Machine password encrypted by admin password in SP3?

[Luke Kenneth Casson Leighton]

hm.

so, a \PIPE\samr connection is made (securely - NTLMSSP) and a non-random
password is added?  oh well.



On Wed, 22 Apr 1998, Jeremy Allison wrote:

> Paul Ashton wrote:
> > 
> > Paul Leach says (I think) that from SP3 when a workstation joins a
> > domain from the client side, i.e. "use this account to add machine
> > to domain", it will encrypt a new random machine password instead of
> > setting it to the default (hostname in unicode). Can someone
> > confirm this as it has implications for a Samba PDC.
> > 
> 
> Done the experiment (last night in fact). Paul Leach 
> is wrong. It still leaves the lame password (hostname
> in unicode) as the secret.
> 
> Yes, I'm afraid the only way to securely add a NT machine
> to a domain is to do it on a private net. I have actually
> been spending a significant amount of time trying to
> get around this hideous security hole and still
> interoperate with an NT PDC with the Samba domain client
> code.

ah, jeremy: i have to add some code to the PAM pam_ntdom to do this.  i
was suggested to cache the 16 byte password in /etc/security/clientpasswd. 

how would this fit in, say, with going for
/usr/local/samba/private/clientpasswd in samba and
/etc/security/clientpasswd in pam_ntdom? 

use the code in smbpass.c because you might have multiple NetBIOS names on
the same machine.  you might even want to use the same file in smbfs,
volker, and cache user / share passwords!