1 <samba:parameter name="server schannel"
4 enumlist="enum_bool_auto"
6 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
10 This option is deprecated and will be removed in future,
11 as it is a security problem if not set to "yes" (which will be
12 the hardcoded behavior in future).
16 Samba will complain in the log files at log level 0,
17 about the security problem if the option is not set to "yes".
20 See CVE-2020-1472(ZeroLogon) https://bugzilla.samba.org/show_bug.cgi?id=14497
23 <para>If you still have legacy domain members use the <smbconfoption name="server require schannel:COMPUTERACCOUNT"/> option.
26 <para>This option yields precedence to the <smbconfoption name="server require schannel:COMPUTERACCOUNT"/> option.</para>
30 <value type="default">yes</value>
33 <samba:parameter name="server require schannel:COMPUTERACCOUNT"
36 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
39 <para>If you still have legacy domain members, which required "server schannel = auto" before,
40 it is possible to specify explicit exception per computer account
41 by using 'server require schannel:COMPUTERACCOUNT = no' as option.
42 Note that COMPUTERACCOUNT has to be the sAMAccountName value of
43 the computer account (including the trailing '$' sign).
47 Samba will complain in the log files at log level 0,
48 about the security problem if the option is not set to "no",
49 but the related computer is actually using the netlogon
50 secure channel (schannel) feature.
54 Samba will warn in the log files at log level 5,
55 if a setting is still needed for the specified computer account.
59 See CVE-2020-1472(ZeroLogon) https://bugzilla.samba.org/show_bug.cgi?id=14497
62 <para>This option takes precedence to the <smbconfoption name="server schannel"/> option.</para>
65 server require schannel:LEGACYCOMPUTER1$ = no
66 server require schannel:NASBOX$ = no
67 server require schannel:LEGACYCOMPUTER2$ = no