? examples/pdb/mysql/Makefile
? examples/pdb/xml/Makefile
? examples/sam/Makefile
? source/config.abartlet
? source/bin/stVaeia1
Index: docs/docbook/smbdotconf/security/clientntlmv2auth.xml
===================================================================
RCS file: /home/cvs/samba/docs/docbook/smbdotconf/security/clientntlmv2auth.xml,v
retrieving revision 1.1.2.2
diff -u -r1.1.2.2 clientntlmv2auth.xml
--- docs/docbook/smbdotconf/security/clientntlmv2auth.xml 5 Jul 2003 01:52:55 -0000 1.1.2.2
+++ docs/docbook/smbdotconf/security/clientntlmv2auth.xml 6 Sep 2003 07:34:06 -0000
@@ -13,6 +13,12 @@
(including NT4 < SP4, Win9x and Samba 2.2) are not compatible with
NTLMv2.
+ Similarly, if enabled, NTLMv1, client lanman auth and client plaintext auth
+ authentication will be disabled. This also disables share-level
+ authentication.
+
If disabled, an NTLM response (and possibly a LANMAN response)
will be sent by the client, depending on the value of client lanman auth.
Index: source/libsmb/cliconnect.c
===================================================================
RCS file: /home/cvs/samba/source/libsmb/cliconnect.c,v
retrieving revision 1.71.2.43
diff -u -r1.71.2.43 cliconnect.c
--- source/libsmb/cliconnect.c 22 Aug 2003 14:24:38 -0000 1.71.2.43
+++ source/libsmb/cliconnect.c 6 Sep 2003 07:34:10 -0000
@@ -271,10 +271,7 @@
if (passlen == 0) {
/* do nothing - guest login */
} else if (passlen != 24) {
- /* if client ntlmv2 auth is set, then don't use it on a
- connection without extended security. This isn't a very
- good check, but it is a start */
- if ((cli->capabilities & CAP_EXTENDED_SECURITY) && lp_client_ntlmv2_auth()) {
+ if (lp_client_ntlmv2_auth()) {
DATA_BLOB server_chal;
DATA_BLOB names_blob;
server_chal = data_blob(cli->secblob.data, MIN(cli->secblob.length, 8));
Index: source/libsmb/ntlmssp.c
===================================================================
RCS file: /home/cvs/samba/source/libsmb/ntlmssp.c,v
retrieving revision 1.4.2.21
diff -u -r1.4.2.21 ntlmssp.c
--- source/libsmb/ntlmssp.c 15 Aug 2003 01:42:28 -0000 1.4.2.21
+++ source/libsmb/ntlmssp.c 6 Sep 2003 07:34:11 -0000
@@ -23,12 +23,6 @@
#include "includes.h"
-#if 0
-/* we currently do not know how to get the right session key for this, so
- we cannot enable it by default... :-( */
-#define USE_NTLM2 1
-#endif
-
/**
* Print out the NTLMSSP flags for debugging
* @param neg_flags The flags from the packet
@@ -422,9 +416,7 @@
ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
}
-#ifdef USE_NTLM2
ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
-#endif
/* generate the ntlmssp negotiate packet */
msrpc_gen(next_request, "CddAA",
@@ -459,16 +451,7 @@
DATA_BLOB lm_response = data_blob(NULL, 0);
DATA_BLOB nt_response = data_blob(NULL, 0);
DATA_BLOB session_key = data_blob(NULL, 0);
- uint8 datagram_sess_key[16];
- size_t datagram_sess_key_len;
-
-#if 0 /* until we know what flag to tigger it on */
- generate_random_buffer(datagram_sess_key, sizeof(datagram_sess_key), False);
- datagram_sess_key_len = sizeof(datagram_sess_key);
-#else
- ZERO_STRUCT(datagram_sess_key);
- datagram_sess_key_len = 0;
-#endif
+ DATA_BLOB encrypted_session_key = data_blob(NULL, 0);
if (!msrpc_parse(&reply, "CdBd",
"NTLMSSP",
@@ -502,7 +485,9 @@
} else {
chal_parse_string = "CdAdbdd";
}
+
auth_gen_string = "CdBBAAABd";
+
ntlmssp_state->unicode = False;
ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_UNICODE;
ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
@@ -526,6 +511,10 @@
ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_128;
}
+ if (!(chal_flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
+ ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_KEY_EXCH;
+ }
+
DEBUG(3, ("NTLMSSP: Set final flags:\n"));
debug_ntlmssp_flags(ntlmssp_state->neg_flags);
@@ -572,31 +561,35 @@
data_blob_free(&struct_blob);
return NT_STATUS_NO_MEMORY;
}
-#ifdef USE_NTLM2
} else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
struct MD5Context md5_session_nonce_ctx;
uchar nt_hash[16];
uchar session_nonce[16];
+ uchar session_nonce_hash[16];
+ uchar nt_session_key[16];
E_md4hash(ntlmssp_state->password, nt_hash);
+ lm_response = data_blob(NULL, 24);
generate_random_buffer(lm_response.data, 8, False);
memset(lm_response.data+8, 0, 16);
-
+
+ memcpy(session_nonce, challenge_blob.data, 8);
+ memcpy(&session_nonce[8], lm_response.data, 8);
+
MD5Init(&md5_session_nonce_ctx);
MD5Update(&md5_session_nonce_ctx, challenge_blob.data, 8);
MD5Update(&md5_session_nonce_ctx, lm_response.data, 8);
- MD5Final(session_nonce, &md5_session_nonce_ctx);
+ MD5Final(session_nonce_hash, &md5_session_nonce_ctx);
nt_response = data_blob(NULL, 24);
SMBNTencrypt(ntlmssp_state->password,
- challenge_blob.data,
+ session_nonce_hash,
nt_response.data);
- /* This is *NOT* the correct session key algorithm - just
- fill in the bytes with something... */
session_key = data_blob(NULL, 16);
- SMBsesskeygen_ntv1(nt_hash, NULL, session_key.data);
-#endif
+
+ SMBsesskeygen_ntv1(nt_hash, NULL, nt_session_key);
+ hmac_md5(nt_session_key, session_nonce, sizeof(session_nonce), session_key.data);
} else {
@@ -627,6 +620,18 @@
}
data_blob_free(&struct_blob);
+ /* Key exchange encryptes a new client-generated session key with
+ the password-derived key */
+ if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_KEY_EXCH) {
+ uint8 client_session_key[16];
+
+ generate_random_buffer(client_session_key, sizeof(client_session_key), False);
+ encrypted_session_key = data_blob(client_session_key, sizeof(client_session_key));
+ SamOEMhash(encrypted_session_key.data, session_key.data, encrypted_session_key.length);
+ data_blob_free(&session_key);
+ session_key = data_blob(client_session_key, sizeof(client_session_key));
+ }
+
/* this generates the actual auth packet */
if (!msrpc_gen(next_request, auth_gen_string,
"NTLMSSP",
@@ -636,7 +641,7 @@
ntlmssp_state->domain,
ntlmssp_state->user,
ntlmssp_state->get_global_myname(),
- datagram_sess_key, datagram_sess_key_len,
+ encrypted_session_key.data, encrypted_session_key.length,
ntlmssp_state->neg_flags)) {
data_blob_free(&lm_response);
@@ -645,6 +650,8 @@
return NT_STATUS_NO_MEMORY;
}
+ data_blob_free(&encrypted_session_key);
+
data_blob_free(&ntlmssp_state->chal);
data_blob_free(&ntlmssp_state->lm_resp);
data_blob_free(&ntlmssp_state->nt_resp);
@@ -683,6 +690,8 @@
(*ntlmssp_state)->neg_flags =
NTLMSSP_NEGOTIATE_128 |
NTLMSSP_NEGOTIATE_NTLM |
+ NTLMSSP_NEGOTIATE_NTLM2 |
+ NTLMSSP_NEGOTIATE_KEY_EXCH |
NTLMSSP_REQUEST_TARGET;
(*ntlmssp_state)->ref_count = 1;
Index: source/param/loadparm.c
===================================================================
RCS file: /home/cvs/samba/source/param/loadparm.c,v
retrieving revision 1.397.2.98
diff -u -r1.397.2.98 loadparm.c
--- source/param/loadparm.c 5 Sep 2003 19:59:54 -0000 1.397.2.98
+++ source/param/loadparm.c 6 Sep 2003 07:34:13 -0000
@@ -1427,7 +1427,8 @@
Globals.bClientPlaintextAuth = True; /* Do use a plaintext password if is requested by the server */
Globals.bLanmanAuth = True; /* Do use the LanMan hash if it is available */
Globals.bNTLMAuth = True; /* Do use NTLMv1 if it is available (otherwise NTLMv2) */
- Globals.bClientNTLMv2Auth = True; /* Client should use NTLMv2 if available. */
+ Globals.bClientNTLMv2Auth = False; /* Client should not use NTLMv2, as we can't tell that the server supports it. */
+ /* Note, that we will use NTLM2 session security (which is different), if it is available */
Globals.map_to_guest = 0; /* By Default, "Never" */
Globals.min_passwd_length = MINPASSWDLENGTH; /* By Default, 5. */