docs-xml:smbdotconf: default "ntlm auth" to "no"

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/docs-xml/smbdotconf/security/ntlmauth.xml b/docs-xml/smbdotconf/security/ntlmauth.xml
index 6af190805e810b0d076e2bd2ad93866f6a8f67c9..884ee9dbf1a0b73c03a91448f168e1b0a01e3a2e 100644 (file)
--- a/docs-xml/smbdotconf/security/ntlmauth.xml
+++ b/docs-xml/smbdotconf/security/ntlmauth.xml
@@ -12,8 +12,14 @@
     <para>If this option, and <command moreinfo="none">lanman
     auth</command> are both disabled, then only NTLMv2 logins will be
     permited.  Not all clients support NTLMv2, and most will require
-       special configuration to use it.</para>
+    special configuration to use it.</para>
+
+    <para>The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x.</para>
+
+    <para>The default changed from "yes" to "no" with Samba 4.5.</para>
 </description>
 
-<value type="default">yes</value>
+<related>lanman auth</related>
+<related>raw NTLMv2 auth</related>
+<value type="default">no</value>
 </samba:parameter>

diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c
index 548d1055a31563401336f5839220284401d88307..5f4610ead7e983c1bab8910a58c7171c6bdfe89a 100644 (file)
--- a/lib/param/loadparm.c
+++ b/lib/param/loadparm.c
@@ -2630,7 +2630,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx)
        lpcfg_do_global_parameter(lp_ctx, "ClientLanManAuth", "False");
        lpcfg_do_global_parameter(lp_ctx, "ClientNTLMv2Auth", "True");
        lpcfg_do_global_parameter(lp_ctx, "LanmanAuth", "False");
-       lpcfg_do_global_parameter(lp_ctx, "NTLMAuth", "True");
+       lpcfg_do_global_parameter(lp_ctx, "NTLMAuth", "False");
        lpcfg_do_global_parameter(lp_ctx, "RawNTLMv2Auth", "False");
        lpcfg_do_global_parameter(lp_ctx, "client use spnego principal", "False");
 

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 71e9e2ec14c5b635918115f747fa1fbbf5e2a2e1..f2826514041691597bec848d3f427ca553e2dabd 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -690,7 +690,7 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals)
        Globals.client_lanman_auth = false;     /* Do NOT use the LanMan hash if it is available */
        Globals.client_plaintext_auth = false;  /* Do NOT use a plaintext password even if is requested by the server */
        Globals.lanman_auth = false;    /* Do NOT use the LanMan hash, even if it is supplied */
-       Globals.ntlm_auth = true;       /* Do use NTLMv1 if it is supplied by the client (otherwise NTLMv2) */
+       Globals.ntlm_auth = false;      /* Do NOT use NTLMv1 if it is supplied by the client (otherwise NTLMv2) */
        Globals.raw_ntlmv2_auth = false; /* Reject NTLMv2 without NTLMSSP */
        Globals.client_ntlmv2_auth = true; /* Client should always use use NTLMv2, as we can't tell that the server supports it, but most modern servers do */
        /* Note, that we will also use NTLM2 session security (which is different), if it is available */