samba.git/auth, branch v4-7-stable

krb5-samba: interdomain trust uses different salt principal

2018-09-05T16:44:46+00:00

Salt principal for the interdomain trust is krbtgt/DOMAIN@REALM where
DOMAIN is the sAMAccountName without the dollar sign ($)

The salt principal for the BLA$ user object was generated wrong.

dn: CN=bla.base,CN=System,DC=w4edom-l4,DC=base
securityIdentifier: S-1-5-21-4053568372-2049667917-3384589010
trustDirection: 3
trustPartner: bla.base
trustPosixOffset: -2147483648
trustType: 2
trustAttributes: 8
flatName: BLA

dn: CN=BLA$,CN=Users,DC=w4edom-l4,DC=base
userAccountControl: 2080
primaryGroupID: 513
objectSid: S-1-5-21-278041429-3399921908-1452754838-1597
accountExpires: 9223372036854775807
sAMAccountName: BLA$
sAMAccountType: 805306370
pwdLastSet: 131485652467995000

The salt stored by Windows in the package_PrimaryKerberosBlob
(within supplementalCredentials) seems to be
'W4EDOM-L4.BASEkrbtgtBLA' for the above trust
and Samba stores 'W4EDOM-L4.BASEBLA$'.

While the salt used when building the keys from
trustAuthOutgoing/trustAuthIncoming is
'W4EDOM-L4.BASEkrbtgtBLA.BASE', which we handle correct.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539

Pair-Programmed-With: Stefan Metzmacher 

Signed-off-by: Alexander Bokovoy 
Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Wed Sep  5 03:57:22 CEST 2018 on sn-devel-144

(cherry picked from commit f3e349bebc443133fdbe4e14b148ca8db8237060)

Autobuild-User(v4-7-test): Stefan Metzmacher 
Autobuild-Date(v4-7-test): Wed Sep  5 18:44:46 CEST 2018 on sn-devel-144

lib: Fix array size in audit_logging

2018-06-27T08:34:21+00:00

../lib/audit_logging/audit_logging.c: In function ‘json_add_timestamp’:
../lib/audit_logging/audit_logging.c:603:12: error: ‘%s’ directive
       output may be truncated writing up to 9 bytes into a region of size
       between 0 and 43 [-Werror=format-truncation=]
   "%s.%06ld%s",
            ^~
../lib/audit_logging/audit_logging.c:606:3:
   tz);
   ~~
../lib/audit_logging/audit_logging.c:600:2: note: ‘snprintf’ output
       between 8 and 70 bytes into a destination of size 50
  snprintf(
  ^~~~~~~~~
   timestamp,
   ~~~~~~~~~~
   sizeof(timestamp),
   ~~~~~~~~~~~~~~~~~~
   "%s.%06ld%s",
   ~~~~~~~~~~~~~
   buffer,
   ~~~~~~~
   tv.tv_usec,
   ~~~~~~~~~~~
   tz);
   ~~~

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13437

Signed-off-by: Andreas Schneider 
Reviewed-by: Guenther Deschner 

(cherry picked from commit 8b7c8eb3907e2123acee67949e88c26072afc81a)

auth/ntlmssp: fix handling of GENSEC_FEATURE_LDAP_STYLE as a server

2018-06-04T07:54:23+00:00

This fixes "NTLMSSP NTLM2 packet check failed due to invalid signature!"
error messages, which were generated if the client only sends
NTLMSSP_NEGOTIATE_SIGN without NTLMSSP_NEGOTIATE_SEAL on an LDAP
connection.

This fixes a regession in the combination of commits
77adac8c3cd2f7419894d18db735782c9646a202 and
3a0b835408a6efa339e8b34333906bfe3aacd6e3.

We need to evaluate GENSEC_FEATURE_LDAP_STYLE at the end
of the authentication (as a server, while we already
do so at the beginning as a client).

As a reminder I introduced GENSEC_FEATURE_LDAP_STYLE
(as an internal flag) in order to let us work as a
Windows using NTLMSSP for LDAP. Even if only signing is
negotiated during the authentication the following PDUs
will still be encrypted if NTLMSSP is used. This is exactly the
same as if the client would have negotiated NTLMSSP_NEGOTIATE_SEAL.
I guess it's a bug in Windows, but we have to reimplement that
bug. Note this only applies to NTLMSSP and only to LDAP!
Signing only works fine for LDAP with Kerberos
or DCERPC and NTLMSSP.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13427

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Wed May 16 03:26:03 CEST 2018 on sn-devel-144

(cherry picked from commit c7a3ce95ac4ce837d8fde36578b3b1f56c3ac2fa)

auth/ntlmssp: add ntlmssp_client:ldap_style_send_seal option

2018-06-04T07:54:22+00:00

This will be used to similate a Windows client only
using NTLMSSP_NEGOTIATE_SIGN without NTLMSSP_NEGOTIATE_SEAL
on an LDAP connection, which is indicated internally by
GENSEC_FEATURE_LDAP_STYLE.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13427

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
(cherry picked from commit 7f2bebf09cd8056b3f901dd9ff1fc9e9525f3e9d)

tests/bind.py: Add a bind test with NTLMSSP with no domain

2018-03-20T16:13:08+00:00

Confirmed to pass against Windows 2012 R2.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13206

Signed-off-by: Garming Sam 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher 
(cherry picked from commit 2e49a97777ebf5bffbeadca03517b4a21bca24c0)

auth: add auth_user_info_copy() function

2018-03-20T16:13:08+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13328

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Ralph Boehme 
(cherry picked from commit 6ff891195855403bc485725aef8d43d4e3cabacb)

CVE-2017-12150: auth/credentials: cli_credentials_authentication_requested() should check for NTLM_CCACHE/SIGN/SEAL

2017-09-20T10:00:34+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997

Signed-off-by: Stefan Metzmacher

source4 netlogon: Add authentication logging for ServerAuthenticate3

2017-07-31T09:31:13+00:00

Log NETLOGON authentication activity by instrumenting the
netr_ServerAuthenticate3 processing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12865

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Alexander Bokovoy 
(cherry picked from commit efc335a03062740f51a6edd09d765a8b77e239c5)

rpc: use symbolic constant to replace /root/ncalrpc_as_system

2017-07-31T09:31:12+00:00

Modified to use constant AS_SYSTEM_MAGIC_PATH_TOKEN instead of string literal
"/root/ncalrpc_as_system"

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12865

Signed-off-by: Gary Lockyer 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Alexander Bokovoy 
(cherry picked from commit 1898096c7ecef4c323b14b7cf30db4283386f913)

auth: Disable SChannel authentication if we are not a DC

2017-07-04T04:57:20+00:00

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam