Gary Lockyer 1d3ae2d92f dsdb encrypted secrets module ...

Encrypt the samba secret attributes on disk.  This is intended to
mitigate the inadvertent disclosure of the sam.ldb file, and to mitigate
memory read attacks.

Currently the key file is stored in the same directory as sam.ldb but
this could be changed at a later date to use an HSM or similar mechanism
to protect the key.

Data is encrypted with AES 128 GCM. The encryption uses gnutls where
available and if it supports AES 128 GCM AEAD modes, otherwise nettle is
used.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

2017-12-18 00:10:16 +01:00

..

ldb_modules

dsdb encrypted secrets module

2017-12-18 00:10:16 +01:00

cracknames.c

samdb/cracknames: support user and service principal as desired format

2017-07-24 11:10:26 +02:00

samdb_privilege.c

s4-auth Remove event context from privilage database handling

2010-12-21 15:10:38 +11:00

samdb.c

samdb: Rework samdb_connect_url() to return LDB error code and an error string

2017-09-20 02:25:30 +02:00

samdb.h

dsdb encrypted secrets module

2017-12-18 00:10:16 +01:00