diff options
Diffstat (limited to 'docs-xml/smbdotconf/security/serverschannel.xml')
| -rw-r--r-- | docs-xml/smbdotconf/security/serverschannel.xml | 102 |
1 files changed, 102 insertions, 0 deletions
diff --git a/docs-xml/smbdotconf/security/serverschannel.xml b/docs-xml/smbdotconf/security/serverschannel.xml new file mode 100644 index 0000000..5c69f0f --- /dev/null +++ b/docs-xml/smbdotconf/security/serverschannel.xml @@ -0,0 +1,102 @@ +<samba:parameter name="server schannel" + context="G" + type="enum" + enumlist="enum_bool_auto" + deprecated="1" + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> +<description> + + <para> + This option is deprecated and will be removed in future, + as it is a security problem if not set to "yes" (which will be + the hardcoded behavior in future). + </para> + + <para><emphasis>Avoid using this option!</emphasis> Use explicit '<smbconfoption name="server require schannel:COMPUTERACCOUNT">no</smbconfoption>' instead! + </para> + + <para> + Samba will log an error in the log files at log level 0 + if legacy a client is rejected or allowed without an explicit, + '<smbconfoption name="server require schannel:COMPUTERACCOUNT">no</smbconfoption>' option + for the client. The message will indicate + the explicit '<smbconfoption name="server require schannel:COMPUTERACCOUNT">no</smbconfoption>' + line to be added, if the legacy client software requires it. (The log level can be adjusted with + '<smbconfoption name="CVE_2020_1472:error_debug_level">1</smbconfoption>' + in order to complain only at a higher log level). + </para> + + <para> + This allows admins to use "auto" only for a short grace period, + in order to collect the explicit + '<smbconfoption name="server require schannel:COMPUTERACCOUNT">no</smbconfoption>' options. + </para> + + <para> + See <ulink url="https://www.samba.org/samba/security/CVE-2020-1472.html">CVE-2020-1472(ZeroLogon)</ulink>, + <ulink url="https://bugzilla.samba.org/show_bug.cgi?id=14497">https://bugzilla.samba.org/show_bug.cgi?id=14497</ulink>. + </para> + + <para>This option is over-ridden by the <smbconfoption name="server require schannel:COMPUTERACCOUNT"/> option.</para> + + <para>This option is over-ridden by the effective value of 'yes' from + the '<smbconfoption name="server schannel require seal:COMPUTERACCOUNT"/>' + and/or '<smbconfoption name="server schannel require seal"/>' options.</para> + +</description> + +<value type="default">yes</value> +</samba:parameter> + +<samba:parameter name="server require schannel:COMPUTERACCOUNT" + context="G" + type="string" + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc"> +<description> + + <para>If you still have legacy domain members, which required "server schannel = auto" before, + it is possible to specify explicit exception per computer account + by using 'server require schannel:COMPUTERACCOUNT = no' as option. + Note that COMPUTERACCOUNT has to be the sAMAccountName value of + the computer account (including the trailing '$' sign). + </para> + + <para> + Samba will complain in the log files at log level 0, + about the security problem if the option is not set to "no", + but the related computer is actually using the netlogon + secure channel (schannel) feature. + (The log level can be adjusted with + '<smbconfoption name="CVE_2020_1472:warn_about_unused_debug_level">1</smbconfoption>' + in order to complain only at a higher log level). + </para> + + <para> + Samba will warn in the log files at log level 5, + if a setting is still needed for the specified computer account. + </para> + + <para> + See <ulink url="https://www.samba.org/samba/security/CVE-2020-1472.html">CVE-2020-1472(ZeroLogon)</ulink>, + <ulink url="https://bugzilla.samba.org/show_bug.cgi?id=14497">https://bugzilla.samba.org/show_bug.cgi?id=14497</ulink>. + </para> + + <para>This option overrides the <smbconfoption name="server schannel"/> option.</para> + + <para>This option is over-ridden by the effective value of 'yes' from + the '<smbconfoption name="server schannel require seal:COMPUTERACCOUNT"/>' + and/or '<smbconfoption name="server schannel require seal"/>' options.</para> + <para>Which means '<smbconfoption name="server require schannel:COMPUTERACCOUNT">no</smbconfoption>' + is only useful in combination with '<smbconfoption name="server schannel require seal:COMPUTERACCOUNT">no</smbconfoption>'</para> + + <programlisting> + server require schannel:LEGACYCOMPUTER1$ = no + server require schannel seal:LEGACYCOMPUTER1$ = no + server require schannel:NASBOX$ = no + server require schannel seal:NASBOX$ = no + server require schannel:LEGACYCOMPUTER2$ = no + server require schannel seal:LEGACYCOMPUTER2$ = no + </programlisting> +</description> + +</samba:parameter> |