[PATCH] Update 'restrict anonymous' in smb.conf.5 manpage

[Andreas Schneider]

On Wednesday, February 6, 2019 5:29:33 PM CET Rowland Penny wrote:
> On Wed, 06 Feb 2019 17:22:51 +0100
> 
> Andreas Schneider <asn at samba.org> wrote:
> > On Wednesday, February 6, 2019 5:11:17 PM CET Rowland Penny wrote:
> > > Setting <smbconfoption name="restrict anonymous">2</smbconfoption>
> > > will, in addition to restricting SAMR access, disallow anonymous
> > > connections to the IPC$ share in general.
> > 
> > Thanks, updated patch attached.
> 
> You still have two 'will' at line 113:
>  +		will will remove the security advantage.
> 
> Rowland

And one patch too much. Fixed patch attached.

-- 
Andreas Schneider                      asn at samba.org
Samba Team                             www.samba.org
GPG-ID:     8DFF53E18F2ABC8D8F3C92237EE0FC4DCC014E3D
-------------- next part --------------
>From 77671150221abb750ba8559296e87bcd974e6b9f Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn at samba.org>
Date: Tue, 5 Feb 2019 16:08:46 +0100
Subject: [PATCH] docs-xml: Update documentation for 'restrict anonymous'
 option

Signed-off-by: Andreas Schneider <asn at samba.org>
---
 .../smbdotconf/security/restrictanonymous.xml | 45 ++++++++++---------
 1 file changed, 23 insertions(+), 22 deletions(-)

diff --git a/docs-xml/smbdotconf/security/restrictanonymous.xml b/docs-xml/smbdotconf/security/restrictanonymous.xml
index 78cafd21d55..06abe7b2bf7 100644
--- a/docs-xml/smbdotconf/security/restrictanonymous.xml
+++ b/docs-xml/smbdotconf/security/restrictanonymous.xml
@@ -3,34 +3,35 @@
                  context="G"
                  xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
 <description>
-    <para>The setting of this parameter determines whether user and
-    group list information is returned for an anonymous connection.
-    and mirrors the effects of the
-<programlisting>
-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
-           Control\LSA\RestrictAnonymous
-</programlisting>
-	registry key in Windows 2000 and Windows NT.  When set to 0, user
-	and group list information is returned to anyone who asks.  When set
-    to 1, only an authenticated user can retrieve user and
-    group list information.  For the value 2, supported by
-    Windows 2000/XP and Samba, no anonymous connections are allowed at
-    all.  This can break third party and Microsoft
-    applications which expect to be allowed to perform
-	operations anonymously.</para>
+	<para>
+		The setting of this parameter determines whether SAMR and LSA
+		DCERPC services can be accessed anonymously. This corresponds
+		to the following Windows Server registry options:
+	</para>
+
+	<programlisting>
+		HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous
+	</programlisting>
+
+	<para>
+		The option also affects the browse option which is required by
+		legacy clients which rely on Netbios browsing. While modern
+		Windows version should be fine with restricting the access
+		there could still be applications relying on anonymous access.
+	</para>
 
 	<para>
-    The security advantage of using restrict anonymous = 1 is dubious,
-    as user and group list information can be obtained using other
-	means.
+		Setting <smbconfoption name="restrict anonymous">1</smbconfoption>
+		will disable anonymous SAMR access.
 	</para>
 
-	<note>
 	<para>
-    The security advantage of using restrict anonymous = 2 is removed
-    by setting <smbconfoption name="guest ok">yes</smbconfoption> on any share.
+		Setting <smbconfoption name="restrict anonymous">2</smbconfoption>
+		will, in addition to restricting SAMR access, disallow anonymous
+		connections to the IPC$ share in general.
+		Setting <smbconfoption name="guest ok">yes</smbconfoption> on any share
+		will remove the security advantage.
 	</para>
-	</note>
 </description>
 
 <value type="default">0</value>
-- 
2.20.1