[Patch] Support for LDAP with GSSAPI/NTLMSSP auth scheme
decoding in wireshark
Stefan (metze) Metzmacher
metze at samba.org
Tue Apr 28 14:01:12 GMT 2009
Stefan (metze) Metzmacher schrieb:
> Hi Matthieu,
>
>> I finally finished my patch to support NTLMSSP auth in LDAP.
>> As metze proposed I add the option that read all the keytab that were
>> provided, and try all the encoded password inside it.
>>
>> It seems to work quite well, I tried with a few keytab generated for
>> pure "traditional" LDAP with kerberos auth and I've been able to decode
>> (well if the keytab contains the md4(password) of the user trying to
>> authenticate himself).
>> I'm quite surprised that when "extracting" crypted password in a keytab
>> they are only stored by using md4(unicode(password))) even if we ask
>> keytab to use arc4_hmac (but I'm far from being well aware of all in
>> kerberos ...).
>>
>> Concerning protocols, I tested NTLM v1 and NTLM v2, for NTLM v1 I tested
>> mostly with extended security flags so for less secure (and maybe not
>> anymore really used ?) scheme (like pure lan manager auth or simple nt
>> auth) problems might still exist.
>>
>> It would be just great if you can provide me some feedback, in anycase
>> my goal is to submit it to wireshark devs soon.
>
> Thanks! I'll give it a try in the next days.
Would it be possible that you base this patch on wiresharks trunk?
metze
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
Url : http://lists.samba.org/archive/samba-technical/attachments/20090428/83ab71b0/signature.bin
More information about the samba-technical
mailing list