From 8ec894c5b4ebe4438cd5b7582ac436ce464188bd Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 30 Nov 2022 15:13:47 +0100 Subject: [PATCH 29/30] CVE-2022-38023 testparm: warn about server/client schannel != yes BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240 Signed-off-by: Stefan Metzmacher Reviewed-by: Andrew Bartlett Reviewed-by: Ralph Boehme (cherry picked from commit f964c0c357214637f80d0089723b9b11d1b38f7e) Conflict: NA Reference: https://attachments.samba.org/attachment.cgi?id=17692 --- source3/utils/testparm.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c index e0455b9d7b6b..7e913a8ac4d3 100644 --- a/source3/utils/testparm.c +++ b/source3/utils/testparm.c @@ -598,11 +598,25 @@ static int do_global_checks(void) ret = 1; } - if (!lp_server_schannel()) { + if (lp_server_schannel() != true) { /* can be 'auto' */ fprintf(stderr, - "WARNING: You have configured 'server schannel = no'. " + "WARNING: You have not configured " + "'server schannel = yes' (the default). " "Your server is vulernable to \"ZeroLogon\" " - "(CVE-2020-1472)\n\n"); + "(CVE-2020-1472)\n" + "If required use individual " + "'server require schannel:COMPUTERACCOUNT$ = no' " + "options\n\n"); + } + if (lp_client_schannel() != true) { /* can be 'auto' */ + fprintf(stderr, + "WARNING: You have not configured " + "'client schannel = yes' (the default). " + "Your server is vulernable to \"ZeroLogon\" " + "(CVE-2020-1472)\n" + "If required use individual " + "'client schannel:NETBIOSDOMAIN = no' " + "options\n\n"); } return ret; -- 2.34.1