Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4727

Re: Call for testing: upcoming samba security update

Cross-posted to 2 groups.

Show all headers | View raw

On 14/04/16 10:02, Chris Boot wrote:
> Firstly:
> 
>>     Finally, two important configuration options should be considered,
>>     that we were unable to silently change defaults for:
>>     - smb signing = required
>>     - ntlm auth = no
>>
>>     Without smb signing = required, Man in the Middle attacks are
>>     still possible against our file server and classic/NT4-like/Samba3
>>     Domain controller.  (It is now enforced on our AD DC.)
> 
> There is no parameter named "smb signing" in smb.conf, and Samba rightly
> complains:
> 
>> [2016/04/14 09:43:53,  0] ../lib/param/loadparm.c:743(lpcfg_map_parameter)
>>   Unknown parameter encountered: "smb signing"
>> [2016/04/14 09:43:53,  0] ../lib/param/loadparm.c:1626(lpcfg_do_global_parameter)
>>   Ignoring unknown parameter "smb signing"
> 
> I suspect you meant one/several of "client ipc signing", "client
> signing" and/or "server signing" instead. Can you please clarify?

Someone has pointed out to me by private mail that this has been fixed
in an updated NEWS entry, and there is a bug open about it:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820983

https://anonscm.debian.org/cgit/pkg-samba/samba.git/commit/?h=stable-update&id=cbcad2a543a28926ee712cf299dbdc03da351cb0

Please can we make sure that this makes it into the inevitable deb8u3
update?

I'm filing a bug about the AD DC winbind issue now.

Cheers,
Chris

-- 
Chris Boot

Tiger Computing Ltd
ISO27001:2013 Certified

Tel: 01600 483 484
Web: https://www.tiger-computing.co.uk

Registered in England. Company number: 3389961
Registered address: Wyastone Business Park,
 Wyastone Leys, Monmouth, NP25 3SR

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Call for testing: upcoming samba security update Salvatore Bonaccorso <carnil@debian.org> - 2016-04-12 22:30 +0200
  Re: Call for testing: upcoming samba security update Chris Boot <crb@tiger-computing.co.uk> - 2016-04-14 11:50 +0200
    Re: Call for testing: upcoming samba security update Chris Boot <crb@tiger-computing.co.uk> - 2016-04-14 14:40 +0200
    Re: Call for testing: upcoming samba security update Virgo Pärna <virgo.parna@mail.ee> - 2016-04-14 15:50 +0200
      Re: Call for testing: upcoming samba security update "oeh univie edv lists" <edv-lists@oeh.univie.ac.at> - 2016-04-14 18:40 +0200
        Re: Call for testing: upcoming samba security update Virgo Pärna <virgo.parna@mail.ee> - 2016-04-16 07:40 +0200
          Re: Call for testing: upcoming samba security update Virgo Pärna <virgo.parna@mail.ee> - 2016-04-19 14:00 +0200
      Re: Call for testing: upcoming samba security update "Birgit Berger (UV Wien)" <birgit.berger@oeh.univie.ac.at> - 2016-04-14 18:50 +0200
  Re: Call for testing: upcoming samba security update Vladislav Kurz <vladislav.kurz@webstep.net> - 2016-04-14 12:10 +0200
    Re: Call for testing: upcoming samba security update Paul Wise <pabs@debian.org> - 2016-04-14 14:10 +0200

csiph-web