55 lines
2.3 KiB
Diff
55 lines
2.3 KiB
Diff
|
From 4aabfecd290cd2769376abf7f170e832becc4112 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Andrew Bartlett <abartlet@samba.org>
|
||
|
|
Date: Tue, 6 Nov 2018 13:32:05 +1300
|
||
|
|
Subject: [PATCH 08/17] CVE-2018-16853 build: The Samba AD DC, when build with
|
||
|
|
MIT Kerberos is experimental
|
||
|
|
|
||
|
|
This matches https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC
|
||
|
|
|
||
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13678
|
||
|
|
|
||
|
|
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
|
||
|
|
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
|
||
|
|
---
|
||
|
|
wscript | 17 +++++++++++++++++
|
||
|
|
1 file changed, 17 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/wscript b/wscript
|
||
|
|
index 19fc6d12118..7c265e7befb 100644
|
||
|
|
--- a/wscript
|
||
|
|
+++ b/wscript
|
||
|
|
@@ -56,6 +56,14 @@ def set_options(opt):
|
||
|
|
help='build Samba with system MIT Kerberos. ' +
|
||
|
|
'You may specify list of paths where Kerberos is installed (e.g. /usr/local /usr/kerberos) to search krb5-config',
|
||
|
|
action='callback', callback=system_mitkrb5_callback, dest='with_system_mitkrb5', default=False)
|
||
|
|
+
|
||
|
|
+ opt.add_option('--with-experimental-mit-ad-dc',
|
||
|
|
+ help='Enable the experimental MIT Kerberos-backed AD DC. ' +
|
||
|
|
+ 'Note that security patches are not issued for this configuration',
|
||
|
|
+ action='store_true',
|
||
|
|
+ dest='with_experimental_mit_ad_dc',
|
||
|
|
+ default=False)
|
||
|
|
+
|
||
|
|
opt.add_option('--with-system-mitkdc',
|
||
|
|
help=('Specify the path to the krb5kdc binary from MIT Kerberos'),
|
||
|
|
type="string",
|
||
|
|
@@ -210,7 +218,16 @@ def configure(conf):
|
||
|
|
conf.DEFINE('AD_DC_BUILD_IS_ENABLED', 1)
|
||
|
|
|
||
|
|
if Options.options.with_system_mitkrb5:
|
||
|
|
+ if not Options.options.with_experimental_mit_ad_dc and \
|
||
|
|
+ not Options.options.without_ad_dc:
|
||
|
|
+ raise Utils.WafError('The MIT Kerberos build of Samba as an AD DC ' +
|
||
|
|
+ 'is experimental. Therefore '
|
||
|
|
+ '--with-system-mitkrb5 requires either ' +
|
||
|
|
+ '--with-experimental-mit-ad-dc or ' +
|
||
|
|
+ '--without-ad-dc')
|
||
|
|
+
|
||
|
|
conf.PROCESS_SEPARATE_RULE('system_mitkrb5')
|
||
|
|
+
|
||
|
|
if not (Options.options.without_ad_dc or Options.options.with_system_mitkrb5):
|
||
|
|
conf.DEFINE('AD_DC_BUILD_IS_ENABLED', 1)
|
||
|
|
|
||
|
|
--
|
||
|
|
2.17.1
|