s3-rpc_server: Disable the NETLOGON server by default

The NETLOGON server is only needed when the classic/NT4 DC is enabled
and has been the source of security issues in the past.  Therefore
reduce the attack surface.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

diff --git a/selftest/knownfail b/selftest/knownfail
index b47a9ceae2cd24f915ded1458e40f625a7013ab1..fe51ec2ae218377d845763161fd5b08f0767c7dc 100644 (file)
--- a/selftest/knownfail
+++ b/selftest/knownfail
@@ -336,3 +336,7 @@
 # We currently don't send referrals for LDAP modify of non-replicated attrs
 ^samba4.ldap.rodc.python\(rodc\).__main__.RodcTests.test_modify_nonreplicated.*
 ^samba4.ldap.rodc_rwdc.python.*.__main__.RodcRwdcTests.test_change_password_reveal_on_demand_kerberos
+# NETLOGON is disabled in any non-DC environments
+^samba.tests.netlogonsvc.python\(ad_member\)
+^samba.tests.netlogonsvc.python\(simpleserver\)
+^samba.tests.netlogonsvc.python\(fileserver\)

diff --git a/source3/rpc_server/rpc_config.c b/source3/rpc_server/rpc_config.c
index 23c6f88eac4e31e8a6cebe67ca553f7df45907a3..9ee7ecaf96f5d1b0ff42d4ea063c89c7015a57df 100644 (file)
--- a/source3/rpc_server/rpc_config.c
+++ b/source3/rpc_server/rpc_config.c
@@ -47,6 +47,7 @@ enum rpc_service_mode_e rpc_service_mode(const char *name)
        const char *rpcsrv_type;
        enum rpc_service_mode_e state;
        const char *def;
+       enum server_role server_role = lp_server_role();
        int i;
 
        /* Handle pipes with multiple names */
@@ -71,6 +72,21 @@ enum rpc_service_mode_e rpc_service_mode(const char *name)
                }
        }
 
+       /*
+        * Only enable the netlogon server by default if we are a
+        * classic/NT4 domain controller
+        */
+       if (strcasecmp_m(name, "netlogon") == 0) {
+               switch (server_role) {
+               case ROLE_STANDALONE:
+               case ROLE_DOMAIN_MEMBER:
+                       def = "disabled";
+                       break;
+               default:
+                       break;
+               }
+       }
+
        rpcsrv_type = lp_parm_const_string(GLOBAL_SECTION_SNUM,
                                           "rpc_server", pipe_name, def);