1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
samba-mirror/source3/libads/kerberos_keytab.c

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

1027 lines
24 KiB
C
Raw Normal View History

/*
Unix SMB/CIFS implementation.
kerberos keytab utility library
Copyright (C) Andrew Tridgell 2001
Copyright (C) Remus Koos 2001
Copyright (C) Luke Howard 2003
Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
Copyright (C) Guenther Deschner 2003
Copyright (C) Rakesh Patel 2004
Copyright (C) Dan Perry 2004
Copyright (C) Jeremy Allison 2004
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
Copyright (C) Gerald Carter 2006
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "smb_krb5.h"
#include "ads.h"
#include "secrets.h"
#ifdef HAVE_KRB5
#ifdef HAVE_ADS
/* This MAX_NAME_LEN is a constant defined in krb5.h */
#ifndef MAX_KEYTAB_NAME_LEN
#define MAX_KEYTAB_NAME_LEN 1100
#endif
static krb5_error_code ads_keytab_open(krb5_context context,
krb5_keytab *keytab)
{
char keytab_str[MAX_KEYTAB_NAME_LEN] = {0};
const char *keytab_name = NULL;
krb5_error_code ret = 0;
switch (lp_kerberos_method()) {
case KERBEROS_VERIFY_SYSTEM_KEYTAB:
case KERBEROS_VERIFY_SECRETS_AND_KEYTAB:
ret = krb5_kt_default_name(context,
keytab_str,
sizeof(keytab_str) - 2);
if (ret != 0) {
DBG_WARNING("Failed to get default keytab name\n");
goto out;
}
keytab_name = keytab_str;
break;
case KERBEROS_VERIFY_DEDICATED_KEYTAB:
keytab_name = lp_dedicated_keytab_file();
break;
default:
DBG_ERR("Invalid kerberos method set (%d)\n",
lp_kerberos_method());
ret = KRB5_KT_BADNAME;
goto out;
}
if (keytab_name == NULL || keytab_name[0] == '\0') {
DBG_ERR("Invalid keytab name\n");
ret = KRB5_KT_BADNAME;
goto out;
}
ret = smb_krb5_kt_open(context, keytab_name, true, keytab);
if (ret != 0) {
DBG_WARNING("smb_krb5_kt_open failed (%s)\n",
error_message(ret));
goto out;
}
out:
return ret;
}
static bool fill_default_spns(TALLOC_CTX *ctx, const char *machine_name,
const char *my_fqdn, const char *spn,
const char ***spns)
{
char *psp1, *psp2;
if (*spns == NULL) {
*spns = talloc_zero_array(ctx, const char*, 3);
if (*spns == NULL) {
return false;
}
}
psp1 = talloc_asprintf(ctx,
"%s/%s",
spn,
machine_name);
if (psp1 == NULL) {
return false;
}
if (!strlower_m(&psp1[strlen(spn) + 1])) {
return false;
}
(*spns)[0] = psp1;
psp2 = talloc_asprintf(ctx,
"%s/%s",
spn,
my_fqdn);
if (psp2 == NULL) {
return false;
}
if (!strlower_m(&psp2[strlen(spn) + 1])) {
return false;
}
(*spns)[1] = psp2;
return true;
}
static bool ads_set_machine_account_spns(TALLOC_CTX *ctx,
ADS_STRUCT *ads,
const char *service_or_spn,
const char *my_fqdn)
{
const char **spn_names = NULL;
ADS_STATUS aderr;
struct spn_struct* spn_struct = NULL;
char *tmp = NULL;
/* SPN should have '/' */
tmp = strchr_m(service_or_spn, '/');
if (tmp != NULL) {
spn_struct = parse_spn(ctx, service_or_spn);
if (spn_struct == NULL) {
return false;
}
}
DBG_INFO("Attempting to add/update '%s'\n", service_or_spn);
if (spn_struct != NULL) {
spn_names = talloc_zero_array(ctx, const char*, 2);
spn_names[0] = service_or_spn;
} else {
bool ok;
ok = fill_default_spns(ctx,
lp_netbios_name(),
my_fqdn,
service_or_spn,
&spn_names);
if (!ok) {
return false;
}
}
aderr = ads_add_service_principal_names(ads,
lp_netbios_name(),
spn_names);
if (!ADS_ERR_OK(aderr)) {
DBG_WARNING("Failed to add service principal name.\n");
return false;
}
return true;
}
s3:libads: Allow 'net ads keytab add' handle Windows SPN(s) part 1 This patch addresses how the windows SPN is converted into a kerberos priniciple to be written to the keytab file. A followup patch will deal with writing Window SPN(s) to the AD. Before this change 'net ads keytab add' handled three scenarios a) 'net ads keytab add param' is passed a fully qualified kerberos principal (identified by the presence of '@' in param) In this scenario the keytab file alone is updated with the principal contained in 'param'. b) 'net ads keytab add param'; is passed a machine name (identified by the paramater ending with '$'). In this case the machine name is converted to a kerberos principal with according to the recipe 'param@realm' where realm is determined by lp_realm(). c) 'net ads keytab add param' is passed a service (e.g. nfs, http etc.) In this scenario the param containing the service is first converted to into 2 kerberos principals (long and short forms) according to the following recipe i) long form: 'param/fully_qualified_dns@realm' ii) short form: 'param/netbios_name@realm' where 'fully_qualified_dns is retrieved from 'dNSHostName' attribute of 'this' machines computer account on the AD. The principals are written to the keytab file Secondly 2 windows SPNs are generated from 'param' as follows i) long form 'param/full_qualified_dns' ii) short form 'param/netbios_name' These SPNs are written to the AD computer account object After this change a) & b) & c) will retain legacy behaviour except in the case of c) where if the 'param' passed to c) is a Windows SPN (e.g. conforming to format 'serviceclass/host:port' i) 'param' will get converted to a kerberos principal (just a single one) with the following recipe: 'serviceclass/host@realm' which will be written to the keytab file. The SPN written to the AD is created as before and the legacy behaviour is preserved. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-01-29 21:30:33 +03:00
/*
* Create kerberos principal(s) from SPN or service name.
*/
static bool service_or_spn_to_kerberos_princ(TALLOC_CTX *ctx,
const char *service_or_spn,
const char *my_fqdn,
char **p_princ_s,
char **p_short_princ_s)
{
char *princ_s = NULL;
char *short_princ_s = NULL;
const char *service = service_or_spn;
const char *host = my_fqdn;
struct spn_struct* spn_struct = NULL;
char *tmp = NULL;
bool ok = true;
/* SPN should have '/' */
tmp = strchr_m(service_or_spn, '/');
if (tmp != NULL) {
spn_struct = parse_spn(ctx, service_or_spn);
if (spn_struct == NULL) {
ok = false;
goto out;
}
}
if (spn_struct != NULL) {
service = spn_struct->serviceclass;
host = spn_struct->host;
}
princ_s = talloc_asprintf(ctx, "%s/%s@%s",
service,
host, lp_realm());
if (princ_s == NULL) {
ok = false;
goto out;
}
if (spn_struct == NULL) {
short_princ_s = talloc_asprintf(ctx, "%s/%s@%s",
service, lp_netbios_name(),
lp_realm());
if (short_princ_s == NULL) {
ok = false;
goto out;
}
}
*p_princ_s = princ_s;
*p_short_princ_s = short_princ_s;
out:
return ok;
}
static int add_kt_entry_etypes(krb5_context context, TALLOC_CTX *tmpctx,
ADS_STRUCT *ads, const char *salt_princ_s,
krb5_keytab keytab, krb5_kvno kvno,
const char *srvPrinc, const char *my_fqdn,
krb5_data *password, bool update_ads)
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
{
krb5_error_code ret = 0;
char *princ_s = NULL;
char *short_princ_s = NULL;
krb5_enctype enctypes[4] = {
ENCTYPE_AES256_CTS_HMAC_SHA1_96,
ENCTYPE_AES128_CTS_HMAC_SHA1_96,
2010-08-18 12:33:32 +04:00
ENCTYPE_ARCFOUR_HMAC,
0
};
size_t i;
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
2010-08-18 12:33:32 +04:00
/* Construct our principal */
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
if (strchr_m(srvPrinc, '@')) {
/* It's a fully-named principal. */
2010-08-18 12:33:32 +04:00
princ_s = talloc_asprintf(tmpctx, "%s", srvPrinc);
if (!princ_s) {
2008-12-23 22:56:48 +03:00
ret = -1;
goto out;
}
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
} else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
/* It's the machine account, as used by smbclient clients. */
2010-08-18 12:33:32 +04:00
princ_s = talloc_asprintf(tmpctx, "%s@%s",
srvPrinc, lp_realm());
if (!princ_s) {
2008-12-23 22:56:48 +03:00
ret = -1;
goto out;
}
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
} else {
/* It's a normal service principal. Add the SPN now so that we
* can obtain credentials for it and double-check the salt value
* used to generate the service's keys. */
2010-08-18 12:33:32 +04:00
s3:libads: Allow 'net ads keytab add' handle Windows SPN(s) part 1 This patch addresses how the windows SPN is converted into a kerberos priniciple to be written to the keytab file. A followup patch will deal with writing Window SPN(s) to the AD. Before this change 'net ads keytab add' handled three scenarios a) 'net ads keytab add param' is passed a fully qualified kerberos principal (identified by the presence of '@' in param) In this scenario the keytab file alone is updated with the principal contained in 'param'. b) 'net ads keytab add param'; is passed a machine name (identified by the paramater ending with '$'). In this case the machine name is converted to a kerberos principal with according to the recipe 'param@realm' where realm is determined by lp_realm(). c) 'net ads keytab add param' is passed a service (e.g. nfs, http etc.) In this scenario the param containing the service is first converted to into 2 kerberos principals (long and short forms) according to the following recipe i) long form: 'param/fully_qualified_dns@realm' ii) short form: 'param/netbios_name@realm' where 'fully_qualified_dns is retrieved from 'dNSHostName' attribute of 'this' machines computer account on the AD. The principals are written to the keytab file Secondly 2 windows SPNs are generated from 'param' as follows i) long form 'param/full_qualified_dns' ii) short form 'param/netbios_name' These SPNs are written to the AD computer account object After this change a) & b) & c) will retain legacy behaviour except in the case of c) where if the 'param' passed to c) is a Windows SPN (e.g. conforming to format 'serviceclass/host:port' i) 'param' will get converted to a kerberos principal (just a single one) with the following recipe: 'serviceclass/host@realm' which will be written to the keytab file. The SPN written to the AD is created as before and the legacy behaviour is preserved. Signed-off-by: Noel Power <noel.power@suse.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-01-29 21:30:33 +03:00
if (!service_or_spn_to_kerberos_princ(tmpctx,
srvPrinc,
my_fqdn,
&princ_s,
&short_princ_s)) {
2008-12-23 22:56:48 +03:00
ret = -1;
goto out;
}
2010-08-18 12:33:32 +04:00
/* According to http://support.microsoft.com/kb/326985/en-us,
certain principal names are automatically mapped to the
host/... principal in the AD account.
So only create these in the keytab, not in AD. --jerry */
if (update_ads && !strequal(srvPrinc, "cifs") &&
2010-08-18 12:33:32 +04:00
!strequal(srvPrinc, "host")) {
if (!ads_set_machine_account_spns(tmpctx,
ads,
srvPrinc,
my_fqdn)) {
ret = -1;
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
goto out;
}
}
}
for (i = 0; enctypes[i]; i++) {
/* add the fqdn principal to the keytab */
ret = smb_krb5_kt_add_entry(context,
keytab,
kvno,
princ_s,
salt_princ_s,
enctypes[i],
password,
false); /* no_salt */
2010-08-18 12:33:32 +04:00
if (ret) {
DBG_WARNING("Failed to add entry to keytab\n");
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
goto out;
}
/* add the short principal name if we have one */
if (short_princ_s) {
ret = smb_krb5_kt_add_entry(context,
keytab,
kvno,
short_princ_s,
salt_princ_s,
enctypes[i],
password,
false); /* no_salt */
if (ret) {
DBG_WARNING("Failed to add short entry to keytab\n");
goto out;
}
}
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
}
out:
return ret;
}
/**********************************************************************
Adds a single service principal, i.e. 'host' to the system keytab
***********************************************************************/
int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc, bool update_ads)
{
krb5_error_code ret = 0;
krb5_context context = NULL;
krb5_keytab keytab = NULL;
krb5_data password;
krb5_kvno kvno;
char *salt_princ_s = NULL;
char *password_s = NULL;
char *my_fqdn;
TALLOC_CTX *tmpctx = NULL;
char **hostnames_array = NULL;
size_t num_hostnames = 0;
ret = smb_krb5_init_context_common(&context);
if (ret) {
DBG_ERR("kerberos init context failed (%s)\n",
error_message(ret));
return -1;
}
ret = ads_keytab_open(context, &keytab);
if (ret != 0) {
goto out;
}
/* retrieve the password */
if (!secrets_init()) {
DBG_WARNING("secrets_init failed\n");
ret = -1;
goto out;
}
password_s = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
if (!password_s) {
DBG_WARNING("failed to fetch machine password\n");
ret = -1;
goto out;
}
ZERO_STRUCT(password);
password.data = password_s;
password.length = strlen(password_s);
/* we need the dNSHostName value here */
tmpctx = talloc_init(__location__);
if (!tmpctx) {
DBG_ERR("talloc_init() failed!\n");
ret = -1;
goto out;
}
my_fqdn = ads_get_dnshostname(ads, tmpctx, lp_netbios_name());
if (!my_fqdn) {
DBG_ERR("unable to determine machine account's dns name in "
"AD!\n");
ret = -1;
goto out;
}
/* make sure we have a single instance of a the computer account */
if (!ads_has_samaccountname(ads, tmpctx, lp_netbios_name())) {
DBG_ERR("unable to determine machine account's short name in "
"AD!\n");
ret = -1;
goto out;
}
kvno = (krb5_kvno)ads_get_machine_kvno(ads, lp_netbios_name());
if (kvno == -1) {
/* -1 indicates failure, everything else is OK */
DBG_WARNING("ads_get_machine_kvno failed to determine the "
"system's kvno.\n");
ret = -1;
goto out;
}
salt_princ_s = kerberos_secrets_fetch_salt_princ();
if (salt_princ_s == NULL) {
DBG_WARNING("kerberos_secrets_fetch_salt_princ() failed\n");
ret = -1;
goto out;
}
ret = add_kt_entry_etypes(context, tmpctx, ads, salt_princ_s, keytab,
kvno, srvPrinc, my_fqdn, &password,
update_ads);
if (ret != 0) {
goto out;
}
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
if (ADS_ERR_OK(ads_get_additional_dns_hostnames(tmpctx, ads,
lp_netbios_name(),
&hostnames_array,
&num_hostnames))) {
size_t i;
for (i = 0; i < num_hostnames; i++) {
ret = add_kt_entry_etypes(context, tmpctx, ads,
salt_princ_s, keytab,
kvno, srvPrinc,
hostnames_array[i],
&password, update_ads);
if (ret != 0) {
goto out;
}
}
}
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
out:
SAFE_FREE(salt_princ_s);
2010-08-18 12:33:32 +04:00
TALLOC_FREE(tmpctx);
if (keytab) {
krb5_kt_close(context, keytab);
}
if (context) {
krb5_free_context(context);
}
return (int)ret;
}
/**********************************************************************
Delete a single service principal, i.e. 'host' from the system keytab
***********************************************************************/
int ads_keytab_delete_entry(ADS_STRUCT *ads, const char *srvPrinc)
{
TALLOC_CTX *frame = talloc_stackframe();
krb5_error_code ret = 0;
krb5_context context = NULL;
krb5_keytab keytab = NULL;
char *princ_s = NULL;
krb5_principal princ = NULL;
char *short_princ_s = NULL;
krb5_principal short_princ = NULL;
bool ok;
ret = smb_krb5_init_context_common(&context);
if (ret) {
DBG_ERR("kerberos init context failed (%s)\n",
error_message(ret));
goto out;
}
ret = ads_keytab_open(context, &keytab);
if (ret != 0) {
goto out;
}
/* Construct our principal */
if (strchr_m(srvPrinc, '@')) {
/* It's a fully-named principal. */
princ_s = talloc_asprintf(frame, "%s", srvPrinc);
if (!princ_s) {
ret = -1;
goto out;
}
} else if (srvPrinc[strlen(srvPrinc)-1] == '$') {
/* It's the machine account, as used by smbclient clients. */
princ_s = talloc_asprintf(frame, "%s@%s",
srvPrinc, lp_realm());
if (!princ_s) {
ret = -1;
goto out;
}
} else {
/*
* It's a normal service principal.
*/
char *my_fqdn = NULL;
char *tmp = NULL;
/*
* SPN should have '/' otherwise we
* need to fallback and find our dnshostname
*/
tmp = strchr_m(srvPrinc, '/');
if (tmp == NULL) {
my_fqdn = ads_get_dnshostname(ads, frame, lp_netbios_name());
if (!my_fqdn) {
DBG_ERR("unable to determine machine account's dns name in "
"AD!\n");
ret = -1;
goto out;
}
}
ok = service_or_spn_to_kerberos_princ(frame,
srvPrinc,
my_fqdn,
&princ_s,
&short_princ_s);
if (!ok) {
ret = -1;
goto out;
}
}
ret = smb_krb5_parse_name(context, princ_s, &princ);
if (ret) {
DEBUG(1, (__location__ ": smb_krb5_parse_name(%s) "
"failed (%s)\n", princ_s, error_message(ret)));
goto out;
}
if (short_princ_s != NULL) {
ret = smb_krb5_parse_name(context, short_princ_s, &short_princ);
if (ret) {
DEBUG(1, (__location__ ": smb_krb5_parse_name(%s) "
"failed (%s)\n", short_princ_s, error_message(ret)));
goto out;
}
}
/* Seek and delete old keytab entries */
ret = smb_krb5_kt_seek_and_delete_old_entries(context,
keytab,
false, /* keep_old_kvno */
-1,
false, /* enctype_only */
ENCTYPE_NULL,
princ_s,
princ,
false); /* flush */
if (ret) {
goto out;
}
if (short_princ_s == NULL) {
goto out;
}
/* Seek and delete old keytab entries */
ret = smb_krb5_kt_seek_and_delete_old_entries(context,
keytab,
false, /* keep_old_kvno */
-1,
false, /* enctype_only */
ENCTYPE_NULL,
short_princ_s,
short_princ,
false); /* flush */
if (ret) {
goto out;
}
out:
if (princ) {
krb5_free_principal(context, princ);
}
if (short_princ) {
krb5_free_principal(context, short_princ);
}
if (keytab) {
krb5_kt_close(context, keytab);
}
if (context) {
krb5_free_context(context);
}
TALLOC_FREE(frame);
return ret;
}
/**********************************************************************
Flushes all entries from the system keytab.
***********************************************************************/
int ads_keytab_flush(ADS_STRUCT *ads)
{
krb5_error_code ret = 0;
krb5_context context = NULL;
krb5_keytab keytab = NULL;
ADS_STATUS aderr;
ret = smb_krb5_init_context_common(&context);
if (ret) {
DBG_ERR("kerberos init context failed (%s)\n",
error_message(ret));
return ret;
}
ret = ads_keytab_open(context, &keytab);
if (ret != 0) {
goto out;
}
/* Seek and delete all old keytab entries */
ret = smb_krb5_kt_seek_and_delete_old_entries(context,
keytab,
false, /* keep_old_kvno */
-1,
false, /* enctype_only */
ENCTYPE_NULL,
NULL,
NULL,
true); /* flush */
if (ret) {
goto out;
}
aderr = ads_clear_service_principal_names(ads, lp_netbios_name());
if (!ADS_ERR_OK(aderr)) {
DEBUG(1, (__location__ ": Error while clearing service "
"principal listings in LDAP.\n"));
ret = -1;
goto out;
}
out:
if (keytab) {
krb5_kt_close(context, keytab);
}
if (context) {
krb5_free_context(context);
}
return ret;
}
/**********************************************************************
Adds all the required service principals to the system keytab.
***********************************************************************/
int ads_keytab_create_default(ADS_STRUCT *ads)
{
krb5_error_code ret = 0;
krb5_context context = NULL;
krb5_keytab keytab = NULL;
krb5_kt_cursor cursor = {0};
krb5_keytab_entry kt_entry = {0};
krb5_kvno kvno;
size_t found = 0;
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
char *sam_account_name, *upn;
char **oldEntries = NULL, *princ_s[26];
TALLOC_CTX *frame;
char *machine_name;
char **spn_array;
size_t num_spns;
size_t i;
bool ok = false;
ADS_STATUS status;
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
ZERO_STRUCT(kt_entry);
ZERO_STRUCT(cursor);
frame = talloc_stackframe();
if (frame == NULL) {
ret = -1;
goto done;
}
status = ads_get_service_principal_names(frame,
ads,
lp_netbios_name(),
&spn_array,
&num_spns);
if (!ADS_ERR_OK(status)) {
ret = -1;
goto done;
}
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
for (i = 0; i < num_spns; i++) {
char *srv_princ;
char *p;
srv_princ = strlower_talloc(frame, spn_array[i]);
if (srv_princ == NULL) {
ret = -1;
goto done;
}
p = strchr_m(srv_princ, '/');
if (p == NULL) {
continue;
}
p[0] = '\0';
/* Add the SPNs found on the DC */
ret = ads_keytab_add_entry(ads, srv_princ, false);
if (ret != 0) {
DEBUG(1, ("ads_keytab_add_entry failed while "
"adding '%s' principal.\n",
spn_array[i]));
goto done;
}
}
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
#if 0 /* don't create the CIFS/... keytab entries since no one except smbd
really needs them and we will fall back to verifying against
secrets.tdb */
ret = ads_keytab_add_entry(ads, "cifs", false));
if (ret != 0 ) {
DEBUG(1, (__location__ ": ads_keytab_add_entry failed while "
"adding 'cifs'.\n"));
return ret;
}
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
#endif
memset(princ_s, '\0', sizeof(princ_s));
ret = smb_krb5_init_context_common(&context);
if (ret) {
DBG_ERR("kerberos init context failed (%s)\n",
error_message(ret));
goto done;
}
machine_name = talloc_strdup(frame, lp_netbios_name());
if (!machine_name) {
ret = -1;
goto done;
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
}
/* now add the userPrincipalName and sAMAccountName entries */
ok = ads_has_samaccountname(ads, frame, machine_name);
if (!ok) {
DEBUG(0, (__location__ ": unable to determine machine "
"account's name in AD!\n"));
ret = -1;
goto done;
}
/*
* append '$' to netbios name so 'ads_keytab_add_entry' recognises
* it as a machine account rather than a service or Windows SPN.
*/
sam_account_name = talloc_asprintf(frame, "%s$",machine_name);
if (sam_account_name == NULL) {
ret = -1;
goto done;
}
/* upper case the sAMAccountName to make it easier for apps to
know what case to use in the keytab file */
if (!strupper_m(sam_account_name)) {
ret = -1;
goto done;
}
ret = ads_keytab_add_entry(ads, sam_account_name, false);
if (ret != 0) {
DEBUG(1, (__location__ ": ads_keytab_add_entry() failed "
"while adding sAMAccountName (%s)\n",
sam_account_name));
goto done;
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
}
r16952: New derive DES salt code and Krb5 keytab generation Major points of interest: * Figure the DES salt based on the domain functional level and UPN (if present and applicable) * Only deal with the DES-CBC-MD5, DES-CBC-CRC, and RC4-HMAC keys * Remove all the case permutations in the keytab entry generation (to be partially re-added only if necessary). * Generate keytab entries based on the existing SPN values in AD The resulting keytab looks like: ktutil: list -e slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 2 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 3 6 host/suse10.plainjoe.org@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 4 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 5 6 host/suse10@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 6 6 host/suse10@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) 7 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with CRC-32) 8 6 suse10$@COLOR.PLAINJOE.ORG (DES cbc mode with RSA-MD5) 9 6 suse10$@COLOR.PLAINJOE.ORG (ArcFour with HMAC/md5) The list entries are the two basic SPN values (host/NetBIOSName & host/dNSHostName) and the sAMAccountName value. The UPN will be added as well if the machine has one. This fixes 'kinit -k'. Tested keytab using mod_auth_krb and MIT's telnet. ads_verify_ticket() continues to work with RC4-HMAC and DES keys. (This used to be commit 6261dd3c67d10db6cfa2e77a8d304d3dce4050a4)
2006-07-11 22:45:22 +04:00
/* remember that not every machine account will have a upn */
upn = ads_get_upn(ads, frame, machine_name);
if (upn) {
ret = ads_keytab_add_entry(ads, upn, false);
if (ret != 0) {
DEBUG(1, (__location__ ": ads_keytab_add_entry() "
"failed while adding UPN (%s)\n", upn));
goto done;
}
}
/* Now loop through the keytab and update any other existing entries */
kvno = (krb5_kvno)ads_get_machine_kvno(ads, machine_name);
if (kvno == (krb5_kvno)-1) {
DEBUG(1, (__location__ ": ads_get_machine_kvno() failed to "
"determine the system's kvno.\n"));
goto done;
}
DEBUG(3, (__location__ ": Searching for keytab entries to preserve "
"and update.\n"));
ret = ads_keytab_open(context, &keytab);
if (ret != 0) {
goto done;
}
ret = krb5_kt_start_seq_get(context, keytab, &cursor);
if (ret != KRB5_KT_END && ret != ENOENT ) {
while ((ret = krb5_kt_next_entry(context, keytab,
&kt_entry, &cursor)) == 0) {
smb_krb5_kt_free_entry(context, &kt_entry);
ZERO_STRUCT(kt_entry);
found++;
}
}
krb5_kt_end_seq_get(context, keytab, &cursor);
ZERO_STRUCT(cursor);
/*
* Hmmm. There is no "rewind" function for the keytab. This means we
* have a race condition where someone else could add entries after
* we've counted them. Re-open asap to minimise the race. JRA.
*/
DEBUG(3, (__location__ ": Found %zd entries in the keytab.\n", found));
if (!found) {
goto done;
}
oldEntries = talloc_zero_array(frame, char *, found + 1);
if (!oldEntries) {
DEBUG(1, (__location__ ": Failed to allocate space to store "
"the old keytab entries (talloc failed?).\n"));
ret = -1;
goto done;
}
ret = krb5_kt_start_seq_get(context, keytab, &cursor);
if (ret == KRB5_KT_END || ret == ENOENT) {
krb5_kt_end_seq_get(context, keytab, &cursor);
ZERO_STRUCT(cursor);
goto done;
}
while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
if (kt_entry.vno != kvno) {
char *ktprinc = NULL;
char *p;
/* This returns a malloc'ed string in ktprinc. */
ret = smb_krb5_unparse_name(oldEntries, context,
kt_entry.principal,
&ktprinc);
if (ret) {
DEBUG(1, (__location__
": smb_krb5_unparse_name failed "
"(%s)\n", error_message(ret)));
goto done;
}
/*
* From looking at the krb5 source they don't seem to
* take locale or mb strings into account.
* Maybe this is because they assume utf8 ?
* In this case we may need to convert from utf8 to
* mb charset here ? JRA.
*/
p = strchr_m(ktprinc, '@');
if (p) {
*p = '\0';
}
p = strchr_m(ktprinc, '/');
if (p) {
*p = '\0';
}
for (i = 0; i < found; i++) {
if (!oldEntries[i]) {
oldEntries[i] = ktprinc;
break;
}
if (!strcmp(oldEntries[i], ktprinc)) {
TALLOC_FREE(ktprinc);
break;
}
}
if (i == found) {
TALLOC_FREE(ktprinc);
}
}
smb_krb5_kt_free_entry(context, &kt_entry);
ZERO_STRUCT(kt_entry);
}
krb5_kt_end_seq_get(context, keytab, &cursor);
ZERO_STRUCT(cursor);
ret = 0;
for (i = 0; oldEntries[i]; i++) {
ret |= ads_keytab_add_entry(ads, oldEntries[i], false);
TALLOC_FREE(oldEntries[i]);
}
done:
TALLOC_FREE(oldEntries);
TALLOC_FREE(frame);
if (context) {
if (!all_zero((uint8_t *)&kt_entry, sizeof(kt_entry))) {
smb_krb5_kt_free_entry(context, &kt_entry);
}
if (!all_zero((uint8_t *)&cursor, sizeof(cursor)) && keytab) {
krb5_kt_end_seq_get(context, keytab, &cursor);
}
if (keytab) {
krb5_kt_close(context, keytab);
}
krb5_free_context(context);
}
return ret;
}
#endif /* HAVE_ADS */
/**********************************************************************
List system keytab.
***********************************************************************/
int ads_keytab_list(const char *keytab_name)
{
krb5_error_code ret = 0;
krb5_context context = NULL;
krb5_keytab keytab = NULL;
krb5_kt_cursor cursor;
krb5_keytab_entry kt_entry;
ZERO_STRUCT(kt_entry);
ZERO_STRUCT(cursor);
ret = smb_krb5_init_context_common(&context);
if (ret) {
DBG_ERR("kerberos init context failed (%s)\n",
error_message(ret));
return ret;
}
if (keytab_name == NULL) {
#ifdef HAVE_ADS
ret = ads_keytab_open(context, &keytab);
#else
ret = ENOENT;
#endif
} else {
ret = smb_krb5_kt_open(context, keytab_name, False, &keytab);
}
if (ret) {
DEBUG(1, ("smb_krb5_kt_open failed (%s)\n",
2010-08-18 14:46:53 +04:00
error_message(ret)));
goto out;
}
ret = krb5_kt_start_seq_get(context, keytab, &cursor);
if (ret) {
ZERO_STRUCT(cursor);
goto out;
}
printf("Vno Type Principal\n");
while (krb5_kt_next_entry(context, keytab, &kt_entry, &cursor) == 0) {
2010-08-18 14:46:53 +04:00
char *princ_s = NULL;
char *etype_s = NULL;
krb5_enctype enctype = 0;
2010-08-18 14:46:53 +04:00
ret = smb_krb5_unparse_name(talloc_tos(), context,
kt_entry.principal, &princ_s);
if (ret) {
goto out;
}
enctype = smb_krb5_kt_get_enctype_from_entry(&kt_entry);
ret = smb_krb5_enctype_to_string(context, enctype, &etype_s);
2010-08-18 14:46:53 +04:00
if (ret &&
(asprintf(&etype_s, "UNKNOWN: %d", enctype) == -1)) {
2010-08-18 14:46:53 +04:00
TALLOC_FREE(princ_s);
goto out;
}
printf("%3d %-43s %s\n", kt_entry.vno, etype_s, princ_s);
TALLOC_FREE(princ_s);
SAFE_FREE(etype_s);
ret = smb_krb5_kt_free_entry(context, &kt_entry);
if (ret) {
goto out;
}
}
ret = krb5_kt_end_seq_get(context, keytab, &cursor);
if (ret) {
goto out;
}
/* Ensure we don't double free. */
ZERO_STRUCT(kt_entry);
ZERO_STRUCT(cursor);
out:
if (!all_zero((uint8_t *)&kt_entry, sizeof(kt_entry))) {
smb_krb5_kt_free_entry(context, &kt_entry);
}
if (!all_zero((uint8_t *)&cursor, sizeof(cursor)) && keytab) {
krb5_kt_end_seq_get(context, keytab, &cursor);
}
if (keytab) {
krb5_kt_close(context, keytab);
}
if (context) {
krb5_free_context(context);
}
return ret;
}
#endif /* HAVE_KRB5 */