samba.git/libcli/auth/ntlm_check.c, branch talloc-2.2.0

libcli:auth: Only use the required md4 header

2019-02-27T07:59:27+00:00

Signed-off-by: Andreas Schneider 
Reviewed-by: Volker Lendecke

CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth".

2018-08-14T11:57:15+00:00

This fixes a regression that came in via 00db3aba6cf9ebaafdf39ee2f9c7ba5ec2281ea0.

Found by Vivek Das  (Red Hat QE).

In order to demonstrate simply run:

smbclient //server/share -U user%password -mNT1 -c quit \
--option="client ntlmv2 auth"=no \
--option="client use spnego"=no

against a server that uses "ntlm auth = ntlmv2-only" (our default
setting).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360

CVE-2018-1139: Weak authentication protocol allowed.

Guenther

Pair-Programmed-With: Stefan Metzmacher 
Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider 
Reviewed-by: Jeremy Allison 
Reviewed-by: Gary Lockyer

CVE-2018-1139 libcli/auth: fix debug messages in hash_password_check()

2018-08-14T11:57:15+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360

CVE-2018-1139: Weak authentication protocol allowed.

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider 
Reviewed-by: Jeremy Allison 
Reviewed-by: Gary Lockyer

param: Add new "disabled" value to "ntlm auth" to disable NTLM totally

2017-07-04T04:57:20+00:00

Signed-off-by: Andrew Bartlett 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923
Reviewed-by: Garming Sam

auth: Allow NTLMv1 if MSV1_0_ALLOW_MSVCHAPV2 is given and re-factor 'ntlm auth ='

2017-07-04T04:57:20+00:00

The ntlm auth parameter is expanded to more clearly describe the
role of each option, and to allow the new mode that permits MSCHAPv2
(as declared by the client over the NETLOGON protocol) while
still banning NTLMv1.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12252
Signed-off-by: Andrew Bartlett 

Based on a patch by Mantas Mikulėnas :

Commit 0b500d413c5b ("Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth")
added the --allow-mschapv2 option, but didn't implement checking for it
server-side. This implements such checking.

Additionally, Samba now disables NTLMv1 authentication by default for
security reasons. To avoid having to re-enable it globally, 'ntlm auth'
becomes an enum and a new setting is added to allow only MSCHAPv2.

Signed-off-by: Mantas Mikulėnas 
Reviewed-by: Garming Sam

libcli: Use "all_zero" where appropriate

2017-01-03T15:04:28+00:00

... Saves a few bytes of footprint

Signed-off-by: Volker Lendecke 
Reviewed-by: Ralph Boehme

Typo: s/preceeded/preceded/

2014-04-14T01:51:15+00:00

Caught by lintian, the Debian package linter :)

Change-Id: Ia7162ea8c2b1845155345526b66d71ae64f15227
Reviewed-on: https://gerrit.samba.org/216
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Jelmer Vernooij 
Autobuild-Date(master): Mon Apr 14 03:51:15 CEST 2014 on sn-devel-104

Remove useless bool "upper_case_domain" parameter from ntv2_owf_gen().

2012-08-24T19:39:41+00:00

The code in SMBNTLMv2encrypt_hash() should not be requesting case
changes on the domain name.

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Fri Aug 24 21:39:42 CEST 2012 on sn-devel-104

Remove useless bool "upper_case_domain" parameter.

2012-08-24T17:57:11+00:00

Move uppercasing the domain out of smb_pwd_check_ntlmv2()

2012-08-24T17:57:01+00:00

Allows us to remove a silly bool parameter.

Based on work done by "Blohm, Guntram (I/FP-37, extern)" .