Changeset 740 for vendor/current/docs-xml/smbdotconf/security
- Timestamp:
- Nov 14, 2012, 12:59:34 PM (13 years ago)
- Location:
- vendor/current/docs-xml/smbdotconf/security
- Files:
-
- 2 added
- 1 deleted
- 6 edited
-
clientntlmv2auth.xml (modified) (2 diffs)
-
guestok.xml (modified) (1 diff)
-
passwordlevel.xml (modified) (1 diff)
-
passwordserver.xml (modified) (3 diffs)
-
security.xml (modified) (6 diffs)
-
sendspengoprincipal.xml (added)
-
updateencrypted.xml (deleted)
-
username.xml (modified) (1 diff)
-
usernamemapcachetime.xml (added)
Legend:
- Unmodified
- Added
- Removed
-
vendor/current/docs-xml/smbdotconf/security/clientntlmv2auth.xml
r414 r740 11 11 12 12 <para>If enabled, only an NTLMv2 and LMv2 response (both much more 13 secure than earlier versions) will be sent. Manyservers13 secure than earlier versions) will be sent. Older servers 14 14 (including NT4 < SP4, Win9x and Samba 2.2) are not compatible with 15 NTLMv2 .</para>15 NTLMv2 when not in an NTLMv2 supporting domain</para> 16 16 17 17 <para>Similarly, if enabled, NTLMv1, <command … … 25 25 moreinfo="none">client lanman auth</command>. </para> 26 26 27 <para>Note that some sites (particularly 28 those following 'best practice' security polices) only allow NTLMv2 29 responses, and not the weaker LM or NTLM.</para> 27 <para>Note that Windows Vista and later versions already use 28 NTLMv2 by default, and some sites (particularly those following 29 'best practice' security polices) only allow NTLMv2 responses, and 30 not the weaker LM or NTLM.</para> 30 31 </description> 31 <value type="default"> no</value>32 <value type="default">yes</value> 32 33 </samba:parameter> -
vendor/current/docs-xml/smbdotconf/security/guestok.xml
r414 r740 10 10 Privileges will be those of the <smbconfoption name="guest account"/>.</para> 11 11 12 <para>This param ater nullifies the benifits of setting12 <para>This parameter nullifies the benefits of setting 13 13 <smbconfoption name="restrict anonymous">2</smbconfoption> 14 14 </para> -
vendor/current/docs-xml/smbdotconf/security/passwordlevel.xml
r414 r740 14 14 negotiation request/response.</para> 15 15 16 <para>This parameter defines the maximum number of characters16 <para>This deprecated parameter defines the maximum number of characters 17 17 that may be upper case in passwords.</para> 18 18 -
vendor/current/docs-xml/smbdotconf/security/passwordserver.xml
r414 r740 11 11 to do all its username/password validation using a specific remote server.</para> 12 12 13 <para>This option sets the name or IP address of the password server to use. 14 New syntax has been added to support defining the port to use when connecting 15 to the server the case of an ADS realm. To define a port other than the 16 default LDAP port of 389, add the port number using a colon after the 17 name or IP address (e.g. 192.168.1.100:389). If you do not specify a port, 18 Samba will use the standard LDAP port of tcp/389. Note that port numbers 19 have no effect on password servers for Windows NT 4.0 domains or netbios 20 connections.</para> 13 <para>If the <parameter moreinfo="none">security</parameter> parameter is set to 14 <constant>domain</constant> or <constant>ads</constant>, then this option 15 <emphasis>should not</emphasis> be used, as the default '*' indicates to Samba 16 to determine the best DC to contact dynamically, just as all other hosts in an 17 AD domain do. This allows the domain to be maintained without modification to 18 the smb.conf file. The cryptograpic protection on the authenticated RPC calls 19 used to verify passwords ensures that this default is safe.</para> 21 20 22 <para>If parameter is a name, it is looked up using the 23 parameter <smbconfoption name="name resolve order"/> and so may resolved 24 by any method and order described in that parameter.</para> 25 26 <para>The password server must be a machine capable of using 27 the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in 28 user level security mode.</para> 29 30 <note><para>Using a password server means your UNIX box (running 31 Samba) is only as secure as your password server. <emphasis>DO NOT 32 CHOOSE A PASSWORD SERVER THAT YOU DON'T COMPLETELY TRUST</emphasis>. 33 </para></note> 34 35 <para>Never point a Samba server at itself for password serving. 36 This will cause a loop and could lock up your Samba server!</para> 37 38 <para>The name of the password server takes the standard 39 substitutions, but probably the only useful one is <parameter moreinfo="none">%m 40 </parameter>, which means the Samba server will use the incoming 41 client as the password server. If you use this then you better 42 trust your clients, and you had better restrict them with hosts allow!</para> 43 44 <para>If the <parameter moreinfo="none">security</parameter> parameter is set to 45 <constant>domain</constant> or <constant>ads</constant>, then the list of machines in this 46 option must be a list of Primary or Backup Domain controllers for the 47 Domain or the character '*', as the Samba server is effectively 48 in that domain, and will use cryptographically authenticated RPC calls 49 to authenticate the user logging on. The advantage of using <command moreinfo="none"> 50 security = domain</command> is that if you list several hosts in the 51 <parameter moreinfo="none">password server</parameter> option then <command moreinfo="none">smbd 52 </command> will try each in turn till it finds one that responds. This 53 is useful in case your primary server goes down.</para> 54 55 <para>If the <parameter moreinfo="none">password server</parameter> option is set 56 to the character '*', then Samba will attempt to auto-locate the 57 Primary or Backup Domain controllers to authenticate against by 58 doing a query for the name <constant>WORKGROUP<1C></constant> 59 and then contacting each server returned in the list of IP 60 addresses from the name resolution source. </para> 21 <para><emphasis>It is strongly recommended that you use the 22 default of '*'</emphasis>, however if in your particular 23 environment you have reason to specify a particular DC list, then 24 the list of machines in this option must be a list of names or IP 25 addresses of Domain controllers for the Domain. If you use the 26 default of '*', or list several hosts in the <parameter 27 moreinfo="none">password server</parameter> option then <command 28 moreinfo="none">smbd </command> will try each in turn till it 29 finds one that responds. This is useful in case your primary 30 server goes down.</para> 61 31 62 32 <para>If the list of servers contains both names/IP's and the '*' … … 66 36 this list by locating the closest DC.</para> 67 37 38 <para>If parameter is a name, it is looked up using the 39 parameter <smbconfoption name="name resolve order"/> and so may resolved 40 by any method and order described in that parameter.</para> 41 68 42 <para>If the <parameter moreinfo="none">security</parameter> parameter is 69 set to <constant>server</constant>, then there are different 70 restrictions that <command moreinfo="none">security = domain</command> doesn't 71 suffer from:</para> 43 set to <constant>server</constant>, these additional restrictions apply:</para> 72 44 73 45 <itemizedlist> … … 83 55 84 56 <listitem> 85 <para>If you are using a Windows NT server as your 86 password server then you will have to ensure that your users 57 <para>You will have to ensure that your users 87 58 are able to login from the Samba server, as when in <command moreinfo="none"> 88 59 security = server</command> mode the network logon will appear to 89 come from the rerather than from the users workstation.</para>60 come from the Samba server rather than from the users workstation.</para> 90 61 </listitem> 62 63 <listitem> 64 <para>The client must not select NTLMv2 authentication.</para> 65 </listitem> 66 67 <listitem> 68 <para>The password server must be a machine capable of using 69 the "LM1.2X002" or the "NT LM 0.12" protocol, and it must be in 70 user level security mode.</para> 71 </listitem> 72 73 <listitem> 74 <para>Using a password server means your UNIX box (running 75 Samba) is only as secure as (a host masqurading as) your password server. <emphasis>DO NOT 76 CHOOSE A PASSWORD SERVER THAT YOU DON'T COMPLETELY TRUST</emphasis>. 77 </para> 78 </listitem> 79 80 <listitem> 81 <para>Never point a Samba server at itself for password serving. 82 This will cause a loop and could lock up your Samba server!</para> 83 </listitem> 84 85 <listitem> 86 <para>The name of the password server takes the standard 87 substitutions, but probably the only useful one is <parameter moreinfo="none">%m 88 </parameter>, which means the Samba server will use the incoming 89 client as the password server. If you use this then you better 90 trust your clients, and you had better restrict them with hosts allow!</para> 91 </listitem> 92 91 93 </itemizedlist> 92 94 </description> -
vendor/current/docs-xml/smbdotconf/security/security.xml
r414 r740 23 23 Windows NT.</para> 24 24 25 <para>The alternatives are <command moreinfo="none">security = share</command>,26 <command moreinfo="none">security = server</command> or <command moreinfo="none">security = domain27 </command> .</para>25 <para>The alternatives are 26 <command moreinfo="none">security = ads</command> or <command moreinfo="none">security = domain 27 </command>, which support joining Samba to a Windows domain, along with <command moreinfo="none">security = share</command> and <command moreinfo="none">security = server</command>, both of which are deprecated.</para> 28 28 29 29 <para>In versions of Samba prior to 2.0.0, the default was … … 31 31 the only option at one stage.</para> 32 32 33 <para>There is a bug in WfWg that has relevance to this 34 setting. When in user or server level security a WfWg client 35 will totally ignore the username and password you type in the "connect 36 drive" dialog box. This makes it very difficult (if not impossible) 37 to connect to a Samba service as anyone except the user that 38 you are logged into WfWg as.</para> 39 40 <para>If your PCs use usernames that are the same as their 41 usernames on the UNIX machine then you will want to use 42 <command moreinfo="none">security = user</command>. If you mostly use usernames 43 that don't exist on the UNIX box then use <command moreinfo="none">security = 44 share</command>.</para> 45 46 <para>You should also use <command moreinfo="none">security = share</command> if you 33 <para>You should use <command moreinfo="none">security = user</command> and 34 <smbconfoption name="map to guest"/> if you 47 35 want to mainly setup shares without a password (guest shares). This 48 is commonly used for a shared printer server. It is more difficult 49 to setup guest shares with <command moreinfo="none">security = user</command>, see 50 the <smbconfoption name="map to guest"/> parameter for details.</para> 36 is commonly used for a shared printer server. </para> 51 37 52 38 <para>It is possible to use <command moreinfo="none">smbd</command> in a <emphasis> … … 57 43 58 44 45 <para><anchor id="SECURITYEQUALSUSER"/><emphasis>SECURITY = USER</emphasis></para> 46 47 <para>This is the default security setting in Samba. 48 With user-level security a client must first "log-on" with a 49 valid username and password (which can be mapped using the <smbconfoption name="username map"/> 50 parameter). Encrypted passwords (see the <smbconfoption name="encrypted passwords"/> parameter) can also 51 be used in this security mode. Parameters such as <smbconfoption name="user"/> and <smbconfoption 52 name="guest only"/> if set are then applied and 53 may change the UNIX user to use on this connection, but only after 54 the user has been successfully authenticated.</para> 55 56 <para><emphasis>Note</emphasis> that the name of the resource being 57 requested is <emphasis>not</emphasis> sent to the server until after 58 the server has successfully authenticated the client. This is why 59 guest shares don't work in user level security without allowing 60 the server to automatically map unknown users into the <smbconfoption name="guest account"/>. 61 See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para> 62 63 <para>See also the section <link linkend="VALIDATIONSECT">NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para> 64 65 <para><anchor id="SECURITYEQUALSDOMAIN"/><emphasis>SECURITY = DOMAIN</emphasis></para> 66 67 <para>This mode will only work correctly if <citerefentry><refentrytitle>net</refentrytitle> 68 <manvolnum>8</manvolnum></citerefentry> has been used to add this 69 machine into a Windows NT Domain. It expects the <smbconfoption name="encrypted passwords"/> 70 parameter to be set to <constant>yes</constant>. In this 71 mode Samba will try to validate the username/password by passing 72 it to a Windows NT Primary or Backup Domain Controller, in exactly 73 the same way that a Windows NT Server would do.</para> 74 75 <para><emphasis>Note</emphasis> that a valid UNIX user must still 76 exist as well as the account on the Domain Controller to allow 77 Samba to have a valid UNIX account to map file access to.</para> 78 79 <para><emphasis>Note</emphasis> that from the client's point 80 of view <command moreinfo="none">security = domain</command> is the same 81 as <command moreinfo="none">security = user</command>. It only 82 affects how the server deals with the authentication, 83 it does not in any way affect what the client sees.</para> 84 85 <para><emphasis>Note</emphasis> that the name of the resource being 86 requested is <emphasis>not</emphasis> sent to the server until after 87 the server has successfully authenticated the client. This is why 88 guest shares don't work in user level security without allowing 89 the server to automatically map unknown users into the <smbconfoption name="guest account"/>. 90 See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para> 91 92 <para>See also the section <link linkend="VALIDATIONSECT"> 93 NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para> 94 95 <para>See also the <smbconfoption name="password server"/> parameter and 96 the <smbconfoption name="encrypted passwords"/> parameter.</para> 97 59 98 <para><anchor id="SECURITYEQUALSSHARE"/><emphasis>SECURITY = SHARE</emphasis></para> 99 100 <note><para>This option is deprecated as it is incompatible with SMB2</para></note> 60 101 61 102 <para>When clients connect to a share level security server, they … … 136 177 NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para> 137 178 138 <para><anchor id="SECURITYEQUALSUSER"/><emphasis>SECURITY = USER</emphasis></para>139 140 <para>This is the default security setting in Samba 3.0.141 With user-level security a client must first "log-on" with a142 valid username and password (which can be mapped using the <smbconfoption name="username map"/>143 parameter). Encrypted passwords (see the <smbconfoption name="encrypted passwords"/> parameter) can also144 be used in this security mode. Parameters such as <smbconfoption name="user"/> and <smbconfoption145 name="guest only"/> if set are then applied and146 may change the UNIX user to use on this connection, but only after147 the user has been successfully authenticated.</para>148 149 <para><emphasis>Note</emphasis> that the name of the resource being150 requested is <emphasis>not</emphasis> sent to the server until after151 the server has successfully authenticated the client. This is why152 guest shares don't work in user level security without allowing153 the server to automatically map unknown users into the <smbconfoption name="guest account"/>.154 See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>155 156 <para>See also the section <link linkend="VALIDATIONSECT">NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>157 158 <para><anchor id="SECURITYEQUALSDOMAIN"/><emphasis>SECURITY = DOMAIN</emphasis></para>159 160 <para>This mode will only work correctly if <citerefentry><refentrytitle>net</refentrytitle>161 <manvolnum>8</manvolnum></citerefentry> has been used to add this162 machine into a Windows NT Domain. It expects the <smbconfoption name="encrypted passwords"/>163 parameter to be set to <constant>yes</constant>. In this164 mode Samba will try to validate the username/password by passing165 it to a Windows NT Primary or Backup Domain Controller, in exactly166 the same way that a Windows NT Server would do.</para>167 168 <para><emphasis>Note</emphasis> that a valid UNIX user must still169 exist as well as the account on the Domain Controller to allow170 Samba to have a valid UNIX account to map file access to.</para>171 172 <para><emphasis>Note</emphasis> that from the client's point173 of view <command moreinfo="none">security = domain</command> is the same174 as <command moreinfo="none">security = user</command>. It only175 affects how the server deals with the authentication,176 it does not in any way affect what the client sees.</para>177 178 <para><emphasis>Note</emphasis> that the name of the resource being179 requested is <emphasis>not</emphasis> sent to the server until after180 the server has successfully authenticated the client. This is why181 guest shares don't work in user level security without allowing182 the server to automatically map unknown users into the <smbconfoption name="guest account"/>.183 See the <smbconfoption name="map to guest"/> parameter for details on doing this.</para>184 185 <para>See also the section <link linkend="VALIDATIONSECT">186 NOTE ABOUT USERNAME/PASSWORD VALIDATION</link>.</para>187 188 <para>See also the <smbconfoption name="password server"/> parameter and189 the <smbconfoption name="encrypted passwords"/> parameter.</para>190 191 179 <para><anchor id="SECURITYEQUALSSERVER"/><emphasis>SECURITY = SERVER</emphasis></para> 192 180 193 181 <para> 194 In this mode Samba will try to validate the username/password by passing it to another SMB server, such as an182 In this depicted mode Samba will try to validate the username/password by passing it to another SMB server, such as an 195 183 NT box. If this fails it will revert to <command moreinfo="none">security = user</command>. It expects the 196 184 <smbconfoption name="encrypted passwords"/> parameter to be set to <constant>yes</constant>, unless the remote … … 204 192 significant pitfalls since it is more vulnerable to 205 193 man-in-the-middle attacks and server impersonation. In particular, 206 this mode of operation can cause significant resource consu ption on194 this mode of operation can cause significant resource consumption on 207 195 the PDC, as it must maintain an active connection for the duration 208 196 of the user's session. Furthermore, if this connection is lost, 209 there is no way to reestablish it, and fu ther authentications to the197 there is no way to reestablish it, and further authentications to the 210 198 Samba server may fail (from a single client, till it disconnects). 199 </para></note> 200 201 <note><para>If the client selects NTLMv2 authentication, then this mode of operation <emphasis>will fail</emphasis> 211 202 </para></note> 212 203 … … 216 207 only affects how the server deals with the authentication, it does 217 208 not in any way affect what the client sees.</para></note> 209 210 <note><para>This option is deprecated, and may be removed in future</para></note> 218 211 219 212 <para><emphasis>Note</emphasis> that the name of the resource being -
vendor/current/docs-xml/smbdotconf/security/username.xml
r414 r740 10 10 each username in turn (left to right).</para> 11 11 12 <para>The <parameter moreinfo="none">username</parameter> line is needed only when12 <para>The deprecated <parameter moreinfo="none">username</parameter> line is needed only when 13 13 the PC is unable to supply its own username. This is the case 14 14 for the COREPLUS protocol or where your users have different WfWg
Note:
See TracChangeset
for help on using the changeset viewer.
