From: Andreas Schneider Date: Fri, 27 Nov 2020 10:22:15 +0000 (+0100) Subject: docs-xml: Add a section about weak crypto in testparm manpage X-Git-Tag: samba-4.14.0rc1~551 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5c27740aeff273bcd5f027d36874e56170234146;p=thirdparty%2Fsamba.git docs-xml: Add a section about weak crypto in testparm manpage BUG: https://bugzilla.samba.org/show_bug.cgi?id=14583 Signed-off-by: Andreas Schneider Reviewed-by: Alexander Bokovoy Autobuild-User(master): Andreas Schneider Autobuild-Date(master): Fri Nov 27 13:48:20 UTC 2020 on sn-devel-184 --- diff --git a/docs-xml/manpages/testparm.1.xml b/docs-xml/manpages/testparm.1.xml index 9099cda010f..7c7abf50e8b 100644 --- a/docs-xml/manpages/testparm.1.xml +++ b/docs-xml/manpages/testparm.1.xml @@ -171,6 +171,15 @@ errors and warnings if the file did not load. If the file was loaded OK, the program then dumps all known service details to stdout. + + For certain use cases, SMB protocol requires use of + cryptographic algorithms which are known to be weak and already + broken. DES and ARCFOUR (RC4) ciphers and the SHA1 and MD5 hash + algorithms are considered weak but they are required for backward + compatibility. The testparm utility shows whether the Samba tools + will fall back to these weak crypto algorithms if it is not possible + to use strong cryptography by default. + In FIPS mode weak crypto cannot be enabled.