From: Aurelien Aptel Date: Fri, 8 Feb 2019 11:04:42 +0000 (+0100) Subject: docs-xml: add "debug encryption" global parm X-Git-Tag: ldb-1.6.1~193 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0732499f23cebe6c5e24f596ff4fe41f8ab1d156;p=thirdparty%2Fsamba.git docs-xml: add "debug encryption" global parm Add debug option to dump in the log the session id & keys in smbd and libsmb-based code for offline decryption. Wireshark can make use of this to decrypt encrypted traffic. Signed-off-by: Aurelien Aptel Reviewed-by: Noel Power Reviewed-by: Ralph Boehme Reviewed-by: David Disseldorp --- diff --git a/docs-xml/smbdotconf/security/debugencryption.xml b/docs-xml/smbdotconf/security/debugencryption.xml new file mode 100644 index 00000000000..5b51b4afe0e --- /dev/null +++ b/docs-xml/smbdotconf/security/debugencryption.xml @@ -0,0 +1,22 @@ + + + + This option will make the smbd server and client code using + libsmb (smbclient, smbget, smbspool, ...) dump the Session Id, + the decrypted Session Key, the Signing Key, the Application Key, + the Encryption Key and the Decryption Key every time an SMB3+ + session is established. This information will be printed in logs + at level 0. + + + Warning: access to these values enables the decryption of any + encrypted traffic on the dumped sessions. This option should + only be enabled for debugging purposes. + + + + no + diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index f31ef2319ac..84c83ae91ec 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -3008,6 +3008,8 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) lpcfg_do_global_parameter(lp_ctx, "store dos attributes", "yes"); + lpcfg_do_global_parameter(lp_ctx, "debug encryption", "no"); + for (i = 0; parm_table[i].label; i++) { if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { lp_ctx->flags[i] |= FLAG_DEFAULT;