Hi,

sorry for the late reply.

On  Fr 25 Sep 2020 07:14:25 CEST, Salvatore Bonaccorso wrote:

> Hi Andrew,
>
> On Fri, Sep 25, 2020 at 02:06:18PM +1200, Andrew Bartlett wrote:
>> G'Day,
>>
>> I just noticed there are no patches for the ZeroLogon issue in Debian.
>>
>> This is a pretty big deal for anybody who has fiddled with the default
>> for 'server schannel' or is running Samba 4.7 or earlier.
>>
>> Is anybody getting onto this?  Did the bug not get to the right folks?
>
> yes it did got to us, we have put it on a 'DSA needed' list for
> buster, but nobody has come to it yet for an update there yet.

I am currently looking at Samba in Extended LTS (jessie) and will work  
on Samba in LTS (stretch) the coming months.

> In my understanding this is more problematic for stretch running AD's
> as they do not have yet the sane 'server schannel' default. buster has
> already the sane defaults but not yet the patches.

I plan to also provide a patch for Samba in buster while working on a  
fix in stretch.

> AFAICS there is Mike Gabriel recently working on triaging samba for
> the LTS supported version, so I'm looping in here.

The upstream-provided patches are quite invasive it seems.

@Salvatore: Depending on if patches easily apply or not, would it be  
an option to add "server schannel = yes" to default smb.conf and add a  
comment containing the CVE number and some URL for further reading.

Greets,
Mike
-- 

mike gabriel aka sunweaver (Debian Developer)
mobile: +49 (1520) 1976 148
landline: +49 (4351) 486 14 27

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: sunweaver@debian.org, http://sunweavers.net

