From bb7806283e71f3b8029aae0eed326b5847a36d83 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Sat, 4 Dec 2010 13:48:37 +1100 Subject: s3-libads Default to NOT using the server-supplied principal from SPNEGO This principal is not supplied by later versions of windows, and using it opens up some oportunities for man in the middle attacks. (Becuase it isn't the name being contacted that is verified with the KDC). This adds the option 'client use spnego principal' to the smb.conf (as used in Samba4) to control this behaivour. As in Samba4, this defaults to false. Against 2008 servers, this will not change behaviour. Against earlier servers, it may cause a downgrade to NTLMSSP more often, in environments where server names are not registered with the KDC as servicePrincipalName values. Andrew Bartlett --- source3/libsmb/cliconnect.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'source3/libsmb') diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c index 1e11e158f7..c66314891d 100644 --- a/source3/libsmb/cliconnect.c +++ b/source3/libsmb/cliconnect.c @@ -1279,10 +1279,9 @@ ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user, } } - /* If we get a bad principal, try to guess it if - we have a valid host NetBIOS name. + /* We may not be allowed to use the server-supplied SPNEGO principal, or it may not have been supplied to us */ - if (strequal(principal, ADS_IGNORE_PRINCIPAL)) { + if (!lp_client_use_spnego_principal() || strequal(principal, ADS_IGNORE_PRINCIPAL)) { TALLOC_FREE(principal); } -- cgit