CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: support "server require schannel...
authorGünther Deschner <gd@samba.org>
Thu, 17 Sep 2020 12:23:16 +0000 (14:23 +0200)
committerKarolin Seeger <kseeger@samba.org>
Fri, 18 Sep 2020 10:45:37 +0000 (12:45 +0200)
This allows to add expections for individual workstations, when using "server schannel = yes".
"server schannel = auto" is very insecure and will be removed soon.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14497

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Günther Deschner <gd@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
source3/rpc_server/netlogon/srv_netlog_nt.c

index d1ce1e94cb5bdffbfbb42cdf2e4aa839e9ba3921..63dd9dc0d5f48a36ea5a8d1e70a7d7b6a92afd6d 100644 (file)
@@ -1072,6 +1072,7 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p,
 {
        NTSTATUS status;
        bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
+       bool schannel_required = schannel_global_required;
        struct loadparm_context *lp_ctx;
        struct netlogon_creds_CredentialState *creds = NULL;
        enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NONE;
@@ -1104,7 +1105,11 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p,
                return status;
        }
 
-       if (schannel_global_required) {
+       schannel_required = lp_parm_bool(GLOBAL_SECTION_SNUM,
+                                        "server require schannel",
+                                        creds->account_name,
+                                        schannel_global_required);
+       if (schannel_required) {
                if (auth_type == DCERPC_AUTH_TYPE_SCHANNEL) {
                        *creds_out = creds;
                        return NT_STATUS_OK;