| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
in ntlmv2, the client will retry the challenge response trying a bunch
of different domain names assuming the same server challenge. so we have
to make retries work with factotum and the auth server.
also, windows 7 with compatlevel=4 sends all zeros LM response.
|
|
this adds new rpc for mschapv2 authentication (21)
deliver the MPPE secret not after the ticket/authenticator
response as cheartext, but include it in the first 128 bit
of the ticket key. and the authenticator in the first 160 bit
of the authenticator random field.
|
|
use OCHAPREPLYLEN instead of sizeof(reply) (no padding).
exit after sending ticket response to force eof as factotum
unconditionally reads tailing secret hash (as of mschap).
|
|
|
|
aiju → i don't like it, it's more bullshit ways to expose the key :)
aiju → if someone can grab /adm/keyseed, they can also grab /adm/users and /adm/keys
|
|
change the keyseed key derivation to hkdf sha256
using the hostowners des key plus 256 bit random
salt from /adm/keyseed.
|
|
|
|
|
|
|
|
after use
|
|
|
|
|
|
|
|
|
|
encryption
this is in preparation for replacing DES ticket encryption with
something better. but first need to make the code stop making
assumptions.
the wire encoding of the Ticket might be variable length
with TICKETLEN just giving an upper bound. the details will be
handled by libauthsrv _asgetticket() and _asgetresp() funciotns.
the Authenticator and Passwordreq structures are encrypted
with the random ticket key. The encryption schmeme will depend
on the Ticket format used, so we pass the Ticket* structure
instead of the DES key.
introduce Authkey structure that will hold all the required
cryptographic keys instead of passing DES key.
|
|
in addition to /sys/lib/httppasswords, allow http authentication
to use the plan9 password, which can be changed by the user.
|
|
structure sizes
|
|
the nt blob ends with 4 zero bytes, this is not the same as
the EOL av-pair terminator!
this makes ntlmv2 work with windows xp with LmCompatibityLevel = 3
|
|
extending factotums and the auth servers mschap implementation
to handle variable length NT response for NTLMv2.
fix some minor bugs.
only tested with cifs so far.
|
|
|
|
|
