From: Jeremy Allison Date: Thu, 19 Mar 2015 20:09:21 +0000 (-0700) Subject: docs: Mark 'client use spnego principal' as deprecated and also a bad idea. X-Git-Tag: samba-4.1.18~20 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2f46746071dbea6cdd30d3629899bb473db08afb;p=thirdparty%2Fsamba.git docs: Mark 'client use spnego principal' as deprecated and also a bad idea. Bug 10888 - smbclient doesn't ignore "not_defined_in_RFC4178@please_ignore" https://bugzilla.samba.org/show_bug.cgi?id=10888 Signed-off-by: Jeremy Allison Reviewed-by: Stefan (metze) Metzmacher (cherry picked from commit c9299bd6a4e86dbec10ab7741056f331a18c44a0) --- diff --git a/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml b/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml index 6ec1eb11165..792a7386f36 100644 --- a/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml +++ b/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml @@ -14,6 +14,10 @@ servers known only by IP address. Kerberos relies on names, so ordinarily cannot function in this situation. + This is a VERY BAD IDEA for security reasons, and so this + parameter SHOULD NOT BE USED. It will be removed in a future + version of Samba. + If disabled, Samba will use the name used to look up the server when asking the KDC for a ticket. This avoids situations where a server may impersonate another, soliciting authentication @@ -23,6 +27,9 @@ Note that Windows XP SP2 and later versions already follow this behaviour, and Windows Vista and later servers no longer supply this 'rfc4178 hint' principal on the server side. + + This parameter is deprecated in Samba 4.2.1 and will be removed + (along with the functionality) in a later release of Samba. no diff --git a/lib/param/param_table.c b/lib/param/param_table.c index 8e3f952b6ec..d590bd11e45 100644 --- a/lib/param/param_table.c +++ b/lib/param/param_table.c @@ -739,7 +739,7 @@ static struct parm_struct parm_table[] = { .offset = GLOBAL_VAR(client_use_spnego_principal), .special = NULL, .enum_list = NULL, - .flags = FLAG_ADVANCED, + .flags = FLAG_ADVANCED | FLAG_DEPRECATED, }, { .label = "username",