diff options
author | Andrew Bartlett <abartlet@samba.org> | 2001-11-26 06:47:04 +0000 |
---|---|---|
committer | Andrew Bartlett <abartlet@samba.org> | 2001-11-26 06:47:04 +0000 |
commit | 4499007e45637f172c4afb0ec2e048cf795a3cbe (patch) | |
tree | 3baebd215a4f88e90800c8811f54f916ceb2c526 /source3/auth/auth_server.c | |
parent | a131c2cfdcd4e10d85e21bcf4b3e45b99054a96c (diff) | |
download | samba-4499007e45637f172c4afb0ec2e048cf795a3cbe.tar.gz samba-4499007e45637f172c4afb0ec2e048cf795a3cbe.tar.bz2 samba-4499007e45637f172c4afb0ec2e048cf795a3cbe.zip |
A number of things to clean up the auth subsytem a bit...
We now default encrypt passwords = yes
We now check plaintext passwords (however aquired) with the 'sam' backend
rather than unix, if encrypt passwords = yes.
(this kills off the 'local' backed. The sam backend may be renamed in its
place)
The new 'samstrict' wrapper backend checks that the user's domain is one of
our netbios aliases - this ensures that we don't get fallback crazies with
security = domain.
Similarly, the code in the 'ntdomain' and 'smbserver' backends now checks
that the user was not local before contacting the DC.
The default ordering has changed, we now check the local stuff first - but
becouse of the changes above, we will really only ever contact one
auth source.
Andrew Bartlett
(This used to be commit e89b47f65e7eaf5eb288a3d6ba2d3d115c628e7e)
Diffstat (limited to 'source3/auth/auth_server.c')
-rw-r--r-- | source3/auth/auth_server.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/source3/auth/auth_server.c b/source3/auth/auth_server.c index a3cfc3a0e6..d061a5a84f 100644 --- a/source3/auth/auth_server.c +++ b/source3/auth/auth_server.c @@ -186,6 +186,17 @@ static NTSTATUS check_smbserver_security(void *my_private_data, NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE; BOOL locally_made_cli = False; + /* + * Check that the requested domain is not our own machine name. + * If it is, we should never check the PDC here, we use our own local + * password file. + */ + + if(is_netbios_alias_or_name(user_info->domain.str)) { + DEBUG(3,("check_ntdomain_security: Requested domain was for this machine.\n")); + return NT_STATUS_LOGON_FAILURE; + } + cli = my_private_data; if (cli) { |