Polskie Forum Użytkowników Debiana

Kod: Zaznacz cały

root@piotr-aspire-5749z-1:/home/piotr# cat /etc/debian_version
8.4

Kod: Zaznacz cały

root@piotr-aspire-5749z-1:/home/piotr#  /etc/apt/sources.list
bash: /etc/apt/sources.list: Brak dostępu

Kod: Zaznacz cały

cat > /etc/apt/sources.list <<EOF
deb http://ftp.pl.debian.org/debian/ stable main contrib non-free
deb http://security.debian.org/ stable/updates main contrib non-free
deb http://ftp.pl.debian.org/debian stable-updates main contrib non-free
EOF

Kod: Zaznacz cały

apt-get update && apt-get dist-upgrade

Kod: Zaznacz cały

Kod: Zaznacz cały

samba (2:4.3.7+dfsg-1) unstable; urgency=high

    This Samba security addresses both Denial of Service and Man in
    the Middle vulnerabilities.

    Both of these changes implement new smb.conf options and a number
    of stricter behaviours to prevent Man in the Middle attacks on our
    network services, as a client and as a server.

    Between these changes, compatibility with a large number of older
    software versions has been lost in the default configuration.

    See the release notes in WHATNEW.txt for more information.


    Here are some additional hints how to work around the new stricter de
fault behaviors:

    * As an AD DC server, only Windows 2000 and Samba 3.6 and above as
      a domain member are supported out of the box. Other smb file
      servers as domain members are also fine out of the box.

    * As an AD DC server, with default setting of "ldap server require
:

Kod: Zaznacz cały

* As an AD DC server, with default setting of "ldap server require
      strong auth", LDAP clients connecting over ldaps:// or START_TLS
      will be allowed to perform simple LDAP bind only.

      The preferred configuration for LDAP clients is to use SASL
      GSSAPI directly over ldap:// without using ldaps:// or
      START_TLS.

      To use LDAP with START_TLS and SASL GSSAPI (either Kerberos or
      NTLMSSP) sign/seal protection must be used by the client and
      server should be configured with "ldap server require strong
      auth = allow_sasl_over_tls".

      Consult OpenLDAP documentation how to set sign/seal protection
      in ldap.conf.

      For SSSD client configured with "id_provider = ad" or
      "id_provider = ldap" with "auth_provider = krb5", see
      sssd-ldap(5) manual for details on TLS session handling.

Kod: Zaznacz cały

  * As a file or printer client and as a domain member, out of the
      box compatibility with Samba less than 4.0 and other SMB/CIFS
      servers, depends on support for SMB signing or SMB2 on the
      server, which is often disabled or absent. You may need to
      adjust the "client ipc signing" to "no" in these cases.

    * In case of an upgrade from versions before 4.2.0, you might run
      into problems as a domain member. The out of the box compatibility
      with Samba 3.x domain controllers requires NETLOGON features only
      available in Samba 3.2 and above.
    
    However, all of these can be worked around by setting smb.conf
    options in Samba, see WHATSNEW.txt the 4.2.0 release notes at
    https://www.samba.org/samba/history/samba-4.2.0.html and the Samba
    wiki for details, workarounds and suggested security-improving
    changes to these and other software packages.


    Suggested further improvements after patching:

    It is recommended that administrators set these additional options,
    if compatible with their network environment:
: