svn commit: samba r11574 - in trunk/source: auth include nsswitch rpc_client rpc_server rpcclient utils

Andrew Bartlett abartlet at
Tue Nov 8 10:47:54 GMT 2005

On Tue, 2005-11-08 at 06:19 +0000, jra at wrote:
> Author: jra
> Date: 2005-11-08 06:19:36 +0000 (Tue, 08 Nov 2005)
> New Revision: 11574
> WebSVN:
> Log:
> Adding Andrew Bartlett's patch to make machine account
> logons work if the client gives the MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT
> the auth module interface to 2 (from 1). The effect of this is
> that clients can access resources as a machine account if they
> set these flags. This is the same as Windows (think of a VPN
> where the vpn client authenticates itself to a VPN server
> using machine account credentials - the vpn server checks
> that the machine password was valid by performing a machine
> account check with the PDC in the same was as it would a
> user account check. 

> I may add in a restriction (parameter)
> to allow this behaviour to be turned off (as it was previously).
> That may be on by default.

While I can't oppose adding yet another parameter to the mix, I feel we
should allow these logins, both on a member server (ie set the bit) and
on the PDC (ie honour it) by default.

On the member server, we already allow machines to login if they do so
with kerberos.  I made that change (machines are people too!) before or
shortly after the 3.0 release.  As you mention above, it is also
required to run a VPN server (this is what started this) via Samba to a
windows domain for PEAP MSCHAPv2 authentication.  

On the PDC, this likewise matches Microsoft behaviour in AD domains.
(Win2k3 is what I've been testing against).  

Andrew Bartlett

Andrew Bartlett                      
Authentication Developer, Samba Team 
Student Network Administrator, Hawker College
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :

More information about the samba-technical mailing list