Disable strong auth samba

[france (Francesco)]

NS8
Hello some time ago on neth7 , @mrmarkuz had indicated me a change to deactivate auth on smb and allow through pfsense the auth of users . To date it still works, I would like to implement it on samba in the NS8 server.
[global]
ldap server require strong auth = no ???

Running podman and entering dc1 it would be correct to execute this directive for what I asked:

echo 'ldap server require strong auth = no' >> /etc/samba/include.conf

I also ask if this compromises the current login of Windows and Linux clients or is it ignored?

[mrmarkuz (Markus Neuberger)]

It’s still possible that way on the NS8 but it’s not the best for security, see https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_(LDAPS)_on_a_Samba_AD_DC#SASL_over_TLS:_A_bad_idea

Here is the command to add the option to the include.conf in the samba-dc container:

AD LDAP binding error (strong authentification required)

echo is also a shell builtin. Let’s run it in a shell: runagent -m samba1 podman exec -i samba-dc bash -c "echo 'ldap server require strong auth = no' >> /etc/samba/include.conf"

To apply the change, samba-dc needs to be restarted, see AD LDAP binding error (strong authentification required) - #5 by etique57

[france (Francesco)]

thank you . I know th problem of security for this parameter…but now the auth running …

[france (Francesco)]

I wanted ask you , if this modify without tls , not load and not controlling a certificate on the server correct ? the credentials for auth are processing in clear text ? thank

[mrmarkuz (Markus Neuberger)]

It would be more secure to use certificates and to not disable strong authentication.

@france

the credentials for auth are processing in clear text ?

Yes, if the client wants an unencrypted connection. It’s still possible to use TLS encryption.