CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: support "server require schannel...

This allows to add expections for individual workstations, when using "server schannel = yes".
"server schannel = auto" is very insecure and will be removed soon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 66f68ea7f95afec9cab9df799d811d6da8cf240c..87ef13ba8074e2ee1ca3579d64f7d8a21e1e5b20 100644 (file)
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -626,6 +626,7 @@ static NTSTATUS dcesrv_netr_creds_server_step_check(struct dcesrv_call_state *dc
        NTSTATUS nt_status;
        int schannel = lpcfg_server_schannel(dce_call->conn->dce_ctx->lp_ctx);
        bool schannel_global_required = (schannel == true);
+       bool schannel_required = schannel_global_required;
        struct netlogon_creds_CredentialState *creds = NULL;
        enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NONE;
        uint16_t opnum = dce_call->pkt.u.request.opnum;
@@ -648,7 +649,13 @@ static NTSTATUS dcesrv_netr_creds_server_step_check(struct dcesrv_call_state *dc
                return nt_status;
        }
 
-       if (schannel_global_required) {
+       schannel_required = lpcfg_parm_bool(dce_call->conn->dce_ctx->lp_ctx,
+                                           NULL,
+                                           "server require schannel",
+                                           creds->account_name,
+                                           schannel_global_required);
+
+       if (schannel_required) {
                if (auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
                        *creds_out = creds;
                        return NT_STATUS_OK;