CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: support "server require schannel...

This allows to add expections for individual workstations, when using "server schannel = yes".
"server schannel = auto" is very insecure and will be removed soon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Günther Deschner <gd@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
index edd397bc8338b8b83af2608f4088390c2c16a847..dc1bfa0c4da83775922e660e74479cc9273b7005 100644 (file)
--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
@@ -1074,6 +1074,7 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p,
 {
        NTSTATUS status;
        bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
+       bool schannel_required = schannel_global_required;
        struct loadparm_context *lp_ctx;
        struct netlogon_creds_CredentialState *creds = NULL;
        enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NONE;
@@ -1106,7 +1107,11 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p,
                return status;
        }
 
-       if (schannel_global_required) {
+       schannel_required = lp_parm_bool(GLOBAL_SECTION_SNUM,
+                                        "server require schannel",
+                                        creds->account_name,
+                                        schannel_global_required);
+       if (schannel_required) {
                if (auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
                        *creds_out = creds;
                        return NT_STATUS_OK;