77 lines
2.9 KiB
Diff
77 lines
2.9 KiB
Diff
From eba5e1321830624e6e42d248616f651beb0d3b99 Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Tue, 5 Oct 2021 18:11:57 +0200
|
|
Subject: [PATCH 124/266] CVE-2020-25719 CVE-2020-25717: auth/gensec: always
|
|
require a PAC in domain mode (DC or member)
|
|
|
|
AD domains always provide a PAC unless UF_NO_AUTH_DATA_REQUIRED is set
|
|
on the service account, which can only be explicitly configured,
|
|
but that's an invalid configuration!
|
|
|
|
We still try to support standalone servers in an MIT realm,
|
|
as legacy setup.
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556
|
|
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
|
[jsutton@samba.org Removed knownfail entries]
|
|
---
|
|
auth/gensec/gensec_util.c | 27 +++++++++++++++++++++++----
|
|
1 files changed, 23 insertions(+), 4 deletions(-)
|
|
delete mode 100644 selftest/knownfail.d/no-pac
|
|
|
|
Conflict:delete a chunk which delete a file do not exist
|
|
Reference:https://git.samba.org/samba.git/?p=samba.git;a=patch;h=eba5e1321830624e6e42d248616f651beb0d3b99
|
|
|
|
diff --git a/auth/gensec/gensec_util.c b/auth/gensec/gensec_util.c
|
|
index e185acc0c20..694661b53b5 100644
|
|
--- a/auth/gensec/gensec_util.c
|
|
+++ b/auth/gensec/gensec_util.c
|
|
@@ -25,6 +25,8 @@
|
|
#include "auth/gensec/gensec_internal.h"
|
|
#include "auth/common_auth.h"
|
|
#include "../lib/util/asn1.h"
|
|
+#include "param/param.h"
|
|
+#include "libds/common/roles.h"
|
|
|
|
#undef DBGC_CLASS
|
|
#define DBGC_CLASS DBGC_AUTH
|
|
@@ -46,10 +48,27 @@ NTSTATUS gensec_generate_session_info_pac(TALLOC_CTX *mem_ctx,
|
|
session_info_flags |= AUTH_SESSION_INFO_DEFAULT_GROUPS;
|
|
|
|
if (!pac_blob) {
|
|
- if (gensec_setting_bool(gensec_security->settings, "gensec", "require_pac", false)) {
|
|
- DEBUG(1, ("Unable to find PAC in ticket from %s, failing to allow access\n",
|
|
- principal_string));
|
|
- return NT_STATUS_ACCESS_DENIED;
|
|
+ enum server_role server_role =
|
|
+ lpcfg_server_role(gensec_security->settings->lp_ctx);
|
|
+
|
|
+ /*
|
|
+ * For any domain setup (DC or member) we require having
|
|
+ * a PAC, as the service ticket comes from an AD DC,
|
|
+ * which will always provide a PAC, unless
|
|
+ * UF_NO_AUTH_DATA_REQUIRED is configured for our
|
|
+ * account, but that's just an invalid configuration,
|
|
+ * the admin configured for us!
|
|
+ *
|
|
+ * As a legacy case, we still allow kerberos tickets from an MIT
|
|
+ * realm, but only in standalone mode. In that mode we'll only
|
|
+ * ever accept a kerberos authentication with a keytab file
|
|
+ * being explicitly configured via the 'keytab method' option.
|
|
+ */
|
|
+ if (server_role != ROLE_STANDALONE) {
|
|
+ DBG_WARNING("Unable to find PAC in ticket from %s, "
|
|
+ "failing to allow access\n",
|
|
+ principal_string);
|
|
+ return NT_STATUS_NO_IMPERSONATION_TOKEN;
|
|
}
|
|
DBG_NOTICE("Unable to find PAC for %s, resorting to local "
|
|
"user lookup\n", principal_string);
|
|
--
|
|
2.23.0
|
|
|