blob: a245af55f5f3632ca1a1baf71421aa797df8ca03 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
<samba:parameter name="kerberos encryption types"
context="G"
type="enum"
enumlist="enum_kerberos_encryption_types_vals"
xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
<description>
<para>This parameter determines the encryption types to use when operating
as a Kerberos client. Possible values are <emphasis>all</emphasis>,
<emphasis>strong</emphasis>, and <emphasis>legacy</emphasis>.
</para>
<para>Samba uses a Kerberos library (MIT or Heimdal) to obtain Kerberos
tickets. This library is normally configured outside of Samba, using
the krb5.conf file. This file may also include directives to configure
the encryption types to be used. However, Samba implements Active Directory
protocols and algorithms to locate a domain controller. In order to
force the Kerberos library into using the correct domain controller,
some Samba processes, such as
<citerefentry><refentrytitle>winbindd</refentrytitle>
<manvolnum>8</manvolnum></citerefentry> and
<citerefentry><refentrytitle>net</refentrytitle>
<manvolnum>8</manvolnum></citerefentry>, build a private krb5.conf
file for use by the Kerberos library while being invoked from Samba.
This private file controls all aspects of the Kerberos library operation,
and this parameter controls how the encryption types are configured
within this generated file, and therefore also controls the encryption
types negotiable by Samba.
</para>
<para>When set to <constant>all</constant>, all active directory
encryption types are allowed.
</para>
<para>When set to <constant>strong</constant>, only AES-based encryption
types are offered. This can be used in hardened environments to prevent
downgrade attacks.
</para>
<para>When set to <constant>legacy</constant>, only RC4-HMAC-MD5
is allowed. AVOID using this option, because of
<ulink url="https://www.samba.org/samba/security/CVE-2022-37966.html">CVE-2022-37966</ulink> see
<ulink url="https://bugzilla.samba.org/show_bug.cgi?id=15237">https://bugzilla.samba.org/show_bug.cgi?id=15237</ulink>.
</para>
</description>
<value type="default">all</value>
</samba:parameter>
|
