Changeset 919 for vendor/current/docs-xml/smbdotconf/security

Timestamp:

Jun 9, 2016, 2:17:22 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: apply latest security patches to vendor

Location:

vendor/current/docs-xml/smbdotconf/security

Files:

• allowdcerpcauthlevelconnect.xml (added)
• clientipcsigning.xml (added)
• clientntlmv2auth.xml (modified) (1 diff)
• clientsigning.xml (modified) (1 diff)
• rawntlmv2auth.xml (added)

vendor/current/docs-xml/smbdotconf/security/clientntlmv2auth.xml

@@ -29 +29 @@
     'best practice' security polices) only allow NTLMv2 responses, and
     not the weaker LM or NTLM.</para>
+
+    <para>When <smbconfoption name="client use spnego"/> is also set to
+    <constant>yes</constant> extended security (SPNEGO) is required
+    in order to use NTLMv2 only within NTLMSSP. This behavior was
+    introduced with the patches for CVE-2016-2111.</para>
 </description>
 <value type="default">yes</value>

vendor/current/docs-xml/smbdotconf/security/clientsigning.xml

@@ -13 +13 @@
     When set to mandatory, SMB signing is required and if set 
         to disabled, SMB signing is not offered either.
+
+    <para>IPC$ connections for DCERPC e.g. in winbindd, are handled by the
+    <smbconfoption name="client ipc signing"/> option.</para>
 </para>
 </description>