From: Andrew Bartlett Date: Tue, 12 Apr 2022 00:23:54 +0000 (+1200) Subject: docs: Explain the impact of "ntlm auth = disabled" on simple bind forwarding X-Git-Tag: talloc-2.3.4~289 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e93d73b618797565dec66b31de961dc062264bd2;p=thirdparty%2Fsamba.git docs: Explain the impact of "ntlm auth = disabled" on simple bind forwarding An RODC will forward an LDAP Simple bind, just like any other authentication, when the password is not present locally. If the full DC does not support NTLMv2 authentication this forwarded password will be rejected. A future Samba version should prefer Kerberos or send the plaintext, but we can not change the MS Windows behaviour, so we document this. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Andrew Bartlett Reviewed-by: Andreas Schneider --- diff --git a/docs-xml/smbdotconf/security/ntlmauth.xml b/docs-xml/smbdotconf/security/ntlmauth.xml index 9fa3d5c1ce5..84b3488e411 100644 --- a/docs-xml/smbdotconf/security/ntlmauth.xml +++ b/docs-xml/smbdotconf/security/ntlmauth.xml @@ -55,6 +55,13 @@ disabled - Do not accept NTLM (or LanMan) authentication of any level, nor permit NTLM password changes. + + WARNING: Both Microsoft Windows + and Samba Read Only Domain Controllers + (RODCs) convert a plain-text LDAP Simple Bind into an NTLMv2 + authentication to forward to a full DC. Setting this option + to disabled will cause these forwarded + authentications to fail.