7 Commits

Author	SHA1	Message	Date
Joseph Sutton	ce3b7b27a3	CVE-2022-2031 s4:kpasswd: Require an initial ticket ... Ensure that for password changes the client uses an AS-REQ to get the ticket to kpasswd, and not a TGS-REQ. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>	2022-07-27 10:52:36 +00:00
Joseph Sutton	714cadfc40	CVE-2022-2031 s4:kpasswd: Add MIT fallback for decoding setpw structure ... The target principal and realm fields of the setpw structure are supposed to be optional, but in MIT Kerberos they are mandatory. For better compatibility and ease of testing, fall back to parsing the simpler (containing only the new password) structure if the MIT function fails to decode it. Although the target principal and realm fields should be optional, one is not supposed to specified without the other, so we don't have to deal with the case where only one is specified. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>	2022-07-27 10:52:36 +00:00
Joseph Sutton	b423c370b9	CVE-2022-2031 s4:kpasswd: Account for missing target principal ... This field is supposed to be optional. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>	2022-07-27 10:52:36 +00:00
Andrew Bartlett	557b1ab5f9	kdc: Remove pre-check for existing NT and LM hash from kpasswd ... We no longer use the old NT and LM hash as proof of performing a password change, and this removes the privileged status of these attributes. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>	2022-03-17 01:57:38 +00:00
Ralph Boehme	4142bde7e5	s4: rename source4/smbd/ to source4/samba/ ... Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Fri Nov 27 10:07:18 UTC 2020 on sn-devel-184	2020-11-27 10:07:18 +00:00
Volker Lendecke	a167014554	krb5_wrap: Add a talloc_ctx to smb_krb5_principal_get_realm() ... Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>	2018-11-28 17:44:15 +01:00
Andreas Schneider	a1d9e8814a	s4-kdc: Add MIT Kerberos specific kpasswd code ... Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlet <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>	2017-04-29 23:31:10 +02:00