Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-30 Thread Simo Sorce
On Fri, 2012-07-27 at 18:54 -0400, Simo Sorce wrote: On Fri, 2012-07-27 at 07:15 +0300, Alexander Bokovoy wrote: On Thu, 12 Jul 2012, Alexander Bokovoy wrote: On Thu, 12 Jul 2012, Simo Sorce wrote: On Thu, 2012-07-12 at 10:48 +0300, Alexander Bokovoy wrote: On Wed, 11 Jul 2012, Simo Sorce

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-27 Thread Simo Sorce
On Fri, 2012-07-27 at 07:15 +0300, Alexander Bokovoy wrote: On Thu, 12 Jul 2012, Alexander Bokovoy wrote: On Thu, 12 Jul 2012, Simo Sorce wrote: On Thu, 2012-07-12 at 10:48 +0300, Alexander Bokovoy wrote: On Wed, 11 Jul 2012, Simo Sorce wrote: From 84ef09a1193ff42fc301fb71354055c5039f51a5 Mon

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-26 Thread Alexander Bokovoy
On Thu, 12 Jul 2012, Alexander Bokovoy wrote: On Thu, 12 Jul 2012, Simo Sorce wrote: On Thu, 2012-07-12 at 10:48 +0300, Alexander Bokovoy wrote: On Wed, 11 Jul 2012, Simo Sorce wrote: From 84ef09a1193ff42fc301fb71354055c5039f51a5 Mon Sep 17 00:00:00 2001 From: Simo Sorce sso...@redhat.com

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-12 Thread Alexander Bokovoy
On Wed, 11 Jul 2012, Simo Sorce wrote: On Wed, 2012-07-11 at 16:40 +0300, Alexander Bokovoy wrote: On Wed, 11 Jul 2012, Simo Sorce wrote: On Wed, 2012-07-11 at 15:41 +0300, Alexander Bokovoy wrote: If users don't have RC4-HMAC key and don't have ipaNTHash set, they can't log in into smbd

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-12 Thread Alexander Bokovoy
On Wed, 11 Jul 2012, Simo Sorce wrote: From 84ef09a1193ff42fc301fb71354055c5039f51a5 Mon Sep 17 00:00:00 2001 From: Simo Sorce sso...@redhat.com Date: Fri, 6 Jul 2012 16:18:29 -0400 Subject: [PATCH] Add special modify op to regen ipaNTHash The NT Hash is the same thing as the RC4-HMAC key, so

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-12 Thread Simo Sorce
On Thu, 2012-07-12 at 10:48 +0300, Alexander Bokovoy wrote: On Wed, 11 Jul 2012, Simo Sorce wrote: From 84ef09a1193ff42fc301fb71354055c5039f51a5 Mon Sep 17 00:00:00 2001 From: Simo Sorce sso...@redhat.com Date: Fri, 6 Jul 2012 16:18:29 -0400 Subject: [PATCH] Add special modify op to regen

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-12 Thread Alexander Bokovoy
On Thu, 12 Jul 2012, Simo Sorce wrote: On Thu, 2012-07-12 at 10:48 +0300, Alexander Bokovoy wrote: On Wed, 11 Jul 2012, Simo Sorce wrote: From 84ef09a1193ff42fc301fb71354055c5039f51a5 Mon Sep 17 00:00:00 2001 From: Simo Sorce sso...@redhat.com Date: Fri, 6 Jul 2012 16:18:29 -0400 Subject:

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-11 Thread Alexander Bokovoy
On Sat, 07 Jul 2012, Simo Sorce wrote: When installing the adtrust code we need to be able to get the ipaNTHash populated as in some cases we may need it to authenticate connections over SMB w/o using kerberos during the trust setup phase. The NT hash is really just the same thing as the

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-11 Thread Simo Sorce
On Wed, 2012-07-11 at 14:55 +0300, Alexander Bokovoy wrote: On Sat, 07 Jul 2012, Simo Sorce wrote: When installing the adtrust code we need to be able to get the ipaNTHash populated as in some cases we may need it to authenticate connections over SMB w/o using kerberos during the trust setup

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-11 Thread Alexander Bokovoy
On Wed, 11 Jul 2012, Simo Sorce wrote: On Wed, 2012-07-11 at 14:55 +0300, Alexander Bokovoy wrote: On Sat, 07 Jul 2012, Simo Sorce wrote: When installing the adtrust code we need to be able to get the ipaNTHash populated as in some cases we may need it to authenticate connections over SMB w/o

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-11 Thread Simo Sorce
On Wed, 2012-07-11 at 15:41 +0300, Alexander Bokovoy wrote: If users don't have RC4-HMAC key and don't have ipaNTHash set, they can't log in into smbd anyway until they change their password. Yes the point is that you may have users you do not want to give a password to. No need to keep

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-11 Thread Alexander Bokovoy
On Wed, 11 Jul 2012, Simo Sorce wrote: On Wed, 2012-07-11 at 15:41 +0300, Alexander Bokovoy wrote: If users don't have RC4-HMAC key and don't have ipaNTHash set, they can't log in into smbd anyway until they change their password. Yes the point is that you may have users you do not want to

Re: [Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-11 Thread Simo Sorce
On Wed, 2012-07-11 at 16:40 +0300, Alexander Bokovoy wrote: On Wed, 11 Jul 2012, Simo Sorce wrote: On Wed, 2012-07-11 at 15:41 +0300, Alexander Bokovoy wrote: If users don't have RC4-HMAC key and don't have ipaNTHash set, they can't log in into smbd anyway until they change their password.

[Freeipa-devel] [PATCHES][RFC] Implement special operation to revoer NT hash for a user

2012-07-07 Thread Simo Sorce
When installing the adtrust code we need to be able to get the ipaNTHash populated as in some cases we may need it to authenticate connections over SMB w/o using kerberos during the trust setup phase. The NT hash is really just the same thing as the rc4-hmac key we already have by default in the