diff options
| author | Stefan Metzmacher <metze@samba.org> | 2020-09-16 10:56:53 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2020-09-18 12:58:23 +0200 |
| commit | 1a1ecc5fc31aa8d00aa8b9ac03daf99375c54d17 (patch) | |
| tree | 9d92ecf518dd5bea0f4f8bcf9795a2ad35c01043 | |
| parent | b33d4dff5f5f32dfb316ec10108d5cb5c12f7986 (diff) | |
| download | samba-1a1ecc5fc31aa8d00aa8b9ac03daf99375c54d17.tar.gz | |
CVE-2020-1472(ZeroLogon): s4:rpc_server/netlogon: support "server require schannel:WORKSTATION$ = no"
This allows to add expections for individual workstations, when using "server schannel = yes".
"server schannel = auto" is very insecure and will be removed soon.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497
Signed-off-by: Stefan Metzmacher <metze@samba.org>
| -rw-r--r-- | source4/rpc_server/netlogon/dcerpc_netlogon.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c index b4326a4ecaa..e7bafb31e83 100644 --- a/source4/rpc_server/netlogon/dcerpc_netlogon.c +++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c @@ -623,6 +623,7 @@ static NTSTATUS dcesrv_netr_creds_server_step_check(struct dcesrv_call_state *dc NTSTATUS nt_status; int schannel = lpcfg_server_schannel(dce_call->conn->dce_ctx->lp_ctx); bool schannel_global_required = (schannel == true); + bool schannel_required = schannel_global_required; struct netlogon_creds_CredentialState *creds = NULL; enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NONE; uint16_t opnum = dce_call->pkt.u.request.opnum; @@ -645,7 +646,13 @@ static NTSTATUS dcesrv_netr_creds_server_step_check(struct dcesrv_call_state *dc return nt_status; } - if (schannel_global_required) { + schannel_required = lpcfg_parm_bool(dce_call->conn->dce_ctx->lp_ctx, + NULL, + "server require schannel", + creds->account_name, + schannel_global_required); + + if (schannel_required) { if (auth_type == DCERPC_AUTH_TYPE_SCHANNEL) { *creds_out = creds; return NT_STATUS_OK; |