Andrew Bartlett [Sun, 23 Nov 2003 00:23:26 +0000 (00:23 +0000)]
(Merge from 3.0)
Patch by emil@disksites.com <Emil Rasamat> to ensure we always always
free() each auth method. (We had relied on the use of talloc() only,
despite providing the free() callback)
Andrew Bartlett [Sat, 22 Nov 2003 13:29:02 +0000 (13:29 +0000)]
(merge from 3.0)
Changes all over the shop, but all towards:
- NTLM2 support in the server
- KEY_EXCH support in the server
- variable length session keys.
In detail:
- NTLM2 is an extension of NTLMv1, that is compatible with existing
domain controllers (unlike NTLMv2, which requires a DC upgrade).
* This is known as 'NTLMv2 session security' *
(This is not yet implemented on the RPC pipes however, so there may
well still be issues for PDC setups, particuarly around password
changes. We do not fully understand the sign/seal implications of
NTLM2 on RPC pipes.)
This requires modifications to our authentication subsystem, as we
must handle the 'challege' input into the challenge-response algorithm
being changed. This also needs to be turned off for
'security=server', which does not support this.
- KEY_EXCH is another 'security' mechanism, whereby the session key
actually used by the server is sent by the client, rather than being
the shared-secret directly or indirectly.
- As both these methods change the session key, the auth subsystem
needed to be changed, to 'override' session keys provided by the
backend.
- There has also been a major overhaul of the NTLMSSP subsystem, to
merge the 'client' and 'server' functions, so they both operate on a
single structure. This should help the SPNEGO implementation.
- The 'names blob' in NTLMSSP is always in unicode - never in ascii.
Don't make an ascii version ever.
- The other big change is to allow variable length session keys. We
have always assumed that session keys are 16 bytes long - and padded
to this length if shorter. However, Kerberos session keys are 8 bytes
long, when the krb5 login uses DES.
* This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. *
- Add better DEBUG() messages to ntlm_auth, warning administrators of
misconfigurations that prevent access to the privileged pipe. This
should help reduce some of the 'it just doesn't work' issues.
- Fix data_blob_talloc() to behave the same way data_blob() does when
passed a NULL data pointer. (just allocate)
REMEMBER to make clean after this commit - I have changed plenty of
data structures...
Gerald Carter [Sat, 22 Nov 2003 04:35:36 +0000 (04:35 +0000)]
Ensure that items in a list of strings containing whitespace
are written out surrounded by single quotes. This means that
both double and single quotes are now used to surround
strings in smb.conf. This is a slight change from the previous
behavior but needed or else things like
Volker Lendecke [Mon, 17 Nov 2003 18:01:28 +0000 (18:01 +0000)]
From 3_0:
This fixes a bug when establishing trust against a german W2k3 AD server. In
the bind response to WKSSVC it does not send \PIPE\ntsvcs as NT4 (did not
check w2k) but \PIPE\wkssvc. I'm not sure whether we should make this check at
all, so making it a bit more liberal should hopefully not really hurt.
Gerald Carter [Thu, 13 Nov 2003 20:16:28 +0000 (20:16 +0000)]
* Fix from SATOH Fumiyasu for bug 660 (failing to view print
jobs) by only enforce the 'max reported print jobs' parameter
when it is non-zero.
* Fixed bug 338 by making sure that data values are written
out when we are marshalling an EnumPrinterDataEx() reply.
This probably fixes other bugs reported against point-n-print
feature in 3.0.0
Rafal Szczesniak [Wed, 12 Nov 2003 21:47:25 +0000 (21:47 +0000)]
> Omit html documentation tree because it has been moved to the separate
> module. Install though, in case one recreates the tree as it was before.
>
>
> rafal
Gerald Carter [Fri, 7 Nov 2003 23:04:52 +0000 (23:04 +0000)]
* only install swat html files once
* revert the change that prevent the guest
account from being added to a passdb backend
since it broke the build farm.
* apply patch from Alex Deiter to fix the
"smbldap_open: cannot access when not root
error" messages when looking up group
information (bug 281)
Gerald Carter [Fri, 7 Nov 2003 14:41:08 +0000 (14:41 +0000)]
fix for bug 680 (heads up). This gist is to map the
UNIX entity foo to DOMAIN\foo instead of SERVER\foo
on members of a Samba domain when all UNIX accounts
are shared via NIS, et. al.
* allow winbindd to match local accounts to domain SID
when 'winbind trusted domains only = yes'
* remove code in idmap_ldap that searches the user
suffix and group suffix. It's not needed and
provides inconsistent functionality from the tdb backend.
This has been tested. I'm still waiting on some more feedback
but This needs to be in 3.0.1pre2 for widespread use.
Volker Lendecke [Fri, 7 Nov 2003 10:12:43 +0000 (10:12 +0000)]
From 3_0:
Implement %i-Macro for the locally used IP address. With this you can again
have virtual hosts with different configurations on a single smbd even on port
445.
Volker Lendecke [Fri, 7 Nov 2003 09:04:57 +0000 (09:04 +0000)]
From 3_0:
Simple rename of get_socket_addr to get_peer_addr and get_socket_name to
get_peer_name. This is to get closer to the getsockname/getpeername system
functions.
Next step will be the %i macro for the local IP address. I still want to play
%L-games in times of port 445.
Jeremy Allison [Mon, 3 Nov 2003 23:59:45 +0000 (23:59 +0000)]
TDBSAM update code from Aur?lien Degr?mont <adegremont@idealx.com>.
Adds support for an additional field (uint32) which represents the
lockout duration. I think this should be stored as an abolute
UNIX time_t that specifies when the lockout should end - set it
when the lockout is imposed. This new code also updates the on
disk tdb version on load. Being merged into HEAD so Simo can
add any other changes he wants before being back-ported to
SAMBA_3_0.
Jeremy.
Tim Potter [Fri, 31 Oct 2003 02:56:11 +0000 (02:56 +0000)]
Merge from 3.0:
Revision 1.45.2.23:
Changed output so all debug output goes to stderr, and all file processing
goes to stdout.
Note: This change permits use of testparm processing of smb.conf to be
redirected into a file that can be used as an smb.conf file. ie: All
information that should not be in smb.conf will be on stderr, all pertinent
smb.conf info will go to stdout.
Example of use:
A fully documented smb.conf.master file can be maintained.
To create smb.conf do:
testparm -s > smb.conf
Jim McDonough [Thu, 30 Oct 2003 18:13:25 +0000 (18:13 +0000)]
Last of the GUID->struct uuid changes.
GUID has been removed. If you are dealing with a flattened version of a
[gu]uid, use UUID_FLAT. smb_pack_uuid and smb_unpack_uuid will switch
between the two.
I'm not sure exactly what the genparse stuff is doing here, so I just
switched it to a UUID_FLAT (no functional change), but I suspect this
may not be the right way to go.
projects / thirdparty / samba.git / log
