[PATCH] Update 'restrict anonymous' in smb.conf.5 manpage
asn at samba.org
Wed Feb 6 15:39:09 UTC 2019
I had some questions about this options so I've looked at the code and updated
the manpage accordingly.
Review is much appreciated.
Andreas Schneider asn at samba.org
Samba Team www.samba.org
-------------- next part --------------
>From a5006a21f689a2b7524617e6930ef1db82131532 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn at samba.org>
Date: Tue, 5 Feb 2019 16:08:46 +0100
Subject: [PATCH] docs-xml: Update documentation for 'restrict anonymous'
Signed-off-by: Andreas Schneider <asn at samba.org>
.../smbdotconf/security/restrictanonymous.xml | 45 ++++++++++---------
1 file changed, 23 insertions(+), 22 deletions(-)
diff --git a/docs-xml/smbdotconf/security/restrictanonymous.xml b/docs-xml/smbdotconf/security/restrictanonymous.xml
index 78cafd21d55..593bff330c6 100644
@@ -3,34 +3,35 @@
- <para>The setting of this parameter determines whether user and
- group list information is returned for an anonymous connection.
- and mirrors the effects of the
- registry key in Windows 2000 and Windows NT. When set to 0, user
- and group list information is returned to anyone who asks. When set
- to 1, only an authenticated user can retrieve user and
- group list information. For the value 2, supported by
- Windows 2000/XP and Samba, no anonymous connections are allowed at
- all. This can break third party and Microsoft
- applications which expect to be allowed to perform
- operations anonymously.</para>
+ The setting of this parameter determines whether SAMR and LSA
+ DCERPC services can be accessed anonymously. This corresponds
+ to the following Windows Server registry options:
+ The option also affects the browse option which is required by
+ legacy clients which rely on Netbios browsing. While modern
+ Windows version should be fine with restricting the access
+ there could still be applications relying on anonymous access.
- The security advantage of using restrict anonymous = 1 is dubious,
- as user and group list information can be obtained using other
+ Setting <smbconfoption name="restrict anonymous">1</smbconfoption>
+ will disable anonymous SAMR access.
- The security advantage of using restrict anonymous = 2 is removed
- by setting <smbconfoption name="guest ok">yes</smbconfoption> on any share.
+ Setting <smbconfoption name="restrict anonymous">2</smbconfoption>
+ will in addition to restrict SAMR access disallow anonymous connections
+ to the IPC$ share in general.
+ Setting <smbconfoption name="guest ok">yes</smbconfoption> on any share
+ will will remove the security advantage.
More information about the samba-technical