samba - Mar 2006 - winbind - security hole?

I am trying to use winbind to authenticate users from some linux based
workstations against a (linux based) PDC. I have set ldap as the Idmap
backend to get consistent uid/gid mapping across the domain. Everything
works fine so far.

But:

The client workstation has the full right to modify the Idmap mappings.
Of course only root on the client workstation is able to see the
password in plain that is necessary to do this.

Consequently if someone is having root access on any single workstation,
he can modify the mapping at will to get root access to the entire
domain. The only remedy I can see is to disallow root access on all
workstations (which is a very undesirable fact).

Are I am missing something, or is there a different setup possible to
omit this security loophole?

Regards,
Roland

On Mon, Mar 20, 2006 at 08:54:22AM +0100, Roland Schwarz
wrote:
> Consequently if someone is having root access on any single workstation,
> he can modify the mapping at will to get root access to the entire
> domain. The only remedy I can see is to disallow root access on all
> workstations (which is a very undesirable fact).
But right now the only possibility.
> Are I am missing something, or is there a different setup possible to
> omit this security loophole?
No, you are right. In Samba trunk we have started working on
the unixinfo RPC pipe that eventually will fix this. But
it's not finished yet.

Volker
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url :
http://lists.samba.org/archive/samba/attachments/20060320/572c8511/attachment.bin