[Patch] Support for LDAP with GSSAPI/NTLMSSP auth scheme decoding in wireshark

[Stefan (metze) Metzmacher]

Hi Matthieu,

> I finally finished my patch to support NTLMSSP auth in LDAP.
> As metze proposed I add the option that read all the keytab that were
> provided, and try all the encoded password inside it.
> 
> It seems to work quite well, I tried with a few keytab generated for
> pure "traditional" LDAP with kerberos auth and I've been able to decode
> (well if the keytab contains the md4(password) of the user trying to
> authenticate himself).
> I'm quite surprised that when "extracting" crypted password in a keytab
> they are only stored by using md4(unicode(password))) even if we ask
> keytab to use arc4_hmac (but I'm far from being well aware of all in
> kerberos ...).
> 
> Concerning protocols, I tested NTLM v1 and NTLM v2, for NTLM v1 I tested
> mostly with extended security flags so for less secure (and maybe not
> anymore really used ?) scheme (like pure lan manager auth or simple nt
> auth) problems might still exist.
> 
> It would be just great if you can provide me some feedback, in anycase
> my goal is to submit it to wireshark devs soon.

Thanks! I'll give it a try in the next days.

metze


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
Url : http://lists.samba.org/archive/samba-technical/attachments/20090427/fd6dfdd1/signature.bin