Changeset 920 for trunk/server/docs-xml/smbdotconf/security

Timestamp:

Jun 9, 2016, 2:23:12 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: apply latest security patches to trunk

Location:

trunk/server

Files:

• . (modified) (1 prop)
• docs-xml/smbdotconf/security/allowdcerpcauthlevelconnect.xml (copied) (copied from vendor/current/docs-xml/smbdotconf/security/allowdcerpcauthlevelconnect.xml )
• docs-xml/smbdotconf/security/clientipcsigning.xml (copied) (copied from vendor/current/docs-xml/smbdotconf/security/clientipcsigning.xml )
• docs-xml/smbdotconf/security/clientntlmv2auth.xml (modified) (1 diff)
• docs-xml/smbdotconf/security/clientsigning.xml (modified) (1 diff)
• docs-xml/smbdotconf/security/rawntlmv2auth.xml (copied) (copied from vendor/current/docs-xml/smbdotconf/security/rawntlmv2auth.xml )

trunk/server/docs-xml/smbdotconf/security/clientntlmv2auth.xml

@@ -29 +29 @@
     'best practice' security polices) only allow NTLMv2 responses, and
     not the weaker LM or NTLM.</para>
+
+    <para>When <smbconfoption name="client use spnego"/> is also set to
+    <constant>yes</constant> extended security (SPNEGO) is required
+    in order to use NTLMv2 only within NTLMSSP. This behavior was
+    introduced with the patches for CVE-2016-2111.</para>
 </description>
 <value type="default">yes</value>

trunk/server/docs-xml/smbdotconf/security/clientsigning.xml

@@ -13 +13 @@
     When set to mandatory, SMB signing is required and if set 
         to disabled, SMB signing is not offered either.
+
+    <para>IPC$ connections for DCERPC e.g. in winbindd, are handled by the
+    <smbconfoption name="client ipc signing"/> option.</para>
 </para>
 </description>