samba.git/source3/param, branch ldb-1.2.3

s3/loadparm: don't mark IPC$ as autoloaded

2017-12-05T09:34:26+00:00

A related problem that affects configuration for the hidden IPC$
share. This share is marked a "autoloaded" and such shares are not
reloaded when requested. That resulted in the tcon to IPC$ still using
encrpytion after running the following sequence of changes:

1. stop Samba
2. set [global] smb encrypt = required
3. start Samba
4. remove [global] smb encrypt = required
5. smbcontrol smbd reload-config
6a bin/smbclient -U slow%x //localhost/raw -c quit, or
6b bin/smbclient -U slow%x -mNT1 //localhost/raw -c ls

In 6a the client simply encrypted packets on the IPC$ tcon. In 6b the
client got a tcon failure with NT_STATUS_ACCESS_DENIED, but silently
ignore the error.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13051

Signed-off-by: Ralph Boehme 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Tue Nov 28 02:02:37 CET 2017 on sn-devel-144

(cherry picked from commit deaaff6843159f02bb15aeaf457f8af305e40164)

s3/loadparm: ensure default service options are not changed

2017-12-05T09:34:26+00:00

Rename sDefault to _sDefault and make it const. sDefault is make a copy
of _sDefault in in the initialisation function lp_load_ex().

As we may end up in setup_lp_context() without going through
lp_load_ex(), sDefault may still be uninitialized at that point, so I'm
initializing lp_ctx->sDefault from _sDefault.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13051

Signed-off-by: Ralph Boehme 
Reviewed-by: Jeremy Allison 
(cherry picked from commit ea4e6f95ae5c97e8570b8090ee7e7a577b49a8c3)

s3/loadparm: allocate a fresh sDefault object per lp_ctx

2017-12-05T09:34:26+00:00

This is in preperation of preventing direct access to sDefault in all
places that currently modify it.

As currently s3/loadparm is afaict not accessing lp_ctx->sDefault, but
changes sDefault indirectly through lp_parm_ptr() this change is just a
safety measure to prevent future breakage.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13051

Signed-off-by: Ralph Boehme 
Reviewed-by: Jeremy Allison 
(cherry picked from commit 1fc103547023aa1c880713e5b65ec164acb58b54)

param: Disable LanMan authentication unless NTLMv1 is also enabled

2017-07-04T04:57:20+00:00

Signed-off-by: Andrew Bartlett 
Reviewed-by: Garming Sam 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923

auth: Allow NTLMv1 if MSV1_0_ALLOW_MSVCHAPV2 is given and re-factor 'ntlm auth ='

2017-07-04T04:57:20+00:00

The ntlm auth parameter is expanded to more clearly describe the
role of each option, and to allow the new mode that permits MSCHAPv2
(as declared by the client over the NETLOGON protocol) while
still banning NTLMv1.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12252
Signed-off-by: Andrew Bartlett 

Based on a patch by Mantas Mikulėnas :

Commit 0b500d413c5b ("Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth")
added the --allow-mschapv2 option, but didn't implement checking for it
server-side. This implements such checking.

Additionally, Samba now disables NTLMv1 authentication by default for
security reasons. To avoid having to re-enable it globally, 'ntlm auth'
becomes an enum and a new setting is added to allow only MSCHAPv2.

Signed-off-by: Mantas Mikulėnas 
Reviewed-by: Garming Sam

param: change the effective default for "client max protocol" to the latest supported protocol

2017-06-27T14:57:48+00:00

Currently it's SMB3_11.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s3:param: Allow to add usershare if uid_wrapper is loaded

2017-06-27T14:57:42+00:00

Signed-off-by: Andreas Schneider 
Reviewed-by: Alexander Bokovoy 
Reviewed-by: Stefan Metzmacher

docs-xml: change the default for "map untrusted to domain" to "auto"

2017-06-16T01:21:29+00:00

This makes the behaviour much more robust, particularly with forest child
domains over one-way forest trusts.

Sadly we don't support this kind of setup with our current ADDC, so
there's no way to have automated tests for this behaviour, but
at least we know it doesn't break any existing tests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=8630

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

param: Add 'mit kdc command' to change the default.

2017-04-29T21:31:09+00:00

Signed-off-by: Andreas Schneider 
Reviewed-by: Andrew Bartlet 
Reviewed-by: Jeremy Allison

s3:param: Use new utility function to hide use of global_iconv_handle

2017-04-18T09:47:17+00:00

Add error return check.

Signed-off-by: Jeremy Allison 
Reviewed-by: Andreas Schneider