From: Tim Beale Date: Wed, 26 Sep 2018 05:01:03 +0000 (+1200) Subject: netcmd: Make sure SMB connection is signed when backing up sysvol X-Git-Tag: tdb-1.3.17~1479 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0122f45f053ecc545950c31bf1fb33fba143478c;p=thirdparty%2Fsamba.git netcmd: Make sure SMB connection is signed when backing up sysvol i.e. protect the client against man-in-the-middle attacks by default. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13621 Signed-off-by: Tim Beale Reviewed-by: Ralph Boehme Reviewed-by: Andrew Bartlett --- diff --git a/python/samba/netcmd/domain_backup.py b/python/samba/netcmd/domain_backup.py index 9c8457db4b8..683e7d2684b 100644 --- a/python/samba/netcmd/domain_backup.py +++ b/python/samba/netcmd/domain_backup.py @@ -245,7 +245,7 @@ class cmd_domain_backup_online(samba.netcmd.Command): # Grab the remote DC's sysvol files and bundle them into a tar file sysvol_tar = os.path.join(tmpdir, 'sysvol.tar.gz') - smb_conn = smb.SMB(server, "sysvol", lp=lp, creds=creds) + smb_conn = smb.SMB(server, "sysvol", lp=lp, creds=creds, sign=True) backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid()) # remove the default sysvol files created by the clone (we want to @@ -768,7 +768,7 @@ class cmd_domain_backup_rename(samba.netcmd.Command): # use the old realm) backed here, as well as default files generated # for the new realm as part of the clone/join. sysvol_tar = os.path.join(tmpdir, 'sysvol.tar.gz') - smb_conn = smb.SMB(server, "sysvol", lp=lp, creds=creds) + smb_conn = smb.SMB(server, "sysvol", lp=lp, creds=creds, sign=True) backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid()) # connect to the local DB (making sure we use the new/renamed config)