diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2010-12-10 12:10:07 +1100 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2010-12-10 16:08:31 +1100 |
| commit | 5cfe949108f253a8e20c835cb53fe6f5eae7fbb5 (patch) | |
| tree | 0b25600ee3c2f017adc56afccb6cc3bc95d025d9 | |
| parent | f13404e27b00f826a11684e69cff82ae0023fc91 (diff) | |
| download | samba-5cfe949108f253a8e20c835cb53fe6f5eae7fbb5.tar.gz samba-5cfe949108f253a8e20c835cb53fe6f5eae7fbb5.tar.bz2 samba-5cfe949108f253a8e20c835cb53fe6f5eae7fbb5.zip | |
s3-winbind Don't send the LM password to the server, ever
This is for the case where we have the plaintext password locally, and
can construct the challenge-response values here.
We should never ever use the LM password in domain authentication.
The last domain controller to only have LM passwords stored was NT
3.5.
Andrew Bartlett
| -rw-r--r-- | source3/winbindd/winbindd_pam.c | 12 |
1 files changed, 1 insertions, 11 deletions
diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c index d52d4e2703..23ffb87b7e 100644 --- a/source3/winbindd/winbindd_pam.c +++ b/source3/winbindd/winbindd_pam.c @@ -1145,7 +1145,6 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain, DATA_BLOB lm_resp; DATA_BLOB nt_resp; int attempts = 0; - unsigned char local_lm_response[24]; unsigned char local_nt_response[24]; fstring name_domain, name_user; bool retry; @@ -1198,16 +1197,7 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain, data_blob_free(&nt_response); } else { - if (lp_client_lanman_auth() - && SMBencrypt(state->request->data.auth.pass, - chal, - local_lm_response)) { - lm_resp = data_blob_talloc(state->mem_ctx, - local_lm_response, - sizeof(local_lm_response)); - } else { - lm_resp = data_blob_null; - } + lm_resp = data_blob_null; SMBNTencrypt(state->request->data.auth.pass, chal, local_nt_response); |