The sii deynta nooca cusub ee Samba 4.13, nooca ku jira xalka nuglaanta ayaa lagu daray taas ayaa la ogaaday maalmo ka hor ZeroLogon (CVE-2020-1472), marka lagu daro xaqiiqda ah in qaybtan cusub ee shuruudaha Python mar horeba loo beddelay nooca 3.6 iyo waliba isbeddelo kale.
Kuwa aan aqoon u lahayn Samba, waa inaad ogaataa in kani yahay mashruuc sii wadaya horumarinta laanta Samba 4.x oo leh fulin buuxda oo ah kontoroole domain iyo adeegga Tilmaamaha Firfircoon, oo la jaan qaadaya hirgelinta Windows 2000 isla markaana awood u leh inuu u adeego dhammaan noocyada macaamiisha Windows oo ay taageerayaan Microsoft, oo ay ku jiraan Windows 10.
Samba 4, waa - shey adeegsi badan, kaas oo sidoo kale bixiya hirgelinta server file, adeegga daabacaadda iyo server xaqiijinta (winbind).
Astaamaha ugu muhiimsan ee cusub ee Samba 4.13
Qaabkan cusub ee borotokoolka ah Xakamaynta nuglaanta ZeroLogon ayaa lagu daray (CVE-2020-1472), kaas oo u oggolaan kara weeraryahan inuu ku helo xuquuqda maamule ee kontoroolka domainka nidaamyada aan isticmaalin dejinta "server schannel = haa" (Hadaad rabto inaad waxbadan ka ogaatoWaxaad ka hubin kartaa daabacaadda aan ka wadaagno halkan barta. Xiriiriyaha waa kan)
Isbeddel kale oo lagu sameeyay noocaan cusub ee Samba waa kan Shuruudaha ugu yar ee Python waxaa laga soo qaaday Python 3.5 ilaa Python 3.6. In kasta oo awoodda lagu dhisi karo faylka faylka leh Python 2 wali la hayo (ka hor inta aanad socon ./configure 'iyo' make ', waxaad u baahan tahay inaad dejiso isbeddellada' PYTHON = python2 '), laakiin laanta ku xigta waa laga saari doonaa oo Python 3.6 ayaa looga baahan doonaa isku dubaridka.
Dhinaca kale shaqeynta "Wide links = haa", taas oo u oggolaanaysa maareeyayaasha faylka faylalka inay abuuraan xiriiro summad leh oo loo raray meel ka baxsan qaybta hadda jirta ee SMB / CIFS, laga soo wareejiyay smbd oo loo beddelay qayb "vfs_widelinks" ah oo gaar ah.
Xilligan, qaybtani si otomaatig ah ayaa loo dhejiyaa haddii ay jiraan halbeegga "xiriiriyeyaal ballaadhan = haa" qaabeynta.
Taageerada "xiriiriyeyaasha ballaadhan = haa" ayaa la qorsheeyay in laga saaro mustaqbalka sababo la xiriira walaac xagga amniga ah, dadka isticmaala samba waxaa si xoog leh lagula talinayaa inay isticmaalaan "Mount –bind" si ay u fuulaan qaybo ka baxsan nidaamka faylasha halkii ay ka ahaan lahaayeen "wide links = haa".
Ogsoonow in soosaarayaasha Samba ay ku talinayaan in la beddelo rakibaadaha hadda isticmaala "xiriiriyeyaal ballaadhan = haa" si ay u adeegsadaan iskuxiraha isku xidhka sida ugu dhakhsaha badan, maadaama "xiriiriyeyaal ballaadhan = haa" ay yihiin goob aan ammaan ahaan habboonayn oo aan jeclaan lahayn inaan ka saarno Samba. U guurista aaladda qaybta VFS waxay u oggolaaneysaa tan in lagu sameeyo hab nadiif ah mustaqbalka.
Taageerida koontaroolaha qaybta qaabka caadiga ah ayaa qiimo dhac ku yimid. Isticmaalayaasha nooca 'NT4' ('caadiga ah') kontoroolayaasha domain waa inay u haajiraan Samba Active Directory domain kormeerayaasha si ay ula shaqeeyaan macaamiisha casriga ah ee Windows.
Hababka aqoonsiga aan sugnayn ee kaliya loo isticmaali karo SMBv1 waa la duudsiiyay: "domain logins", "xaqiijinta NTLMv2 ceyri", "xaqiijinta cadeynta macmiilka", "xaqiijinta macmiilka NTLMv2", "xaqiijinta lanman macmiil" iyo "isticmaalka macaamilka 'spnego".
Sidoo kale, taageerada "ldap ssl ads" xulashada smb.conf waa laga saaray. Nooca soosocda ayaa lafilayaa inuu meesha ka saaro ikhtiyaarka "server channel".
Isbadalada kale ee muuqda waa baabi'inta:
- Xayeysiisyada Ldap ssl ayaa laga saaray
- smb2 wuxuu joojiyaa xaqiijinta taxanaha qufulka
- smb2 jooji oplock break retry
- logins domain
- cayriin NTLMv2 cayriin
- xaqiijinta macnaha macmiilka
- NTLMv2 macmiilka auth
- macmiilka lanman auth
- Adeegsiga macmiilka 'spnego'
- Kanaal ka socda serverka ayaa lagaa saari doonaa nooca 4.13.0
- Ikhtiyaarkii smb.conf ee daciifka ahaa "ldap ssl ads" waa laga saaray.
- Xulashada "server schannel" smb.conf ikhtiyaari ahaan waxay u badan tahay in laga saaray nooca ugu dambeeya ee 4.13.0.
Finalmente hadaad rabto inaad waxbadan ka ogaato ku saabsan isbeddelada ku yimid noocan cusub ee Samba, waad garan kartaa iyaga Xiriirka soo socda.