diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2005-10-31 00:23:38 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 13:45:31 -0500 |
| commit | cfa2adf04017c9491d4cc6a69a0bbd4869061b6d (patch) | |
| tree | 48606e66d038e118bb613ad86cc5c3fe1f58438e /source4/auth/credentials/credentials_ntlm.c | |
| parent | fb2bceea6e2d44f86f014a2d969591f462ee27bc (diff) | |
| download | samba-cfa2adf04017c9491d4cc6a69a0bbd4869061b6d.tar.gz samba-cfa2adf04017c9491d4cc6a69a0bbd4869061b6d.tar.bz2 samba-cfa2adf04017c9491d4cc6a69a0bbd4869061b6d.zip | |
r11401: A simple hack to have our central credentials system deny sending LM
authentication for user@realm logins and machine account logins.
This should avoid various protocol downgrade attacks.
Andrew Bartlett
(This used to be commit 76c2d204d0a1ec66d1ef3c935688c7571b051f46)
Diffstat (limited to 'source4/auth/credentials/credentials_ntlm.c')
| -rw-r--r-- | source4/auth/credentials/credentials_ntlm.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/source4/auth/credentials/credentials_ntlm.c b/source4/auth/credentials/credentials_ntlm.c index 8540d07305..6a8b284e78 100644 --- a/source4/auth/credentials/credentials_ntlm.c +++ b/source4/auth/credentials/credentials_ntlm.c @@ -56,6 +56,18 @@ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred, TALLOC_ cli_credentials_get_ntlm_username_domain(cred, mem_ctx, &user, &domain); + /* If we are sending a username@realm login (see function + * above), then we will not send LM, it will not be + * accepted */ + if (cred->principal_obtained > cred->username_obtained) { + *flags = *flags & ~CLI_CRED_LANMAN_AUTH; + } + + /* Likewise if we are a machine account (avoid protocol downgrade attacks) */ + if (cred->principal_obtained > cred->username_obtained) { + *flags = *flags & ~CLI_CRED_LANMAN_AUTH; + } + if (!nt_hash) { static const uint8_t zeros[16]; /* do nothing - blobs are zero length */ |