samba.git/libcli/auth, branch v4-7-stable

CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth".

2018-08-11T19:56:43+00:00

This fixes a regression that came in via 00db3aba6cf9ebaafdf39ee2f9c7ba5ec2281ea0.

Found by Vivek Das  (Red Hat QE).

In order to demonstrate simply run:

smbclient //server/share -U user%password -mNT1 -c quit \
--option="client ntlmv2 auth"=no \
--option="client use spnego"=no

against a server that uses "ntlm auth = ntlmv2-only" (our default
setting).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360

CVE-2018-1139: Weak authentication protocol allowed.

Guenther

Pair-Programmed-With: Stefan Metzmacher 
Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider

CVE-2018-1139 libcli/auth: fix debug messages in hash_password_check()

2018-08-11T19:56:42+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360

CVE-2018-1139: Weak authentication protocol allowed.

Guenther

Signed-off-by: Guenther Deschner 
Reviewed-by: Andreas Schneider

CVE-2018-1139 libcli/auth: Add initial tests for ntlm_password_check()

2018-08-11T19:56:42+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360

Signed-off-by: Andrew Bartlett

lib: auth: Store the netlogon_creds_cli_global_db pointer on the NULL context.

2017-08-17T08:38:22+00:00

Now we shutdown correctly it doesn't need the talloc_autofree_context().

Last use of talloc_autofree_context() ourside the talloc test code !

Please don't add it ever again :-).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12932

Signed-off-by: Jeremy Allison 
Reviewed-by: Andrew Bartlett 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Thu Jul 27 01:34:12 CEST 2017 on sn-devel-144

(cherry picked from commit e74081ce5d0f81024f7384816c589e5bc28baf80)

lib: auth: Add a shutdown function for netlogon_creds_cli_global_db.

2017-08-17T08:38:22+00:00

Will allow us to move off the talloc_autofree_context().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12932

Signed-off-by: Jeremy Allison 
Reviewed-by: Andrew Bartlett 
(cherry picked from commit 4cc104d015bdfeb631c7c8f5252fc31727a128ca)

lib: cli: fname is a local variable already freed in the function scope, doesn't need to be on talloc_autofree_context()

2017-08-17T08:38:21+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12932

Signed-off-by: Jeremy Allison 
Reviewed-by: Andrew Bartlett 
(cherry picked from commit 5c8a98c2dae92c71873798eb37f506093700a14c)

param: Add new "disabled" value to "ntlm auth" to disable NTLM totally

2017-07-04T04:57:20+00:00

Signed-off-by: Andrew Bartlett 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923
Reviewed-by: Garming Sam

auth: Allow NTLMv1 if MSV1_0_ALLOW_MSVCHAPV2 is given and re-factor 'ntlm auth ='

2017-07-04T04:57:20+00:00

The ntlm auth parameter is expanded to more clearly describe the
role of each option, and to allow the new mode that permits MSCHAPv2
(as declared by the client over the NETLOGON protocol) while
still banning NTLMv1.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12252
Signed-off-by: Andrew Bartlett 

Based on a patch by Mantas Mikulėnas :

Commit 0b500d413c5b ("Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth")
added the --allow-mschapv2 option, but didn't implement checking for it
server-side. This implements such checking.

Additionally, Samba now disables NTLMv1 authentication by default for
security reasons. To avoid having to re-enable it globally, 'ntlm auth'
becomes an enum and a new setting is added to allow only MSCHAPv2.

Signed-off-by: Mantas Mikulėnas 
Reviewed-by: Garming Sam

libcli/auth: pass the cleartext blob to netlogon_creds_cli_ServerPasswordSet*()

2017-06-27T14:57:46+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider

libcli/auth: add const to set_pw_in_buffer()

2017-06-27T14:57:46+00:00

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12782

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andreas Schneider