mark do not generate function
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-02-03 00:47:23 +01:00
Garming Sam
e57ef85810 docs: insert meta data for ldap group suffix parameter - mark do not generate function
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-02-03 00:47:22 +01:00
Garming Sam
ee59dacfc4 docs: fix type for client ldap sasl wrapping parameter
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
2014-02-02 23:43:46 +01:00
Rusty Russell
2f4b21bb57 ntdb: switch between secrets.tdb and secrets.ntdb depending on 'use ntdb'
Since we open with dbwrap, it auto-converts old tdbs (which it will
rename to secrets.tdb.bak once it's done).

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Rusty Russell <rusty@rustcorp.com.au>
Autobuild-Date(master): Wed Feb 20 07:09:19 CET 2013 on sn-devel-104
2013-02-20 07:09:19 +01:00
Jelmer Vernooij
695df863ed smb.conf(5): Add 'ldap password sync' as synonym for 'ldap passwd sync'. 2012-10-18 22:34:31 +02:00
Björn Jacke
1b0690fd83 s3/doc: some spelling fixes
Thanks to Frans Luteijn <f.a.g.luteijn at knoware.nl> for providing the fixes!

Autobuild-User(master): Björn Jacke <bj@sernet.de>
Autobuild-Date(master): Mon Jun 11 23:16:26 CEST 2012 on sn-devel-104
2012-06-11 23:16:26 +02:00
Karolin Seeger
f740bdc47b s3:docs: Fix 'make manpages3'.
Karolin
2009-12-14 08:58:50 +01:00
Björn Jacke
c69b9b7890 s3:docs: document ldap deref 2009-12-11 13:28:31 +01:00
Karolin Seeger
9478ec35b5 s3:docs: Document "ldap page size".
Part of a fix for bug #6890 (Some smb.conf parameters are undocumented).

Karolin
2009-11-30 13:35:47 +01:00
Karolin Seeger
f381faa8d6 s3: Rename new parameter "ldap ref follow" to "ldap follow referral".
This parameter will be introduced with Samba 3.5.0.

Karolin
2009-10-26 12:11:59 +01:00
Jan Engelhardt
c5d5969e24 s3/smbldap: add option to disable following LDAP refs
Fix bug #6717.
2009-10-12 11:34:58 +02:00
Karolin Seeger
61f1747441 docs: Clarify "ldap ssl" description in man smb.conf.
Mention "ldap ssl ads".

Karolin
2009-02-06 09:42:55 +01:00
Karolin Seeger
02f13538f0 docs: Add description of "ldap ssl ads" to man smb.conf.
Karolin
2009-02-06 09:42:55 +01:00
root
cf9f2484b7 s3:loadparm/docs: Set default for "ldap ssl" to "start tls".
This has been discussed on samba-technical before.
3.3 and newer only!

Karolin
2008-12-21 08:55:30 +01:00
Björn Jacke
1aff97bc48 correct the description of the "ldap timeout" parameter 2008-12-19 14:23:11 +01:00
Karolin Seeger
580461629b docs: Update section "ldap ssl" in man smb.conf.
Remove non-existent value "on".
Change default value to "no".
Add hint about ldaps.

Karolin
2008-12-17 16:31:06 +01:00
Karolin Seeger
6ac36698e9 docs: Fix some formatting issues in the "ldap ssl" section of man smb.conf.
Karolin
2008-12-17 16:31:06 +01:00
Christoph Zauner
7617741e64 man pages: Fix typos.
(This used to be commit 881eaa26e0)
2008-06-12 09:26:10 +02:00
Karolin Seeger
d84aca59bb man pages: Fix typo.
Karolin
(cherry picked from commit 87bcff8dde)
(This used to be commit f0b3df1ff0)
2008-06-09 15:33:50 +02:00
Karolin Seeger
a307e90f3f man pages: Add documentation for new parameter 'ldap connection timeout'.
Karolin
(This used to be commit f7bfa1330c)
2008-06-03 16:44:59 +02:00
Gerald W. Carter
8f8a9f0190 Moving docs tree to docs-xml to make room for generated docs in the release tarball.
(This used to be commit 9f672c26d6)
2008-04-23 08:47:48 -05:00