From 91ed623daf97524aeef8dc3c35808634456c4526 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 18 Nov 2022 13:44:28 +1300 Subject: [PATCH 15/54] CVE-2022-37966 param: Add support for new option "kdc force enable rc4 weak session keys" Pair-Programmed-With: Joseph Sutton Signed-off-by: Andrew Bartlett Signed-off-by: Joseph Sutton Reviewed-by: Stefan Metzmacher (cherry picked from commit ee18bc29b8ef6a3f09070507cc585467e55a1628) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237 Conflict: NA Reference: https://attachments.samba.org/attachment.cgi?id=17695 --- .../kdcforceenablerc4weaksessionkeys.xml | 24 +++++++++++++++++++ lib/param/loadparm.c | 4 ++++ source3/param/loadparm.c | 1 + 3 files changed, 29 insertions(+) create mode 100644 docs-xml/smbdotconf/security/kdcforceenablerc4weaksessionkeys.xml diff --git a/docs-xml/smbdotconf/security/kdcforceenablerc4weaksessionkeys.xml b/docs-xml/smbdotconf/security/kdcforceenablerc4weaksessionkeys.xml new file mode 100644 index 000000000000..1cb46d74a369 --- /dev/null +++ b/docs-xml/smbdotconf/security/kdcforceenablerc4weaksessionkeys.xml @@ -0,0 +1,24 @@ + + + + RFC8429 declares that + rc4-hmac Kerberos ciphers are weak and + there are known attacks on Active Directory use of this + cipher suite. + + + However for compatibility with Microsoft Windows this option + allows the KDC to assume that regardless of the value set in + a service account's + msDS-SupportedEncryptionTypes attribute + that a rc4-hmac Kerberos session key (as distinct from the ticket key, as + found in a service keytab) can be used if the potentially + older client requests it. + + + +no + diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index 1cb25f843b3b..a858c31dbba4 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -3091,6 +3091,10 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) "kdc default domain supported enctypes", "rc4-hmac aes256-cts-hmac-sha1-96-sk"); + lpcfg_do_global_parameter(lp_ctx, + "kdc force enable rc4 weak session keys", + "no"); + for (i = 0; parm_table[i].label; i++) { if (!(lp_ctx->flags[i] & FLAG_CMDLINE)) { lp_ctx->flags[i] |= FLAG_DEFAULT; diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index fb15b20e1876..dc1a830cdbe1 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -997,6 +997,7 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) Globals.kdc_default_domain_supported_enctypes = KERB_ENCTYPE_RC4_HMAC_MD5 | KERB_ENCTYPE_AES256_CTS_HMAC_SHA1_96_SK; + Globals.kdc_force_enable_rc4_weak_session_keys = false; /* Now put back the settings that were set with lp_set_cmdline() */ apply_lp_set_cmdline(); -- 2.34.1