Age | Commit message (Collapse) | Author | Files | Lines |
|
<j.lu@tiesse.com>
(This used to be commit 59cabc5b940990352ebd0ceef8b6e85ac04669c4)
|
|
(This used to be commit c98399e3c9d74e19b7c9d806ca8028b48866931e)
|
|
code changes form 3.0
(This used to be commit 2279e98cb81faaf8a4e971fec339955f14c23858)
|
|
Match Win2k, and return NT_STATUS_INVALID_PARAMETER
if this parameter is not an account type
Andrew Bartlett
(This used to be commit 43ee2e0b6a6f95ce2864befeb08b5de2ace41c7c)
|
|
JHT came up with a nasty (broken) torture case in preparing examples for
his book.
This prompted me to look at the code that reads the unix group list. This
code did a lot of name -> uid -> name -> sid translations, which caused
problems. Instead, we now do just name -> sid
I also cleaned up some interfaces, and client tools.
Andrew Bartlett
(This used to be commit cc535a6c70d8dcf677322e31b24dec58b23d80f0)
|
|
script; patch from Jianliang Lu <j.lu@tiesse.com>
(This used to be commit 66edeb855e7d7a0bfa20cbe93275c86880bd453d)
|
|
on local files on on domain members; bug 875
(This used to be commit a5c5dde1c34ba44f8d9bbb38720a089a6d61806c)
|
|
(This used to be commit 975ac6f5aa4d8d709733757e4e003f3c551fc9ba)
|
|
source/libsmb/ntlmssp.c:
Picked up by the build farm - despite all my efforts, security=server was
broken by my NTLM2 commit. This should correctly cause the NTLM2 case
not to be negotiated when 'security=server' is in effect.
testsuide/build_farm/runlist:
Without 'non unix accounts' we can't test security=domain on the build farm.
source/rpc_server/srv_samr_nt.c:
Match Win2k and return 'invalid parameter' for creating of a new account with
account flags of 0.
Andrew Bartlett
(This used to be commit e97f1eb62ae01b5259d7ecfab9b55b07103379c7)
|
|
whether we have a complete pdu or not; fixes bug with multiple pdu request rpc's broken over SMBwriteX calls each
(This used to be commit 514acc655d58a660b2a2542ff81a880f1bdfc3f6)
|
|
* don't fall back to unmapped UNIX group for
get_local_group_from_sid()
* remove an extra become/unbecome_root() pair
from group enumeration
(This used to be commit c0f34b42a6a4af09ae4b76721bc350784d87f686)
|
|
Jeremy.
(This used to be commit 6543bca0cbf6030d2400e30bb7491237d9c818f8)
|
|
(This used to be commit c4ce92e80688fe7fd4b2fde2c31e94baf3e4dca0)
|
|
Add support for variable-length session keys in our client code.
This means that we now support 'net rpc join' with KRB5 (des based)
logins. Now, you need to hack 'net' to do that, but the principal is
important...
When we add kerberos to 'net rpc', it should be possible to still do
user management and the like over RPC.
-
Add server-side support for variable-length session keys (as used by
DES based krb5 logins).
Andrew Bartlett
(This used to be commit 1287cf5f921327c9ea758de46220c4e2dedc485c)
|
|
Changes all over the shop, but all towards:
- NTLM2 support in the server
- KEY_EXCH support in the server
- variable length session keys.
In detail:
- NTLM2 is an extension of NTLMv1, that is compatible with existing
domain controllers (unlike NTLMv2, which requires a DC upgrade).
* This is known as 'NTLMv2 session security' *
(This is not yet implemented on the RPC pipes however, so there may
well still be issues for PDC setups, particuarly around password
changes. We do not fully understand the sign/seal implications of
NTLM2 on RPC pipes.)
This requires modifications to our authentication subsystem, as we
must handle the 'challege' input into the challenge-response algorithm
being changed. This also needs to be turned off for
'security=server', which does not support this.
- KEY_EXCH is another 'security' mechanism, whereby the session key
actually used by the server is sent by the client, rather than being
the shared-secret directly or indirectly.
- As both these methods change the session key, the auth subsystem
needed to be changed, to 'override' session keys provided by the
backend.
- There has also been a major overhaul of the NTLMSSP subsystem, to
merge the 'client' and 'server' functions, so they both operate on a
single structure. This should help the SPNEGO implementation.
- The 'names blob' in NTLMSSP is always in unicode - never in ascii.
Don't make an ascii version ever.
- The other big change is to allow variable length session keys. We
have always assumed that session keys are 16 bytes long - and padded
to this length if shorter. However, Kerberos session keys are 8 bytes
long, when the krb5 login uses DES.
* This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. *
- Add better DEBUG() messages to ntlm_auth, warning administrators of
misconfigurations that prevent access to the privileged pipe. This
should help reduce some of the 'it just doesn't work' issues.
- Fix data_blob_talloc() to behave the same way data_blob() does when
passed a NULL data pointer. (just allocate)
REMEMBER to make clean after this commit - I have changed plenty of
data structures...
Andrew Bartlett
(This used to be commit 57a895aaabacc0c9147344d097d333793b77c947)
|
|
Jeremy.
(This used to be commit b93e44e01edb432e11b9ad6aeb4d4eea0f7fa433)
|
|
Patch by metze.
rafal
(This used to be commit 7191186fc64eb0b8092a2f6f1e89b6b6a6df7627)
|
|
(not /etc/group) even when doing local aliases
* remove "hide local users" parameter; we have this
behavior built into 3.0
(This used to be commit 3b75e862dfba42c95e2279c300c06bb981f52993)
|
|
source/passdb/pdb_get_set.c:
I agree with vl's #if 0 here, and am not quite sure what I was
thinking with regard to the original code.
Let's keep samba simple, and just remove it.
source/rpc_server/srv_netlog_nt.c:
Remove compleatly wrong comments. (There were correct, 2 years ago...)
source/intl/lang_tdb.c:
Add newline to debug message
Andrew Bartlett
(This used to be commit 2a8dbe03690b60f3d9c83de3cf6ce873aa0657bc)
|
|
* revert the change that prevent the guest
account from being added to a passdb backend
since it broke the build farm.
* apply patch from Alex Deiter to fix the
"smbldap_open: cannot access when not root
error" messages when looking up group
information (bug 281)
(This used to be commit 20bd309239199d85accb2b7aac6d4dd73e414f85)
|
|
with memory leak fixes by me.
Jeremy.
(This used to be commit daceed37387c517b3f0ab9c173f419215e3d676b)
|
|
(This used to be commit a6cc763333943bc6e360bb7e78cf9bfb1bc936e8)
|
|
Takes care of the lsass pipe
(This used to be commit 3dca3efa4b427fa3094a8cd392fe5744b5f6f6a8)
|
|
This eliminates RPC_UUID. It creates the following struct:
struct uuid
{
uint32 time_low;
uint16 time_mid;
uint16 time_hi_and_version;
uint8 clock_seq[2];
uint8 node[6];
};
which replaces RPC_UUID and various random struct uuid definitions
and a flat version:
#define UUID_FLAT_SIZE 16
typedef struct uuid_flat
{
uint8 info[UUID_FLAT_SIZE];
} UUID_FLAT;
which pretty much looks like GUID (which I will start eliminating).
I want us to use the FLAT one only on the wire (perhaps in files, too?), and
I want it to be obvious to the coder that it is the FLAT version.
This leaves a couple of compiler warnings, where GUID isn't completely
replaced by FLAT_UUID yet...I'll get to those soon.
(This used to be commit 1532b5d2e3c61df232b16394acedf6eac387588b)
|
|
Jeremy.
(This used to be commit cbefb5c4f983ca49fcc563111d8704d3770daf81)
|
|
when reverse connecting back to a client for printer notify.
Jeremy.
(This used to be commit 7fde193efeb856ec325d5d563f1e710c45dc65d7)
|
|
mapping, but this is the base for changes to come.
(This used to be commit 73882e970a3aea1c3c9f34779b4220bbf28f6dad)
|
|
* add server support for DsEnumerateDomainTrusts()
(This used to be commit 06bacf6e3434db5bd09b48f84206441712e69a63)
|
|
(no need to include all of smbd files to use some basic sec functions)
also minor compile fixes
(This used to be commit 66074d3b097d8cf2a231bf08c7f4db62da68189d)
|
|
Jeremy.
(This used to be commit a0828a2a1ce04075f0a7cb4a201cea0781998237)
|
|
clientspreviously joined to the Samba domain
(This used to be commit 9d2e585e5e6f9066c6901aa8d8308734f8667296)
|
|
>Fix for #480. Change the interface for init_unistr2 to not take a length
>but a flags field. We were assuming that 2*strlen(mb_string) == length of ucs2-le string.
>This is not the case. Count it after conversion.
>Jeremy.
(This used to be commit e2ab9e54cd0ec0002175cf18ff364f4aebaf85a0)
|
|
me to expose a type arguement to make_sec_desc(). We weren't copying
the SE_DESC_DACL_AUTO_INHERITED flag which could cause errors on
auto inherited checks.
Jeremy.
(This used to be commit 546b2271c08735ac1049a453abac996d794aa364)
|
|
fields, bad_password_count and logon_count. Ensure this is stored/fetched
in the various SAMs. As it replaces the unknown_5 field this fits
exactly into the tdb SAM without any binary problems. It also is added
to the LDAP SAM as two extra attributes. It breaks compatibility with
the experimental SAMs xml and mysql. The maintainers of these SAMs must
fix them so upgrades like this can be done transparently. I will insist
on the "experimental" status until this is solved.
Jeremy.
(This used to be commit 71ecd10181cd35313b79f618c2928c2f45424812)
|
|
>Patch from Gregory Hinton Nietsky <gregory@networksentry.co.za>,
>ensure the desired access is read from the incoming RPC request.
>Jeremy.
(This used to be commit a556637d0bc56aeb980c422c4d1da44311956c3b)
|
|
(This used to be commit c17a7dc9a190156a069da3e861c18fd3f81224ad)
|
|
(This used to be commit 3101c236b8241dc0183995ffceed551876427de4)
|
|
prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE
(This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad)
|
|
* quit obsessing over the sequence number so much
* share the updated sequence number between parent
and child winbindd processes in dual mode
(This used to be commit 6fb5bdb30e2b1341ba600ce0dfd397394f7a831c)
|
|
unless we are trying to be an ADS DC
(This used to be commit 689576c242dd24349265973bded36ef6a239cebc)
|
|
in add groupmem code.
Jeremy.
(This used to be commit 7e7077e9e363f46cea93767f0463581dbec87063)
|
|
Jeremy.
(This used to be commit 0f7f762a1e1aa86afc2a740dcce83c8384d8d53b)
|
|
Jeremy.
(This used to be commit e12934c67b6aea9e3e449009e159ce6814dcbd11)
|
|
plus internal fixes
1st stage
(This used to be commit 6d036761e565bc93964bb3c939d5b7d78d5778a3)
|
|
SAM_ACCOUNT does not have anymore uid and gid fields
all the code that used them has been fixed to use the proper idmap calls
fix to idmap_tdb for first time idmap.tdb initialization.
auth_serversupplied_info structure has now an uid and gid field
few other fixes to make the system behave correctly with idmap
tested only with tdbsam, but smbpasswd and nisplus should be ok
have not tested ldap !
(This used to be commit 6a6f6032467e55aa9b76390e035623976477ba42)
|
|
of sync-up for the rpc_server/srv_samr_nt.c
Andrew Bartlett
(This used to be commit 3c867aedd9abc29389f5d049dbc94ada6738d1b0)
|
|
(This used to be commit ba1e654a15fa800e56732fe005afd7479c18324b)
|
|
function. Patch by metze with some minor modifications.
(This used to be commit f4576757d1d52a8f1b96894c869bb76450003fd1)
|
|
(This used to be commit e2d757aed27ede67cf904c01e8f23e436d764108)
|
|
samlogon call certainly breaks the credential chain. Do it once during
the bind response.
Volker
(This used to be commit 616b6dd60fe621a968fef34e66550f86b7b735bc)
|