We need to rework "allow weak crypto" mode in Samba

[Andrew Bartlett]

On Sat, 2022-03-19 at 11:40 +0200, Alexander Bokovoy via samba-
technical wrote:
> 
> 
> Note, though, if you'd follow strictly FIPS 140-3 (or even FIPS 140-
> 2)
> requirements, krb5kdf function is not FIPS-compliant, so aes256-sha1
> and
> aes128-sha1 encryption types could not be used in FIPS mode. Active
> Directory has no support for RFC 8009 types (aes256-sha2 and
> aes128-sha2), so in a strict following of a FIPS 140-3 environment,
> there is simply no way to interoperate with Microsoft Windows clients
> in
> Active Directory. I believe Samba AD has no support for these
> encryption
> types either even though underlying MIT Kerberos and Heimdal do
> support
> them.
> 

Thanks Alexander, this and the other comments that I didn't quote do
help.  

It is now clear to me that we should ensure that Samba has independent
configuration for the 'weak' crypto operations that we may wish to
enable/disable, totally aside from a system 'FIPS mode'.

We can still override and disable operations if that is be globally
defined of course.

Andrew Bartlett

-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions