From 499fd673befa6fed6bd0e542d9bb06cb49bd150e Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Thu, 11 Apr 2019 11:40:11 +0200 Subject: [PATCH 198/208] s3:param: Only allow SMB 3.0+ for DCERPC client connections over named pipes We need an AES encrypted transport as some RPC services only encrypt secrets using RC4, e.g. password changes over SAMR. Signed-off-by: Andreas Schneider --- source3/param/loadparm.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index b52e2bcb036..c1d02cf5bc6 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -4614,6 +4614,15 @@ int lp_client_max_protocol(void) int lp_client_ipc_min_protocol(void) { int client_ipc_min_protocol = lp__client_ipc_min_protocol(); + + /* + * If weak crypto is not allowed, force at least SMB3 which offers AES + * encrypted connections. + */ + if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED) { + return MAX(client_ipc_min_protocol, PROTOCOL_SMB3_00); + } + if (client_ipc_min_protocol == PROTOCOL_DEFAULT) { client_ipc_min_protocol = lp_client_min_protocol(); } -- 2.23.0