Samba Issue
Andrew Bartlett
abartlet at samba.org
Thu Aug 25 02:43:35 GMT 2005
On Thu, 2005-08-25 at 09:43 +0800, paul.bardeskar at sg.abnamro.com wrote:
>
>
>
> Hi Andrew,
>
> Check the attached smb.conf file.
> I have changed the IP and the host name.
You have set 'security=share'. In the current Samba3 code we do:
if (lp_security() == SEC_SHARE) {
/* in share level we should ignore any passwords */
data_blob_free(&lm_resp);
data_blob_free(&nt_resp);
data_blob_clear_free(&plaintext_password);
map_username(sub_user);
add_session_user(sub_user);
/* Then force it to null for the benfit of the code below */
*user = 0;
}
In Samba 2.2 it was similar, but my point is simple - in security=share,
the username and password for a session setup (the thing your 'tool' is
testing) is ignored, so indeed it will 'find' dummy accounts.
Andrew Bartlett
--
Andrew Bartlett http://samba.org/~abartlet/
Samba Developer, SuSE Labs, Novell Inc. http://suse.de
Authentication Developer, Samba Team http://samba.org
Student Network Administrator, Hawker College http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba-technical/attachments/20050825/24cb6e4d/attachment.bin
More information about the samba-technical
mailing list