From: Stefan Metzmacher Date: Fri, 25 Mar 2016 18:24:20 +0000 (+0100) Subject: CVE-2016-2112: docs-xml: change the default of "ldap server require strong auth"... X-Git-Tag: talloc-2.1.7~412 X-Git-Url: http://git.samba.org/samba.git/?p=kai%2Fsamba-autobuild%2F.git;a=commitdiff_plain;h=6e22abd9775e69aed018d04e5488757910862436 CVE-2016-2112: docs-xml: change the default of "ldap server require strong auth" to "yes" BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher Reviewed-by: Alexander Bokovoy --- diff --git a/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml b/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml index 18d695b7ef7..02bdd811491 100644 --- a/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml +++ b/docs-xml/smbdotconf/ldap/ldapserverrequirestrongauth.xml @@ -21,8 +21,6 @@ A value of yes allows only simple binds over TLS encrypted connections. Unencrypted connections only allow sasl binds with sign or seal. - - Note the default will change to yes with Samba 4.5. -no +yes diff --git a/lib/param/loadparm.c b/lib/param/loadparm.c index d26a3f819c1..5584d878006 100644 --- a/lib/param/loadparm.c +++ b/lib/param/loadparm.c @@ -2810,7 +2810,7 @@ struct loadparm_context *loadparm_init(TALLOC_CTX *mem_ctx) lpcfg_do_global_parameter(lp_ctx, "client ldap sasl wrapping", "sign"); - lpcfg_do_global_parameter(lp_ctx, "ldap server require strong auth", "no"); + lpcfg_do_global_parameter(lp_ctx, "ldap server require strong auth", "yes"); lpcfg_do_global_parameter(lp_ctx, "follow symlinks", "yes"); diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index 14c3c5e0515..70a29ab7322 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -742,7 +742,7 @@ static void init_globals(struct loadparm_context *lp_ctx, bool reinit_globals) Globals.client_ldap_sasl_wrapping = ADS_AUTH_SASL_SIGN; Globals.ldap_server_require_strong_auth = - LDAP_SERVER_REQUIRE_STRONG_AUTH_NO; + LDAP_SERVER_REQUIRE_STRONG_AUTH_YES; /* This is what we tell the afs client. in reality we set the token * to never expire, though, when this runs out the afs client will