1996-05-04 11:50:46 +04:00
/*
Unix SMB / Netbios implementation .
Version 1.9 .
Password and authentication handling
1998-01-22 16:27:43 +03:00
Copyright ( C ) Andrew Tridgell 1992 - 1998
1996-05-04 11:50:46 +04:00
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation ; either version 2 of the License , or
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
along with this program ; if not , write to the Free Software
Foundation , Inc . , 675 Mass Ave , Cambridge , MA 0213 9 , USA .
*/
# include "includes.h"
extern int DEBUGLEVEL ;
extern int Protocol ;
/* users from session setup */
static pstring session_users = " " ;
1998-09-26 01:01:52 +04:00
extern pstring scope ;
1998-04-25 05:12:08 +04:00
extern pstring global_myname ;
1998-04-29 04:02:57 +04:00
extern fstring global_myworkgroup ;
1998-04-23 22:54:57 +04:00
1996-05-04 11:50:46 +04:00
/* Data to do lanman1/2 password challenge. */
static unsigned char saved_challenge [ 8 ] ;
static BOOL challenge_sent = False ;
/*******************************************************************
Get the next challenge value - no repeats .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
void generate_next_challenge ( char * challenge )
{
1998-04-21 02:43:54 +04:00
#if 0
/*
* Leave this ifdef ' d out while we test
* the new crypto random number generator .
* JRA .
*/
1997-09-16 08:41:16 +04:00
unsigned char buf [ 16 ] ;
static int counter = 0 ;
struct timeval tval ;
int v1 , v2 ;
/* get a sort-of random number */
GetTimeOfDay ( & tval ) ;
v1 = ( counter + + ) + getpid ( ) + tval . tv_sec ;
v2 = ( counter + + ) * getpid ( ) + tval . tv_usec ;
SIVAL ( challenge , 0 , v1 ) ;
SIVAL ( challenge , 4 , v2 ) ;
/* mash it up with md4 */
1997-09-16 12:26:33 +04:00
mdfour ( buf , ( unsigned char * ) challenge , 8 ) ;
1998-04-21 02:43:54 +04:00
# else
unsigned char buf [ 8 ] ;
1997-09-16 08:41:16 +04:00
1998-04-21 02:43:54 +04:00
generate_random_buffer ( buf , 8 , False ) ;
# endif
1997-09-16 08:41:16 +04:00
memcpy ( saved_challenge , buf , 8 ) ;
memcpy ( challenge , buf , 8 ) ;
challenge_sent = True ;
1996-05-04 11:50:46 +04:00
}
/*******************************************************************
set the last challenge sent , usually from a password server
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-09-29 01:43:48 +04:00
BOOL set_challenge ( unsigned char * challenge )
1996-05-04 11:50:46 +04:00
{
memcpy ( saved_challenge , challenge , 8 ) ;
challenge_sent = True ;
return ( True ) ;
}
/*******************************************************************
get the last challenge sent
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-09-05 09:07:05 +04:00
static BOOL last_challenge ( unsigned char * challenge )
1996-05-04 11:50:46 +04:00
{
if ( ! challenge_sent ) return ( False ) ;
memcpy ( challenge , saved_challenge , 8 ) ;
return ( True ) ;
}
/* this holds info on user ids that are already validated for this VC */
static user_struct * validated_users = NULL ;
static int num_validated_users = 0 ;
/****************************************************************************
check if a uid has been validated , and return an pointer to the user_struct
1996-10-26 00:18:28 +04:00
if it has . NULL if not . vuid is biased by an offset . This allows us to
tell random client vuid ' s ( normally zero ) from valid vuids .
1996-05-04 11:50:46 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-26 00:18:28 +04:00
user_struct * get_valid_user_struct ( uint16 vuid )
1996-05-04 11:50:46 +04:00
{
1997-10-10 18:48:05 +04:00
if ( vuid = = UID_FIELD_INVALID )
1996-10-26 00:18:28 +04:00
return NULL ;
vuid - = VUID_OFFSET ;
1997-10-10 18:48:05 +04:00
if ( ( vuid > = ( uint16 ) num_validated_users ) | |
1998-09-30 00:24:17 +04:00
( validated_users [ vuid ] . uid = = ( uid_t ) - 1 ) | | ( validated_users [ vuid ] . gid = = ( gid_t ) - 1 ) )
1996-05-04 11:50:46 +04:00
return NULL ;
return & validated_users [ vuid ] ;
}
/****************************************************************************
invalidate a uid
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-26 00:18:28 +04:00
void invalidate_vuid ( uint16 vuid )
1996-05-04 11:50:46 +04:00
{
1996-10-26 00:18:28 +04:00
user_struct * vuser = get_valid_user_struct ( vuid ) ;
1997-10-10 18:48:05 +04:00
if ( vuser = = NULL ) return ;
1996-10-26 00:18:28 +04:00
1998-09-30 00:24:17 +04:00
vuser - > uid = ( uid_t ) - 1 ;
vuser - > gid = ( gid_t ) - 1 ;
1997-10-10 18:48:05 +04:00
vuser - > n_sids = 0 ;
1998-07-27 22:50:45 +04:00
/* same number of igroups as groups */
1997-10-10 18:48:05 +04:00
vuser - > n_groups = 0 ;
1998-09-30 00:24:17 +04:00
if ( vuser - > groups )
free ( ( char * ) vuser - > groups ) ;
1997-10-10 18:48:05 +04:00
1998-09-30 00:24:17 +04:00
if ( vuser - > sids )
free ( ( char * ) vuser - > sids ) ;
1997-10-10 18:48:05 +04:00
vuser - > sids = NULL ;
vuser - > groups = NULL ;
1996-05-04 11:50:46 +04:00
}
/****************************************************************************
return a validated username
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-26 00:18:28 +04:00
char * validated_username ( uint16 vuid )
1996-05-04 11:50:46 +04:00
{
1996-10-26 00:18:28 +04:00
user_struct * vuser = get_valid_user_struct ( vuid ) ;
1997-10-10 18:48:05 +04:00
if ( vuser = = NULL )
1996-10-26 00:18:28 +04:00
return 0 ;
return ( vuser - > name ) ;
1996-05-04 11:50:46 +04:00
}
1998-03-12 05:43:46 +03:00
1996-05-04 11:50:46 +04:00
/****************************************************************************
register a uid / name pair as being valid and that a valid password
1996-10-26 00:18:28 +04:00
has been given . vuid is biased by an offset . This allows us to
tell random client vuid ' s ( normally zero ) from valid vuids .
1996-05-04 11:50:46 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-09-30 00:24:17 +04:00
uint16 register_vuid ( uid_t uid , gid_t gid , char * unix_name , char * requested_name , BOOL guest )
1996-05-04 11:50:46 +04:00
{
user_struct * vuser ;
1997-05-07 21:56:46 +04:00
struct passwd * pwfile ; /* for getting real name from passwd file */
1998-03-16 21:31:09 +03:00
/* Ensure no vuid gets registered in share level security. */
if ( lp_security ( ) = = SEC_SHARE )
return UID_FIELD_INVALID ;
1997-07-22 23:04:40 +04:00
#if 0
/*
* After observing MS - Exchange services writing to a Samba share
1997-10-10 18:48:05 +04:00
* I belive this code is incorrect . Each service does its own
1997-07-22 23:04:40 +04:00
* sessionsetup_and_X for the same user , and as each service shuts
* down , it does a user_logoff_and_X . As we are consolidating multiple
* sessionsetup_and_X ' s onto the same vuid here , when the first service
* shuts down , it invalidates all the open files for the other services .
* Hence I am removing this code and forcing each sessionsetup_and_X
* to get a new vuid .
* Jeremy Allison . ( jallison @ whistle . com ) .
*/
1996-10-26 00:18:28 +04:00
int i ;
for ( i = 0 ; i < num_validated_users ; i + + ) {
vuser = & validated_users [ i ] ;
1997-10-10 18:48:05 +04:00
if ( vuser - > uid = = uid )
1997-06-18 05:04:57 +04:00
return ( uint16 ) ( i + VUID_OFFSET ) ; /* User already validated */
1996-10-26 00:18:28 +04:00
}
1997-07-22 23:04:40 +04:00
# endif
1996-05-04 11:50:46 +04:00
1996-10-26 00:18:28 +04:00
validated_users = ( user_struct * ) Realloc ( validated_users ,
sizeof ( user_struct ) *
( num_validated_users + 1 ) ) ;
1996-05-04 11:50:46 +04:00
if ( ! validated_users )
{
DEBUG ( 0 , ( " Failed to realloc users struct! \n " ) ) ;
1996-11-09 04:56:20 +03:00
num_validated_users = 0 ;
1996-10-26 00:18:28 +04:00
return UID_FIELD_INVALID ;
1996-05-04 11:50:46 +04:00
}
vuser = & validated_users [ num_validated_users ] ;
1996-10-26 00:18:28 +04:00
num_validated_users + + ;
1996-05-04 11:50:46 +04:00
vuser - > uid = uid ;
vuser - > gid = gid ;
vuser - > guest = guest ;
1998-05-06 05:34:51 +04:00
fstrcpy ( vuser - > name , unix_name ) ;
fstrcpy ( vuser - > requested_name , requested_name ) ;
1996-05-04 11:50:46 +04:00
1997-10-10 18:48:05 +04:00
vuser - > n_sids = 0 ;
vuser - > sids = NULL ;
vuser - > n_groups = 0 ;
vuser - > groups = NULL ;
1996-05-04 11:50:46 +04:00
/* Find all the groups this uid is in and store them.
Used by become_user ( ) */
- group database API. oops and oh dear, the threat has been carried out:
the pre-alpha "domain group" etc parameters have disappeared.
- interactive debug detection
- re-added mem_man (andrew's memory management, detects memory corruption)
- american spellings of "initialise" replaced with english spelling of
"initialise".
- started on "lookup_name()" and "lookup_sid()" functions. proper ones.
- moved lots of functions around. created some modules of commonly used
code. e.g the password file locking code, which is used in groupfile.c
and aliasfile.c and smbpass.c
- moved RID_TYPE_MASK up another bit. this is really unfortunate, but
there is no other "fast" way to identify users from groups from aliases.
i do not believe that this code saves us anything (the multipliers)
and puts us at a disadvantage (reduces the useable rid space).
the designers of NT aren't silly: if they can get away with a user-
interface-speed LsaLookupNames / LsaLookupSids, then so can we. i
spoke with isaac at the cifs conference, the only time for example that
they do a security context check is on file create. certainly not on
individual file reads / writes, which would drastically hit their
performance and ours, too.
- renamed myworkgroup to global_sam_name, amongst other things, when used
in the rpc code. there is also a global_member_name, as we are always
responsible for a SAM database, the scope of which is limited by the role
of the machine (e.g if a member of a workgroup, your SAM is for _local_
logins only, and its name is the name of your server. you even still
have a SID. see LsaQueryInfoPolicy, levels 3 and 5).
- updated functionality of groupname.c to be able to cope with names
like DOMAIN\group and SERVER\alias. used this code to be able to
do aliases as well as groups. this code may actually be better
off being used in username mapping, too.
- created a connect to serverlist function in clientgen.c and used it
in password.c
- initialisation in server.c depends on the role of the server. well,
it does now.
- rpctorture. smbtorture. EXERCISE EXTREME CAUTION.
(This used to be commit 0d21e1e6090b933f396c764af535ca3388a562db)
1998-11-17 19:19:04 +03:00
get_unixgroups ( unix_name , uid , gid ,
1997-10-10 18:48:05 +04:00
& vuser - > n_groups ,
1998-07-27 22:50:45 +04:00
& vuser - > groups ) ;
1996-05-04 11:50:46 +04:00
1998-09-30 00:24:17 +04:00
DEBUG ( 3 , ( " uid %d registered to name %s \n " , ( int ) uid , unix_name ) ) ;
1996-10-26 00:18:28 +04:00
1997-05-07 21:56:46 +04:00
DEBUG ( 3 , ( " Clearing default real name \n " ) ) ;
1997-10-10 18:48:05 +04:00
fstrcpy ( vuser - > real_name , " <Full Name> \0 " ) ;
1997-05-07 21:56:46 +04:00
if ( lp_unix_realname ( ) ) {
1997-10-10 18:48:05 +04:00
if ( ( pwfile = getpwnam ( vuser - > name ) ) ! = NULL )
1997-07-28 22:59:57 +04:00
{
DEBUG ( 3 , ( " User name: %s \t Real name: %s \n " , vuser - > name , pwfile - > pw_gecos ) ) ;
1997-10-10 18:48:05 +04:00
fstrcpy ( vuser - > real_name , pwfile - > pw_gecos ) ;
1997-07-28 22:59:57 +04:00
}
1997-05-07 21:56:46 +04:00
}
1996-10-26 00:18:28 +04:00
return ( uint16 ) ( ( num_validated_users - 1 ) + VUID_OFFSET ) ;
1996-05-04 11:50:46 +04:00
}
/****************************************************************************
add a name to the session users list
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
void add_session_user ( char * user )
{
fstring suser ;
StrnCpy ( suser , user , sizeof ( suser ) - 1 ) ;
if ( ! Get_Pwnam ( suser , True ) ) return ;
if ( suser & & * suser & & ! in_list ( suser , session_users , False ) )
{
if ( strlen ( suser ) + strlen ( session_users ) + 2 > = sizeof ( pstring ) )
DEBUG ( 1 , ( " Too many session users?? \n " ) ) ;
else
{
1998-05-12 04:55:32 +04:00
pstrcat ( session_users , " " ) ;
pstrcat ( session_users , suser ) ;
1996-05-04 11:50:46 +04:00
}
}
}
1998-04-30 05:39:22 +04:00
/****************************************************************************
update the encrypted smbpasswd file from the plaintext username and password
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-09-05 09:07:05 +04:00
static BOOL update_smbpassword_file ( char * user , char * password )
1997-07-18 00:11:58 +04:00
{
1998-08-10 11:04:53 +04:00
struct smb_passwd * smbpw ;
BOOL ret ;
1997-07-18 00:11:58 +04:00
1998-08-10 11:04:53 +04:00
become_root ( 0 ) ;
smbpw = getsmbpwnam ( user ) ;
unbecome_root ( 0 ) ;
1997-07-18 00:11:58 +04:00
1998-08-10 11:04:53 +04:00
if ( smbpw = = NULL ) {
DEBUG ( 0 , ( " getsmbpwnam returned NULL \n " ) ) ;
return False ;
1997-07-18 00:11:58 +04:00
}
1998-08-10 11:04:53 +04:00
/* Here, the flag is one, because we want to ignore the
XXXXXXX ' d out password */
ret = change_oem_password ( smbpw , password , True ) ;
if ( ret = = False ) {
DEBUG ( 3 , ( " change_oem_password returned False \n " ) ) ;
1997-07-18 00:11:58 +04:00
}
1998-08-10 11:04:53 +04:00
return ret ;
1996-05-04 11:50:46 +04:00
}
1998-02-27 01:58:21 +03:00
1996-05-04 11:50:46 +04:00
1997-12-03 02:27:40 +03:00
1996-05-04 11:50:46 +04:00
/****************************************************************************
core of smb password checking routine .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL smb_password_check ( char * password , unsigned char * part_passwd , unsigned char * c8 )
{
/* Finish the encryption of part_passwd. */
unsigned char p21 [ 21 ] ;
unsigned char p24 [ 24 ] ;
1997-10-10 18:48:05 +04:00
if ( part_passwd = = NULL )
1996-05-04 11:50:46 +04:00
DEBUG ( 10 , ( " No password set - allowing access \n " ) ) ;
/* No password set - always true ! */
1997-10-10 18:48:05 +04:00
if ( part_passwd = = NULL )
1996-05-04 11:50:46 +04:00
return 1 ;
memset ( p21 , ' \0 ' , 21 ) ;
memcpy ( p21 , part_passwd , 16 ) ;
E_P24 ( p21 , c8 , p24 ) ;
# if DEBUG_PASSWORD
{
int i ;
DEBUG ( 100 , ( " Part password (P16) was | " ) ) ;
for ( i = 0 ; i < 16 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) part_passwd [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
DEBUG ( 100 , ( " Password from client was | " ) ) ;
for ( i = 0 ; i < 24 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) password [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
DEBUG ( 100 , ( " Given challenge was | " ) ) ;
for ( i = 0 ; i < 8 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) c8 [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
DEBUG ( 100 , ( " Value from encryption was | " ) ) ;
for ( i = 0 ; i < 24 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) p24 [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
}
# endif
return ( memcmp ( p24 , password , 24 ) = = 0 ) ;
}
1998-03-12 00:11:04 +03:00
/****************************************************************************
Do a specific test for an smb password being correct , given a smb_password and
the lanman and NT responses .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-10-19 21:32:10 +04:00
BOOL smb_password_ok ( struct smb_passwd * smb_pass , uchar chal [ 8 ] ,
1998-03-12 00:11:04 +03:00
uchar lm_pass [ 24 ] , uchar nt_pass [ 24 ] )
{
1998-08-10 11:04:53 +04:00
uchar challenge [ 8 ] ;
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
if ( ! lm_pass | | ! smb_pass ) return ( False ) ;
1998-03-12 00:11:04 +03:00
1998-10-15 04:55:17 +04:00
DEBUG ( 4 , ( " Checking SMB password for user %s \n " ,
1998-11-29 23:03:33 +03:00
smb_pass - > unix_name ) ) ;
1998-10-15 04:55:17 +04:00
1998-08-10 11:04:53 +04:00
if ( smb_pass - > acct_ctrl & ACB_DISABLED ) {
DEBUG ( 3 , ( " account for user %s was disabled. \n " ,
1998-11-29 23:03:33 +03:00
smb_pass - > unix_name ) ) ;
1998-08-10 11:04:53 +04:00
return ( False ) ;
}
1998-03-12 00:11:04 +03:00
1998-10-19 21:32:10 +04:00
if ( chal = = NULL )
{
DEBUG ( 5 , ( " use last SMBnegprot challenge \n " ) ) ;
if ( ! last_challenge ( challenge ) )
{
DEBUG ( 1 , ( " no challenge done - password failed \n " ) ) ;
return False ;
}
}
else
{
DEBUG ( 5 , ( " challenge received \n " ) ) ;
memcpy ( challenge , chal , 8 ) ;
1998-08-10 11:04:53 +04:00
}
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
if ( ( Protocol > = PROTOCOL_NT1 ) & & ( smb_pass - > smb_nt_passwd ! = NULL ) ) {
/* We have the NT MD4 hash challenge available - see if we can
use it ( ie . does it exist in the smbpasswd file ) .
*/
DEBUG ( 4 , ( " smb_password_ok: Checking NT MD4 password \n " ) ) ;
if ( smb_password_check ( ( char * ) nt_pass ,
( uchar * ) smb_pass - > smb_nt_passwd ,
challenge ) ) {
DEBUG ( 4 , ( " NT MD4 password check succeeded \n " ) ) ;
return ( True ) ;
}
DEBUG ( 4 , ( " NT MD4 password check failed \n " ) ) ;
}
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
/* Try against the lanman password. smb_pass->smb_passwd == NULL means
no password , allow access . */
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
DEBUG ( 4 , ( " Checking LM MD4 password \n " ) ) ;
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
if ( ( smb_pass - > smb_passwd = = NULL ) & &
( smb_pass - > acct_ctrl & ACB_PWNOTREQ ) ) {
DEBUG ( 4 , ( " no password required for user %s \n " ,
1998-11-29 23:03:33 +03:00
smb_pass - > unix_name ) ) ;
1998-08-10 11:04:53 +04:00
return True ;
}
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
if ( ( smb_pass - > smb_passwd ! = NULL ) & &
smb_password_check ( ( char * ) lm_pass ,
( uchar * ) smb_pass - > smb_passwd , challenge ) ) {
DEBUG ( 4 , ( " LM MD4 password check succeeded \n " ) ) ;
return ( True ) ;
}
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
DEBUG ( 4 , ( " LM MD4 password check failed \n " ) ) ;
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
return False ;
1998-03-12 00:11:04 +03:00
}
1998-08-10 11:04:53 +04:00
1996-05-04 11:50:46 +04:00
/****************************************************************************
1998-08-10 11:04:53 +04:00
check if a username / password is OK assuming the password is a 24 byte
SMB hash
return True if the password is correct , False otherwise
1996-05-04 11:50:46 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-10-21 20:58:34 +04:00
1998-10-17 01:36:19 +04:00
BOOL pass_check_smb ( char * user , char * domain ,
1998-10-21 20:58:34 +04:00
uchar * chal , uchar * lm_pwd , uchar * nt_pwd ,
1998-10-17 01:36:19 +04:00
struct passwd * pwd )
1996-05-04 11:50:46 +04:00
{
1998-08-10 11:04:53 +04:00
struct passwd * pass ;
struct smb_passwd * smb_pass ;
1996-05-04 11:50:46 +04:00
1998-10-17 01:36:19 +04:00
if ( ! lm_pwd | | ! nt_pwd )
{
1998-08-10 11:04:53 +04:00
return ( False ) ;
}
1996-05-04 11:50:46 +04:00
1998-10-17 01:36:19 +04:00
if ( pwd ! = NULL & & user = = NULL )
{
1998-08-10 11:04:53 +04:00
pass = ( struct passwd * ) pwd ;
user = pass - > pw_name ;
1998-10-17 01:36:19 +04:00
}
else
{
1998-08-10 11:04:53 +04:00
pass = Get_Pwnam ( user , True ) ;
}
1998-04-14 04:41:59 +04:00
1998-10-17 01:41:42 +04:00
if ( pass = = NULL )
1998-10-17 01:36:19 +04:00
{
1998-10-14 10:29:20 +04:00
DEBUG ( 3 , ( " Couldn't find user %s \n " , user ) ) ;
1998-08-10 11:04:53 +04:00
return ( False ) ;
1996-05-04 11:50:46 +04:00
}
1998-08-10 11:04:53 +04:00
smb_pass = getsmbpwnam ( user ) ;
1998-03-12 00:11:04 +03:00
1998-10-17 01:41:42 +04:00
if ( smb_pass = = NULL )
1998-10-17 01:36:19 +04:00
{
1998-10-14 10:29:20 +04:00
DEBUG ( 3 , ( " Couldn't find user %s in smb_passwd file. \n " , user ) ) ;
1998-08-10 11:04:53 +04:00
return ( False ) ;
1996-05-04 11:50:46 +04:00
}
1998-08-10 11:04:53 +04:00
/* Quit if the account was disabled. */
if ( smb_pass - > acct_ctrl & ACB_DISABLED ) {
1998-10-14 10:29:20 +04:00
DEBUG ( 3 , ( " account for user %s was disabled. \n " , user ) ) ;
1998-08-10 11:04:53 +04:00
return ( False ) ;
1998-03-12 00:11:04 +03:00
}
1996-05-04 11:50:46 +04:00
1998-08-10 11:04:53 +04:00
/* Ensure the uid's match */
1998-11-29 23:03:33 +03:00
if ( smb_pass - > unix_uid ! = pass - > pw_uid )
1998-10-17 01:36:19 +04:00
{
1998-10-14 10:29:20 +04:00
DEBUG ( 3 , ( " Error : UNIX and SMB uids in password files do not match ! \n " ) ) ;
1998-08-10 11:04:53 +04:00
return ( False ) ;
}
1996-05-04 11:50:46 +04:00
1998-10-17 01:36:19 +04:00
if ( lm_pwd [ 0 ] = = ' \0 ' & & IS_BITS_SET_ALL ( smb_pass - > acct_ctrl , ACB_PWNOTREQ ) & & lp_null_passwords ( ) )
{
1998-11-29 23:03:33 +03:00
DEBUG ( 3 , ( " account for user %s has no password and null passwords are allowed. \n " , smb_pass - > unix_name ) ) ;
1998-10-15 04:55:17 +04:00
return ( True ) ;
}
1998-10-21 20:58:34 +04:00
if ( smb_password_ok ( smb_pass , chal , lm_pwd , nt_pwd ) )
1998-10-17 01:36:19 +04:00
{
1998-08-10 11:04:53 +04:00
return ( True ) ;
}
DEBUG ( 3 , ( " Error smb_password_check failed \n " ) ) ;
return False ;
1996-05-04 11:50:46 +04:00
}
1998-08-10 11:04:53 +04:00
/****************************************************************************
check if a username / password pair is OK either via the system password
database or the encrypted SMB password database
return True if the password is correct , False otherwise
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-10-17 01:36:19 +04:00
BOOL password_ok ( char * user , char * password , int pwlen , struct passwd * pwd )
1998-08-10 11:04:53 +04:00
{
1998-10-17 01:36:19 +04:00
if ( pwlen = = 24 | | ( lp_encrypted_passwords ( ) & & ( pwlen = = 0 ) & & lp_null_passwords ( ) ) )
{
/* if 24 bytes long assume it is an encrypted password */
uchar challenge [ 8 ] ;
if ( ! last_challenge ( challenge ) )
{
DEBUG ( 0 , ( " Error: challenge not done for user=%s \n " , user ) ) ;
return False ;
}
return pass_check_smb ( user , global_myworkgroup ,
1998-10-21 20:58:34 +04:00
challenge , ( uchar * ) password , ( uchar * ) password , pwd ) ;
1998-08-10 11:04:53 +04:00
}
return pass_check ( user , password , pwlen , pwd ,
lp_update_encrypted ( ) ?
update_smbpassword_file : NULL ) ;
}
1996-05-04 11:50:46 +04:00
/****************************************************************************
check if a username is valid
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL user_ok ( char * user , int snum )
{
1998-08-10 11:04:53 +04:00
pstring valid , invalid ;
BOOL ret ;
1996-05-04 11:50:46 +04:00
1998-08-10 11:04:53 +04:00
StrnCpy ( valid , lp_valid_users ( snum ) , sizeof ( pstring ) ) ;
StrnCpy ( invalid , lp_invalid_users ( snum ) , sizeof ( pstring ) ) ;
1996-05-04 11:50:46 +04:00
1998-08-10 11:04:53 +04:00
string_sub ( valid , " %S " , lp_servicename ( snum ) ) ;
string_sub ( invalid , " %S " , lp_servicename ( snum ) ) ;
ret = ! user_in_list ( user , invalid ) ;
if ( ret & & valid & & * valid ) {
ret = user_in_list ( user , valid ) ;
}
1996-05-04 11:50:46 +04:00
1998-08-10 11:04:53 +04:00
if ( ret & & lp_onlyuser ( snum ) ) {
char * user_list = lp_username ( snum ) ;
string_sub ( user_list , " %S " , lp_servicename ( snum ) ) ;
ret = user_in_list ( user , user_list ) ;
}
1996-05-04 11:50:46 +04:00
1998-08-10 11:04:53 +04:00
return ( ret ) ;
1996-05-04 11:50:46 +04:00
}
/****************************************************************************
validate a group username entry . Return the username or NULL
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static char * validate_group ( char * group , char * password , int pwlen , int snum )
{
1998-11-29 23:03:33 +03:00
# if defined(HAVE_NETGROUP) && defined(HAVE_GETNETGRENT) && defined(HAVE_SETNETGRENT) && defined(HAVE_ENDNETGRENT)
1996-05-04 11:50:46 +04:00
{
char * host , * user , * domain ;
setnetgrent ( group ) ;
while ( getnetgrent ( & host , & user , & domain ) ) {
if ( user ) {
if ( user_ok ( user , snum ) & &
1996-10-02 18:06:17 +04:00
password_ok ( user , password , pwlen , NULL ) ) {
1996-05-04 11:50:46 +04:00
endnetgrent ( ) ;
return ( user ) ;
}
}
}
endnetgrent ( ) ;
}
# endif
1998-07-29 07:08:05 +04:00
# ifdef HAVE_GETGRNAM
1996-05-04 11:50:46 +04:00
{
struct group * gptr = ( struct group * ) getgrnam ( group ) ;
char * * member ;
if ( gptr )
{
member = gptr - > gr_mem ;
while ( member & & * member )
{
static fstring name ;
1998-05-12 04:55:32 +04:00
fstrcpy ( name , * member ) ;
1996-05-04 11:50:46 +04:00
if ( user_ok ( name , snum ) & &
1996-10-02 18:06:17 +04:00
password_ok ( name , password , pwlen , NULL ) )
1996-05-04 11:50:46 +04:00
return ( & name [ 0 ] ) ;
member + + ;
}
# ifdef GROUP_CHECK_PWENT
{
struct passwd * pwd ;
static fstring tm ;
setpwent ( ) ;
while ( pwd = getpwent ( ) ) {
if ( * ( pwd - > pw_passwd ) & & pwd - > pw_gid = = gptr - > gr_gid ) {
/* This Entry have PASSWORD and same GID then check pwd */
1996-10-02 18:06:17 +04:00
if ( password_ok ( NULL , password , pwlen , pwd ) ) {
1998-05-12 04:55:32 +04:00
fstrcpy ( tm , pwd - > pw_name ) ;
1996-05-04 11:50:46 +04:00
endpwent ( ) ;
return tm ;
}
}
}
endpwent ( ) ;
}
# endif /* GROUP_CHECK_PWENT */
}
}
# endif
return ( NULL ) ;
}
/****************************************************************************
check for authority to login to a service with a given username / password
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL authorise_login ( int snum , char * user , char * password , int pwlen ,
1996-10-26 00:18:28 +04:00
BOOL * guest , BOOL * force , uint16 vuid )
1996-05-04 11:50:46 +04:00
{
BOOL ok = False ;
* guest = False ;
# if DEBUG_PASSWORD
DEBUG ( 100 , ( " checking authorisation on user=%s pass=%s \n " , user , password ) ) ;
# endif
1997-08-11 22:06:44 +04:00
/* there are several possibilities:
1996-05-04 11:50:46 +04:00
1 ) login as the given user with given password
2 ) login as a previously registered username with the given password
3 ) login as a session list username with the given password
4 ) login as a previously validated user / password pair
5 ) login as the " user = " user with given password
6 ) login as the " user = " user with no password ( guest connection )
7 ) login as guest user with no password
if the service is guest_only then steps 1 to 5 are skipped
*/
if ( GUEST_ONLY ( snum ) ) * force = True ;
if ( ! ( GUEST_ONLY ( snum ) & & GUEST_OK ( snum ) ) )
{
1996-10-26 00:18:28 +04:00
user_struct * vuser = get_valid_user_struct ( vuid ) ;
1996-05-04 11:50:46 +04:00
/* check the given username and password */
if ( ! ok & & ( * user ) & & user_ok ( user , snum ) ) {
1996-10-02 18:06:17 +04:00
ok = password_ok ( user , password , pwlen , NULL ) ;
1996-05-04 11:50:46 +04:00
if ( ok ) DEBUG ( 3 , ( " ACCEPTED: given username password ok \n " ) ) ;
}
/* check for a previously registered guest username */
1996-10-26 00:18:28 +04:00
if ( ! ok & & ( vuser ! = 0 ) & & vuser - > guest ) {
if ( user_ok ( vuser - > name , snum ) & &
password_ok ( vuser - > name , password , pwlen , NULL ) ) {
1998-05-12 04:55:32 +04:00
fstrcpy ( user , vuser - > name ) ;
1996-10-26 00:18:28 +04:00
vuser - > guest = False ;
1996-05-04 11:50:46 +04:00
DEBUG ( 3 , ( " ACCEPTED: given password with registered user %s \n " , user ) ) ;
ok = True ;
}
}
/* now check the list of session users */
1998-05-22 03:59:04 +04:00
if ( ! ok )
{
char * auser ;
char * user_list = strdup ( session_users ) ;
if ( ! user_list ) return ( False ) ;
1996-05-04 11:50:46 +04:00
1998-05-22 03:59:04 +04:00
for ( auser = strtok ( user_list , LIST_SEP ) ;
! ok & & auser ;
auser = strtok ( NULL , LIST_SEP ) )
{
fstring user2 ;
fstrcpy ( user2 , auser ) ;
if ( ! user_ok ( user2 , snum ) ) continue ;
if ( password_ok ( user2 , password , pwlen , NULL ) ) {
ok = True ;
fstrcpy ( user , user2 ) ;
DEBUG ( 3 , ( " ACCEPTED: session list username and given password ok \n " ) ) ;
}
1996-05-04 11:50:46 +04:00
}
1998-05-22 03:59:04 +04:00
free ( user_list ) ;
}
/* check for a previously validated username/password pair */
if ( ! ok & & ( ! lp_revalidate ( snum ) | | lp_security ( ) > SEC_SHARE ) & &
( vuser ! = 0 ) & & ! vuser - > guest & &
user_ok ( vuser - > name , snum ) ) {
fstrcpy ( user , vuser - > name ) ;
* guest = False ;
DEBUG ( 3 , ( " ACCEPTED: validated uid ok as non-guest \n " ) ) ;
ok = True ;
}
1996-05-04 11:50:46 +04:00
/* check for a rhosts entry */
if ( ! ok & & user_ok ( user , snum ) & & check_hosts_equiv ( user ) ) {
ok = True ;
DEBUG ( 3 , ( " ACCEPTED: hosts equiv or rhosts entry \n " ) ) ;
}
/* check the user= fields and the given password */
if ( ! ok & & lp_username ( snum ) ) {
char * auser ;
pstring user_list ;
StrnCpy ( user_list , lp_username ( snum ) , sizeof ( pstring ) ) ;
string_sub ( user_list , " %S " , lp_servicename ( snum ) ) ;
for ( auser = strtok ( user_list , LIST_SEP ) ;
auser & & ! ok ;
auser = strtok ( NULL , LIST_SEP ) )
{
if ( * auser = = ' @ ' )
{
auser = validate_group ( auser + 1 , password , pwlen , snum ) ;
if ( auser )
{
ok = True ;
1998-05-12 04:55:32 +04:00
fstrcpy ( user , auser ) ;
1996-05-04 11:50:46 +04:00
DEBUG ( 3 , ( " ACCEPTED: group username and given password ok \n " ) ) ;
}
}
else
{
fstring user2 ;
1998-05-12 04:55:32 +04:00
fstrcpy ( user2 , auser ) ;
1996-05-04 11:50:46 +04:00
if ( user_ok ( user2 , snum ) & &
1996-10-02 18:06:17 +04:00
password_ok ( user2 , password , pwlen , NULL ) )
1996-05-04 11:50:46 +04:00
{
ok = True ;
1998-05-12 04:55:32 +04:00
fstrcpy ( user , user2 ) ;
1996-05-04 11:50:46 +04:00
DEBUG ( 3 , ( " ACCEPTED: user list username and given password ok \n " ) ) ;
}
}
}
}
} /* not guest only */
/* check for a normal guest connection */
if ( ! ok & & GUEST_OK ( snum ) )
{
fstring guestname ;
StrnCpy ( guestname , lp_guestaccount ( snum ) , sizeof ( guestname ) - 1 ) ;
if ( Get_Pwnam ( guestname , True ) )
{
1998-05-12 04:55:32 +04:00
fstrcpy ( user , guestname ) ;
1996-05-04 11:50:46 +04:00
ok = True ;
DEBUG ( 3 , ( " ACCEPTED: guest account and guest ok \n " ) ) ;
}
else
DEBUG ( 0 , ( " Invalid guest account %s?? \n " , guestname ) ) ;
* guest = True ;
* force = True ;
}
if ( ok & & ! user_ok ( user , snum ) )
{
DEBUG ( 0 , ( " rejected invalid user %s \n " , user ) ) ;
ok = False ;
}
return ( ok ) ;
}
/****************************************************************************
read the a hosts . equiv or . rhosts file and check if it
allows this user from this machine
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static BOOL check_user_equiv ( char * user , char * remote , char * equiv_file )
{
pstring buf ;
int plus_allowed = 1 ;
char * file_host ;
char * file_user ;
1998-11-17 23:50:07 +03:00
FILE * fp = sys_fopen ( equiv_file , " r " ) ;
1996-05-04 11:50:46 +04:00
DEBUG ( 5 , ( " check_user_equiv %s %s %s \n " , user , remote , equiv_file ) ) ;
if ( ! fp ) return False ;
while ( fgets ( buf , sizeof ( buf ) , fp ) )
{
trim_string ( buf , " " , " " ) ;
if ( buf [ 0 ] ! = ' # ' & & buf [ 0 ] ! = ' \n ' )
{
BOOL is_group = False ;
int plus = 1 ;
char * bp = buf ;
if ( strcmp ( buf , " NO_PLUS \n " ) = = 0 )
{
DEBUG ( 6 , ( " check_user_equiv NO_PLUS \n " ) ) ;
plus_allowed = 0 ;
}
else {
if ( buf [ 0 ] = = ' + ' )
{
bp + + ;
if ( * bp = = ' \n ' & & plus_allowed )
{
/* a bare plus means everbody allowed */
DEBUG ( 6 , ( " check_user_equiv everybody allowed \n " ) ) ;
fclose ( fp ) ;
return True ;
}
}
else if ( buf [ 0 ] = = ' - ' )
{
bp + + ;
plus = 0 ;
}
if ( * bp = = ' @ ' )
{
is_group = True ;
bp + + ;
}
file_host = strtok ( bp , " \t \n " ) ;
file_user = strtok ( NULL , " \t \n " ) ;
1997-07-18 00:11:58 +04:00
DEBUG ( 7 , ( " check_user_equiv %s %s \n " , file_host ? file_host : " (null) " ,
file_user ? file_user : " (null) " ) ) ;
1996-05-04 11:50:46 +04:00
if ( file_host & & * file_host )
{
BOOL host_ok = False ;
1998-08-15 05:19:26 +04:00
# if defined(HAVE_NETGROUP) && defined(HAVE_YP_GET_DEFAULT_DOMAIN)
1996-05-04 11:50:46 +04:00
if ( is_group )
{
static char * mydomain = NULL ;
if ( ! mydomain )
yp_get_default_domain ( & mydomain ) ;
1996-05-04 14:45:50 +04:00
if ( mydomain & & innetgr ( file_host , remote , user , mydomain ) )
1996-05-04 11:50:46 +04:00
host_ok = True ;
}
# else
if ( is_group )
{
1998-07-29 07:08:05 +04:00
DEBUG ( 1 , ( " Netgroups not configured \n " ) ) ;
1996-05-04 11:50:46 +04:00
continue ;
}
# endif
/* is it this host */
/* the fact that remote has come from a call of gethostbyaddr
* means that it may have the fully qualified domain name
* so we could look up the file version to get it into
* a canonical form , but I would rather just type it
* in full in the equiv file
*/
if ( ! host_ok & & ! is_group & & strequal ( remote , file_host ) )
host_ok = True ;
if ( ! host_ok )
continue ;
/* is it this user */
if ( file_user = = 0 | | strequal ( user , file_user ) )
{
fclose ( fp ) ;
DEBUG ( 5 , ( " check_user_equiv matched %s%s %s \n " ,
( plus ? " + " : " - " ) , file_host ,
( file_user ? file_user : " " ) ) ) ;
return ( plus ? True : False ) ;
}
}
}
}
}
fclose ( fp ) ;
return False ;
}
/****************************************************************************
check for a possible hosts equiv or rhosts entry for the user
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL check_hosts_equiv ( char * user )
{
char * fname = NULL ;
pstring rhostsfile ;
struct passwd * pass = Get_Pwnam ( user , True ) ;
if ( ! pass )
return ( False ) ;
fname = lp_hosts_equiv ( ) ;
/* note: don't allow hosts.equiv on root */
1998-03-17 15:31:43 +03:00
if ( fname & & * fname & & ( pass - > pw_uid ! = 0 ) ) {
extern int Client ;
if ( check_user_equiv ( user , client_name ( Client ) , fname ) )
return ( True ) ;
}
1996-05-04 11:50:46 +04:00
if ( lp_use_rhosts ( ) )
{
char * home = get_home_dir ( user ) ;
1998-03-17 15:31:43 +03:00
if ( home ) {
extern int Client ;
1998-05-11 10:38:36 +04:00
slprintf ( rhostsfile , sizeof ( rhostsfile ) - 1 , " %s/.rhosts " , home ) ;
1998-03-17 15:31:43 +03:00
if ( check_user_equiv ( user , client_name ( Client ) , rhostsfile ) )
return ( True ) ;
}
1996-05-04 11:50:46 +04:00
}
return ( False ) ;
}
1997-11-10 22:23:17 +03:00
/****************************************************************************
return the client state structure
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
struct cli_state * server_client ( void )
{
1998-10-06 20:25:24 +04:00
static struct cli_state pw_cli ;
1998-04-24 00:12:17 +04:00
return & pw_cli ;
1997-11-10 22:23:17 +03:00
}
/****************************************************************************
support for server level security
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
struct cli_state * server_cryptkey ( void )
{
1998-12-15 00:22:59 +03:00
if ( cli_connect_serverlist ( server_client ( ) , lp_passwordserver ( ) ) )
{
return server_client ( ) ;
1997-11-10 22:23:17 +03:00
}
1998-12-15 00:22:59 +03:00
return NULL ;
1997-11-10 22:23:17 +03:00
}
/****************************************************************************
validate a password with the password server
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL server_validate ( char * user , char * domain ,
char * pass , int passlen ,
char * ntpass , int ntpasslen )
{
1998-11-07 08:32:37 +03:00
struct cli_state * cli ;
static unsigned char badpass [ 24 ] ;
static BOOL tested_password_server = False ;
static BOOL bad_password_server = False ;
1997-11-10 22:23:17 +03:00
1998-11-07 08:32:37 +03:00
cli = server_client ( ) ;
1997-11-10 22:23:17 +03:00
1998-11-07 08:32:37 +03:00
if ( ! cli - > initialised ) {
DEBUG ( 1 , ( " password server %s is not connected \n " , cli - > desthost ) ) ;
return ( False ) ;
}
1998-04-22 04:56:38 +04:00
1998-11-07 08:32:37 +03:00
if ( badpass [ 0 ] = = 0 )
memset ( badpass , 0x1f , sizeof ( badpass ) ) ;
1998-04-22 04:56:38 +04:00
1998-11-07 08:32:37 +03:00
if ( ( passlen = = sizeof ( badpass ) ) & & ! memcmp ( badpass , pass , passlen ) ) {
/*
* Very unlikely , our random bad password is the same as the users
* password . */
memset ( badpass , badpass [ 0 ] + 1 , sizeof ( badpass ) ) ;
}
1998-04-22 04:56:38 +04:00
1998-11-07 08:32:37 +03:00
/*
* Attempt a session setup with a totally incorrect password .
* If this succeeds with the guest bit * NOT * set then the password
* server is broken and is not correctly setting the guest bit . We
* need to detect this as some versions of NT4 . x are broken . JRA .
*/
1998-04-22 04:56:38 +04:00
1998-11-07 08:32:37 +03:00
if ( ! tested_password_server ) {
if ( cli_session_setup ( cli , user , ( char * ) badpass , sizeof ( badpass ) ,
( char * ) badpass , sizeof ( badpass ) , domain ) ) {
1998-04-22 04:56:38 +04:00
1998-11-07 08:32:37 +03:00
/*
* We connected to the password server so we
* can say we ' ve tested it .
*/
tested_password_server = True ;
1997-11-10 22:23:17 +03:00
1998-11-07 08:32:37 +03:00
if ( ( SVAL ( cli - > inbuf , smb_vwv2 ) & 1 ) = = 0 ) {
DEBUG ( 0 , ( " server_validate: password server %s allows users as non-guest \
with a bad password . \ n " , cli->desthost));
DEBUG ( 0 , ( " server_validate: This is broken (and insecure) behaviour. Please do not \
use this machine as the password server . \ n " ));
cli_ulogoff ( cli ) ;
1997-11-10 22:23:17 +03:00
1998-02-07 15:15:20 +03:00
/*
1998-11-07 08:32:37 +03:00
* Password server has the bug .
1998-02-07 15:15:20 +03:00
*/
1998-11-07 08:32:37 +03:00
bad_password_server = True ;
return False ;
}
cli_ulogoff ( cli ) ;
}
} else {
1998-02-07 15:15:20 +03:00
1998-11-07 08:32:37 +03:00
/*
* We have already tested the password server .
* Fail immediately if it has the bug .
*/
1998-05-05 23:24:32 +04:00
1998-11-07 08:32:37 +03:00
if ( bad_password_server ) {
DEBUG ( 0 , ( " server_validate: [1] password server %s allows users as non-guest \
with a bad password . \ n " , cli->desthost));
DEBUG ( 0 , ( " server_validate: [1] This is broken (and insecure) behaviour. Please do not \
use this machine as the password server . \ n " ));
return False ;
}
}
1998-05-05 23:24:32 +04:00
1998-11-07 08:32:37 +03:00
/*
* Now we know the password server will correctly set the guest bit , or is
* not guest enabled , we can try with the real password .
*/
1997-11-10 22:23:17 +03:00
1998-11-07 08:32:37 +03:00
if ( ! cli_session_setup ( cli , user , pass , passlen , ntpass , ntpasslen , domain ) ) {
DEBUG ( 1 , ( " password server %s rejected the password \n " , cli - > desthost ) ) ;
return False ;
}
1997-11-10 22:23:17 +03:00
1998-11-07 08:32:37 +03:00
/* if logged in as guest then reject */
if ( ( SVAL ( cli - > inbuf , smb_vwv2 ) & 1 ) ! = 0 ) {
DEBUG ( 1 , ( " password server %s gave us guest only \n " , cli - > desthost ) ) ;
cli_ulogoff ( cli ) ;
return ( False ) ;
}
1997-11-10 22:23:17 +03:00
1998-11-07 08:32:37 +03:00
cli_ulogoff ( cli ) ;
1997-11-10 22:23:17 +03:00
1998-11-07 08:32:37 +03:00
return ( True ) ;
1997-11-10 22:23:17 +03:00
}
1998-04-23 22:54:57 +04:00
1998-04-24 00:12:17 +04:00
/***********************************************************************
Do the same as security = server , but using NT Domain calls and a session
1999-03-19 18:49:22 +03:00
key from the workstation trust account password .
1998-04-24 00:12:17 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-04-23 22:54:57 +04:00
BOOL domain_client_validate ( char * user , char * domain ,
char * smb_apasswd , int smb_apasslen ,
char * smb_ntpasswd , int smb_ntpasslen )
{
1999-03-19 18:49:22 +03:00
uint16 nt_pipe_fnum ;
unsigned char local_challenge [ 8 ] ;
unsigned char local_lm_response [ 24 ] ;
unsigned char local_nt_reponse [ 24 ] ;
unsigned char trust_passwd [ 16 ] ;
NET_ID_INFO_CTR ctr ;
NET_USER_INFO_3 info3 ;
struct cli_state cli ;
uint32 smb_uid_low ;
/*
* Check that the requested domain is not our own machine name .
* If it is , we should never check the PDC here , we use our own local
* password file .
*/
if ( strequal ( domain , global_myname ) )
{
DEBUG ( 3 , ( " domain_client_validate: Requested domain was for this machine. \n " ) ) ;
return False ;
}
1998-04-23 22:54:57 +04:00
1999-03-19 18:49:22 +03:00
/*
* Next , check that the passwords given were encrypted .
*/
1998-04-23 22:54:57 +04:00
1999-03-19 18:49:22 +03:00
if ( ( ( smb_apasslen ! = 24 ) & & ( smb_apasslen ! = 0 ) ) | |
( ( smb_ntpasslen ! = 24 ) & & ( smb_ntpasslen ! = 0 ) ) )
{
/*
* Not encrypted - do so .
*/
DEBUG ( 3 , ( " domain_client_validate: User passwords not in encrypted format. \n " ) ) ;
generate_random_buffer ( local_challenge , 8 , False ) ;
SMBencrypt ( ( uchar * ) smb_apasswd , local_challenge , local_lm_response ) ;
SMBNTencrypt ( ( uchar * ) smb_ntpasswd , local_challenge , local_nt_reponse ) ;
smb_apasslen = 24 ;
smb_ntpasslen = 24 ;
smb_apasswd = ( char * ) local_lm_response ;
smb_ntpasswd = ( char * ) local_nt_reponse ;
}
else
{
/*
* Encrypted - get the challenge we sent for these
* responses .
*/
1998-04-23 22:54:57 +04:00
1999-03-19 18:49:22 +03:00
if ( ! last_challenge ( local_challenge ) )
{
DEBUG ( 0 , ( " domain_client_validate: no challenge done - password failed \n " ) ) ;
return False ;
}
}
1998-04-23 22:54:57 +04:00
1999-03-19 18:49:22 +03:00
/*
* Get the workstation trust account password .
*/
if ( ! trust_get_passwd ( trust_passwd , global_myworkgroup , global_myname ) )
{
return False ;
}
1998-04-29 04:02:57 +04:00
1999-03-19 18:49:22 +03:00
/*
* At this point , smb_apasswd points to the lanman response to
* the challenge in local_challenge , and smb_ntpasswd points to
* the NT response to the challenge in local_challenge . Ship
* these over the secure channel to a domain controller and
* see if they were valid .
*/
1998-04-23 22:54:57 +04:00
- group database API. oops and oh dear, the threat has been carried out:
the pre-alpha "domain group" etc parameters have disappeared.
- interactive debug detection
- re-added mem_man (andrew's memory management, detects memory corruption)
- american spellings of "initialise" replaced with english spelling of
"initialise".
- started on "lookup_name()" and "lookup_sid()" functions. proper ones.
- moved lots of functions around. created some modules of commonly used
code. e.g the password file locking code, which is used in groupfile.c
and aliasfile.c and smbpass.c
- moved RID_TYPE_MASK up another bit. this is really unfortunate, but
there is no other "fast" way to identify users from groups from aliases.
i do not believe that this code saves us anything (the multipliers)
and puts us at a disadvantage (reduces the useable rid space).
the designers of NT aren't silly: if they can get away with a user-
interface-speed LsaLookupNames / LsaLookupSids, then so can we. i
spoke with isaac at the cifs conference, the only time for example that
they do a security context check is on file create. certainly not on
individual file reads / writes, which would drastically hit their
performance and ours, too.
- renamed myworkgroup to global_sam_name, amongst other things, when used
in the rpc code. there is also a global_member_name, as we are always
responsible for a SAM database, the scope of which is limited by the role
of the machine (e.g if a member of a workgroup, your SAM is for _local_
logins only, and its name is the name of your server. you even still
have a SID. see LsaQueryInfoPolicy, levels 3 and 5).
- updated functionality of groupname.c to be able to cope with names
like DOMAIN\group and SERVER\alias. used this code to be able to
do aliases as well as groups. this code may actually be better
off being used in username mapping, too.
- created a connect to serverlist function in clientgen.c and used it
in password.c
- initialisation in server.c depends on the role of the server. well,
it does now.
- rpctorture. smbtorture. EXERCISE EXTREME CAUTION.
(This used to be commit 0d21e1e6090b933f396c764af535ca3388a562db)
1998-11-17 19:19:04 +03:00
if ( ! cli_connect_serverlist ( & cli , lp_passwordserver ( ) ) )
1998-09-26 01:01:52 +04:00
{
1999-03-19 18:49:22 +03:00
DEBUG ( 0 , ( " domain_client_validate: Domain password server not available. \n " ) ) ;
return False ;
}
1998-04-24 00:12:17 +04:00
1999-03-19 18:49:22 +03:00
/*
* Ok - we have an anonymous connection to the IPC $ share .
* Now start the NT Domain stuff : - ) .
*/
if ( cli_nt_session_open ( & cli , PIPE_NETLOGON , & nt_pipe_fnum ) = = False ) {
DEBUG ( 0 , ( " domain_client_validate: unable to open the domain client session to \
machine % s . Error was : % s . \ n " , cli.desthost, cli_errstr(&cli)));
cli_nt_session_close ( & cli , nt_pipe_fnum ) ;
cli_ulogoff ( & cli ) ;
cli_shutdown ( & cli ) ;
return False ;
}
1998-04-24 00:12:17 +04:00
1999-03-19 18:49:22 +03:00
if ( cli_nt_setup_creds ( & cli , nt_pipe_fnum ,
cli . mach_acct , trust_passwd , SEC_CHAN_WKSTA ) = = False )
{
DEBUG ( 0 , ( " domain_client_validate: unable to setup the PDC credentials to machine \
% s . Error was : % s . \ n " , cli.desthost, cli_errstr(&cli)));
cli_nt_session_close ( & cli , nt_pipe_fnum ) ;
cli_ulogoff ( & cli ) ;
cli_shutdown ( & cli ) ;
return False ;
}
1998-04-24 02:59:19 +04:00
1999-03-19 18:49:22 +03:00
/* We really don't care what LUID we give the user. */
generate_random_buffer ( ( unsigned char * ) & smb_uid_low , 4 , False ) ;
1998-04-29 04:02:57 +04:00
1999-03-19 18:49:22 +03:00
if ( ! cli_nt_login_network ( & cli , nt_pipe_fnum , domain , user , smb_uid_low , ( char * ) local_challenge ,
( ( smb_apasslen ! = 0 ) ? smb_apasswd : NULL ) ,
( ( smb_ntpasslen ! = 0 ) ? smb_ntpasswd : NULL ) ,
& ctr , & info3 ) )
{
DEBUG ( 0 , ( " domain_client_validate: unable to validate password for user %s in domain \
% s to Domain controller % s . Error was % s . \ n " , user, domain, cli.desthost, cli_errstr(&cli)));
cli_nt_session_close ( & cli , nt_pipe_fnum ) ;
cli_ulogoff ( & cli ) ;
cli_shutdown ( & cli ) ;
return False ;
}
1998-04-29 04:02:57 +04:00
1999-03-19 18:49:22 +03:00
/*
* Here , if we really want it , we have lots of info about the user in info3 .
* LKCLXXXX - really important to check things like " is this user acct
* locked out / disabled " etc!!!!
*/
1998-04-29 04:02:57 +04:00
1998-04-29 23:22:01 +04:00
#if 0
1999-03-19 18:49:22 +03:00
/*
* We don ' t actually need to do this - plus it fails currently with
* NT_STATUS_INVALID_INFO_CLASS - we need to know * exactly * what to
* send here . JRA .
*/
1998-04-29 23:22:01 +04:00
1999-03-19 18:49:22 +03:00
if ( ! cli_nt_logoff ( & cli , nt_pipe_fnum , & ctr ) )
{
DEBUG ( 0 , ( " domain_client_validate: unable to log off user %s in domain \
% s to Domain controller % s . Error was % s . \ n " , user, domain, cli.desthost, cli_errstr(&cli)));
cli_nt_session_close ( & cli , nt_pipe_fnum ) ;
cli_ulogoff ( & cli ) ;
cli_shutdown ( & cli ) ;
return False ;
}
1998-04-29 23:22:01 +04:00
# endif /* 0 */
1998-04-29 04:02:57 +04:00
1999-03-19 18:49:22 +03:00
cli_nt_session_close ( & cli , nt_pipe_fnum ) ;
cli_ulogoff ( & cli ) ;
cli_shutdown ( & cli ) ;
return True ;
1998-04-23 22:54:57 +04:00
}