|
 |
b6b438 |
From a1c732637f1ed984e1ff76fa8179d6fd3aa036fb Mon Sep 17 00:00:00 2001
|
|
|
b6b438 |
From: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
Date: Mon, 18 Nov 2019 17:42:11 +0100
|
|
|
b6b438 |
Subject: [PATCH 206/208] param: Do not use weak crypto in ldap server if
|
|
|
b6b438 |
disallowed
|
|
|
b6b438 |
|
|
|
b6b438 |
Signed-off-by: Andreas Schneider <asn@samba.org>
|
|
|
b6b438 |
---
|
|
|
b6b438 |
.../ldap/ldapserverrequirestrongauth.xml | 5 +++++
|
|
|
b6b438 |
lib/param/loadparm.c | 8 ++++++++
|
|
|
b6b438 |
source3/include/proto.h | 1 +
|
|
|
b6b438 |
source3/param/loadparm.c | 14 +++++++++++++-
|
|
|
b6b438 |
4 files changed, 27 insertions(+), 1 deletion(-)
|
|
|
b6b438 |
|
|
|
b6b438 |
diff --git a/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml b/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml
|
|
|
b6b438 |
index 02bdd811491..e40ac06dfe6 100644
|
|
|
b6b438 |
--- a/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml
|
|
|
b6b438 |
+++ b/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml
|
|
|
b6b438 |
@@ -2,6 +2,7 @@
|
|
|
b6b438 |
context="G"
|
|
|
b6b438 |
type="enum"
|
|
|
b6b438 |
enumlist="enum_ldap_server_require_strong_auth_vals"
|
|
|
b6b438 |
+ function="_ldap_server_require_strong_auth"
|
|
|
b6b438 |
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
|
b6b438 |
<description>
|
|
|
b6b438 |
<para>
|
|
|
b6b438 |
@@ -21,6 +22,10 @@
|
|
|
b6b438 |
<para>A value of <emphasis>yes</emphasis> allows only simple binds
|
|
|
b6b438 |
over TLS encrypted connections. Unencrypted connections only
|
|
|
b6b438 |
allow sasl binds with sign or seal.</para>
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ <para>If weak cryptography is not allowed by the system, then this
|
|
|
b6b438 |
+ variable will default to <constant>allow_sasl_over_tls</constant>
|
|
|
b6b438 |
+ and setting it to <constant>no</constant> will not have any effect.</para>
|
|
|
b6b438 |
</description>
|
|
|
b6b438 |
<value type="default">yes</value>
|
|
|
b6b438 |
</samba:parameter>
|
|
|
b6b438 |
diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
|
|
|
b6b438 |
index 41a4c110195..b1497f00aaa 100644
|
|
|
b6b438 |
--- a/lib/param/loadparm.c
|
|
|
b6b438 |
+++ b/lib/param/loadparm.c
|
|
|
b6b438 |
@@ -105,6 +105,14 @@ int lpcfg_kerberos_encryption_types(struct loadparm_context *lp_ctx)
|
|
|
b6b438 |
return lpcfg__kerberos_encryption_types(lp_ctx);
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
+enum ldap_server_require_strong_auth lpcfg_ldap_server_require_strong_auth(struct loadparm_context *lp_ctx)
|
|
|
b6b438 |
+{
|
|
|
b6b438 |
+ if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED) {
|
|
|
b6b438 |
+ return LDAP_SERVER_REQUIRE_STRONG_AUTH_YES;
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ return lpcfg__ldap_server_require_strong_auth(lp_ctx);
|
|
|
b6b438 |
+}
|
|
|
b6b438 |
|
|
|
b6b438 |
enum samba_weak_crypto lpcfg_weak_crypto(struct loadparm_context *lp_ctx)
|
|
|
b6b438 |
{
|
|
|
b6b438 |
diff --git a/source3/include/proto.h b/source3/include/proto.h
|
|
|
b6b438 |
index aaa101fc63c..c758c31ea67 100644
|
|
|
b6b438 |
--- a/source3/include/proto.h
|
|
|
b6b438 |
+++ b/source3/include/proto.h
|
|
|
b6b438 |
@@ -756,6 +756,7 @@ int lp_rpc_low_port(void);
|
|
|
b6b438 |
int lp_rpc_high_port(void);
|
|
|
b6b438 |
bool lp_lanman_auth(void);
|
|
|
b6b438 |
int lp_kerberos_encryption_types(void);
|
|
|
b6b438 |
+enum ldap_server_require_strong_auth lp_ldap_server_require_strong_auth(void);
|
|
|
b6b438 |
enum samba_weak_crypto lp_weak_crypto(void);
|
|
|
b6b438 |
|
|
|
b6b438 |
int lp_wi_scan_global_parametrics(
|
|
|
b6b438 |
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
|
|
|
b6b438 |
index e68140ae5f0..da2af1f9f46 100644
|
|
|
b6b438 |
--- a/source3/param/loadparm.c
|
|
|
b6b438 |
+++ b/source3/param/loadparm.c
|
|
|
b6b438 |
@@ -754,7 +754,7 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)
|
|
|
b6b438 |
|
|
|
b6b438 |
Globals.client_ldap_sasl_wrapping = ADS_AUTH_SASL_SIGN;
|
|
|
b6b438 |
|
|
|
b6b438 |
- Globals.ldap_server_require_strong_auth =
|
|
|
b6b438 |
+ Globals._ldap_server_require_strong_auth =
|
|
|
b6b438 |
LDAP_SERVER_REQUIRE_STRONG_AUTH_YES;
|
|
|
b6b438 |
|
|
|
b6b438 |
/* This is what we tell the afs client. in reality we set the token
|
|
|
b6b438 |
@@ -4688,6 +4688,18 @@ int lp_kerberos_encryption_types(void)
|
|
|
b6b438 |
return lp__kerberos_encryption_types();
|
|
|
b6b438 |
}
|
|
|
b6b438 |
|
|
|
b6b438 |
+enum ldap_server_require_strong_auth lp_ldap_server_require_strong_auth(void)
|
|
|
b6b438 |
+{
|
|
|
b6b438 |
+ enum ldap_server_require_strong_auth a =
|
|
|
b6b438 |
+ lp__ldap_server_require_strong_auth();
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED) {
|
|
|
b6b438 |
+ return MAX(a, LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS);
|
|
|
b6b438 |
+ }
|
|
|
b6b438 |
+
|
|
|
b6b438 |
+ return a;
|
|
|
b6b438 |
+}
|
|
|
b6b438 |
+
|
|
|
b6b438 |
struct loadparm_global * get_globals(void)
|
|
|
b6b438 |
{
|
|
|
b6b438 |
return &Globals;
|
|
|
b6b438 |
--
|
|
|
b6b438 |
2.23.0
|
|
|
b6b438 |
|