Author: kseeger Date: 2007-10-30 07:42:25 +0000 (Tue, 30 Oct 2007) New Revision: 1197
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba-docs&rev=1197 Log: Add manpage section for the new parameter client ldap sasl wrapping Karolin Added: trunk/smbdotconf/ldap/clientldapsaslwrapping.xml Modified: trunk/smbdotconf/security/clientsigning.xml Changeset: Added: trunk/smbdotconf/ldap/clientldapsaslwrapping.xml =================================================================== --- trunk/smbdotconf/ldap/clientldapsaslwrapping.xml 2007-10-24 11:39:38 UTC (rev 1196) +++ trunk/smbdotconf/ldap/clientldapsaslwrapping.xml 2007-10-30 07:42:25 UTC (rev 1197) @@ -0,0 +1,43 @@ +<samba:parameter name="client ldap sasl wrapping" + context="G" + type="string" + advanced="1" + xmlns:samba="http://www.samba.org/samba/DTD/samba-doc";> +<description> + <para> + The <smbconfoption name="client ldap sasl wrapping"/> defines whether + ldap traffic will be signed or signed and encrypted (sealed). + Possible values are <emphasis>plain</emphasis>, <emphasis>sign</emphasis> + and <emphasis>seal</emphasis>. + </para> + + <para> + The values <emphasis>sign</emphasis> and <emphasis>seal</emphasis> + are only available if Samba has been compiled against a modern + OpenLDAP version (2.3.x or higher). + </para> + + <para> + This option is needed in the case of Domain Controllers enforcing + the usage of signed LDAP connections (e.g. Windows 2000 SP3 or higher). + LDAP sign and seal can be controlled with the registry key + "HKLM\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity" + on the Windows server side. + </para> + + <para> + Depending on the used KRB5 library (MIT and older Heimdal versions) + it is possible that the message "integrity only" is not supported. + In this case, <emohasis>sign</emphasis> is just an alias for + <emphasis>seal</emphasis>. + </para> + + <para> + The default value is <emphasis>plain</emphasis> which is not irritable + to KRB5 clock skew errors. That implies synchronizing the time + with the KDC in the case of using <emphasis>sign</emphasis> or + <emphasis>seal</emphasis>. + </para> +</description> +<value type="default">plain</value> +</samba:parameter> Modified: trunk/smbdotconf/security/clientsigning.xml =================================================================== --- trunk/smbdotconf/security/clientsigning.xml 2007-10-24 11:39:38 UTC (rev 1196) +++ trunk/smbdotconf/security/clientsigning.xml 2007-10-30 07:42:25 UTC (rev 1197) @@ -12,7 +12,8 @@ <para>When set to auto, SMB signing is offered, but not enforced. When set to mandatory, SMB signing is required and if set - to disabled, SMB signing is not offered either.</para> + to disabled, SMB signing is not offered either. +</para> </description> <value type="default">auto</value>
