| 1 | <samba:parameter name="lanman auth"
|
|---|
| 2 | context="G"
|
|---|
| 3 | type="boolean"
|
|---|
| 4 | xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
|
|---|
| 5 | <description>
|
|---|
| 6 | <para>This parameter determines whether or not <citerefentry><refentrytitle>smbd</refentrytitle>
|
|---|
| 7 | <manvolnum>8</manvolnum></citerefentry> will attempt to
|
|---|
| 8 | authenticate users or permit password changes
|
|---|
| 9 | using the LANMAN password hash. If disabled, only clients which support NT
|
|---|
| 10 | password hashes (e.g. Windows NT/2000 clients, smbclient, but not
|
|---|
| 11 | Windows 95/98 or the MS DOS network client) will be able to
|
|---|
| 12 | connect to the Samba host.</para>
|
|---|
| 13 |
|
|---|
| 14 | <para>The LANMAN encrypted response is easily broken, due to its
|
|---|
| 15 | case-insensitive nature, and the choice of algorithm. Servers
|
|---|
| 16 | without Windows 95/98/ME or MS DOS clients are advised to disable
|
|---|
| 17 | this option. </para>
|
|---|
| 18 |
|
|---|
| 19 | <para>When this parameter is set to <value>no</value> this
|
|---|
| 20 | will also result in sambaLMPassword in Samba's passdb being
|
|---|
| 21 | blanked after the next password change. As a result of that
|
|---|
| 22 | lanman clients won't be able to authenticate, even if lanman
|
|---|
| 23 | auth is re-enabled later on.
|
|---|
| 24 | </para>
|
|---|
| 25 |
|
|---|
| 26 | <para>Unlike the <command moreinfo="none">encrypt
|
|---|
| 27 | passwords</command> option, this parameter cannot alter client
|
|---|
| 28 | behaviour, and the LANMAN response will still be sent over the
|
|---|
| 29 | network. See the <command moreinfo="none">client lanman
|
|---|
| 30 | auth</command> to disable this for Samba's clients (such as smbclient)</para>
|
|---|
| 31 |
|
|---|
| 32 | <para>If this option, and <command moreinfo="none">ntlm
|
|---|
| 33 | auth</command> are both disabled, then only NTLMv2 logins will be
|
|---|
| 34 | permited. Not all clients support NTLMv2, and most will require
|
|---|
| 35 | special configuration to use it.</para>
|
|---|
| 36 | </description>
|
|---|
| 37 |
|
|---|
| 38 | <value type="default">no</value>
|
|---|
| 39 | </samba:parameter>
|
|---|
