s4-auth: Remove last traces of LanMan authentiation support in the AD DC.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Mar 29 03:32:57 UTC 2022 on sn-devel-184

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index d23bede2da28d324cb3e9aa462298dd55043a7a2..1bdf3a01cfb0381dd650cc25b56b9004a021eaae 100644 (file)
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -66,6 +66,11 @@ server used as a front.
 REMOVED FEATURES
 ================
 
+LanMan Authentication and password storage removed from the AD DC
+-----------------------------------------------------------------
+
+The storage and authentication with LanMan passwords has been entirely
+removed from the Samba AD DC, even when "lanman auth = yes" is set.
 
 smb.conf changes
 ================

diff --git a/docs-xml/smbdotconf/security/lanmanauth.xml b/docs-xml/smbdotconf/security/lanmanauth.xml
index 842c12d9b6490432b645094018ad89088e208fc7..045e89d94d61bd8029377965992de4112fb5831f 100644 (file)
--- a/docs-xml/smbdotconf/security/lanmanauth.xml
+++ b/docs-xml/smbdotconf/security/lanmanauth.xml
@@ -45,6 +45,10 @@
     then only NTLMv2 logins will be permitted and no LM hash will be
     stored.  All modern clients support NTLMv2, and but some older
     clients require special configuration to use it.</para>
+
+    <para><emphasis>This parameter has no impact on the Samba AD DC,
+    LM authentication is always disabled and no LM password is ever
+    stored.</emphasis></para>
 </description>
 
 <value type="default">no</value>

diff --git a/source4/auth/ntlm/auth_sam.c b/source4/auth/ntlm/auth_sam.c
index 5a56076ac5b76f04c69828f2817d8f46a9dd6e85..14b6c707aa5ad291429600e655f990dcb3087b08 100644 (file)
--- a/source4/auth/ntlm/auth_sam.c
+++ b/source4/auth/ntlm/auth_sam.c
@@ -78,8 +78,8 @@ static NTSTATUS authsam_password_ok(struct auth4_context *auth_context,
                *lm_sess_key = data_blob(NULL, 0);
                *user_sess_key = data_blob(NULL, 0);
                status = hash_password_check(mem_ctx, 
-                                            lpcfg_lanman_auth(auth_context->lp_ctx),
-                                            user_info->password.hash.lanman,
+                                            false,
+                                            NULL,
                                             user_info->password.hash.nt,
                                             user_info->mapped.account_name,
                                             NULL, nt_pwd);