CVE-2016-2112: selftest: servers with explicit "ldap server require strong auth"...
authorStefan Metzmacher <metze@samba.org>
Mon, 21 Dec 2015 09:27:33 +0000 (10:27 +0100)
committerStefan Metzmacher <metze@samba.org>
Tue, 12 Apr 2016 17:25:25 +0000 (19:25 +0200)
The default is "ldap server require strong auth = yes",
ad_dc_ntvfs uses "ldap server require strong auth = allow_sasl_over_tls",
fl2008r2dc uses "ldap server require strong auth = no".

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: G√ľnther Deschner <gd@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
selftest/target/Samba4.pm

index 7ad3b6daa39156fd9b56d50f1b86331ef37ce4e1..14fddcfb83f410cc83927594f40889dda2ff5d48 100755 (executable)
@@ -545,6 +545,7 @@ sub provision_raw_step1($$)
         dcerpc endpoint servers = +winreg +srvsvc
        notify:inotify = false
        ldb:nosync = true
+       ldap server require strong auth = yes
 #We don't want to pass our self-tests if the PAC code is wrong
        gensec:require_pac = true
        log file = $ctx->{logdir}/log.\%m
@@ -1334,7 +1335,9 @@ sub provision_ad_dc_ntvfs($$)
 
        print "PROVISIONING AD DC (NTVFS)...";
         my $extra_conf_options = "netbios aliases = localDC1-a
-        server services = +winbind -winbindd";
+        server services = +winbind -winbindd
+       ldap server require strong auth = allow_sasl_over_tls
+       ";
        my $ret = $self->provision($prefix,
                                   "domain controller",
                                   "localdc",
@@ -1452,6 +1455,7 @@ sub provision_fl2008r2dc($$$)
        my ($self, $prefix, $dcvars) = @_;
 
        print "PROVISIONING DC WITH FOREST LEVEL 2008r2...";
+        my $extra_conf_options = "ldap server require strong auth = no";
        my $ret = $self->provision($prefix,
                                   "domain controller",
                                   "dc7",
@@ -1461,7 +1465,7 @@ sub provision_fl2008r2dc($$$)
                                   "locDCpass7",
                                   undef,
                                   undef,
-                                  "",
+                                  $extra_conf_options,
                                   "",
                                   undef);