summaryrefslogtreecommitdiff
path: root/lib/param/param_table.c
AgeCommit message (Collapse)AuthorFilesLines
2025-11-10lib: Simplify num_parameters() with ARRAY_SIZE()Volker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-11-10smbd: Fix a few possible buffer read overrunsVolker Lendecke1-1/+3
... only happens with invalid smb.conf settings.... Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Anoop C S <anoopcs@samba.org>
2025-10-10config: add strong certificate binding enforcementGary Lockyer1-0/+9
This parameter controls the enforcement of Windows Certificate bindings as outlined in "KB5014754: Certificate-based authentication changes on Windows domain controllers", when preforming certificate based kerberos authentication (PKINIT) Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2025-01-13docs-xml/smbdotconf: add "client use krb5 netlogon" optionStefan Metzmacher1-0/+12
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
2024-11-11param: Add "client netlogon ping protocol"Volker Lendecke1-0/+8
Allow "net ads join" in environments where UDP/389 is blocked. Code will follow. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2024-04-23smbdotconf: add client ldap sasl wrapping = {starttls,ldaps}Stefan Metzmacher1-0/+2
In order to use SASL authentitation within a TLS connection we now provide "client ldap sasl wrapping = starttls" or "client ldap sasl wrapping = ldaps". Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-23s4:ldap_server: add support for tls channel bindingsStefan Metzmacher1-0/+2
ldap server require strong auth = allow_sasl_over_tls is now an alias for 'allow_sasl_without_tls_channel_bindings' and should be avoided and changed to 'yes' or 'allow_sasl_without_tls_channel_bindings'. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15621 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-26docs-xml: Add new parameter "acl claims evaluation"Andrew Bartlett1-0/+6
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2023-06-21docs-xml/smbdotconf: also allow 2012[_R2] for 'ad dc functional level'Stefan Metzmacher1-0/+2
We may not jump to 2016 directly... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-05-16param: Add new parameter "ad dc functional level"Andrew Bartlett1-0/+7
This allows the new unsupported functional levels to be unlocked, but with an smb.conf option that is easily seen. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2023-04-06lib/util: Add "debug syslog format = always", which logs to stdout in syslog ↵Andrew Bartlett1-0/+12
style Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-12-16s3-librpc: add ads.idl and convert ads_struct to talloc.Günther Deschner1-0/+1
Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-06-26dsdb: Allow password history and password changes without an NT hashAndrew Bartlett1-0/+7
We now allow this to be via the ENCTYPE_AES256_CTS_HMAC_SHA1_96 hash instead which allows us to decouple Samba from the unsalted NT hash for organisations that are willing to take this step (for user accounts). (History checking is limited to the last three passwords only, as ntPwdHistory is limited to NT hash values, and the PrimaryKerberosCtr4 package only stores three sets of keys.) Since we don't store a salt per-key, but only a single salt, the check will fail for a previous password if the account was renamed prior to a newer password being set. Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2021-11-09CVE-2020-25717: Add FreeIPA domain controller roleAlexander Bokovoy1-0/+1
As we want to reduce use of 'classic domain controller' role but FreeIPA relies on it internally, add a separate role to mark FreeIPA domain controller role. It means that role won't result in ROLE_STANDALONE. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801 BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Alexander Bokovoy <ab@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-07-15docs-xml: remove support for "SMB3_10"Stefan Metzmacher1-1/+0
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-07-15docs-xml: remove support for "SMB2_24"Stefan Metzmacher1-1/+0
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-07-15docs-xml: remove support for "SMB2_22"Stefan Metzmacher1-1/+0
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2021-04-28lib:param: Add 'client protection' config optionAndreas Schneider1-0/+8
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2021-04-28lib:param: Add 'client use kerberos' config parameterAndreas Schneider1-0/+12
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2020-08-19param: Create and use enum_smb_encryption_valsAndreas Schneider1-0/+23
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2019-11-12Detect when command line max protocol < min protocolDavid Mulder1-0/+11
Due to the increased default minimum protocol level to SMB2, some users notice that specifying smbclient -m NT1 fails with NT_STATUS_CONNECTION_DISCONNECTED, with no SMB traffic on the wire. Report when the max protocol is set less than the min protocol. Signed-off-by: David Mulder <dmulder@suse.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Noel Power <npower@samba.org> Autobuild-User(master): Noel Power <npower@samba.org> Autobuild-Date(master): Tue Nov 12 17:52:28 UTC 2019 on sn-devel-184
2019-10-09s3:mdssvc: add Elasticsearch backendRalph Boehme1-0/+1
Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Noel Power <noel.power@suse.com>
2019-08-08s3:mdssvc: add noindex backendRalph Boehme1-0/+1
Add a new default backend that, while allowing mdsvc RPC and search queries from clients, always returns no results. Shares using this backend will behave the same way as shares on a macOS SMB server where indexing is disabled. This change will later also allow us to compile the Spotlight RPC service by default which is a big step in the direction of adding tests to CI. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-08-08s3:mdssvc: new option "spotlight backend"Ralph Boehme1-0/+5
Currently there's only the tracker backend, but subsequent commits will add other backends. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-12-08Add mdns name configuration optionKevin Anderson1-0/+6
Add the mdns name configuration variable to control the mdns hostname. The default is to use the NETBIOS name of the system to match previous versions which is typically the hostname in all capitals. A value of mdns can be provided to defer the hostname to the mdns library. With the recent patch to support time machine being merged this patch allows for a user to configure the server name that is advertised to be lower cased through Avahi advertisements. Signed-off-by: Kevin Anderson <andersonkw2@gmail.com> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-07-04param: Add new "disabled" value to "ntlm auth" to disable NTLM totallyAndrew Bartlett1-0/+1
Signed-off-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11923 Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-07-04auth: Allow NTLMv1 if MSV1_0_ALLOW_MSVCHAPV2 is given and re-factor 'ntlm ↵Andrew Bartlett1-0/+14
auth =' The ntlm auth parameter is expanded to more clearly describe the role of each option, and to allow the new mode that permits MSCHAPv2 (as declared by the client over the NETLOGON protocol) while still banning NTLMv1. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12252 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Based on a patch by Mantas Mikulėnas <mantas@utenos-kolegija.lt>: Commit 0b500d413c5b ("Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth") added the --allow-mschapv2 option, but didn't implement checking for it server-side. This implements such checking. Additionally, Samba now disables NTLMv1 authentication by default for security reasons. To avoid having to re-enable it globally, 'ntlm auth' becomes an enum and a new setting is added to allow only MSCHAPv2. Signed-off-by: Mantas Mikulėnas <mantas@utenos-kolegija.lt> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-03-14param: Allow to specify kerberos method on the commandlineAndreas Schneider1-0/+4
We support --option for our tools but you cannot set an option where the value of the option includes a space. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlet <abartlet@samba.org>
2017-01-09s3/smbd: new "mangled names" setting "illegal"Ralph Boehme1-0/+1
This does mangling for names with illegal NTFS characters, but not for names longer then 8.3: Name mangling with mangled named = yes ====================================== Mangled | Short | Name ---------------------------- | | foo | yes | 123456789 yes | | foo:bar Name mangling with mangled named = illegal ========================================== Mangled | Short | Name ---------------------------- | | foo | | 123456789 yes | | foo:bar Setting "mangled names = illegal" is the most sensible setting for modern clients that don't use the shortname anymore. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-01-09s3/smbd: convert "mangled names" option to an enumRalph Boehme1-0/+10
This is in preparation of adding an additional setting for this option. No change in behaviour by this commit, that comes in the next one. Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-10smbd: add an option to inherit only the UNIX ownerUri Simchoni1-0/+6
This can be used to emulate folder quotas, as explained in the modified manpage. Signed-off-by: Uri Simchoni <uri@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-09s3-param: add kerberos encryption types parameterUri Simchoni1-0/+9
Signed-off-by: Uri Simchoni <uri@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-04-12CVE-2016-2113: docs-xml: add "tls verify peer" option defaulting to "no_check"Stefan Metzmacher1-0/+15
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11752 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2016-04-12CVE-2016-2112: docs-xml: add "ldap server require strong auth" optionStefan Metzmacher1-0/+12
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Günther Deschner <gd@samba.org>
2016-01-13Avoid including libds/common/roles.h in public loadparm.h header.Jelmer Vernooij1-0/+1
Signed-Off-By: Jelmer Vernooij <jelmer@samba.org> Reviewed-By: Andrew Bartlett <abartlet@samba.org> Reviewed-By: Stefan Metzmacher <metze@samba.org>
2015-07-31param: use the generated parameter table.Michael Adam1-1/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: move the actual table out into param_table_static.cMichael Adam1-3733/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: don't list '-valid' and 'copy' as synonyms - they aren'tMichael Adam1-2/+0
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: make 'timestamp logs' the default writing of 'debug timestamp'Michael Adam1-0/+1
This is how it used internally. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: add SYNONYM flag where missingMichael Adam1-1/+9
thereby remove DEPRECATED flags: synonyms currently only carry the syn flag. Other flags sit on the primary entry. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: rename szIdmapGID -> idmap_gidMichael Adam1-2/+2
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: rename szIdmapUID -> idmap_uidMichael Adam1-2/+2
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: rename szIdmapBackend -> idmap_backendMichael Adam1-1/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: rename szInclude -> includeMichael Adam1-1/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: rename szCopy -> copyMichael Adam1-1/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: rename bAvailable -> availableMichael Adam1-1/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: make 'realm' use the standard 'realm' variable.Michael Adam1-1/+1
This way, the generated lp_realm() function matches the param_table. realm_original is only treated in the special handler now. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: rename CupsEncrypt -> cups_encryptMichael Adam1-1/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: rename winbindMaxDomainConnections -> _winbind_max_domain_connectionsMichael Adam1-1/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-07-31param: rename bWidelinks -> wide_linksMichael Adam1-1/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-06 20:56:45 +0000