summaryrefslogtreecommitdiff
path: root/source4/auth/credentials/credentials_ntlm.c
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2005-10-31 00:23:38 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 13:45:31 -0500
commitcfa2adf04017c9491d4cc6a69a0bbd4869061b6d (patch)
tree48606e66d038e118bb613ad86cc5c3fe1f58438e /source4/auth/credentials/credentials_ntlm.c
parentfb2bceea6e2d44f86f014a2d969591f462ee27bc (diff)
downloadsamba-cfa2adf04017c9491d4cc6a69a0bbd4869061b6d.tar.gz
samba-cfa2adf04017c9491d4cc6a69a0bbd4869061b6d.tar.bz2
samba-cfa2adf04017c9491d4cc6a69a0bbd4869061b6d.zip
r11401: A simple hack to have our central credentials system deny sending LM
authentication for user@realm logins and machine account logins. This should avoid various protocol downgrade attacks. Andrew Bartlett (This used to be commit 76c2d204d0a1ec66d1ef3c935688c7571b051f46)
Diffstat (limited to 'source4/auth/credentials/credentials_ntlm.c')
-rw-r--r--source4/auth/credentials/credentials_ntlm.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/source4/auth/credentials/credentials_ntlm.c b/source4/auth/credentials/credentials_ntlm.c
index 8540d07305..6a8b284e78 100644
--- a/source4/auth/credentials/credentials_ntlm.c
+++ b/source4/auth/credentials/credentials_ntlm.c
@@ -56,6 +56,18 @@ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_
cli_credentials_get_ntlm_username_domain(cred, mem_ctx, &user, &domain);
+ /* If we are sending a username@realm login (see function
+ * above), then we will not send LM, it will not be
+ * accepted */
+ if (cred->principal_obtained > cred->username_obtained) {
+ *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
+ }
+
+ /* Likewise if we are a machine account (avoid protocol downgrade attacks) */
+ if (cred->principal_obtained > cred->username_obtained) {
+ *flags = *flags & ~CLI_CRED_LANMAN_AUTH;
+ }
+
if (!nt_hash) {
static const uint8_t zeros[16];
/* do nothing - blobs are zero length */