[SCM] Samba Shared Repository - branch v4-21-test updated
Jule Anger
janger at samba.org
Fri Sep 20 15:41:01 UTC 2024
The branch, v4-21-test has been updated
via 0ed55bfe082 sync machine password to keytab: handle FreeIPA use case
from 505f48fff98 smbd: use metadata_fsp(fsp) in copy_access_posix_acl() for SMB_VFS_SYS_ACL_SET_FD
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-21-test
- Log -----------------------------------------------------------------
commit 0ed55bfe0820819c7653110c5650bb02084a67a1
Author: Alexander Bokovoy <ab at samba.org>
Date: Tue Sep 3 08:48:24 2024 +0300
sync machine password to keytab: handle FreeIPA use case
FreeIPA uses own procedure to retrieve keytabs and during the setup of
Samba on FreeIPA client the keytab is already present, only machine
account needs to be set in the secrets database.
'sync machine password to keytab' option handling broke this use case by
always attempting to contact a domain controller and failing to do so
(Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=2309199).
The original synchronizing machine account password to keytab feature
did not have a mechanism to disable its logic at all.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15715
Signed-off-by: Alexander Bokovoy <ab at samba.org>
Reviewed-by: Pavel Filipenský <pfilipensky at samba.org>
Autobuild-User(master): Alexander Bokovoy <ab at samba.org>
Autobuild-Date(master): Fri Sep 13 13:16:09 UTC 2024 on atb-devel-224
(cherry picked from commit 4f577c7b6894132be4842944f2f950b087312b16)
Autobuild-User(v4-21-test): Jule Anger <janger at samba.org>
Autobuild-Date(v4-21-test): Fri Sep 20 15:40:36 UTC 2024 on atb-devel-224
-----------------------------------------------------------------------
Summary of changes:
.../security/syncmachinepasswordtokeytab.xml | 29 +++++++++++++++++++---
source3/libads/kerberos_keytab.c | 5 ++++
source3/utils/net.c | 8 ++++++
source3/utils/testparm.c | 3 ++-
4 files changed, 41 insertions(+), 4 deletions(-)
Changeset truncated at 500 lines:
diff --git a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml
index 4cad9da73f2..f7dc30023d4 100644
--- a/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml
+++ b/docs-xml/smbdotconf/security/syncmachinepasswordtokeytab.xml
@@ -18,7 +18,11 @@ or by winbindd doing regular updates (see <smbconfoption name="machine password
</para>
<para>
-The option takes a list of keytab strings. Each string has this form:
+The option takes a list of keytab strings to describe how to synchronize
+content of those keytabs or a single 'disabled' value to disable the
+synchronization.
+
+Each string has this form:
<programlisting>
absolute_path_to_keytab:spn_spec[:sync_etypes][:sync_kvno][:netbios_aliases][:additional_dns_hostnames][:machine_password]
</programlisting>
@@ -70,8 +74,27 @@ If sync_etypes or sync_kvno or sync_spns is present then winbind connects to DC.
</para>
<para>
-If no value is present, winbind uses value <programlisting>/path/to/keytab:sync_spns:sync_kvno:machine_password</programlisting>
-where the path to the keytab is obtained either from the krb5 library or from <smbconfoption name="dedicated keytab file"/>
+If no value is present and <smbconfoption name="kerberos method"/> is different from
+'secrets only', the behavior differs between winbind and net utility:
+</para>
+<itemizedlist>
+ <listitem>
+ <para><userinput>winbind</userinput> uses value
+ <programlisting>/path/to/keytab:sync_spns:sync_kvno:machine_password</programlisting>
+ where the path to the keytab is obtained either from the krb5 library or from
+ <smbconfoption name="dedicated keytab file"/>.
+ </para>
+ </listitem>
+ <listitem>
+ <para><userinput>net changesecretpw -f</userinput> command uses the default 'disabled' value.</para>
+ </listitem>
+ <listitem><para>No other <userinput>net</userinput> subcommands use the 'disabled' value.</para></listitem>
+</itemizedlist>
+
+<para>
+If a single value 'disabled' is present, the synchronization process is
+disabled. This is required for FreeIPA domain member setup where keytab
+synchronization uses a protocol not implemented by Samba.
</para>
<para>
diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
index 6ede567b75f..dbf8af44c1f 100644
--- a/source3/libads/kerberos_keytab.c
+++ b/source3/libads/kerberos_keytab.c
@@ -904,6 +904,11 @@ NTSTATUS sync_pw2keytabs(void)
goto params_ready;
}
+ if ((*lp_ptr != NULL) && strequal_m(*lp_ptr, "disabled")) {
+ DBG_DEBUG("'sync machine password to keytab' is explicitly disabled.\n");
+ return NT_STATUS_OK;
+ }
+
line = lp_ptr;
while (*line) {
DBG_DEBUG("Scanning line: %s\n", *line);
diff --git a/source3/utils/net.c b/source3/utils/net.c
index 7b40d2bee95..c432ebe991f 100644
--- a/source3/utils/net.c
+++ b/source3/utils/net.c
@@ -207,6 +207,14 @@ static int net_changesecretpw(struct net_context *c, int argc,
struct timeval tv = timeval_current();
NTTIME now = timeval_to_nttime(&tv);
+#ifdef HAVE_ADS
+ if (USE_KERBEROS_KEYTAB) {
+ if (lp_sync_machine_password_to_keytab() == NULL) {
+ lp_do_parameter(-1, "sync machine password to keytab", "disabled");
+ }
+ }
+#endif
+
if (c->opt_stdin) {
set_line_buffering(stdin);
set_line_buffering(stdout);
diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c
index e3ed336a79a..a31a7a8a30a 100644
--- a/source3/utils/testparm.c
+++ b/source3/utils/testparm.c
@@ -803,7 +803,8 @@ static int do_global_checks(void)
"instead of 'kerberos method'.\n\n");
}
- if (lp_ptr != NULL) {
+ if (lp_ptr != NULL &&
+ ((*lp_ptr != NULL) && !strequal_m(*lp_ptr, "disabled"))) {
while (*lp_ptr) {
ret |= pw2kt_check_line(*lp_ptr++);
}
--
Samba Shared Repository
More information about the samba-cvs
mailing list