lib/param: add "allow nt4 crypto" option, defaulting to false

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/docs-xml/smbdotconf/logon/allownt4crypto.xml b/docs-xml/smbdotconf/logon/allownt4crypto.xml
new file mode 100644 (file)
index 0000000..4d417c7
--- /dev/null
+++ b/docs-xml/smbdotconf/logon/allownt4crypto.xml
@@ -0,0 +1,26 @@
+<samba:parameter name="allow nt4 crypto"
+                 context="G"
+                 type="boolean"
+                 advanced="1"
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+       <para>This option controls whether the netlogon server (currently
+       only in 'active directory domain controller' mode), will
+       reject clients which does not support NETLOGON_NEG_STRONG_KEYS
+       nor NETLOGON_NEG_SUPPORTS_AES.</para>
+
+       <para>This option was added with Samba 4.2.0. It may lock out clients
+       which worked fine with Samba versions up to 4.1.x. as the effective default
+       was "yes" there, while it is "no" now.</para>
+
+       <para>If you have clients without RequireStrongKey = 1 in the registry,
+       you may need to set "allow nt4 crypto = yes", until you have fixed all clients.
+       </para>
+
+       <para>"allow nt4 crypto = yes" allows weak crypto to be negotiated, maybe via downgrade attacks.</para>
+
+       <para>This option yields precedence to the 'reject md5 clients' option.</para>
+</description>
+
+<value type="default">no</value>
+</samba:parameter>

diff --git a/lib/param/param_functions.c b/lib/param/param_functions.c
index d04bc0de91d2826612cd6b761fc98ba95e0822b8..7d86828ee269f0c1f6e4d147b27c0793a68605be 100644 (file)
--- a/lib/param/param_functions.c
+++ b/lib/param/param_functions.c
@@ -154,6 +154,7 @@ FN_LOCAL_PARM_BOOL(kernel_change_notify, bKernelChangeNotify)
 FN_LOCAL_BOOL(durable_handles, bDurableHandles)
 
 FN_GLOBAL_BOOL(allow_insecure_widelinks, bAllowInsecureWidelinks)
+FN_GLOBAL_BOOL(allow_nt4_crypto, bAllowNT4Crypto)
 FN_GLOBAL_BOOL(allow_trusted_domains, bAllowTrustedDomains)
 FN_GLOBAL_BOOL(async_smb_echo_handler, bAsyncSMBEchoHandler)
 FN_GLOBAL_BOOL(bind_interfaces_only, bBindInterfacesOnly)

diff --git a/lib/param/param_table.c b/lib/param/param_table.c
index c79190c43c1437c626260b13c670d6fed5e77823..8b6b234ea5d2ae81508188ba26f25d971004f5fc 100644 (file)
--- a/lib/param/param_table.c
+++ b/lib/param/param_table.c
@@ -4316,6 +4316,15 @@ static struct parm_struct parm_table[] = {
                .special        = NULL,
                .enum_list      = NULL
        },
+       {
+               .label          = "allow nt4 crypto",
+               .type           = P_BOOL,
+               .p_class        = P_GLOBAL,
+               .offset         = GLOBAL_VAR(bAllowNT4Crypto),
+               .special        = NULL,
+               .enum_list      = NULL,
+               .flags          = FLAG_ADVANCED,
+       },
 
        {N_("TLS options"), P_SEP, P_SEPARATOR},