Distribution EOLE » Services » eole-fichier

lanman auth = yes

Sans cette option l'authentification NTLM fonctionne correctement avec Amon 2.6 et Scribe 2.6.

enable privileges = No

On doit laisser cette option car sans elle, ESU ne se lance pas. #14453

On peut remplacer :

syslog only = yes
syslog = 0

par :

logging = syslog@0

1°) ntlmv2 & spnego

client NTLMv2 auth = Yes
client use spnego principal = No
send spnego principal = No

The impact of 'client ntlmv2 auth = yes' is that by default we will not use NTLM authentication as a client ! (samba >= 3.6 )

Default >3.6.0: client NTLMv2 auth = Yes > inutile
Default >3.6.0: client use spnego principal = no > inutile
Default >3.6.0: send spnego principal = no > inutile (removed)

2°) log writeable

log writeable files on exit = No

3°) CTDB1048576

ctdb locktime warn threshold = 0

On n'utilise pas le cluster !
Defautl >3.6.0: ctdb locktime warn threshold = 0 ==> inutile

4°) limitation taille paquet smb2

smb2 max read = 65536
smb2 max write = 65536
smb2 max trans = 65536
smb2 max credits = 8192

ces valeurs sont pour NTLM v1 !
Default >3.6.0: smb2 max credits = 128
Default >3.6.0: smb2 max read = 8388608
Default >3.6.0: smb2 max trans = 8388608
Default >3.6.0: smb2 max write = 8388608

laisser les valeurs par défaut

5°)

username map cache time = 0

Default >3.6.0: username map cache time = 0 ==> inutile

6°) Wide Links

allow insecure wide links = No

Normalement, a utiliser avec "wide links = Yes" (ce qui n'est pas le cas)

"Setting allow insecure wide links to true disables the link between these two parameters, removing this protection and allowing a site to configure the server to follow symlinks (by setting wide links to "true") even when unix extensions is turned on."
N'est pas ce que l'on fait avec les liens 'groupes', ....

Default >3: allow insecure wide links = no > a voir

7°)

async smb echo handler = No

This parameter specifies whether Samba should fork the async smb echo handler. It can be beneficial if your file system can block syscalls for a very long time. In some circumstances, it prolongs the timeout that Windows uses to determine whether a connection is dead.

Default >3.6: async smb echo handler = no > inutile

8°) Multicast DNS

multicast dns register = Yes

Default >3.6: multicast dns register = yes ==> inutile

9°) winbind

winbind max clients = 200
winbind max domain connections = 1

Default >3.6: winbind max clients = 200
Default >3.6.0: winbind max domain connections = 1 ==> inutile, mais a voir "winbind max domain connections = 10"

10°)

ncalrpc dir = /var/ncalrpc

11°)

scannedonly:allow_nonscanned_files = True

12°) Idmap

idmap config * : backend = tdb

13°) print

print notify backchannel = Yes
print ok = No

Pour rappel :

https://www.samba.org/samba/history/samba-4.4.0.html

  Parameter Name        Description        Default
  --------------        -----------        -------
  aio max threads               New                     100
  ldap page size        Changed default        1000
  server multi channel support    New            No
  interfaces            Extended syntax

https://www.samba.org/samba/history/samba-4.3.0.html

  Parameter Name        Description        Default
  --------------        -----------        -------
  logging            New            (empty)
  msdfs shuffle referrals    New            no
  smbd profiling level        New            off
  spotlight            New            no
  tls priority            New             NORMAL:-VERS-SSL3.0
  use ntdb            Removed
  change notify            Changed to [global]
  kernel change notify        Changed to [global]
  client max protocol        Changed    default        SMB3_11
  server max protocol        Changed default        SMB3_11

https://www.samba.org/samba/history/samba-4.2.0.html

   Parameter Name            Description    Default
   --------------            -----------    -------
   allow nt4 crypto                     New             no
   neutralize nt4 emulation             New             no
   reject md5 client                    New             no
   reject md5 servers                   New             no
   require strong key                   New             yes
   smb2 max read                        Changed default 8388608
   smb2 max write                       Changed default 8388608
   smb2 max trans                       Changed default 8388608
   winbind expand groups                Changed default 0

https://www.samba.org/samba/history/samba-4.1.0.html

   Parameter Name            Description    Default
   --------------            -----------    -------

   acl allow execute always        New        False
   password level            Removed
   set directory            Removed
   use ntdb                New        No

https://www.samba.org/samba/history/samba-4.0.0.html

   Parameter Name            Description
   --------------            -----------

   acl compatibility            Removed
   allow dns updates            New
   announce as                Removed
   announce version            Removed
   cldap port                New
   client max protocol            New
   client min protocol            New
   client signing            Changed default
   dcerpc endpoint servers        New
   dgram port                New
   directory security mask        Removed
   display charset            Removed
   dns forwarder            New
   dns update command            New
   force security mode            Removed
   force directory security mode    Removed
   homedir map                Changed default
   kernel oplocks            Changed default
   kernel share modes            New
   kpasswd port                New
   krb5 port                New
   nbt client socket address        New
   nbt port                New
   nsupdate command            New
   ntp signd socket directory        New
   ntvfs handler            New
   paranoid server security        Removed
   pid directory            New
   printer admin            Removed
   rndc command             New
   rpc big endian            New
   samba kcc command            New
   security mask            Removed
   send spnego principal        Removed
   server max protocol            New
   server min protocol            New
   server role                New
   server services            New
   server signing            Changed default
   share backend            New
   share modes                Removed
   smb2 max read            Changed default
   smb2 max write            Changed default
   smb2 max trans            Changed default
   socket address            Removed
   spn update command            New
   time offset                Removed
   tls cafile                New
   tls certfile                New
   tls crlfile                New
   tls dh params file            New
   tls enabled                New
   tls keyfile                New
   unicode                New
   web port                New
   winbindd privileged socket directory    New
   winbind sealed pipes            New
   winbindd socket directory        New

Klaas a écrit :

Concrètement, concernant la réduction de smb.conf de Scribe/Horus, on peut remplacer :

syslog only = yes
> syslog = 0

par :

logging = syslog@0

C'est tout ce que j'ai trouvé, le reste on en a besoin.

=> eole-fichier 2.6.1-3