r11401: A simple hack to have our central credentials system deny sending LM

authentication for user@realm logins and machine account logins.

This should avoid various protocol downgrade attacks.

Andrew Bartlett

diff --git a/source/auth/credentials/credentials.c b/source/auth/credentials/credentials.c
index c07f0f6c6ae482d67078891707dbc23a100d5c33..5d2c5c553e9b1e8bcf480b30f13b86b35a933a05 100644 (file)
--- a/source/auth/credentials/credentials.c
+++ b/source/auth/credentials/credentials.c
@@ -52,6 +52,7 @@ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
        cred->old_password = NULL;
        cred->smb_krb5_context = NULL;
        cred->salt_principal = NULL;
+       cred->machine_account = False;
 
        return cred;
 }

diff --git a/source/auth/credentials/credentials.h b/source/auth/credentials/credentials.h
index b43ddbbe89e17d37db9d3032c721be67b7fefafc..b85337bd1885eb7dc393e7ee2d6b7d50732c9dd3 100644 (file)
--- a/source/auth/credentials/credentials.h
+++ b/source/auth/credentials/credentials.h
@@ -84,4 +84,7 @@ struct cli_credentials {
         * secrets.ldb when we are asked for a username or password */
 
        BOOL machine_account_pending;
+       
+       /* Is this a machine account? */
+       BOOL machine_account;
 };

diff --git a/source/auth/credentials/credentials_files.c b/source/auth/credentials/credentials_files.c
index cdf38dcfa8511e4d9ca64fa776f54dca4cde150f..35bbc43b343802c395654907814c3187e92f7e73 100644 (file)
--- a/source/auth/credentials/credentials_files.c
+++ b/source/auth/credentials/credentials_files.c
@@ -197,6 +197,9 @@ static NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred,
        /* ok, we are going to get it now, don't recurse back here */
        cred->machine_account_pending = False;
 
+       /* some other parts of the system will key off this */
+       cred->machine_account = True;
+
        mem_ctx = talloc_named(cred, 0, "cli_credentials fetch machine password");
        /* Local secrets are stored in secrets.ldb */
        ldb = secrets_db_connect(mem_ctx);

diff --git a/source/auth/credentials/credentials_ntlm.c b/source/auth/credentials/credentials_ntlm.c
index 8540d073057c567cc0f6efa5a9a2a72e3b368389..6a8b284e781917d4042699f9b7debca9de605673 100644 (file)
--- a/source/auth/credentials/credentials_ntlm.c
+++ b/source/auth/credentials/credentials_ntlm.c
@@ -56,6 +56,18 @@ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_
 
        cli_credentials_get_ntlm_username_domain(cred, mem_ctx, &user, &domain);
 
+       /* If we are sending a username@realm login (see function
+        * above), then we will not send LM, it will not be
+        * accepted */
+       if (cred->principal_obtained > cred->username_obtained) {
+               *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
+       }
+
+       /* Likewise if we are a machine account (avoid protocol downgrade attacks) */
+       if (cred->principal_obtained > cred->username_obtained) {
+               *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
+       }
+
        if (!nt_hash) {
                static const uint8_t zeros[16];
                /* do nothing - blobs are zero length */