From 0239f680a79ec41ecff97eea38687eccad2b5894 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Sat, 12 May 2012 12:00:32 +0200 Subject: docs-xml: remove documentation of "SECURITY = SERVER" metze --- docs-xml/smbdotconf/security/security.xml | 32 ------------------------------- 1 file changed, 32 deletions(-) (limited to 'docs-xml/smbdotconf') diff --git a/docs-xml/smbdotconf/security/security.xml b/docs-xml/smbdotconf/security/security.xml index 2575d77b99..453de94620 100644 --- a/docs-xml/smbdotconf/security/security.xml +++ b/docs-xml/smbdotconf/security/security.xml @@ -79,38 +79,6 @@ See also the parameter and the parameter. - SECURITY = SERVER - - - In this depicted mode Samba will try to validate the username/password by passing it to another SMB server, such as an - NT box. If this fails it will revert to security = user. It expects the - parameter to be set to yes, unless the remote - server does not support them. However note that if encrypted passwords have been negotiated then Samba cannot - revert back to checking the UNIX password file, it must have a valid smbpasswd file to check users against. See the chapter about the User Database in - the Samba HOWTO Collection for details on how to set this up. - - - This mode of operation has - significant pitfalls since it is more vulnerable to - man-in-the-middle attacks and server impersonation. In particular, - this mode of operation can cause significant resource consumption on - the PDC, as it must maintain an active connection for the duration - of the user's session. Furthermore, if this connection is lost, - there is no way to reestablish it, and further authentications to the - Samba server may fail (from a single client, till it disconnects). - - - If the client selects NTLMv2 authentication, then this mode of operation will fail - - - From the client's point of - view, security = server is the - same as security = user. It - only affects how the server deals with the authentication, it does - not in any way affect what the client sees. - - This option is deprecated, and may be removed in future Note that the name of the resource being requested is not sent to the server until after -- cgit