samba.git/lib/param, branch talloc-2.4.0

s3-librpc: add ads.idl and convert ads_struct to talloc.

2022-12-16T20:38:32+00:00

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Jeremy Allison

CVE-2022-37966 param: Add support for new option "kdc supported enctypes"

2022-12-13T13:07:30+00:00

This allows admins to disable enctypes completely if required.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

CVE-2022-37966 param: let "kdc default domain supportedenctypes = 0" mean the default

2022-12-13T13:07:30+00:00

In order to allow better upgrades we need the default value for smb.conf to the
same even if the effective default value of the software changes in future.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

CVE-2022-37966 param: don't explicitly initialize "kdc force enable rc4 weak session keys" to false/"no"

2022-12-13T13:07:30+00:00

This is not squashed in order to allow easier backports...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

CVE-2022-37966 param: Add support for new option "kdc force enable rc4 weak session keys"

2022-12-13T13:07:29+00:00

Pair-Programmed-With: Joseph Sutton 

Signed-off-by: Andrew Bartlett 
Signed-off-by: Joseph Sutton 
Reviewed-by: Stefan Metzmacher

CVE-2022-37966 param: Add support for new option "kdc default domain supportedenctypes"

2022-12-13T13:07:29+00:00

This matches the Windows registry key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\KDC\DefaultDomainSupportedEncTypes

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Pair-Programmed-With: Andrew Bartlett 

Signed-off-by: Joseph Sutton 
Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

CVE-2022-38023 docs-xml/smbdotconf: add "server schannel require seal[:COMPUTERACCOUNT]" options

2022-12-13T13:07:29+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Ralph Boehme

CVE-2022-38023 docs-xml/smbdotconf: change 'reject md5 clients' default to yes

2022-12-13T13:07:29+00:00

AES is supported by Windows Server >= 2008R2, Windows (Client) >= 7 and Samba >= 4.0,
so there's no reason to allow md5 clients by default.
However some third party domain members may need it.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Ralph Boehme

CVE-2022-38023 docs-xml/smbdotconf: change 'reject md5 servers' default to yes

2022-12-13T13:07:29+00:00

AES is supported by Windows >= 2008R2 and Samba >= 4.0 so there's no
reason to allow md5 servers by default.

Note the change in netlogon_creds_cli_context_global() is only cosmetic,
but avoids confusion while reading the code. Check with:

 git show -U35 libcli/auth/netlogon_creds_cli.c

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Ralph Boehme

dsdb: Allow password history and password changes without an NT hash

2022-06-26T22:10:29+00:00

We now allow this to be via the ENCTYPE_AES256_CTS_HMAC_SHA1_96 hash instead
which allows us to decouple Samba from the unsalted NT hash for
organisations that are willing to take this step (for user accounts).

(History checking is limited to the last three passwords only, as
ntPwdHistory is limited to NT hash values, and the PrimaryKerberosCtr4
package only stores three sets of keys.)

Since we don't store a salt per-key, but only a single salt, the check
will fail for a previous password if the account was renamed prior to a
newer password being set.

Pair-Programmed-With: Stefan Metzmacher 

Signed-off-by: Andrew Bartlett 
Signed-off-by: Stefan Metzmacher 
Reviewed-by: Stefan Metzmacher