121 lines
5.1 KiB
Diff
121 lines
5.1 KiB
Diff
From 41d64ebc813440e809909076c98de25084c4731b Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Fri, 25 Nov 2022 13:31:14 +0100
|
|
Subject: [PATCH 20/30] CVE-2022-38023 docs-xml/smbdotconf: document "allow nt4
|
|
crypto:COMPUTERACCOUNT = no"
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240
|
|
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
Reviewed-by: Ralph Boehme <slow@samba.org>
|
|
(cherry picked from commit bd429d025981b445bf63935063e8e302bfab3f9b)
|
|
|
|
Conflict: NA
|
|
Reference: https://attachments.samba.org/attachment.cgi?id=17692
|
|
---
|
|
docs-xml/smbdotconf/logon/allownt4crypto.xml | 76 +++++++++++++++++++-
|
|
1 file changed, 74 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/docs-xml/smbdotconf/logon/allownt4crypto.xml b/docs-xml/smbdotconf/logon/allownt4crypto.xml
|
|
index 06afcef73b1b..bbd03a42db74 100644
|
|
--- a/docs-xml/smbdotconf/logon/allownt4crypto.xml
|
|
+++ b/docs-xml/smbdotconf/logon/allownt4crypto.xml
|
|
@@ -1,11 +1,18 @@
|
|
<samba:parameter name="allow nt4 crypto"
|
|
context="G"
|
|
type="boolean"
|
|
+ deprecated="1"
|
|
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
<description>
|
|
+ <para>
|
|
+ This option is deprecated and will be removed in future,
|
|
+ as it is a security problem if not set to "no" (which will be
|
|
+ the hardcoded behavior in future).
|
|
+ </para>
|
|
+
|
|
<para>This option controls whether the netlogon server (currently
|
|
only in 'active directory domain controller' mode), will
|
|
- reject clients which does not support NETLOGON_NEG_STRONG_KEYS
|
|
+ reject clients which do not support NETLOGON_NEG_STRONG_KEYS
|
|
nor NETLOGON_NEG_SUPPORTS_AES.</para>
|
|
|
|
<para>This option was added with Samba 4.2.0. It may lock out clients
|
|
@@ -18,8 +25,73 @@
|
|
|
|
<para>"allow nt4 crypto = yes" allows weak crypto to be negotiated, maybe via downgrade attacks.</para>
|
|
|
|
- <para>This option is over-ridden by the 'reject md5 clients' option.</para>
|
|
+ <para><emphasis>Avoid using this option!</emphasis> Use explicit '<smbconfoption name="allow nt4 crypto:COMPUTERACCOUNT">yes</smbconfoption>' instead!
|
|
+ Which is available with the patches for
|
|
+ <ulink url="https://www.samba.org/samba/security/CVE-2022-38023.html">CVE-2022-38023</ulink>
|
|
+ see <ulink url="https://bugzilla.samba.org/show_bug.cgi?id=15240">https://bugzilla.samba.org/show_bug.cgi?id=15240</ulink></para>
|
|
+
|
|
+ <para>
|
|
+ Samba will log an error in the log files at log level 0
|
|
+ if legacy a client is rejected or allowed without an explicit,
|
|
+ '<smbconfoption name="allow nt4 crypto:COMPUTERACCOUNT">yes</smbconfoption>' option
|
|
+ for the client. The message will indicate
|
|
+ the explicit '<smbconfoption name="allow nt4 crypto:COMPUTERACCOUNT">yes</smbconfoption>'
|
|
+ line to be added, if the legacy client software requires it. (The log level can be adjusted with
|
|
+ '<smbconfoption name="CVE_2022_38023:error_debug_level">1</smbconfoption>'
|
|
+ in order to complain only at a higher log level).
|
|
+ </para>
|
|
+
|
|
+ <para>This allows admins to use "yes" only for a short grace period,
|
|
+ in order to collect the explicit
|
|
+ '<smbconfoption name="allow nt4 crypto:COMPUTERACCOUNT">yes</smbconfoption>' options.</para>
|
|
+
|
|
+ <para>This option is over-ridden by the '<smbconfoption name="reject md5 clients">yes</smbconfoption>' option.</para>
|
|
</description>
|
|
|
|
<value type="default">no</value>
|
|
</samba:parameter>
|
|
+
|
|
+<samba:parameter name="allow nt4 crypto:COMPUTERACCOUNT"
|
|
+ context="G"
|
|
+ type="string"
|
|
+ xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|
+<description>
|
|
+
|
|
+ <para>If you still have legacy domain members which required 'allow nt4 crypto = yes',
|
|
+ it is possible to specify an explicit exception per computer account
|
|
+ by using 'allow nt4 crypto:COMPUTERACCOUNT = yes' as option.
|
|
+ Note that COMPUTERACCOUNT has to be the sAMAccountName value of
|
|
+ the computer account (including the trailing '$' sign).
|
|
+ </para>
|
|
+
|
|
+ <para>
|
|
+ Samba will log a complaint in the log files at log level 0
|
|
+ about the security problem if the option is set to "yes",
|
|
+ but the related computer does not require it.
|
|
+ (The log level can be adjusted with
|
|
+ '<smbconfoption name="CVE_2022_38023:warn_about_unused_debug_level">1</smbconfoption>'
|
|
+ in order to complain only at a higher log level).
|
|
+ </para>
|
|
+
|
|
+ <para>
|
|
+ Samba will log a warning in the log files at log level 5,
|
|
+ if a setting is still needed for the specified computer account.
|
|
+ </para>
|
|
+
|
|
+ <para>
|
|
+ See <ulink url="https://www.samba.org/samba/security/CVE-2022-38023.html">CVE-2022-38023</ulink>,
|
|
+ <ulink url="https://bugzilla.samba.org/show_bug.cgi?id=15240">https://bugzilla.samba.org/show_bug.cgi?id=15240</ulink>.
|
|
+ </para>
|
|
+
|
|
+ <para>This option overrides the <smbconfoption name="allow nt4 crypto"/> option.</para>
|
|
+
|
|
+ <para>This option is over-ridden by the '<smbconfoption name="reject md5 clients">yes</smbconfoption>' option.</para>
|
|
+
|
|
+ <programlisting>
|
|
+ allow nt4 crypto:LEGACYCOMPUTER1$ = yes
|
|
+ allow nt4 crypto:NASBOX$ = yes
|
|
+ allow nt4 crypto:LEGACYCOMPUTER2$ = yes
|
|
+ </programlisting>
|
|
+</description>
|
|
+
|
|
+</samba:parameter>
|
|
--
|
|
2.34.1
|