Context Navigation

security

Timestamp:

May 24, 2009, 7:17:10 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 to 3.3.1

Location:

branches/samba-3.3.x/docs-xml/smbdotconf/security

Files:

r217	r221
12	12	Windows 95/98) will be able to be connected from the Samba client.</para>
13	13
14		<para>The LANMAN encrypted response is easily broken, due to it's
	14	<para>The LANMAN encrypted response is easily broken, due to its
15	15	case-insensitive nature, and the choice of algorithm. Clients
16	16	without Windows 95/98 servers are advised to disable

-              r217
+              r221
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
 <description>
+    <para>This controls whether the client offers or requires
+    the server it talks to to use SMB signing. Possible values
+    <para>This controls whether the client is allowed or required to use SMB signing. Possible values
     are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
     and <emphasis>disabled</emphasis>.

r217	r221
13	13	connect to the Samba host.</para>
14	14
15		<para>The LANMAN encrypted response is easily broken, due to it's
	15	<para>The LANMAN encrypted response is easily broken, due to its
16	16	case-insensitive nature, and the choice of algorithm. Servers
17	17	without Windows 95/98/ME or MS DOS clients are advised to disable

r217	r221
8	8	or Active Directory domain controller with this option,
9	9	and using <command moreinfo="none">security = [ads\|domain\|server]</command>
10		it is possible to get Samba to
	10	it is possible to get Samba
11	11	to do all its username/password validation using a specific remote server.</para>
12	12

-              r217
+              r221
     is commonly used for a shared printer server. It is more difficult
     to setup guest shares with <command moreinfo="none">security = user</command>, see
     the <smbconfoption name="map to guest"/>parameter for details.</para>
+    the <smbconfoption name="map to guest"/> parameter for details.</para>
     <para>It is possible to use <command moreinfo="none">smbd</command> in a <emphasis>
 …
     <para><anchor id="SECURITYEQUALSSHARE"/><emphasis>SECURITY = SHARE</emphasis></para>
     <para>When clients connect to a share level security server they
+    <para>When clients connect to a share level security server, they
     need not log onto the server with a valid username and password before
     attempting to connect to a shared resource (although modern clients
 …
         <note><para>From the client's point of
     view <command moreinfo="none">security = server</command> is the
+    view, <command moreinfo="none">security = server</command> is the
     same as <command moreinfo="none">security = user</command>.  It
     only affects how the server deals  with the authentication, it does

r217	r221
14	14
15	15	<para>
16		Please note that with this set to <literal>no</literal> you will have to apply the WindowsXP
	16	Please note that with this set to <literal>no</literal>, you will have to apply the WindowsXP
17	17	<filename>WinXP_SignOrSeal.reg</filename> registry patch found in the docs/registry subdirectory of the Samba distribution tarball.
18	18	</para>

-              r217
+              r221
 <description>
+    <para>This controls whether the server offers or requires
+    the client it talks to to use SMB signing. Possible values
+    <para>This controls whether the client is allowed or required to use SMB signing. Possible values
     are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
     and <emphasis>disabled</emphasis>.

-              r217
+              r221
     </para>
+    <para>This controls whether the server offers or requires
+    the client it talks to to use SMB encryption. Possible values
+    <para>This controls whether the remote client is allowed or required to use SMB encryption. Possible values
     are <emphasis>auto</emphasis>, <emphasis>mandatory</emphasis>
     and <emphasis>disabled</emphasis>. This may be set on a per-share

-              r217
+              r221
         password in the smbpasswd file to be updated automatically as they log on. This option allows a site to
         migrate from plaintext password authentication (users authenticate with plaintext password over the
         wire, and are checked against a UNIX account atabase) to encrypted password authentication (the SMB
+        wire, and are checked against a UNIX account database) to encrypted password authentication (the SMB
         challenge/response authentication mechanism) without forcing all users to re-enter their passwords via
         smbpasswd at the time the change is made. This is a convenience option to allow the change over to encrypted
 …
     <para>
         Note that even when this parameter is set a user authenticating to <command moreinfo="none">smbd</command>
+        Note that even when this parameter is set, a user authenticating to <command moreinfo="none">smbd</command>
         must still enter a valid password in order to connect correctly, and to update their hashed (smbpasswd)
         passwords.

Note: See TracChangeset for help on using the changeset viewer.