60 lines
1.9 KiB
Diff
60 lines
1.9 KiB
Diff
|
From 60b2cd50f4d0554cc5ca8c53b2d1fa89e56a6d06 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Tim Beale <timbeale@catalyst.net.nz>
|
||
|
|
Date: Tue, 13 Nov 2018 13:22:41 +1300
|
||
|
|
Subject: [PATCH 17/17] CVE-2018-16857 dsdb/util: Add better default
|
||
|
|
lockOutObservationWindow
|
||
|
|
|
||
|
|
Clearly the lockOutObservationWindow value is important, and using a
|
||
|
|
default value of zero doesn't work very well.
|
||
|
|
|
||
|
|
This patch adds a better default value (the domain default setting of 30
|
||
|
|
minutes).
|
||
|
|
|
||
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683
|
||
|
|
|
||
|
|
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
|
||
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
||
|
|
---
|
||
|
|
source4/dsdb/common/util.c | 10 +++++++---
|
||
|
|
1 file changed, 7 insertions(+), 3 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
|
||
|
|
index 8d863f85a29..18f700370a3 100644
|
||
|
|
--- a/source4/dsdb/common/util.c
|
||
|
|
+++ b/source4/dsdb/common/util.c
|
||
|
|
@@ -56,6 +56,9 @@
|
||
|
|
*/
|
||
|
|
#include "dsdb/samdb/ldb_modules/util.h"
|
||
|
|
|
||
|
|
+/* default is 30 minutes: -1e7 * 30 * 60 */
|
||
|
|
+#define DEFAULT_OBSERVATION_WINDOW -18000000000
|
||
|
|
+
|
||
|
|
/*
|
||
|
|
search the sam for the specified attributes in a specific domain, filter on
|
||
|
|
objectSid being in domain_sid.
|
||
|
|
@@ -5363,7 +5366,7 @@ int samdb_result_effective_badPwdCount(struct ldb_context *sam_ldb,
|
||
|
|
lockOutObservationWindow =
|
||
|
|
ldb_msg_find_attr_as_int64(res->msgs[0],
|
||
|
|
"msDS-LockoutObservationWindow",
|
||
|
|
- 0);
|
||
|
|
+ DEFAULT_OBSERVATION_WINDOW);
|
||
|
|
talloc_free(res);
|
||
|
|
} else {
|
||
|
|
|
||
|
|
@@ -5402,10 +5405,11 @@ static int64_t get_lockout_observation_window(struct ldb_message *domain_msg,
|
||
|
|
if (pso_msg != NULL) {
|
||
|
|
return ldb_msg_find_attr_as_int64(pso_msg,
|
||
|
|
"msDS-LockoutObservationWindow",
|
||
|
|
- 0);
|
||
|
|
+ DEFAULT_OBSERVATION_WINDOW);
|
||
|
|
} else {
|
||
|
|
return ldb_msg_find_attr_as_int64(domain_msg,
|
||
|
|
- "lockOutObservationWindow", 0);
|
||
|
|
+ "lockOutObservationWindow",
|
||
|
|
+ DEFAULT_OBSERVATION_WINDOW);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
--
|
||
|
|
2.17.1
|