s3-auth: remove "security=server" (depricated since 3.6)

"security=server" has a lot of problems in the world with
modern security (ntlmv2 and krb5). It was also not very
reliable, as it needed a stable connection to the password
server for the lifetime of the whole client connection!

Please use "security=domain" or "security=ads" is you
authentication against remote servers (domain controllers).

metze
                       --------------
                      /              \
                     /      REST      \
                    /        IN        \
                   /       PEACE        \
                  /                      \
                  |      SEC_SERVER      |
                  |    security=server   |
                  |                      |
                  |                      |
                  |       12 May         |
                  |                      |
                  |        2012          |
                 *|     *  *  *          | *
        _________)/\\_//(\/(/\)/\//\/\///|_)_______

diff --git a/lib/param/loadparm_server_role.c b/lib/param/loadparm_server_role.c
index 4ba54b913168efe36a8df01ce876692189134df4..9ff64be0461ca479d01aa600c15f59a711420f8d 100644 (file)
--- a/lib/param/loadparm_server_role.c
+++ b/lib/param/loadparm_server_role.c
@@ -73,13 +73,6 @@ int lp_find_server_role(int server_role, int security, int domain_logons, int do
        role = ROLE_STANDALONE;
 
        switch (security) {
-               case SEC_SERVER:
-                       if (domain_logons) {
-                               DEBUG(0, ("Server's Role (logon server) conflicts with server-level security\n"));
-                       }
-                       /* this used to be considered ROLE_DOMAIN_MEMBER but that's just wrong */
-                       role = ROLE_STANDALONE;
-                       break;
                case SEC_DOMAIN:
                        if (domain_logons) {
                                DEBUG(1, ("Server's Role (logon server) NOT ADVISED with domain-level security\n"));
@@ -157,7 +150,7 @@ bool lp_is_security_and_server_role_valid(int server_role, int security)
                valid = true;
                break;
        case ROLE_STANDALONE:
-               if (security == SEC_SERVER || security == SEC_USER) {
+               if (security == SEC_USER) {
                        valid = true;
                }
                break;

diff --git a/lib/param/param_enums.c b/lib/param/param_enums.c
index 36234ea4f9d7050f14d0b4a1b6d4caaa8af94f53..5f4cd61bf6a13b16725c766cf912b9ce47052de7 100644 (file)
--- a/lib/param/param_enums.c
+++ b/lib/param/param_enums.c
@@ -46,7 +46,6 @@ static const struct enum_list enum_protocol[] = {
 static const struct enum_list enum_security[] = {
        {SEC_AUTO, "AUTO"},
        {SEC_USER, "USER"},
-       {SEC_SERVER, "SERVER"},
        {SEC_DOMAIN, "DOMAIN"},
 #if (defined(HAVE_ADS) || _SAMBA_BUILD_ >= 4)
        {SEC_ADS, "ADS"},

diff --git a/libds/common/roles.h b/libds/common/roles.h
index 90281ba788e0cb033d8140c368fb1784121ae210..9dc9a00d28c0fa88b19726a0f5c7bdbc1cee6808 100644 (file)
--- a/libds/common/roles.h
+++ b/libds/common/roles.h
@@ -60,10 +60,25 @@ enum server_role {
                  *|     *  *  *          | *
         _________)/\\_//(\/(/\)/\//\/\///|_)_______
 
- */
+                       --------------
+                      /              \
+                     /      REST      \
+                    /        IN        \
+                   /       PEACE        \
+                  /                      \
+                  |      SEC_SERVER      |
+                  |    security=server   |
+                  |                      |
+                  |                      |
+                  |       12 May         |
+                  |                      |
+                  |        2012          |
+                 *|     *  *  *          | *
+        _________)/\\_//(\/(/\)/\//\/\///|_)_______
+
+*/
 enum security_types {SEC_AUTO = 0, 
                     SEC_USER = 2, 
-                    SEC_SERVER = 3,
                     SEC_DOMAIN = 4,
                     SEC_ADS = 5};
 

diff --git a/source3/auth/auth.c b/source3/auth/auth.c
index 4b075a6c54b053c17053f76b04f05461ed5f48b3..c442a536d8b509e56120b7ec41add361c7a11aec 100644 (file)
--- a/source3/auth/auth.c
+++ b/source3/auth/auth.c
@@ -494,12 +494,6 @@ NTSTATUS make_auth_context_subsystem(TALLOC_CTX *mem_ctx,
                                talloc_tos(), "guest sam winbind:ntdomain",
                                NULL);
                        break;
-               case SEC_SERVER:
-                       DEBUG(5,("Making default auth method list for security=server\n"));
-                       auth_method_list = str_list_make_v3(
-                               talloc_tos(), "guest sam smbserver",
-                               NULL);
-                       break;
                case SEC_USER:
                        if (lp_encrypted_passwords()) { 
                                if ((lp_server_role() == ROLE_DOMAIN_PDC) || (lp_server_role() == ROLE_DOMAIN_BDC)) {

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 7d82b615e723444d07eddb5265ae9cc2049271c6..a34e5d524b2609e5d8795b8392a36b17c2c39fe5 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -9049,10 +9049,6 @@ static bool lp_load_ex(const char *pszFname,
 
        set_allowed_client_auth();
 
-       if (lp_security() == SEC_SERVER) {
-               DEBUG(1, ("WARNING: The security=server option is deprecated\n"));
-       }
-
        if (lp_security() == SEC_ADS && strchr(lp_passwordserver(), ':')) {
                DEBUG(1, ("WARNING: The optional ':port' in password server = %s is deprecated\n",
                          lp_passwordserver()));

diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c
index 9b224d4c1bb39fc0f68d8dc2e52ec41b17ce6f7d..b75fc61b6e7d49e44fefe54531fcd6773d5f5164 100644 (file)
--- a/source3/utils/testparm.c
+++ b/source3/utils/testparm.c
@@ -129,11 +129,9 @@ cannot be set in the smb.conf file. nmbd will abort with this setting.\n");
         * Password server sanity checks.
         */
 
-       if((lp_security() == SEC_SERVER || lp_security() >= SEC_DOMAIN) && !*lp_passwordserver()) {
+       if((lp_security() >= SEC_DOMAIN) && !*lp_passwordserver()) {
                const char *sec_setting;
-               if(lp_security() == SEC_SERVER)
-                       sec_setting = "server";
-               else if(lp_security() == SEC_DOMAIN)
+               if(lp_security() == SEC_DOMAIN)
                        sec_setting = "domain";
                else if(lp_security() == SEC_ADS)
                        sec_setting = "ads";