diff options
author | Andrew Bartlett <abartlet@samba.org> | 2012-02-03 18:03:10 +1100 |
---|---|---|
committer | Andrew Bartlett <abartlet@samba.org> | 2012-03-04 23:33:05 +0100 |
commit | d7bb961859a3501aec4d28842bfffb6190d19a73 (patch) | |
tree | e472b543e1e88914fbcf7bf68a3e431ff7314afd /source3/smbd/sesssetup.c | |
parent | acfa107ec64ceb6bf3a28df14585cfb0ccc79f41 (diff) | |
download | samba-d7bb961859a3501aec4d28842bfffb6190d19a73.tar.gz samba-d7bb961859a3501aec4d28842bfffb6190d19a73.tar.bz2 samba-d7bb961859a3501aec4d28842bfffb6190d19a73.zip |
s3-auth: Remove security=share (depricated since 3.6).
This patch removes security=share, which Samba implemented by matching
the per-share password provided by the client in the Tree Connect with
a selection of usernames supplied by the client, the smb.conf or
guessed from the environment.
The rationale for the removal is that for the bulk of security=share
users, we just we need a very simple way to run a 'trust the network'
Samba server, where users mark shares as guest ok. This is still
supported, and the smb.conf options are documented at
https://wiki.samba.org/index.php/Public_Samba_Server
At the same time, this closes the door on one of the most arcane areas
of Samba authentication.
Naturally, full user-name/password authentication remain available in
security=user and above.
This includes documentation updates for username and only user, which
now only do a small amount of what they used to do.
Andrew Bartlett
--------------
/ \
/ REST \
/ IN \
/ PEACE \
/ \
| SEC_SHARE |
| security=share |
| |
| |
| 5 March |
| |
| 2012 |
*| * * * | *
_________)/\\_//(\/(/\)/\//\/\///|_)_______
Diffstat (limited to 'source3/smbd/sesssetup.c')
-rw-r--r-- | source3/smbd/sesssetup.c | 80 |
1 files changed, 25 insertions, 55 deletions
diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c index 987b626d6b..da306b97bc 100644 --- a/source3/smbd/sesssetup.c +++ b/source3/smbd/sesssetup.c @@ -561,11 +561,7 @@ void reply_sesssetup_and_X(struct smb_request *req) if (doencrypt) { lm_resp = data_blob(p, passlen1); nt_resp = data_blob(p+passlen1, passlen2); - } else if (lp_security() != SEC_SHARE) { - /* - * In share level we should ignore any passwords, so - * only read them if we're not. - */ + } else { char *pass = NULL; bool unic= smb_flag2 & FLAGS2_UNICODE_STRINGS; @@ -673,27 +669,6 @@ void reply_sesssetup_and_X(struct smb_request *req) reload_services(sconn, conn_snum_used, true); - if (lp_security() == SEC_SHARE) { - char *sub_user_mapped = NULL; - /* In share level we should ignore any passwords */ - - data_blob_free(&lm_resp); - data_blob_free(&nt_resp); - data_blob_clear_free(&plaintext_password); - - (void)map_username(talloc_tos(), sub_user, &sub_user_mapped); - if (!sub_user_mapped) { - reply_nterror(req, NT_STATUS_NO_MEMORY); - END_PROFILE(SMBsesssetupX); - return; - } - fstrcpy(sub_user, sub_user_mapped); - add_session_user(sconn, sub_user); - add_session_workgroup(sconn, domain); - /* Then force it to null for the benfit of the code below */ - user = ""; - } - if (!*user) { nt_status = check_guest_password(sconn->remote_address, &server_info); @@ -796,36 +771,31 @@ void reply_sesssetup_and_X(struct smb_request *req) /* register the name and uid as being validated, so further connections to a uid can get through without a password, on the same VC */ - if (lp_security() == SEC_SHARE) { - sess_vuid = UID_FIELD_INVALID; - TALLOC_FREE(session_info); - } else { - /* Ignore the initial vuid. */ - sess_vuid = register_initial_vuid(sconn); - if (sess_vuid == UID_FIELD_INVALID) { - data_blob_free(&nt_resp); - data_blob_free(&lm_resp); - reply_nterror(req, nt_status_squash( - NT_STATUS_LOGON_FAILURE)); - END_PROFILE(SMBsesssetupX); - return; - } - /* register_existing_vuid keeps the session_info */ - sess_vuid = register_existing_vuid(sconn, sess_vuid, - session_info, - nt_resp.data ? nt_resp : lm_resp); - if (sess_vuid == UID_FIELD_INVALID) { - data_blob_free(&nt_resp); - data_blob_free(&lm_resp); - reply_nterror(req, nt_status_squash( - NT_STATUS_LOGON_FAILURE)); - END_PROFILE(SMBsesssetupX); - return; - } - - /* current_user_info is changed on new vuid */ - reload_services(sconn, conn_snum_used, true); + /* Ignore the initial vuid. */ + sess_vuid = register_initial_vuid(sconn); + if (sess_vuid == UID_FIELD_INVALID) { + data_blob_free(&nt_resp); + data_blob_free(&lm_resp); + reply_nterror(req, nt_status_squash( + NT_STATUS_LOGON_FAILURE)); + END_PROFILE(SMBsesssetupX); + return; } + /* register_existing_vuid keeps the session_info */ + sess_vuid = register_existing_vuid(sconn, sess_vuid, + session_info, + nt_resp.data ? nt_resp : lm_resp); + if (sess_vuid == UID_FIELD_INVALID) { + data_blob_free(&nt_resp); + data_blob_free(&lm_resp); + reply_nterror(req, nt_status_squash( + NT_STATUS_LOGON_FAILURE)); + END_PROFILE(SMBsesssetupX); + return; + } + + /* current_user_info is changed on new vuid */ + reload_services(sconn, conn_snum_used, true); data_blob_free(&nt_resp); data_blob_free(&lm_resp); |