Samba Issue

[Andrew Bartlett]

On Thu, 2005-08-25 at 09:43 +0800, paul.bardeskar at sg.abnamro.com wrote:
> 
> 
> 
> Hi Andrew,
> 
> Check the attached smb.conf file.
> I have changed the IP and the host name.

You have set 'security=share'.  In the current Samba3 code we do:

	if (lp_security() == SEC_SHARE) {
		/* in share level we should ignore any passwords */

		data_blob_free(&lm_resp);
		data_blob_free(&nt_resp);
		data_blob_clear_free(&plaintext_password);

		map_username(sub_user);
		add_session_user(sub_user);
		/* Then force it to null for the benfit of the code below */
		*user = 0;
	}
	

In Samba 2.2 it was similar, but my point is simple - in security=share,
the username and password for a session setup (the thing your 'tool' is
testing) is ignored, so indeed it will 'find' dummy accounts.

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Samba Developer, SuSE Labs, Novell Inc.        http://suse.de
Authentication Developer, Samba Team           http://samba.org
Student Network Administrator, Hawker College  http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba-technical/attachments/20050825/24cb6e4d/attachment.bin