svn commit: samba-docs r1197 - in trunk/smbdotconf: ldap security

kseeger at samba.org kseeger at samba.org
Tue Oct 30 07:42:25 GMT 2007


Author: kseeger
Date: 2007-10-30 07:42:25 +0000 (Tue, 30 Oct 2007)
New Revision: 1197

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba-docs&rev=1197

Log:
Add manpage section for the new parameter client ldap sasl wrapping
Karolin
Added:
   trunk/smbdotconf/ldap/clientldapsaslwrapping.xml
Modified:
   trunk/smbdotconf/security/clientsigning.xml


Changeset:
Added: trunk/smbdotconf/ldap/clientldapsaslwrapping.xml
===================================================================
--- trunk/smbdotconf/ldap/clientldapsaslwrapping.xml	2007-10-24 11:39:38 UTC (rev 1196)
+++ trunk/smbdotconf/ldap/clientldapsaslwrapping.xml	2007-10-30 07:42:25 UTC (rev 1197)
@@ -0,0 +1,43 @@
+<samba:parameter name="client ldap sasl wrapping"
+                 context="G"
+               	 type="string"
+		 advanced="1" 
+                 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+	<para>
+	The <smbconfoption name="client ldap sasl wrapping"/> defines whether
+	ldap traffic will be signed or signed and encrypted (sealed). 
+	Possible values are <emphasis>plain</emphasis>, <emphasis>sign</emphasis> 
+	and <emphasis>seal</emphasis>. 	
+	</para>
+
+	<para>
+	The values <emphasis>sign</emphasis> and <emphasis>seal</emphasis> 
+	are only available if Samba has been compiled against a modern 
+	OpenLDAP version (2.3.x or higher).
+	</para>
+	
+	<para>
+	This option is needed in the case of Domain Controllers enforcing 
+	the usage of signed LDAP connections (e.g. Windows 2000 SP3 or higher).
+	LDAP sign and seal can be controlled with the registry key
+	"HKLM\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity"
+	on the Windows server side.  
+	</para>
+
+	<para>
+	Depending on the used KRB5 library (MIT and older Heimdal versions)
+	it is possible that the message "integrity only" is not supported. 
+	In this case, <emohasis>sign</emphasis> is just an alias for 
+	<emphasis>seal</emphasis>.
+	</para>
+
+	<para>
+	The default value is <emphasis>plain</emphasis> which is not irritable 
+	to KRB5 clock skew errors. That implies synchronizing the time
+	with the KDC in the case of using <emphasis>sign</emphasis> or
+	<emphasis>seal</emphasis>.
+	</para>
+</description>
+<value type="default">plain</value>
+</samba:parameter>

Modified: trunk/smbdotconf/security/clientsigning.xml
===================================================================
--- trunk/smbdotconf/security/clientsigning.xml	2007-10-24 11:39:38 UTC (rev 1196)
+++ trunk/smbdotconf/security/clientsigning.xml	2007-10-30 07:42:25 UTC (rev 1197)
@@ -12,7 +12,8 @@
 
     <para>When set to auto, SMB signing is offered, but not enforced. 
     When set to mandatory, SMB signing is required and if set 
-	to disabled, SMB signing is not offered either.</para>
+	to disabled, SMB signing is not offered either.
+</para>
 </description>
 
 <value type="default">auto</value>



More information about the samba-cvs mailing list