| 1 | <samba:parameter name="lanman auth"
|
|---|
| 2 | context="G"
|
|---|
| 3 | type="boolean"
|
|---|
| 4 | advanced="1" developer="1"
|
|---|
| 5 | xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 6 | <description>
|
|---|
| 7 | <para>This parameter determines whether or not <citerefentry><refentrytitle>smbd</refentrytitle>
|
|---|
| 8 | <manvolnum>8</manvolnum></citerefentry> will attempt to
|
|---|
| 9 | authenticate users or permit password changes
|
|---|
| 10 | using the LANMAN password hash. If disabled, only clients which support NT
|
|---|
| 11 | password hashes (e.g. Windows NT/2000 clients, smbclient, but not
|
|---|
| 12 | Windows 95/98 or the MS DOS network client) will be able to
|
|---|
| 13 | connect to the Samba host.</para>
|
|---|
| 14 |
|
|---|
| 15 | <para>The LANMAN encrypted response is easily broken, due to its
|
|---|
| 16 | case-insensitive nature, and the choice of algorithm. Servers
|
|---|
| 17 | without Windows 95/98/ME or MS DOS clients are advised to disable
|
|---|
| 18 | this option. </para>
|
|---|
| 19 |
|
|---|
| 20 | <para>Unlike the <command moreinfo="none">encrypt
|
|---|
| 21 | passwords</command> option, this parameter cannot alter client
|
|---|
| 22 | behaviour, and the LANMAN response will still be sent over the
|
|---|
| 23 | network. See the <command moreinfo="none">client lanman
|
|---|
| 24 | auth</command> to disable this for Samba's clients (such as smbclient)</para>
|
|---|
| 25 |
|
|---|
| 26 | <para>If this option, and <command moreinfo="none">ntlm
|
|---|
| 27 | auth</command> are both disabled, then only NTLMv2 logins will be
|
|---|
| 28 | permited. Not all clients support NTLMv2, and most will require
|
|---|
| 29 | special configuration to use it.</para>
|
|---|
| 30 | </description>
|
|---|
| 31 |
|
|---|
| 32 | <value type="default">no</value>
|
|---|
| 33 | </samba:parameter>
|
|---|
