Bug 49964 – S4-Connector: Allow missing NT-Hash (sambaNTpassword)

Bug 49964 - S4-Connector: Allow missing NT-Hash (sambaNTpassword)


Summary:	S4-Connector: Allow missing NT-Hash (sambaNTpassword)

Status:	NEW

Product:	UCS
Classification:	Unclassified
Component:	S4 Connector
Version:	UCS 4.4
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Samba maintainers
QA Contact:	Samba maintainers

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2019-08-05 16:01 CEST by Arvid Requate
Modified:	2020-12-04 12:30 CET (History)
CC List:	2 users (show)

See Also:	42967
What kind of report is it?:	Development Internal
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Flags:	requate: Patch_Available+

Attachments
s4c_allow_missing_nthash.patch (5.01 KB, patch) 2019-08-05 16:01 CEST, Arvid Requate	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2019-08-05 16:01:43 CEST

Created attachment 10150 [details]
s4c_allow_missing_nthash.patch

Imagine an UCS domain without NT Hashes.

Citing John Lennon: "It's easy if you try. No hell below us. Above us only sky"

Ok, let's assume you have a UCS domain without Samba/AD and you only want strong password hashes (according to our current state of the art). So you would adjust the krb5.conf to only allow AES keys and no RC4 or DES. Fine, we also can adjust the udm users/user code to not generate the sambaNTpassword either.

Now you may ask, ok fine, what's the S4-Connector got to do with it then?

Well, at some point the customer may got to the Appcenter and choose to install Samba/AD and then it would be great to gracefully handle this. The S4-Connector could just allow the NT-Hash (sambaNTpassword) to be missing from an account. The attached patch would allow bidirectional replication of the krb5Keys with supplementalCredentials without the sambaNTpassword attribute.