From 99bde6889d3d8b7a9e950c86c30e82662e1dacdd Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Tue, 9 Sep 2003 02:58:53 +0000 Subject: syncing files from 3.0 into HEAD again (This used to be commit bca0bba209255d0effbae6a3d3b6d298f0952c3a) --- .../smbdotconf/security/allowtrusteddomains.xml | 2 +- docs/docbook/smbdotconf/security/clientntlmv2auth.xml | 6 ++++++ .../smbdotconf/security/clientplaintextauth.xml | 12 ++++++++++++ docs/docbook/smbdotconf/security/clientschannel.xml | 19 +++++++++++++++++++ docs/docbook/smbdotconf/security/clientsigning.xml | 19 +++++++++++++++++++ docs/docbook/smbdotconf/security/passdbbackend.xml | 13 +++---------- docs/docbook/smbdotconf/security/passwdprogram.xml | 5 ++--- docs/docbook/smbdotconf/security/preloadmodules.xml | 3 --- docs/docbook/smbdotconf/security/serversigning.xml | 19 +++++++++++++++++++ 9 files changed, 81 insertions(+), 17 deletions(-) create mode 100644 docs/docbook/smbdotconf/security/clientplaintextauth.xml create mode 100644 docs/docbook/smbdotconf/security/clientschannel.xml create mode 100644 docs/docbook/smbdotconf/security/clientsigning.xml create mode 100644 docs/docbook/smbdotconf/security/serversigning.xml (limited to 'docs/docbook/smbdotconf/security') diff --git a/docs/docbook/smbdotconf/security/allowtrusteddomains.xml b/docs/docbook/smbdotconf/security/allowtrusteddomains.xml index 63363d2607..8354f8b8da 100644 --- a/docs/docbook/smbdotconf/security/allowtrusteddomains.xml +++ b/docs/docbook/smbdotconf/security/allowtrusteddomains.xml @@ -7,7 +7,7 @@ security option is set to server or domain. If it is set to no, then attempts to connect to a resource from - a domain or workgroup other than the one which smbd is running + a domain or workgroup other than the one which smbd is running in will fail, even if that domain is trusted by the remote server doing the authentication. diff --git a/docs/docbook/smbdotconf/security/clientntlmv2auth.xml b/docs/docbook/smbdotconf/security/clientntlmv2auth.xml index 0bf196488b..611ebcd094 100644 --- a/docs/docbook/smbdotconf/security/clientntlmv2auth.xml +++ b/docs/docbook/smbdotconf/security/clientntlmv2auth.xml @@ -13,6 +13,12 @@ (including NT4 < SP4, Win9x and Samba 2.2) are not compatible with NTLMv2. + Similarly, if enabled, NTLMv1, client lanman auth and client plaintext auth + authentication will be disabled. This also disables share-level + authentication. + If disabled, an NTLM response (and possibly a LANMAN response) will be sent by the client, depending on the value of client lanman auth. diff --git a/docs/docbook/smbdotconf/security/clientplaintextauth.xml b/docs/docbook/smbdotconf/security/clientplaintextauth.xml new file mode 100644 index 0000000000..ac90ef9fe5 --- /dev/null +++ b/docs/docbook/smbdotconf/security/clientplaintextauth.xml @@ -0,0 +1,12 @@ + + + Specifies whether a client should send a plaintext + password if the server does not support encrypted passwords. + + Default: client plaintext auth = yes + + + diff --git a/docs/docbook/smbdotconf/security/clientschannel.xml b/docs/docbook/smbdotconf/security/clientschannel.xml new file mode 100644 index 0000000000..f3ad682517 --- /dev/null +++ b/docs/docbook/smbdotconf/security/clientschannel.xml @@ -0,0 +1,19 @@ + + + + This controls whether the client offers or even + demands the use of the netlogon schannel. + client schannel = no does not + offer the schannel, server schannel = + auto offers the schannel but does not + enforce it, and server schannel = + yes denies access if the server is not + able to speak netlogon schannel. + + Default: client schannel = auto + Example: client schannel = yes + + diff --git a/docs/docbook/smbdotconf/security/clientsigning.xml b/docs/docbook/smbdotconf/security/clientsigning.xml new file mode 100644 index 0000000000..e006dc71ab --- /dev/null +++ b/docs/docbook/smbdotconf/security/clientsigning.xml @@ -0,0 +1,19 @@ + + + + This controls whether the client offers or requires + the server it talks to to use SMB signing. Possible values + are auto, mandatory + and disabled. + + + When set to auto, SMB signing is offered, but not enforced. + When set to mandatory, SMB signing is required and if set + to disabled, SMB signing is not offered either. + + Default: client signing = auto + + diff --git a/docs/docbook/smbdotconf/security/passdbbackend.xml b/docs/docbook/smbdotconf/security/passdbbackend.xml index 1a3a83946a..8c64299dd4 100644 --- a/docs/docbook/smbdotconf/security/passdbbackend.xml +++ b/docs/docbook/smbdotconf/security/passdbbackend.xml @@ -55,22 +55,15 @@ details. - - guest - - Very simple backend that only provides one user: the guest user. - Only maps the NT guest user to the guest account. - Required in pretty much all situations. - - Default: passdb backend = smbpasswd - Example: passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd guest + Example: passdb backend = tdbsam:/etc/samba/private/passdb.tdb smbpasswd:/etc/samba/smbpasswd - Example: passdb backend = ldapsam:ldaps://ldap.example.com guest + Example: passdb backend = ldapsam:ldaps://ldap.example.com - Example: passdb backend = mysql:my_plugin_args tdbsam:/etc/samba/private/passdb.tdb guest + Example: passdb backend = mysql:my_plugin_args tdbsam diff --git a/docs/docbook/smbdotconf/security/passwdprogram.xml b/docs/docbook/smbdotconf/security/passwdprogram.xml index dbcc261ce4..db02670158 100644 --- a/docs/docbook/smbdotconf/security/passwdprogram.xml +++ b/docs/docbook/smbdotconf/security/passwdprogram.xml @@ -17,9 +17,8 @@ Note that if the unix password sync parameter is set to yes then this program is called AS ROOT - before the SMB password in the - smbpasswd5 - file is changed. If this UNIX password change fails, then + before the SMB password in the smbpasswd + file is changed. If this UNIX password change fails, then smbd will fail to change the SMB password also (this is by design). diff --git a/docs/docbook/smbdotconf/security/preloadmodules.xml b/docs/docbook/smbdotconf/security/preloadmodules.xml index 7b4e57cff1..101d9606fa 100644 --- a/docs/docbook/smbdotconf/security/preloadmodules.xml +++ b/docs/docbook/smbdotconf/security/preloadmodules.xml @@ -7,9 +7,6 @@ be loaded into smbd before a client connects. This improves the speed of smbd when reacting to new connections somewhat. - It is recommended to only use this option on heavy-performance - servers. - Default: preload modules = Example: preload modules = /usr/lib/samba/passdb/mysql.so+++ diff --git a/docs/docbook/smbdotconf/security/serversigning.xml b/docs/docbook/smbdotconf/security/serversigning.xml new file mode 100644 index 0000000000..5108918d84 --- /dev/null +++ b/docs/docbook/smbdotconf/security/serversigning.xml @@ -0,0 +1,19 @@ + + + + This controls whether the server offers or requires + the client it talks to to use SMB signing. Possible values + are auto, mandatory + and disabled. + + + When set to auto, SMB signing is offered, but not enforced. + When set to mandatory, SMB signing is required and if set + to disabled, SMB signing is not offered either. + + Default: client signing = False + + -- cgit