Attachment 6480 Details for Bug 8151 – Improved patch stream

[patch] Improved patch stream

security-param.patch (text/plain), 28.47 KB, created by Andrew Bartlett on 2011-05-24 00:44:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Bartlett

Created: 2011-05-24 00:44:14 UTC

Size: 28.47 KB

patch

obsolete

>From d476877c327a53defa97f9a500e09a9f944b5fa6 Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Mon, 23 May 2011 10:20:47 +1000
>Subject: [PATCH 1/5] docs: Rewrite 'password server' documentation
>
>I think this new version is more clear.
>
>Andrew Bartlett
>---
> docs-xml/smbdotconf/security/passwordserver.xml |  106 ++++++++++++-----------
> 1 files changed, 54 insertions(+), 52 deletions(-)
>
>diff --git a/docs-xml/smbdotconf/security/passwordserver.xml b/docs-xml/smbdotconf/security/passwordserver.xml
>index 0e92af9..0ac39f1 100644
>--- a/docs-xml/smbdotconf/security/passwordserver.xml
>+++ b/docs-xml/smbdotconf/security/passwordserver.xml
>@@ -10,54 +10,24 @@
>     it is possible to get Samba
>     to do all its username/password validation using a specific remote server.</para>
> 
>-    <para>This option sets the name or IP address of the password server to use. 
>-    New syntax has been added to support defining the port to use when connecting 
>-    to the server the case of an ADS realm.  To define a port other than the
>-    default LDAP port of 389, add the port number using a colon after the 
>-    name or IP address (e.g. 192.168.1.100:389).  If you do not specify a port,
>-    Samba will use the standard LDAP port of tcp/389.  Note that port numbers
>-    have no effect on password servers for Windows NT 4.0 domains or netbios 
>-    connections.</para>
>-
>-    <para>If parameter is a name, it is looked up using the 
>-    parameter <smbconfoption name="name resolve order"/> and so may resolved
>-    by any method and order described in that parameter.</para>
>-
>-    <para>The password server must be a machine capable of using 
>-    the &quot;LM1.2X002&quot; or the &quot;NT LM 0.12&quot; protocol, and it must be in 
>-    user level security mode.</para>
>-
>-    <note><para>Using a password server  means your UNIX box (running
>-    Samba) is only as secure as your  password server. <emphasis>DO NOT
>-    CHOOSE A PASSWORD SERVER THAT  YOU DON'T COMPLETELY TRUST</emphasis>.
>-    </para></note>
>-		
>-    <para>Never point a Samba server at itself for password serving.
>-    This will cause a loop and could lock up your Samba  server!</para>
>-
>-    <para>The name of the password server takes the standard 
>-    substitutions, but probably the only useful one is <parameter moreinfo="none">%m
>-    </parameter>, which means the Samba server will use the incoming 
>-    client as the password server. If you use this then you better 
>-    trust your clients, and you had better restrict them with hosts allow!</para>
>-
>     <para>If the <parameter moreinfo="none">security</parameter> parameter is set to
>-    <constant>domain</constant> or <constant>ads</constant>, then the list of machines in this 
>-    option must be a list of Primary or Backup Domain controllers for the
>-    Domain or the character '*', as the Samba server is effectively
>-    in that domain, and will use cryptographically authenticated RPC calls
>-    to authenticate the user logging on. The advantage of using <command moreinfo="none">
>-    security = domain</command> is that if you list several hosts in the 
>-    <parameter moreinfo="none">password server</parameter> option then <command moreinfo="none">smbd
>-    </command> will try each in turn till it finds one that responds.  This
>-    is useful in case your primary server goes down.</para>
>+    <constant>domain</constant> or <constant>ads</constant>, then this option 
>+    <emphasis>should not</emphasis> be used, as the default '*' indicates to Samba 
>+    to determine the best DC to contact dynamically, just as all other hosts in an 
>+    AD domain do.  This allows the domain to be maintained without modification to 
>+    the smb.conf file.  The cryptograpic protection on the authenticated RPC calls
>+    used to verify passwords ensures that this default is safe.</para>
> 
>-    <para>If the <parameter moreinfo="none">password server</parameter> option is set 
>-    to the character '*', then Samba will attempt to auto-locate the 
>-    Primary or Backup Domain controllers to authenticate against by 
>-    doing a query for the name <constant>WORKGROUP&lt;1C&gt;</constant> 
>-    and then contacting each server returned in the list of IP 
>-    addresses from the name resolution source. </para>
>+    <para><emphasis>It is strongly recommended that you use the
>+    default of '*'</emphasis>, however if in your particular
>+    environment you have reason to specify a particular DC list, then
>+    the list of machines in this option must be a list of names or IP
>+    addresses of Domain controllers for the Domain. If you use the
>+    default of '*', or list several hosts in the <parameter
>+    moreinfo="none">password server</parameter> option then <command
>+    moreinfo="none">smbd </command> will try each in turn till it
>+    finds one that responds.  This is useful in case your primary
>+    server goes down.</para>
> 
>     <para>If the list of servers contains both names/IP's and the '*'
>     character, the list is treated as a list of preferred 
>@@ -65,10 +35,12 @@
>     will be added to the list as well.  Samba will not attempt to optimize 
>     this list by locating the closest DC.</para>
> 		
>+    <para>If parameter is a name, it is looked up using the 
>+    parameter <smbconfoption name="name resolve order"/> and so may resolved
>+    by any method and order described in that parameter.</para>
>+
>     <para>If the <parameter moreinfo="none">security</parameter> parameter is 
>-    set to <constant>server</constant>, then there are different
>-    restrictions that <command moreinfo="none">security = domain</command> doesn't 
>-    suffer from:</para>
>+    set to <constant>server</constant>, these additional restrictions apply:</para>
> 
>     <itemizedlist>
> 	<listitem>
>@@ -82,12 +54,42 @@
> 	</listitem>
> 	    
> 	<listitem>
>-	    <para>If you are using a Windows NT server as your 
>-	    password server then you will have to ensure that your users 
>+	    <para>You will have to ensure that your users 
> 	    are able to login from the Samba server, as when in <command moreinfo="none">
> 	    security = server</command>  mode the network logon will appear to 
>-	    come from there rather than from the users workstation.</para>
>+	    come from the Samba server rather than from the users workstation.</para>
> 	</listitem>
>+
>+	<listitem>
>+	    <para>The client must not select NTLMv2 authentication.</para>
>+	</listitem>
>+
>+	<listitem>
>+	  <para>The password server must be a machine capable of using 
>+	  the &quot;LM1.2X002&quot; or the &quot;NT LM 0.12&quot; protocol, and it must be in 
>+	  user level security mode.</para>
>+	</listitem>
>+
>+	<listitem>
>+	  <para>Using a password server  means your UNIX box (running
>+	  Samba) is only as secure as (a host masqurading as) your password server. <emphasis>DO NOT
>+	  CHOOSE A PASSWORD SERVER THAT  YOU DON'T COMPLETELY TRUST</emphasis>.
>+	  </para>
>+	</listitem>
>+		
>+	<listitem>
>+	  <para>Never point a Samba server at itself for password serving.
>+	  This will cause a loop and could lock up your Samba  server!</para>
>+	</listitem>
>+
>+	<listitem>
>+	  <para>The name of the password server takes the standard 
>+	  substitutions, but probably the only useful one is <parameter moreinfo="none">%m
>+	  </parameter>, which means the Samba server will use the incoming 
>+	  client as the password server. If you use this then you better 
>+	  trust your clients, and you had better restrict them with hosts allow!</para>
>+	</listitem>
>+
>     </itemizedlist>
> </description>
> 
>-- 
>1.7.4.4
>
>
>From 19c31e2b34ffbbac13e60acd9994b69b9b8b5d3c Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Mon, 23 May 2011 10:42:40 +1000
>Subject: [PATCH 2/5] docs: Clarify the 'security=server' fails for NTLMv2
>
>---
> docs-xml/smbdotconf/security/security.xml |    3 +++
> 1 files changed, 3 insertions(+), 0 deletions(-)
>
>diff --git a/docs-xml/smbdotconf/security/security.xml b/docs-xml/smbdotconf/security/security.xml
>index 514ea54..18b9f6c 100644
>--- a/docs-xml/smbdotconf/security/security.xml
>+++ b/docs-xml/smbdotconf/security/security.xml
>@@ -210,6 +210,9 @@
>     Samba server may fail (from a single client, till it disconnects).
> 	</para></note>
> 
>+	<note><para>If the client selects NTLMv2 authentication, then this mode of operation <emphasis>will fail</emphasis>
>+	</para></note>
>+
> 	<note><para>From the client's point of 
>     view, <command moreinfo="none">security = server</command> is the
>     same as <command moreinfo="none">security = user</command>.  It
>-- 
>1.7.4.4
>
>
>From 90648008e8efe1bfc06ea29b23df392f74216609 Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Fri, 13 May 2011 17:55:41 +0200
>Subject: [PATCH 3/5] s3-param Deprecate a number of security parameters for
> 3.6
>
>This follows up on the agreement on the samba-technical list in Jan
>2011 to deprecate these options, and to possibly remove these in the
>4.0 release after user feedback.
>
>Andrew Bartlett
>
>Autobuild-User: Andrew Bartlett <abartlet@samba.org>
>Autobuild-Date: Fri May 13 19:51:41 CEST 2011 on sn-devel-104
>---
> docs-xml/smbdotconf/logon/enableprivileges.xml |    2 +-
> docs-xml/smbdotconf/protocol/usespnego.xml     |    2 +-
> docs-xml/smbdotconf/security/passwordlevel.xml |    2 +-
> docs-xml/smbdotconf/security/security.xml      |  142 +++++++++++-------------
> docs-xml/smbdotconf/security/username.xml      |    2 +-
> source3/param/loadparm.c                       |   16 ++-
> 6 files changed, 81 insertions(+), 85 deletions(-)
>
>diff --git a/docs-xml/smbdotconf/logon/enableprivileges.xml b/docs-xml/smbdotconf/logon/enableprivileges.xml
>index 3e958e0..0fbc504 100644
>--- a/docs-xml/smbdotconf/logon/enableprivileges.xml
>+++ b/docs-xml/smbdotconf/logon/enableprivileges.xml
>@@ -5,7 +5,7 @@
>                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
> <description>
> 	<para>
>-	This parameter controls whether or not smbd will honor privileges assigned to specific SIDs via either
>+	This deprecated parameter controls whether or not smbd will honor privileges assigned to specific SIDs via either
> 	 <command>net rpc rights</command> or one of the Windows user and group manager tools.  This parameter is
> 	enabled by default. It can be disabled to prevent members of the Domain Admins group from being able to
> 	assign privileges to users or groups which can then result in certain smbd operations running as root that
>diff --git a/docs-xml/smbdotconf/protocol/usespnego.xml b/docs-xml/smbdotconf/protocol/usespnego.xml
>index 8fb559c..e16c7ce 100644
>--- a/docs-xml/smbdotconf/protocol/usespnego.xml
>+++ b/docs-xml/smbdotconf/protocol/usespnego.xml
>@@ -4,7 +4,7 @@
>                  developer="1"
>                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
> <description>
>-    <para>This variable controls controls whether samba will try 
>+    <para>This deprecated variable controls controls whether samba will try 
>     to use Simple and Protected NEGOciation (as specified by rfc2478) with 
>     WindowsXP and Windows2000 clients to agree upon an authentication mechanism. 
> </para>
>diff --git a/docs-xml/smbdotconf/security/passwordlevel.xml b/docs-xml/smbdotconf/security/passwordlevel.xml
>index 1da11e4..eee838f 100644
>--- a/docs-xml/smbdotconf/security/passwordlevel.xml
>+++ b/docs-xml/smbdotconf/security/passwordlevel.xml
>@@ -13,7 +13,7 @@
>     text passwords even when NT LM 0.12 selected by the protocol
>     negotiation request/response.</para>
> 
>-    <para>This parameter defines the maximum number of characters 
>+    <para>This deprecated parameter defines the maximum number of characters 
>     that may be upper case in passwords.</para>
> 
>     <para>For example, say the password given was &quot;FRED&quot;. If <parameter moreinfo="none">
>diff --git a/docs-xml/smbdotconf/security/security.xml b/docs-xml/smbdotconf/security/security.xml
>index 18b9f6c..55e147e 100644
>--- a/docs-xml/smbdotconf/security/security.xml
>+++ b/docs-xml/smbdotconf/security/security.xml
>@@ -22,32 +22,18 @@
>     the most common setting needed when talking to Windows 98 and 
>     Windows NT.</para>
> 
>-    <para>The alternatives are <command moreinfo="none">security = share</command>,
>-    <command moreinfo="none">security = server</command> or <command moreinfo="none">security = domain
>-    </command>.</para>
>+    <para>The alternatives are
>+    <command moreinfo="none">security = ads</command> or <command moreinfo="none">security = domain
>+    </command>, which support joining Samba to a Windows domain, along with <command moreinfo="none">security = share</command> and <command moreinfo="none">security = server</command>, both of which are deprecated.</para>
> 
>     <para>In versions of Samba prior to 2.0.0, the default was 
>     <command moreinfo="none">security = share</command> mainly because that was
>     the only option at one stage.</para>
> 
>-    <para>There is a bug in WfWg that has relevance to this 
>-    setting. When in user or server level security a WfWg client 
>-    will totally ignore the username and password you type in the &quot;connect 
>-    drive&quot; dialog box. This makes it very difficult (if not impossible) 
>-    to connect to a Samba service as anyone except the user that 
>-    you are logged into WfWg as.</para>
>-
>-    <para>If your PCs use usernames that are the same as their 
>-    usernames on the UNIX machine then you will want to use 
>-    <command moreinfo="none">security = user</command>. If you mostly use usernames 
>-    that don't exist on the UNIX box then use <command moreinfo="none">security = 
>-    share</command>.</para>
>-
>-    <para>You should also use <command moreinfo="none">security = share</command> if you 
>+    <para>You should use <command moreinfo="none">security = user</command> and 
>+    <smbconfoption name="map to guest"/> if you 
>     want to mainly setup shares without a password (guest shares). This 
>-    is commonly used for a shared printer server. It is more difficult 
>-    to setup guest shares with <command moreinfo="none">security = user</command>, see 
>-    the <smbconfoption name="map to guest"/> parameter for details.</para>
>+    is commonly used for a shared printer server. </para>
> 		
>     <para>It is possible to use <command moreinfo="none">smbd</command> in a <emphasis>
>     hybrid mode</emphasis> where it is offers both user and share 
>@@ -56,7 +42,62 @@
>     <para>The different settings will now be explained.</para>
> 
> 
>+    <para><anchor id="SECURITYEQUALSUSER"/><emphasis>SECURITY = USER</emphasis></para>
>+
>+    <para>This is the default security setting in Samba. 
>+    With user-level security a client must first &quot;log-on&quot; with a 
>+    valid username and password (which can be mapped using the <smbconfoption name="username map"/> 
>+    parameter). Encrypted passwords (see the <smbconfoption name="encrypted passwords"/> parameter) can also
>+    be used in this security mode. Parameters such as <smbconfoption name="user"/> and <smbconfoption
>+	name="guest only"/> if set	are then applied and 
>+    may change the UNIX user to use on this connection, but only after 
>+    the user has been successfully authenticated.</para>
>+
>+    <para><emphasis>Note</emphasis> that the name of the resource being 
>+    requested is <emphasis>not</emphasis> sent to the server until after 
>+    the server has successfully authenticated the client. This is why 
>+    guest shares don't work in user level security without allowing 
>+    the server to automatically map unknown users into the <smbconfoption name="guest account"/>. 
>+    See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
>+
>+    <para>See also the section <link linkend="VALIDATIONSECT">NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
>+
>+    <para><anchor id="SECURITYEQUALSDOMAIN"/><emphasis>SECURITY = DOMAIN</emphasis></para>
>+
>+    <para>This mode will only work correctly if <citerefentry><refentrytitle>net</refentrytitle>
>+    <manvolnum>8</manvolnum></citerefentry> has been used to add this
>+    machine into a Windows NT Domain. It expects the <smbconfoption name="encrypted passwords"/>
>+	parameter to be set to <constant>yes</constant>. In this 
>+    mode Samba will try to validate the username/password by passing
>+    it to a Windows NT Primary or Backup Domain Controller, in exactly 
>+    the same way that a Windows NT Server would do.</para>
>+
>+    <para><emphasis>Note</emphasis> that a valid UNIX user must still 
>+    exist as well as the account on the Domain Controller to allow 
>+    Samba to have a valid UNIX account to map file access to.</para>
>+
>+    <para><emphasis>Note</emphasis> that from the client's point 
>+    of view <command moreinfo="none">security = domain</command> is the same 
>+    as <command moreinfo="none">security = user</command>. It only 
>+    affects how the server deals with the authentication, 
>+    it does not in any way affect what the client sees.</para>
>+
>+    <para><emphasis>Note</emphasis> that the name of the resource being 
>+    requested is <emphasis>not</emphasis> sent to the server until after 
>+    the server has successfully authenticated the client. This is why 
>+    guest shares don't work in user level security without allowing 
>+    the server to automatically map unknown users into the <smbconfoption name="guest account"/>. 
>+    See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
>+
>+    <para>See also the section <link linkend="VALIDATIONSECT">
>+    NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
>+
>+    <para>See also the <smbconfoption name="password server"/> parameter and
>+	 the <smbconfoption name="encrypted passwords"/> parameter.</para>
>+
>     <para><anchor id="SECURITYEQUALSSHARE"/><emphasis>SECURITY = SHARE</emphasis></para> 
>+
>+    <note><para>This option is deprecated as it is incompatible with SMB2</para></note>
> 		
>     <para>When clients connect to a share level security server, they 
>     need not log onto the server with a valid username and password before 
>@@ -135,63 +176,10 @@
>     <para>See also the section <link linkend="VALIDATIONSECT">
>     NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
> 
>-    <para><anchor id="SECURITYEQUALSUSER"/><emphasis>SECURITY = USER</emphasis></para>
>-
>-    <para>This is the default security setting in Samba 3.0. 
>-    With user-level security a client must first &quot;log-on&quot; with a 
>-    valid username and password (which can be mapped using the <smbconfoption name="username map"/> 
>-    parameter). Encrypted passwords (see the <smbconfoption name="encrypted passwords"/> parameter) can also
>-    be used in this security mode. Parameters such as <smbconfoption name="user"/> and <smbconfoption
>-	name="guest only"/> if set	are then applied and 
>-    may change the UNIX user to use on this connection, but only after 
>-    the user has been successfully authenticated.</para>
>-
>-    <para><emphasis>Note</emphasis> that the name of the resource being 
>-    requested is <emphasis>not</emphasis> sent to the server until after 
>-    the server has successfully authenticated the client. This is why 
>-    guest shares don't work in user level security without allowing 
>-    the server to automatically map unknown users into the <smbconfoption name="guest account"/>. 
>-    See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
>-
>-    <para>See also the section <link linkend="VALIDATIONSECT">NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
>-
>-    <para><anchor id="SECURITYEQUALSDOMAIN"/><emphasis>SECURITY = DOMAIN</emphasis></para>
>-
>-    <para>This mode will only work correctly if <citerefentry><refentrytitle>net</refentrytitle>
>-    <manvolnum>8</manvolnum></citerefentry> has been used to add this
>-    machine into a Windows NT Domain. It expects the <smbconfoption name="encrypted passwords"/>
>-	parameter to be set to <constant>yes</constant>. In this 
>-    mode Samba will try to validate the username/password by passing
>-    it to a Windows NT Primary or Backup Domain Controller, in exactly 
>-    the same way that a Windows NT Server would do.</para>
>-
>-    <para><emphasis>Note</emphasis> that a valid UNIX user must still 
>-    exist as well as the account on the Domain Controller to allow 
>-    Samba to have a valid UNIX account to map file access to.</para>
>-
>-    <para><emphasis>Note</emphasis> that from the client's point 
>-    of view <command moreinfo="none">security = domain</command> is the same 
>-    as <command moreinfo="none">security = user</command>. It only 
>-    affects how the server deals with the authentication, 
>-    it does not in any way affect what the client sees.</para>
>-
>-    <para><emphasis>Note</emphasis> that the name of the resource being 
>-    requested is <emphasis>not</emphasis> sent to the server until after 
>-    the server has successfully authenticated the client. This is why 
>-    guest shares don't work in user level security without allowing 
>-    the server to automatically map unknown users into the <smbconfoption name="guest account"/>. 
>-    See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>
>-
>-    <para>See also the section <link linkend="VALIDATIONSECT">
>-    NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>
>-
>-    <para>See also the <smbconfoption name="password server"/> parameter and
>-	 the <smbconfoption name="encrypted passwords"/> parameter.</para>
>-
>     <para><anchor id="SECURITYEQUALSSERVER"/><emphasis>SECURITY = SERVER</emphasis></para>
> 
>     <para>
>-	In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an
>+	In this depicted mode Samba will try to validate the username/password by passing it to another SMB server, such as an
> 	NT box. If this fails it will revert to <command moreinfo="none">security = user</command>. It expects the
> 	<smbconfoption name="encrypted passwords"/> parameter to be set to <constant>yes</constant>, unless the remote
> 	server does not support them.  However note that if encrypted passwords have been negotiated then Samba cannot
>@@ -203,10 +191,10 @@
> 	<note><para>This mode of operation has
>     significant pitfalls since it is more vulnerable to
>     man-in-the-middle attacks and server impersonation.  In particular,
>-    this mode of operation can cause significant resource consuption on
>+    this mode of operation can cause significant resource consumption on
>     the PDC, as it must maintain an active connection for the duration
>     of the user's session.  Furthermore, if this connection is lost,
>-    there is no way to reestablish it, and futher authentications to the
>+    there is no way to reestablish it, and further authentications to the
>     Samba server may fail (from a single client, till it disconnects).
> 	</para></note>
> 
>@@ -219,6 +207,8 @@
>     only affects how the server deals  with the authentication, it does
> 	not in any way affect what the  client sees.</para></note>
> 
>+    <note><para>This option is deprecated, and may be removed in future</para></note>
>+
>     <para><emphasis>Note</emphasis> that the name of the resource being 
>     requested is <emphasis>not</emphasis> sent to the server until after 
>     the server has successfully authenticated the client. This is why 
>diff --git a/docs-xml/smbdotconf/security/username.xml b/docs-xml/smbdotconf/security/username.xml
>index 3a45d4d..19d8a2e 100644
>--- a/docs-xml/smbdotconf/security/username.xml
>+++ b/docs-xml/smbdotconf/security/username.xml
>@@ -9,7 +9,7 @@
>     list, in which case the supplied password will be tested against 
>     each username in turn (left to right).</para>
> 
>-    <para>The <parameter moreinfo="none">username</parameter> line is needed only when 
>+    <para>The deprecated <parameter moreinfo="none">username</parameter> line is needed only when 
>     the PC is unable to supply its own username. This is the case 
>     for the COREPLUS protocol or where your users have different WfWg 
>     usernames to UNIX usernames. In both these cases you may also be 
>diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
>index 73406c1..fc19656 100644
>--- a/source3/param/loadparm.c
>+++ b/source3/param/loadparm.c
>@@ -1160,7 +1160,7 @@ static struct parm_struct parm_table[] = {
> 		.ptr		= &Globals.bNullPasswords,
> 		.special	= NULL,
> 		.enum_list	= NULL,
>-		.flags		= FLAG_ADVANCED,
>+		.flags		= FLAG_ADVANCED | FLAG_DEPRECATED,
> 	},
> 	{
> 		.label		= "obey pam restrictions",
>@@ -1259,7 +1259,7 @@ static struct parm_struct parm_table[] = {
> 		.ptr		= &Globals.bEnablePrivileges,
> 		.special	= NULL,
> 		.enum_list	= NULL,
>-		.flags		= FLAG_ADVANCED,
>+		.flags		= FLAG_ADVANCED | FLAG_DEPRECATED,
> 	},
> 
> 	{
>@@ -1332,7 +1332,7 @@ static struct parm_struct parm_table[] = {
> 		.ptr		= &Globals.pwordlevel,
> 		.special	= NULL,
> 		.enum_list	= NULL,
>-		.flags		= FLAG_ADVANCED,
>+		.flags		= FLAG_ADVANCED | FLAG_DEPRECATED,
> 	},
> 	{
> 		.label		= "username level",
>@@ -1431,7 +1431,7 @@ static struct parm_struct parm_table[] = {
> 		.ptr		= &sDefault.szUsername,
> 		.special	= NULL,
> 		.enum_list	= NULL,
>-		.flags		= FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE,
>+		.flags		= FLAG_ADVANCED | FLAG_GLOBAL | FLAG_SHARE | FLAG_DEPRECATED,
> 	},
> 	{
> 		.label		= "user",
>@@ -2294,7 +2294,7 @@ static struct parm_struct parm_table[] = {
> 		.ptr		= &Globals.bUseSpnego,
> 		.special	= NULL,
> 		.enum_list	= NULL,
>-		.flags		= FLAG_ADVANCED,
>+		.flags		= FLAG_ADVANCED | FLAG_DEPRECATED,
> 	},
> 	{
> 		.label		= "client signing",
>@@ -9580,6 +9580,12 @@ static bool lp_load_ex(const char *pszFname,
> 	set_default_server_announce_type();
> 	set_allowed_client_auth();
> 
>+	if (lp_security() == SEC_SHARE) {
>+		DEBUG(1, ("WARNING: The security=share option is deprecated\n"));
>+	} else if (lp_security() == SEC_SERVER) {
>+		DEBUG(1, ("WARNING: The security=server option is deprecated\n"));
>+	}
>+
> 	bLoaded = True;
> 
> 	/* Now we check bWINSsupport and set szWINSserver to 127.0.0.1 */
>-- 
>1.7.4.4
>
>
>From 2747a334252b1e237406f432bfa6219f2f52cb0c Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Mon, 23 May 2011 10:42:57 +1000
>Subject: [PATCH 4/5] s3-param Depricate 'password server = foo:12389' syntax
>
>This was originally intended to allow the LDAP port on a DC to be
>varied, but makes little sense to change one port when in an
>environment where krb5, ldap, smb and potentially DCE/RPC over TCP are
>involved.
>
>Andrew Bartlett
>---
> source3/param/loadparm.c |    5 +++++
> 1 files changed, 5 insertions(+), 0 deletions(-)
>
>diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
>index fc19656..6b0d127 100644
>--- a/source3/param/loadparm.c
>+++ b/source3/param/loadparm.c
>@@ -9586,6 +9586,11 @@ static bool lp_load_ex(const char *pszFname,
> 		DEBUG(1, ("WARNING: The security=server option is deprecated\n"));
> 	}
> 
>+	if (lp_security() == SEC_ADS && strchr(lp_passwordserver(), ':')) {
>+		DEBUG(1, ("WARNING: The optional ':port' in password server = %s is deprecated\n",
>+			  lp_passwordserver()));
>+	}
>+
> 	bLoaded = True;
> 
> 	/* Now we check bWINSsupport and set szWINSserver to 127.0.0.1 */
>-- 
>1.7.4.4
>
>
>From a25dc325bab2fb7c98849046c83fc4c2c8f67afb Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Wed, 18 May 2011 11:53:34 +1000
>Subject: [PATCH 5/5] s3-testparm Warn about incorrect use of 'password
> server'
>
>---
> source3/utils/testparm.c |   21 ++++++++++++++++++---
> 1 files changed, 18 insertions(+), 3 deletions(-)
>
>diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c
>index 978ada2..6076a57 100644
>--- a/source3/utils/testparm.c
>+++ b/source3/utils/testparm.c
>@@ -128,20 +128,35 @@ cannot be set in the smb.conf file. nmbd will abort with this setting.\n");
> 	 * Password server sanity checks.
> 	 */
> 
>-	if((lp_security() == SEC_SERVER || lp_security() >= SEC_DOMAIN) && !lp_passwordserver()) {
>+	if((lp_security() == SEC_SERVER || lp_security() >= SEC_DOMAIN) && !*lp_passwordserver()) {
> 		const char *sec_setting;
> 		if(lp_security() == SEC_SERVER)
> 			sec_setting = "server";
> 		else if(lp_security() == SEC_DOMAIN)
> 			sec_setting = "domain";
>+		else if(lp_security() == SEC_ADS)
>+			sec_setting = "ads";
> 		else
> 			sec_setting = "";
> 
>-		fprintf(stderr, "ERROR: The setting 'security=%s' requires the 'password server' parameter be set \
>-to a valid password server.\n", sec_setting );
>+		fprintf(stderr, "ERROR: The setting 'security=%s' requires the 'password server' parameter be set\n"
>+			"to the default value * or a valid password server.\n", sec_setting );
> 		ret = 1;
> 	}
> 
>+	if((lp_security() >= SEC_DOMAIN) && (strcmp(lp_passwordserver(), "*") != 0)) {
>+		const char *sec_setting;
>+		if(lp_security() == SEC_DOMAIN)
>+			sec_setting = "domain";
>+		else if(lp_security() == SEC_ADS)
>+			sec_setting = "ads";
>+		else
>+			sec_setting = "";
>+
>+		fprintf(stderr, "WARNING: The setting 'security=%s' should NOT be combined with the 'password server' parameter.\n"
>+			"(by default Samba will discover the correct DC to contact automatically).\n", sec_setting );
>+	}
>+
> 	/*
> 	 * Password chat sanity checks.
> 	 */
>-- 
>1.7.4.4
>

Flags:

jra: review+

Actions: View

Attachments on bug 8151: 6468 | 6469 | 6470 | 6471 | 6473 | 6480