Summary of "encrypted and cleartext password in the same time" issue.

[Barker, Brian W.]

I have been also trying to get my UNIX Samba to work with
both win95 and win2000 and have had this problem with
encrypted vs. not. I don't understand this answer. You
say "All the listed clients will send an encrypted password
if 'encrypt passwords = yes'". But the 'encrypt passwords = yes'
is in the config file on my Unix machine, are you saying that
this will automatically make my Win95 machine send an encrypted
password? I find this hard to believe but maybe it is so. What do you
mean the clients will permit a security downgrade if the server
requests it? Can you elaborate? Maybe Martin understands...

Brian W. Barker
SAIC
Rosslyn, VA

-----Original Message-----
From: Andrew Bartlett [mailto:abartlet at pcug.org.au]
Sent: Saturday, January 12, 2002 8:13 PM
To: Martin Rusko
Cc: samba at lists.samba.org; Barker, Brian W.
Subject: Re: Summary of "encrypted and cleartext password in the same
time" issue.


Martin Rusko wrote:
> 
> Hi all,
> this is an attempt to cover all possibilities, how to access samba server
with
> clients sending cleartext password (CP clients) (original Win95, WinNT
until
> SP3) and clients sending encrypted password (EP clients) (Win98, Win2k,
> ....) at the same time. Any feedback, comments, questions or improvements
> are very welcome. :-)

All the listed clients will send an encrypted password if 'encrypt
passwords = yes'.  

The 'CP' clients you list are only different in that they will *permit*
a security downgrade if the server requests it.  Later clients do not
permit this downgrade without a registry hack (for security reasons).

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet at pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet at samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net