WIP

diff --git a/docs-xml/smbdotconf/security/restrictanonymous.xml b/docs-xml/smbdotconf/security/restrictanonymous.xml
index 06abe7b2bf78d31ae60c7356077b69c2aac0dacd..ea918ef46f25910f184eaee68e739114a5c0abcb 100644 (file)
--- a/docs-xml/smbdotconf/security/restrictanonymous.xml
+++ b/docs-xml/smbdotconf/security/restrictanonymous.xml
@@ -1,6 +1,7 @@
 <samba:parameter name="restrict anonymous"
                  type="integer"
                  context="G"
+                 function="_restrict_anonymous"
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
 <description>
        <para>
@@ -20,6 +21,11 @@
                there could still be applications relying on anonymous access.
        </para>
 
+       <para>
+               Setting <smbconfoption name="restrict anonymous">0</smbconfoption>
+               will not restrict anonymous SAMR access.
+       </para>
+
        <para>
                Setting <smbconfoption name="restrict anonymous">1</smbconfoption>
                will disable anonymous SAMR access.
@@ -34,5 +40,5 @@
        </para>
 </description>
 
-<value type="default">0</value>
+<value type="default">2</value>
 </samba:parameter>

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 0b33373dcf9e6f691e6fe27272b64bae46ae5038..98c8f7a2d3e39d8f3c71e4e953cdc13a3afba567 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -723,7 +723,7 @@ void loadparm_s3_init_globals(struct loadparm_context *lp_ctx,
        Globals.smbd_profiling_level = 0;
        Globals.stat_cache = true;      /* use stat cache by default */
        Globals.max_stat_cache_size = 512; /* 512k by default */
-       Globals.restrict_anonymous = 0;
+       Globals.restrict_anonymous = 2;
        Globals.client_lanman_auth = false;     /* Do NOT use the LanMan hash if it is available */
        Globals.client_plaintext_auth = false;  /* Do NOT use a plaintext password even if is requested by the server */
        Globals._lanman_auth = false;   /* Do NOT use the LanMan hash, even if it is supplied */
@@ -1167,6 +1167,17 @@ int lp_winbind_max_domain_connections(void)
        return MAX(1, lp__winbind_max_domain_connections());
 }
 
+int lp_restrict_anonymous(void)
+{
+       int val = lp__restrict_anonymous();
+
+       if (IS_DC) {
+               return MIN(val, 1);
+       }
+
+       return val;
+}
+
 /* These functions remain in source3/param for now */
 
 #include "lib/param/param_functions.c"