1996-05-04 11:50:46 +04:00
/*
Unix SMB / Netbios implementation .
Version 1.9 .
Password and authentication handling
1998-01-22 16:27:43 +03:00
Copyright ( C ) Andrew Tridgell 1992 - 1998
1996-05-04 11:50:46 +04:00
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation ; either version 2 of the License , or
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
along with this program ; if not , write to the Free Software
Foundation , Inc . , 675 Mass Ave , Cambridge , MA 0213 9 , USA .
*/
# include "includes.h"
1997-11-10 22:23:17 +03:00
# if (defined(NETGROUP) && defined (AUTOMOUNT))
1997-05-07 21:56:46 +04:00
# include "rpcsvc/ypclnt.h"
# endif
1996-05-04 11:50:46 +04:00
extern int DEBUGLEVEL ;
extern int Protocol ;
/* users from session setup */
static pstring session_users = " " ;
/* these are kept here to keep the string_combinations function simple */
static char this_user [ 100 ] = " " ;
static char this_salt [ 100 ] = " " ;
static char this_crypted [ 100 ] = " " ;
/* Data to do lanman1/2 password challenge. */
static unsigned char saved_challenge [ 8 ] ;
static BOOL challenge_sent = False ;
/*******************************************************************
Get the next challenge value - no repeats .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
void generate_next_challenge ( char * challenge )
{
1997-09-16 08:41:16 +04:00
unsigned char buf [ 16 ] ;
static int counter = 0 ;
struct timeval tval ;
int v1 , v2 ;
/* get a sort-of random number */
GetTimeOfDay ( & tval ) ;
v1 = ( counter + + ) + getpid ( ) + tval . tv_sec ;
v2 = ( counter + + ) * getpid ( ) + tval . tv_usec ;
SIVAL ( challenge , 0 , v1 ) ;
SIVAL ( challenge , 4 , v2 ) ;
/* mash it up with md4 */
1997-09-16 12:26:33 +04:00
mdfour ( buf , ( unsigned char * ) challenge , 8 ) ;
1997-09-16 08:41:16 +04:00
memcpy ( saved_challenge , buf , 8 ) ;
memcpy ( challenge , buf , 8 ) ;
challenge_sent = True ;
1996-05-04 11:50:46 +04:00
}
/*******************************************************************
set the last challenge sent , usually from a password server
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL set_challenge ( char * challenge )
{
memcpy ( saved_challenge , challenge , 8 ) ;
challenge_sent = True ;
return ( True ) ;
}
/*******************************************************************
get the last challenge sent
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL last_challenge ( char * challenge )
{
if ( ! challenge_sent ) return ( False ) ;
memcpy ( challenge , saved_challenge , 8 ) ;
return ( True ) ;
}
/* this holds info on user ids that are already validated for this VC */
static user_struct * validated_users = NULL ;
static int num_validated_users = 0 ;
/****************************************************************************
check if a uid has been validated , and return an pointer to the user_struct
1996-10-26 00:18:28 +04:00
if it has . NULL if not . vuid is biased by an offset . This allows us to
tell random client vuid ' s ( normally zero ) from valid vuids .
1996-05-04 11:50:46 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-26 00:18:28 +04:00
user_struct * get_valid_user_struct ( uint16 vuid )
1996-05-04 11:50:46 +04:00
{
1997-10-10 18:48:05 +04:00
if ( vuid = = UID_FIELD_INVALID )
1996-10-26 00:18:28 +04:00
return NULL ;
vuid - = VUID_OFFSET ;
1997-10-10 18:48:05 +04:00
if ( ( vuid > = ( uint16 ) num_validated_users ) | |
1996-10-26 00:18:28 +04:00
( validated_users [ vuid ] . uid = = - 1 ) | | ( validated_users [ vuid ] . gid = = - 1 ) )
1996-05-04 11:50:46 +04:00
return NULL ;
return & validated_users [ vuid ] ;
}
/****************************************************************************
invalidate a uid
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-26 00:18:28 +04:00
void invalidate_vuid ( uint16 vuid )
1996-05-04 11:50:46 +04:00
{
1996-10-26 00:18:28 +04:00
user_struct * vuser = get_valid_user_struct ( vuid ) ;
1997-10-10 18:48:05 +04:00
if ( vuser = = NULL ) return ;
1996-10-26 00:18:28 +04:00
vuser - > uid = - 1 ;
vuser - > gid = - 1 ;
1997-10-10 18:48:05 +04:00
vuser - > n_sids = 0 ;
/* same number of igroups as groups as attrs */
vuser - > n_groups = 0 ;
if ( vuser - > groups & & ( vuser - > groups ! = ( gid_t * ) vuser - > igroups ) )
free ( vuser - > groups ) ;
if ( vuser - > igroups ) free ( vuser - > igroups ) ;
if ( vuser - > attrs ) free ( vuser - > attrs ) ;
if ( vuser - > sids ) free ( vuser - > sids ) ;
vuser - > attrs = NULL ;
vuser - > sids = NULL ;
vuser - > igroups = NULL ;
vuser - > groups = NULL ;
1996-05-04 11:50:46 +04:00
}
/****************************************************************************
return a validated username
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-26 00:18:28 +04:00
char * validated_username ( uint16 vuid )
1996-05-04 11:50:46 +04:00
{
1996-10-26 00:18:28 +04:00
user_struct * vuser = get_valid_user_struct ( vuid ) ;
1997-10-10 18:48:05 +04:00
if ( vuser = = NULL )
1996-10-26 00:18:28 +04:00
return 0 ;
return ( vuser - > name ) ;
1996-05-04 11:50:46 +04:00
}
1998-03-12 05:43:46 +03:00
/****************************************************************************
Setup the groups a user belongs to .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
int setup_groups ( char * user , int uid , int gid , int * p_ngroups ,
int * * p_igroups , gid_t * * p_groups ,
int * * p_attrs )
{
if ( - 1 = = initgroups ( user , gid ) )
{
if ( getuid ( ) = = 0 )
{
DEBUG ( 0 , ( " Unable to initgroups! \n " ) ) ;
if ( gid < 0 | | gid > 16000 | | uid < 0 | | uid > 16000 )
DEBUG ( 0 , ( " This is probably a problem with the account %s \n " , user ) ) ;
}
}
else
{
int i , ngroups ;
int * igroups ;
int * attrs ;
gid_t grp = 0 ;
ngroups = getgroups ( 0 , & grp ) ;
if ( ngroups < = 0 )
ngroups = 32 ;
igroups = ( int * ) malloc ( sizeof ( int ) * ngroups ) ;
attrs = ( int * ) malloc ( sizeof ( int ) * ngroups ) ;
for ( i = 0 ; i < ngroups ; i + + )
{
attrs [ i ] = 0x7 ; /* XXXX don't know what NT user attributes are yet! */
igroups [ i ] = 0x42424242 ;
}
ngroups = getgroups ( ngroups , ( gid_t * ) igroups ) ;
if ( igroups [ 0 ] = = 0x42424242 )
ngroups = 0 ;
* p_ngroups = ngroups ;
* p_attrs = attrs ;
/* The following bit of code is very strange. It is due to the
fact that some OSes use int * and some use gid_t * for
getgroups , and some ( like SunOS ) use both , one in prototypes ,
and one in man pages and the actual code . Thus we detect it
dynamically using some very ugly code */
if ( ngroups > 0 )
{
/* does getgroups return ints or gid_t ?? */
static BOOL groups_use_ints = True ;
if ( groups_use_ints & &
ngroups = = 1 & &
SVAL ( igroups , 2 ) = = 0x4242 )
groups_use_ints = False ;
for ( i = 0 ; groups_use_ints & & i < ngroups ; i + + )
if ( igroups [ i ] = = 0x42424242 )
groups_use_ints = False ;
if ( groups_use_ints )
{
* p_igroups = igroups ;
* p_groups = ( gid_t * ) igroups ;
}
else
{
gid_t * groups = ( gid_t * ) igroups ;
igroups = ( int * ) malloc ( sizeof ( int ) * ngroups ) ;
for ( i = 0 ; i < ngroups ; i + + )
{
igroups [ i ] = groups [ i ] ;
}
* p_igroups = igroups ;
* p_groups = ( gid_t * ) groups ;
}
}
DEBUG ( 3 , ( " %s is in %d groups \n " , user , ngroups ) ) ;
for ( i = 0 ; i < ngroups ; i + + )
DEBUG ( 3 , ( " %d " , igroups [ i ] ) ) ;
DEBUG ( 3 , ( " \n " ) ) ;
}
return 0 ;
}
1996-05-04 11:50:46 +04:00
/****************************************************************************
register a uid / name pair as being valid and that a valid password
1996-10-26 00:18:28 +04:00
has been given . vuid is biased by an offset . This allows us to
tell random client vuid ' s ( normally zero ) from valid vuids .
1996-05-04 11:50:46 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-26 00:18:28 +04:00
uint16 register_vuid ( int uid , int gid , char * name , BOOL guest )
1996-05-04 11:50:46 +04:00
{
user_struct * vuser ;
1997-05-07 21:56:46 +04:00
struct passwd * pwfile ; /* for getting real name from passwd file */
1998-03-16 21:31:09 +03:00
/* Ensure no vuid gets registered in share level security. */
if ( lp_security ( ) = = SEC_SHARE )
return UID_FIELD_INVALID ;
1997-07-22 23:04:40 +04:00
#if 0
/*
* After observing MS - Exchange services writing to a Samba share
1997-10-10 18:48:05 +04:00
* I belive this code is incorrect . Each service does its own
1997-07-22 23:04:40 +04:00
* sessionsetup_and_X for the same user , and as each service shuts
* down , it does a user_logoff_and_X . As we are consolidating multiple
* sessionsetup_and_X ' s onto the same vuid here , when the first service
* shuts down , it invalidates all the open files for the other services .
* Hence I am removing this code and forcing each sessionsetup_and_X
* to get a new vuid .
* Jeremy Allison . ( jallison @ whistle . com ) .
*/
1996-10-26 00:18:28 +04:00
int i ;
for ( i = 0 ; i < num_validated_users ; i + + ) {
vuser = & validated_users [ i ] ;
1997-10-10 18:48:05 +04:00
if ( vuser - > uid = = uid )
1997-06-18 05:04:57 +04:00
return ( uint16 ) ( i + VUID_OFFSET ) ; /* User already validated */
1996-10-26 00:18:28 +04:00
}
1997-07-22 23:04:40 +04:00
# endif
1996-05-04 11:50:46 +04:00
1996-10-26 00:18:28 +04:00
validated_users = ( user_struct * ) Realloc ( validated_users ,
sizeof ( user_struct ) *
( num_validated_users + 1 ) ) ;
1996-05-04 11:50:46 +04:00
if ( ! validated_users )
{
DEBUG ( 0 , ( " Failed to realloc users struct! \n " ) ) ;
1996-11-09 04:56:20 +03:00
num_validated_users = 0 ;
1996-10-26 00:18:28 +04:00
return UID_FIELD_INVALID ;
1996-05-04 11:50:46 +04:00
}
vuser = & validated_users [ num_validated_users ] ;
1996-10-26 00:18:28 +04:00
num_validated_users + + ;
1996-05-04 11:50:46 +04:00
vuser - > uid = uid ;
vuser - > gid = gid ;
vuser - > guest = guest ;
strcpy ( vuser - > name , name ) ;
1997-10-10 18:48:05 +04:00
vuser - > n_sids = 0 ;
vuser - > sids = NULL ;
vuser - > n_groups = 0 ;
vuser - > groups = NULL ;
vuser - > igroups = NULL ;
vuser - > attrs = NULL ;
1996-05-04 11:50:46 +04:00
/* Find all the groups this uid is in and store them.
Used by become_user ( ) */
setup_groups ( name , uid , gid ,
1997-10-10 18:48:05 +04:00
& vuser - > n_groups ,
& vuser - > igroups ,
& vuser - > groups ,
& vuser - > attrs ) ;
1996-05-04 11:50:46 +04:00
DEBUG ( 3 , ( " uid %d registered to name %s \n " , uid , name ) ) ;
1996-10-26 00:18:28 +04:00
1997-05-07 21:56:46 +04:00
DEBUG ( 3 , ( " Clearing default real name \n " ) ) ;
1997-10-10 18:48:05 +04:00
fstrcpy ( vuser - > real_name , " <Full Name> \0 " ) ;
1997-05-07 21:56:46 +04:00
if ( lp_unix_realname ( ) ) {
1997-10-10 18:48:05 +04:00
if ( ( pwfile = getpwnam ( vuser - > name ) ) ! = NULL )
1997-07-28 22:59:57 +04:00
{
DEBUG ( 3 , ( " User name: %s \t Real name: %s \n " , vuser - > name , pwfile - > pw_gecos ) ) ;
1997-10-10 18:48:05 +04:00
fstrcpy ( vuser - > real_name , pwfile - > pw_gecos ) ;
1997-07-28 22:59:57 +04:00
}
1997-05-07 21:56:46 +04:00
}
1996-10-26 00:18:28 +04:00
return ( uint16 ) ( ( num_validated_users - 1 ) + VUID_OFFSET ) ;
1996-05-04 11:50:46 +04:00
}
/****************************************************************************
add a name to the session users list
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
void add_session_user ( char * user )
{
fstring suser ;
StrnCpy ( suser , user , sizeof ( suser ) - 1 ) ;
if ( ! Get_Pwnam ( suser , True ) ) return ;
if ( suser & & * suser & & ! in_list ( suser , session_users , False ) )
{
if ( strlen ( suser ) + strlen ( session_users ) + 2 > = sizeof ( pstring ) )
DEBUG ( 1 , ( " Too many session users?? \n " ) ) ;
else
{
strcat ( session_users , " " ) ;
strcat ( session_users , suser ) ;
}
}
}
# ifdef NO_GETSPNAM
/* a fake shadow password routine which just fills a fake spwd struct
* with the sp_pwdp field . ( sreiz @ aie . nl )
*/
static struct spwd * getspnam ( char * username ) /* fake shadow password routine */
{
FILE * f ;
char line [ 1024 ] ;
static char pw [ 20 ] ;
static struct spwd static_spwd ;
static_spwd . sp_pwdp = 0 ;
if ( ! ( f = fopen ( " /etc/master.passwd " , " r " ) ) )
return 0 ;
while ( fgets ( line , 1024 , f ) ) {
if ( ! strncmp ( line , username , strlen ( username ) ) & &
line [ strlen ( username ) ] = = ' : ' ) { /* found entry */
char * p , * q ;
p = line + strlen ( username ) + 1 ;
if ( ( q = strchr ( p , ' : ' ) ) ) {
* q = 0 ;
if ( q - p + 1 > 20 )
break ;
strcpy ( pw , p ) ;
static_spwd . sp_pwdp = pw ;
}
break ;
}
}
fclose ( f ) ;
if ( static_spwd . sp_pwdp )
return & static_spwd ;
return 0 ;
}
# endif
# ifdef OSF1_ENH_SEC
/****************************************************************************
an enhanced crypt for OSF1
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static char * osf1_bigcrypt ( char * password , char * salt1 )
{
static char result [ AUTH_MAX_PASSWD_LENGTH ] = " " ;
char * p1 ;
char * p2 = password ;
char salt [ 3 ] ;
int i ;
int parts = strlen ( password ) / AUTH_CLEARTEXT_SEG_CHARS ;
if ( strlen ( password ) % AUTH_CLEARTEXT_SEG_CHARS )
parts + + ;
StrnCpy ( salt , salt1 , 2 ) ;
StrnCpy ( result , salt1 , 2 ) ;
for ( i = 0 ; i < parts ; i + + )
{
p1 = crypt ( p2 , salt ) ;
strcat ( result , p1 + 2 ) ;
StrnCpy ( salt , & result [ 2 + i * AUTH_CIPHERTEXT_SEG_CHARS ] , 2 ) ;
p2 + = AUTH_CLEARTEXT_SEG_CHARS ;
}
return ( result ) ;
}
# endif
/****************************************************************************
update the enhanced security database . Only relevant for OSF1 at the moment .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static void update_protected_database ( char * user , BOOL result )
{
# ifdef OSF1_ENH_SEC
struct pr_passwd * mypasswd ;
time_t starttime ;
mypasswd = getprpwnam ( user ) ;
starttime = time ( NULL ) ;
if ( result )
{
1996-05-31 19:13:29 +04:00
mypasswd - > ufld . fd_slogin = starttime ;
1996-05-04 11:50:46 +04:00
mypasswd - > ufld . fd_nlogins = 0 ;
putprpwnam ( user , mypasswd ) ;
DEBUG ( 3 , ( " Update protected database for Account %s after succesful connection \n " , user ) ) ;
}
else
{
1996-05-31 19:13:29 +04:00
mypasswd - > ufld . fd_ulogin = starttime ;
1996-05-04 11:50:46 +04:00
mypasswd - > ufld . fd_nlogins = mypasswd - > ufld . fd_nlogins + 1 ;
if ( mypasswd - > ufld . fd_max_tries ! = 0 & & mypasswd - > ufld . fd_nlogins > mypasswd - > ufld . fd_max_tries )
{
mypasswd - > uflg . fg_lock = 0 ;
DEBUG ( 3 , ( " Account is disabled -- see Account Administrator. \n " ) ) ;
}
putprpwnam ( user , mypasswd ) ;
DEBUG ( 3 , ( " Update protected database for Account %s after refusing connection \n " , user ) ) ;
}
# else
DEBUG ( 6 , ( " Updated database with %s %s \n " , user , BOOLSTR ( result ) ) ) ;
# endif
}
1997-01-02 07:04:49 +03:00
# ifdef USE_PAM
/*******************************************************************
check on PAM authentication
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/* We first need some helper functions */
# include <security/pam_appl.h>
/* Static variables used to communicate between the conversation function
* and the server_login function
*/
static char * PAM_username ;
static char * PAM_password ;
/* PAM conversation function
* Here we assume ( for now , at least ) that echo on means login name , and
* echo off means password .
*/
static int PAM_conv ( int num_msg ,
1997-09-14 20:37:18 +04:00
struct pam_message * * msg ,
1997-01-02 07:04:49 +03:00
struct pam_response * * resp ,
void * appdata_ptr ) {
1997-10-16 09:33:24 +04:00
int replies = 0 ;
1997-01-02 07:04:49 +03:00
struct pam_response * reply = NULL ;
# define COPY_STRING(s) (s) ? strdup(s) : NULL
1997-10-16 09:33:24 +04:00
reply = malloc ( sizeof ( struct pam_response ) * num_msg ) ;
if ( ! reply ) return PAM_CONV_ERR ;
for ( replies = 0 ; replies < num_msg ; replies + + ) {
switch ( msg [ replies ] - > msg_style ) {
1997-01-02 07:04:49 +03:00
case PAM_PROMPT_ECHO_ON :
reply [ replies ] . resp_retcode = PAM_SUCCESS ;
1997-10-16 09:33:24 +04:00
reply [ replies ] . resp = COPY_STRING ( PAM_username ) ;
1997-01-02 07:04:49 +03:00
/* PAM frees resp */
break ;
case PAM_PROMPT_ECHO_OFF :
reply [ replies ] . resp_retcode = PAM_SUCCESS ;
1997-10-16 09:33:24 +04:00
reply [ replies ] . resp = COPY_STRING ( PAM_password ) ;
1997-01-02 07:04:49 +03:00
/* PAM frees resp */
break ;
case PAM_TEXT_INFO :
1997-10-16 09:33:24 +04:00
/* fall through */
case PAM_ERROR_MSG :
1997-01-02 07:04:49 +03:00
/* ignore it... */
1997-10-16 09:33:24 +04:00
reply [ replies ] . resp_retcode = PAM_SUCCESS ;
reply [ replies ] . resp = NULL ;
1997-01-02 07:04:49 +03:00
break ;
default :
/* Must be an error of some sort... */
free ( reply ) ;
return PAM_CONV_ERR ;
}
}
if ( reply ) * resp = reply ;
return PAM_SUCCESS ;
}
static struct pam_conv PAM_conversation = {
& PAM_conv ,
NULL
} ;
static BOOL pam_auth ( char * this_user , char * password )
{
pam_handle_t * pamh ;
int pam_error ;
/* Now use PAM to do authentication. For now, we won't worry about
* session logging , only authentication . Bail out if there are any
* errors . Since this is a limited protocol , and an even more limited
* function within a server speaking this protocol , we can ' t be as
* verbose as would otherwise make sense .
* Query : should we be using PAM_SILENT to shut PAM up ?
*/
# define PAM_BAIL if (pam_error != PAM_SUCCESS) { \
pam_end ( pamh , 0 ) ; return False ; \
}
PAM_password = password ;
PAM_username = this_user ;
pam_error = pam_start ( " samba " , this_user , & PAM_conversation , & pamh ) ;
PAM_BAIL ;
1998-01-10 14:42:29 +03:00
/* Setting PAM_SILENT stops generation of error messages to syslog
* to enable debugging on Red Hat Linux set :
* / etc / pam . d / samba :
* auth required / lib / security / pam_pwdb . so nullok shadow audit
* _OR_ change PAM_SILENT to 0 to force detailed reporting ( logging )
*/
pam_error = pam_authenticate ( pamh , PAM_SILENT ) ;
1997-01-02 07:04:49 +03:00
PAM_BAIL ;
/* It is not clear to me that account management is the right thing
* to do , but it is not clear that it isn ' t , either . This can be
* removed if no account management should be done . Alternately ,
* put a pam_allow . so entry in / etc / pam . conf for account handling . */
1998-01-10 14:42:29 +03:00
pam_error = pam_acct_mgmt ( pamh , PAM_SILENT ) ;
1997-01-02 07:04:49 +03:00
PAM_BAIL ;
pam_end ( pamh , PAM_SUCCESS ) ;
/* If this point is reached, the user has been authenticated. */
return ( True ) ;
}
# endif
1996-05-04 11:50:46 +04:00
# ifdef AFS_AUTH
/*******************************************************************
check on AFS authentication
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static BOOL afs_auth ( char * this_user , char * password )
{
long password_expires = 0 ;
char * reason ;
/* For versions of AFS prior to 3.3, this routine has few arguments, */
/* but since I can't find the old documentation... :-) */
setpag ( ) ;
if ( ka_UserAuthenticateGeneral ( KA_USERAUTH_VERSION + KA_USERAUTH_DOSETPAG ,
this_user ,
( char * ) 0 , /* instance */
( char * ) 0 , /* cell */
password ,
0 , /* lifetime, default */
& password_expires , /*days 'til it expires */
0 , /* spare 2 */
& reason ) = = 0 )
return ( True ) ;
return ( False ) ;
}
# endif
# ifdef DFS_AUTH
sec_login_handle_t my_dce_sec_context ;
int dcelogin_atmost_once = 0 ;
/*******************************************************************
check on a DCE / DFS authentication
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static BOOL dfs_auth ( char * this_user , char * password )
{
error_status_t err ;
int err2 ;
int prterr ;
boolean32 password_reset ;
sec_passwd_rec_t my_dce_password ;
sec_login_auth_src_t auth_src = sec_login_auth_src_network ;
unsigned char dce_errstr [ dce_c_error_string_len ] ;
/*
* We only go for a DCE login context if the given password
* matches that stored in the local password file . .
* Assumes local passwd file is kept in sync w / DCE RGY !
*/
1998-02-07 15:15:20 +03:00
/* Fix for original (broken) code from Brett Wooldridge <brettw@austin.ibm.com> */
1998-03-04 04:50:47 +03:00
if ( dcelogin_atmost_once )
1998-02-07 15:15:20 +03:00
return ( False ) ;
/* This can be ifdefed as the DCE check below is stricter... */
# ifndef NO_CRYPT
if ( strcmp ( ( char * ) crypt ( password , this_salt ) , this_crypted ) )
return ( False ) ;
# endif
1996-05-04 11:50:46 +04:00
if ( sec_login_setup_identity (
( unsigned char * ) this_user ,
sec_login_no_flags ,
& my_dce_sec_context ,
& err ) = = 0 )
{
dce_error_inq_text ( err , dce_errstr , & err2 ) ;
DEBUG ( 0 , ( " DCE Setup Identity for %s failed: %s \n " ,
this_user , dce_errstr ) ) ;
return ( False ) ;
}
my_dce_password . version_number = sec_passwd_c_version_none ;
my_dce_password . pepper = NULL ;
my_dce_password . key . key_type = sec_passwd_plain ;
my_dce_password . key . tagged_union . plain = ( idl_char * ) password ;
if ( sec_login_valid_and_cert_ident ( my_dce_sec_context ,
& my_dce_password ,
& password_reset ,
& auth_src ,
& err ) = = 0 )
{
dce_error_inq_text ( err , dce_errstr , & err2 ) ;
DEBUG ( 0 , ( " DCE Identity Validation failed for principal %s: %s \n " ,
this_user , dce_errstr ) ) ;
return ( False ) ;
}
sec_login_set_context ( my_dce_sec_context , & err ) ;
if ( err ! = error_status_ok )
{
dce_error_inq_text ( err , dce_errstr , & err2 ) ;
DEBUG ( 0 , ( " DCE login failed for principal %s, cant set context: %s \n " ,
this_user , dce_errstr ) ) ;
sec_login_purge_context ( my_dce_sec_context , & err ) ;
return ( False ) ;
}
else
{
DEBUG ( 0 , ( " DCE login succeeded for principal %s on pid %d \n " ,
this_user , getpid ( ) ) ) ;
}
dcelogin_atmost_once = 1 ;
return ( True ) ;
}
void dfs_unlogin ( void )
{
error_status_t err ;
int err2 ;
unsigned char dce_errstr [ dce_c_error_string_len ] ;
sec_login_purge_context ( my_dce_sec_context , & err ) ;
if ( err ! = error_status_ok )
{
dce_error_inq_text ( err , dce_errstr , & err2 ) ;
DEBUG ( 0 , ( " DCE purge login context failed for server instance %d: %s \n " ,
getpid ( ) , dce_errstr ) ) ;
}
}
# endif
1997-07-18 00:11:58 +04:00
# ifdef KRB5_AUTH
/*******************************************************************
check on Kerberos authentication
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static BOOL krb5_auth ( char * this_user , char * password )
{
krb5_data tgtname = {
0 ,
KRB5_TGS_NAME_SIZE ,
KRB5_TGS_NAME
} ;
krb5_context kcontext ;
krb5_principal kprinc ;
krb5_principal server ;
krb5_creds kcreds ;
int options = 0 ;
krb5_address * * addrs = ( krb5_address * * ) 0 ;
krb5_preauthtype * preauth = NULL ;
krb5_keytab keytab = NULL ;
krb5_timestamp now ;
krb5_ccache ccache = NULL ;
int retval ;
char * name ;
if ( retval = krb5_init_context ( & kcontext ) )
{
return ( False ) ;
}
if ( retval = krb5_timeofday ( kcontext , & now ) )
{
return ( False ) ;
}
if ( retval = krb5_cc_default ( kcontext , & ccache ) )
{
return ( False ) ;
}
if ( retval = krb5_parse_name ( kcontext , this_user , & kprinc ) )
{
return ( False ) ;
}
memset ( ( char * ) & kcreds , 0 , sizeof ( kcreds ) ) ;
kcreds . client = kprinc ;
if ( ( retval = krb5_build_principal_ext ( kcontext , & server ,
krb5_princ_realm ( kcontext , kprinc ) - > length ,
krb5_princ_realm ( kcontext , kprinc ) - > data ,
tgtname . length ,
tgtname . data ,
krb5_princ_realm ( kcontext , kprinc ) - > length ,
krb5_princ_realm ( kcontext , kprinc ) - > data ,
0 ) ) )
{
return ( False ) ;
}
kcreds . server = server ;
retval = krb5_get_in_tkt_with_password ( kcontext ,
options ,
addrs ,
NULL ,
preauth ,
password ,
0 ,
& kcreds ,
0 ) ;
if ( retval )
{
return ( False ) ;
}
return ( True ) ;
}
# endif /* KRB5_AUTH */
1996-05-04 11:50:46 +04:00
1998-02-27 01:58:21 +03:00
# ifdef KRB4_AUTH
/*******************************************************************
check on Kerberos authentication
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static BOOL krb4_auth ( char * this_user , char * password )
{
char realm [ REALM_SZ ] ;
char tkfile [ MAXPATHLEN ] ;
if ( krb_get_lrealm ( realm , 1 ) ! = KSUCCESS )
( void ) strncpy ( realm , KRB_REALM , sizeof ( realm ) ) ;
( void ) sprintf ( tkfile , " /tmp/samba_tkt_%d " , getpid ( ) ) ;
krb_set_tkt_string ( tkfile ) ;
if ( krb_verify_user ( this_user , " " , realm ,
password , 0 ,
" rmcd " ) = = KSUCCESS ) {
unlink ( tkfile ) ;
return 1 ;
}
unlink ( tkfile ) ;
return 0 ;
}
# endif /* KRB4_AUTH */
1996-05-04 11:50:46 +04:00
# ifdef LINUX_BIGCRYPT
/****************************************************************************
an enhanced crypt for Linux to handle password longer than 8 characters
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static int linux_bigcrypt ( char * password , char * salt1 , char * crypted )
{
# define LINUX_PASSWORD_SEG_CHARS 8
char salt [ 3 ] ;
int i ;
StrnCpy ( salt , salt1 , 2 ) ;
crypted + = 2 ;
for ( i = strlen ( password ) ; i > 0 ; i - = LINUX_PASSWORD_SEG_CHARS ) {
char * p = crypt ( password , salt ) + 2 ;
1997-10-10 18:48:05 +04:00
if ( strncmp ( p , crypted , LINUX_PASSWORD_SEG_CHARS ) ! = 0 )
1996-05-04 11:50:46 +04:00
return ( 0 ) ;
password + = LINUX_PASSWORD_SEG_CHARS ;
crypted + = strlen ( p ) ;
}
return ( 1 ) ;
}
# endif
/****************************************************************************
apply a function to upper / lower case combinations
of a string and return true if one of them returns true .
try all combinations with N uppercase letters .
offset is the first char to try and change ( start with 0 )
it assumes the string starts lowercased
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static BOOL string_combinations2 ( char * s , int offset , BOOL ( * fn ) ( ) , int N )
{
int len = strlen ( s ) ;
int i ;
# ifdef PASSWORD_LENGTH
len = MIN ( len , PASSWORD_LENGTH ) ;
# endif
if ( N < = 0 | | offset > = len )
return ( fn ( s ) ) ;
for ( i = offset ; i < ( len - ( N - 1 ) ) ; i + + )
{
char c = s [ i ] ;
if ( ! islower ( c ) ) continue ;
s [ i ] = toupper ( c ) ;
if ( string_combinations2 ( s , i + 1 , fn , N - 1 ) )
return ( True ) ;
s [ i ] = c ;
}
return ( False ) ;
}
/****************************************************************************
apply a function to upper / lower case combinations
of a string and return true if one of them returns true .
try all combinations with up to N uppercase letters .
offset is the first char to try and change ( start with 0 )
it assumes the string starts lowercased
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static BOOL string_combinations ( char * s , BOOL ( * fn ) ( ) , int N )
{
int n ;
for ( n = 1 ; n < = N ; n + + )
if ( string_combinations2 ( s , 0 , fn , n ) ) return ( True ) ;
return ( False ) ;
}
/****************************************************************************
core of password checking routine
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL password_check ( char * password )
{
1997-01-02 07:04:49 +03:00
# ifdef USE_PAM
1997-02-04 13:35:38 +03:00
/* This falls through if the password check fails
- if NO_CRYPT is defined this causes an error msg
saying Warning - no crypt available
- if NO_CRYPT is NOT defined this is a potential security hole
as it may authenticate via the crypt call when PAM
settings say it should fail .
1997-01-02 07:04:49 +03:00
if ( pam_auth ( this_user , password ) ) return ( True ) ;
1997-02-04 13:35:38 +03:00
Hence we make a direct return to avoid a second chance ! ! !
*/
return ( pam_auth ( this_user , password ) ) ;
1997-01-02 07:04:49 +03:00
# endif
1996-05-04 11:50:46 +04:00
# ifdef AFS_AUTH
if ( afs_auth ( this_user , password ) ) return ( True ) ;
# endif
# ifdef DFS_AUTH
if ( dfs_auth ( this_user , password ) ) return ( True ) ;
# endif
1997-07-18 00:11:58 +04:00
# ifdef KRB5_AUTH
if ( krb5_auth ( this_user , password ) ) return ( True ) ;
# endif
1998-02-27 01:58:21 +03:00
# ifdef KRB4_AUTH
if ( krb4_auth ( this_user , password ) ) return ( True ) ;
# endif
1996-05-04 11:50:46 +04:00
# ifdef PWDAUTH
if ( pwdauth ( this_user , password ) = = 0 )
return ( True ) ;
# endif
# ifdef OSF1_ENH_SEC
return ( strcmp ( osf1_bigcrypt ( password , this_salt ) , this_crypted ) = = 0 ) ;
# endif
# ifdef ULTRIX_AUTH
return ( strcmp ( ( char * ) crypt16 ( password , this_salt ) , this_crypted ) = = 0 ) ;
# endif
# ifdef LINUX_BIGCRYPT
return ( linux_bigcrypt ( password , this_salt , this_crypted ) ) ;
# endif
1997-12-03 02:27:40 +03:00
# ifdef HPUX_10_TRUSTED
return ( bigcrypt ( password , this_salt , this_crypted ) ) ;
# endif
1996-05-04 11:50:46 +04:00
# ifdef NO_CRYPT
DEBUG ( 1 , ( " Warning - no crypt available \n " ) ) ;
return ( False ) ;
# else
return ( strcmp ( ( char * ) crypt ( password , this_salt ) , this_crypted ) = = 0 ) ;
# endif
}
/****************************************************************************
core of smb password checking routine .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL smb_password_check ( char * password , unsigned char * part_passwd , unsigned char * c8 )
{
/* Finish the encryption of part_passwd. */
unsigned char p21 [ 21 ] ;
unsigned char p24 [ 24 ] ;
1997-10-10 18:48:05 +04:00
if ( part_passwd = = NULL )
1996-05-04 11:50:46 +04:00
DEBUG ( 10 , ( " No password set - allowing access \n " ) ) ;
/* No password set - always true ! */
1997-10-10 18:48:05 +04:00
if ( part_passwd = = NULL )
1996-05-04 11:50:46 +04:00
return 1 ;
memset ( p21 , ' \0 ' , 21 ) ;
memcpy ( p21 , part_passwd , 16 ) ;
E_P24 ( p21 , c8 , p24 ) ;
# if DEBUG_PASSWORD
{
int i ;
DEBUG ( 100 , ( " Part password (P16) was | " ) ) ;
for ( i = 0 ; i < 16 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) part_passwd [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
DEBUG ( 100 , ( " Password from client was | " ) ) ;
for ( i = 0 ; i < 24 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) password [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
DEBUG ( 100 , ( " Given challenge was | " ) ) ;
for ( i = 0 ; i < 8 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) c8 [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
DEBUG ( 100 , ( " Value from encryption was | " ) ) ;
for ( i = 0 ; i < 24 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) p24 [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
}
# endif
return ( memcmp ( p24 , password , 24 ) = = 0 ) ;
}
1998-03-12 00:11:04 +03:00
/****************************************************************************
Do a specific test for an smb password being correct , given a smb_password and
the lanman and NT responses .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL smb_password_ok ( struct smb_passwd * smb_pass ,
uchar lm_pass [ 24 ] , uchar nt_pass [ 24 ] )
{
uchar challenge [ 8 ] ;
if ( ! lm_pass | | ! smb_pass ) return ( False ) ;
if ( smb_pass - > acct_ctrl & ACB_DISABLED )
{
DEBUG ( 3 , ( " smb_password_ok: account for user %s was disabled. \n " , smb_pass - > smb_name ) ) ;
return ( False ) ;
}
if ( ! last_challenge ( challenge ) )
{
DEBUG ( 1 , ( " smb_password_ok: no challenge done - password failed \n " ) ) ;
return False ;
}
DEBUG ( 4 , ( " smb_password_ok: Checking SMB password for user %s \n " , smb_pass - > smb_name ) ) ;
if ( ( Protocol > = PROTOCOL_NT1 ) & & ( smb_pass - > smb_nt_passwd ! = NULL ) )
{
/* We have the NT MD4 hash challenge available - see if we can
use it ( ie . does it exist in the smbpasswd file ) .
*/
DEBUG ( 4 , ( " smb_password_ok: Checking NT MD4 password \n " ) ) ;
if ( smb_password_check ( nt_pass , smb_pass - > smb_nt_passwd , challenge ) )
{
DEBUG ( 4 , ( " smb_password_ok: NT MD4 password check succeeded \n " ) ) ;
return ( True ) ;
}
DEBUG ( 4 , ( " smb_password_ok: NT MD4 password check failed \n " ) ) ;
}
/* Try against the lanman password. smb_pass->smb_passwd == NULL means
no password , allow access . */
DEBUG ( 4 , ( " Checking LM MD4 password \n " ) ) ;
if ( ( smb_pass - > smb_passwd = = NULL ) & & ( smb_pass - > acct_ctrl & ACB_PWNOTREQ ) )
{
DEBUG ( 4 , ( " smb_password_ok: no password required for user %s \n " , smb_pass - > smb_name ) ) ;
return True ;
}
if ( ( smb_pass - > smb_passwd ! = NULL ) & & smb_password_check ( lm_pass , smb_pass - > smb_passwd , challenge ) )
{
DEBUG ( 4 , ( " smb_password_ok: LM MD4 password check succeeded \n " ) ) ;
return ( True ) ;
}
DEBUG ( 4 , ( " smb_password_ok: LM MD4 password check failed \n " ) ) ;
return False ;
}
1996-05-04 11:50:46 +04:00
/****************************************************************************
check if a username / password is OK
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-02 18:06:17 +04:00
BOOL password_ok ( char * user , char * password , int pwlen , struct passwd * pwd )
1996-05-04 11:50:46 +04:00
{
pstring pass2 ;
int level = lp_passwordlevel ( ) ;
struct passwd * pass ;
char challenge [ 8 ] ;
struct smb_passwd * smb_pass ;
BOOL challenge_done = False ;
if ( password ) password [ pwlen ] = 0 ;
if ( pwlen = = 24 )
challenge_done = last_challenge ( challenge ) ;
# if DEBUG_PASSWORD
if ( challenge_done )
{
int i ;
DEBUG ( 100 , ( " checking user=[%s] pass=[ " , user ) ) ;
for ( i = 0 ; i < 24 ; i + + )
DEBUG ( 100 , ( " %0x " , ( unsigned char ) password [ i ] ) ) ;
DEBUG ( 100 , ( " ] \n " ) ) ;
1997-09-14 20:37:18 +04:00
} else {
DEBUG ( 100 , ( " checking user=[%s] pass=[%s] \n " , user , password ) ) ;
1996-05-04 11:50:46 +04:00
}
# endif
if ( ! password )
return ( False ) ;
if ( ( ( ! * password ) | | ( ! pwlen ) ) & & ! lp_null_passwords ( ) )
return ( False ) ;
if ( pwd & & ! user )
{
pass = ( struct passwd * ) pwd ;
user = pass - > pw_name ;
}
else
pass = Get_Pwnam ( user , True ) ;
DEBUG ( 4 , ( " SMB Password - pwlen = %d, challenge_done = %d \n " , pwlen , challenge_done ) ) ;
1997-10-10 18:48:05 +04:00
if ( ( pwlen = = 24 ) & & challenge_done )
1996-05-04 11:50:46 +04:00
{
DEBUG ( 4 , ( " Checking SMB password for user %s (l=24) \n " , user ) ) ;
if ( ! pass )
{
DEBUG ( 3 , ( " Couldn't find user %s \n " , user ) ) ;
return ( False ) ;
}
following a cvs error, i am rewriting this monster-commit. with bad grace.
Modified Files:
---------------
Makefile:
adding extra files
ipc.c :
send_trans_reply() - alignment issue. this makes the alignment
the same as that in NT. this should be looked at by people who
understand the SMB stuff better than i.
api_fd_commands[] - added samr and wkssvc pipes.
loadparm.c :
lp_domain_controller() changed to mean "samba is a domain controller".
it's a "yes/no" parameter, now. no, it isn't used _anywhere_.
namedbwork.c nameelect.c :
if "domain controller = yes" then add SV_TYPE_DOMAIN_CTRL to the
host _and_ workgroup announcements. yes, you must do both: nt does.
namelogon.c :
important NETLOGON bug in SAMLOGON request parsing, which may be
the source of some people's problems with logging on to the Samba PDC.
password.c :
get_smbpwnam() renamed to get_smbpwd_entry().
pipes.c :
added samr and wkssvc pipes.
proto.h :
usual. can we actually _remove_ proto.h from the cvs tree, and
have it as one of the Makefile dependencies, or something?
reply.c :
get_smbpwnam() renamed to get_smbpwd_entry() - also changed response
error code when logging in from a WORKSTATION$ account. yes, paul
is right: we need to know when to return the right error code, and why.
server.c :
added call to reset_chain_pnum().
#ifdef NTDOMAIN added call to init_lsa_policy_hnd() #endif. jeremy,
you'd be proud: i did a compile without NTDOMAIN, and caught a link
error for this function.
smb.h :
defines and structures for samr and wkssvc pipes.
smbpass.c :
modified get_smbpwnam() to get_smbpwd_entry() and it now takes
two arguments. one for the name; if this is null, it looks up
by smb_userid instead.
oh, by the way, smb_userids are actually domain relative ids
(RIDs). concatenate a RID with the domain SID, and you have
an internet globally unique way of identifying a user.
we're using RIDs in the wrong way....
added mod_smbpwnam() function. this was based on code in smbpasswd.c
rpc_pipes/lsaparse.c :
added enum trusted domain parsing. this is incomplete: i need
a packet trace to write it properly.
rpc_pipes/pipe_hnd.c :
added reset_chain_pnum() function.
rpc_pipes/pipenetlog.c :
get_smbpwnam() function renamed to get_smbpwd_entry().
arcfour() issues.
removed capability of get_md4pw() function to automatically add
workstation accounts. this should either be done using
smbpasswd -add MACHINE$, or by using \PIPE\samr.
rpc_pipes/pipe_util.c :
create_pol_hnd() - creates a unique LSA Policy Handle. overkill
function: uses a 64 bit sequence number; current unix time and
the smbd pid.
rpc_pipes/smbparse.c :
arcfour() issues.
smb_io_unistr2() should advance by uni_str_len not uni_max_len.
smb_io_smb_hdr_rb() - request bind uses uint16 for the context
id, and uint8 for the num_syntaxes. oops, i put these both as
uint32s.
Added Files:
------------
rpc_pipes/lsa_hnd.c :
on the samr pipe, allocate and associate an LSA Policy Handle
with a SID. you receive queries with the LSA Policy Handle,
and have to turn this back into a SID in order to answer the
query...
rpc_pipes/pipesamr.c rpc_pipes/samrparse.c
\PIPE\samr processing. samr i presume is the SAM Replication pipe.
rpc_pipes/pipewkssvc.c rpc_pipes/wksparse.c
\PIPE\wkssvc processing. the Workstation Service pipe?
holy cow.
(This used to be commit 1bd084b3e690eb26a1006d616075e53d711ecd2f)
1997-11-07 02:03:58 +03:00
/* non-null username indicates search by username not smb userid */
smb_pass = get_smbpwd_entry ( user , 0 ) ;
1997-10-10 18:48:05 +04:00
if ( ! smb_pass )
1996-05-04 11:50:46 +04:00
{
DEBUG ( 3 , ( " Couldn't find user %s in smb_passwd file. \n " , user ) ) ;
return ( False ) ;
}
1998-03-12 00:11:04 +03:00
/* Quit if the account was disabled. */
if ( smb_pass - > acct_ctrl & ACB_DISABLED )
{
DEBUG ( 3 , ( " password_ok: account for user %s was disabled. \n " , user ) ) ;
return ( False ) ;
}
1996-05-04 11:50:46 +04:00
/* Ensure the uid's match */
1997-10-10 18:48:05 +04:00
if ( smb_pass - > smb_userid ! = pass - > pw_uid )
1996-05-04 11:50:46 +04:00
{
DEBUG ( 3 , ( " Error : UNIX and SMB uids in password files do not match ! \n " ) ) ;
return ( False ) ;
}
1998-03-12 00:11:04 +03:00
if ( smb_password_ok ( smb_pass , password , password ) )
{
update_protected_database ( user , True ) ;
return ( True ) ;
}
1996-05-04 11:50:46 +04:00
1998-03-12 00:11:04 +03:00
DEBUG ( 3 , ( " Error smb_password_check failed \n " ) ) ;
1996-05-04 11:50:46 +04:00
}
DEBUG ( 4 , ( " Checking password for user %s (l=%d) \n " , user , pwlen ) ) ;
if ( ! pass )
{
DEBUG ( 3 , ( " Couldn't find user %s \n " , user ) ) ;
return ( False ) ;
}
# ifdef SHADOW_PWD
{
struct spwd * spass ;
/* many shadow systems require you to be root to get the password,
in most cases this should already be the case when this
function is called , except perhaps for IPC password changing
requests */
spass = getspnam ( pass - > pw_name ) ;
if ( spass & & spass - > sp_pwdp )
pass - > pw_passwd = spass - > sp_pwdp ;
}
1997-07-03 21:19:46 +04:00
# elif defined(IA_UINFO)
{
/* Need to get password with SVR4.2's ia_ functions instead of
get { sp , pw } ent functions . Required by UnixWare 2. x , tested on
version 2.1 . ( tangent @ cyberport . com ) */
uinfo_t uinfo ;
if ( ia_openinfo ( pass - > pw_name , & uinfo ) ! = - 1 )
ia_get_logpwd ( uinfo , & ( pass - > pw_passwd ) ) ;
}
1996-05-04 11:50:46 +04:00
# endif
# ifdef SecureWare
{
struct pr_passwd * pr_pw = getprpwnam ( pass - > pw_name ) ;
if ( pr_pw & & pr_pw - > ufld . fd_encrypt )
pass - > pw_passwd = pr_pw - > ufld . fd_encrypt ;
}
# endif
# ifdef HPUX_10_TRUSTED
{
struct pr_passwd * pr_pw = getprpwnam ( pass - > pw_name ) ;
if ( pr_pw & & pr_pw - > ufld . fd_encrypt )
pass - > pw_passwd = pr_pw - > ufld . fd_encrypt ;
}
# endif
# ifdef OSF1_ENH_SEC
{
struct pr_passwd * mypasswd ;
DEBUG ( 5 , ( " Checking password for user %s in OSF1_ENH_SEC \n " , user ) ) ;
mypasswd = getprpwnam ( user ) ;
if ( mypasswd )
{
strcpy ( pass - > pw_name , mypasswd - > ufld . fd_name ) ;
strcpy ( pass - > pw_passwd , mypasswd - > ufld . fd_encrypt ) ;
}
else
{
DEBUG ( 5 , ( " No entry for user %s in protected database ! \n " , user ) ) ;
return ( False ) ;
}
}
# endif
# ifdef ULTRIX_AUTH
{
AUTHORIZATION * ap = getauthuid ( pass - > pw_uid ) ;
if ( ap )
{
strcpy ( pass - > pw_passwd , ap - > a_password ) ;
endauthent ( ) ;
}
}
# endif
/* extract relevant info */
strcpy ( this_user , pass - > pw_name ) ;
strcpy ( this_salt , pass - > pw_passwd ) ;
1998-01-23 16:52:17 +03:00
# ifdef HPUX
/* The crypt on HPUX won't work with more than 2 salt characters. */
1997-10-15 08:04:38 +04:00
this_salt [ 2 ] = 0 ;
1998-01-23 16:52:17 +03:00
# endif /* HPUX */
1996-05-04 11:50:46 +04:00
strcpy ( this_crypted , pass - > pw_passwd ) ;
if ( ! * this_crypted ) {
if ( ! lp_null_passwords ( ) ) {
DEBUG ( 2 , ( " Disallowing access to %s due to null password \n " , this_user ) ) ;
return ( False ) ;
}
# ifndef PWDAUTH
if ( ! * password ) {
DEBUG ( 3 , ( " Allowing access to %s with null password \n " , this_user ) ) ;
return ( True ) ;
}
# endif
}
/* try it as it came to us */
if ( password_check ( password ) )
{
update_protected_database ( user , True ) ;
return ( True ) ;
}
/* if the password was given to us with mixed case then we don't
need to proceed as we know it hasn ' t been case modified by the
client */
if ( strhasupper ( password ) & & strhaslower ( password ) )
return ( False ) ;
/* make a copy of it */
StrnCpy ( pass2 , password , sizeof ( pstring ) - 1 ) ;
/* try all lowercase */
strlower ( password ) ;
if ( password_check ( password ) )
{
update_protected_database ( user , True ) ;
return ( True ) ;
}
/* give up? */
1997-10-10 18:48:05 +04:00
if ( level < 1 )
1996-05-04 11:50:46 +04:00
{
update_protected_database ( user , False ) ;
/* restore it */
strcpy ( password , pass2 ) ;
return ( False ) ;
}
/* last chance - all combinations of up to level chars upper! */
strlower ( password ) ;
if ( string_combinations ( password , password_check , level ) )
{
update_protected_database ( user , True ) ;
return ( True ) ;
}
update_protected_database ( user , False ) ;
/* restore it */
strcpy ( password , pass2 ) ;
return ( False ) ;
}
/****************************************************************************
check if a username is valid
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL user_ok ( char * user , int snum )
{
pstring valid , invalid ;
BOOL ret ;
StrnCpy ( valid , lp_valid_users ( snum ) , sizeof ( pstring ) ) ;
StrnCpy ( invalid , lp_invalid_users ( snum ) , sizeof ( pstring ) ) ;
string_sub ( valid , " %S " , lp_servicename ( snum ) ) ;
string_sub ( invalid , " %S " , lp_servicename ( snum ) ) ;
ret = ! user_in_list ( user , invalid ) ;
if ( ret & & valid & & * valid )
ret = user_in_list ( user , valid ) ;
if ( ret & & lp_onlyuser ( snum ) ) {
char * user_list = lp_username ( snum ) ;
string_sub ( user_list , " %S " , lp_servicename ( snum ) ) ;
ret = user_in_list ( user , user_list ) ;
}
return ( ret ) ;
}
/****************************************************************************
validate a group username entry . Return the username or NULL
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static char * validate_group ( char * group , char * password , int pwlen , int snum )
{
# ifdef NETGROUP
{
char * host , * user , * domain ;
setnetgrent ( group ) ;
while ( getnetgrent ( & host , & user , & domain ) ) {
if ( user ) {
if ( user_ok ( user , snum ) & &
1996-10-02 18:06:17 +04:00
password_ok ( user , password , pwlen , NULL ) ) {
1996-05-04 11:50:46 +04:00
endnetgrent ( ) ;
return ( user ) ;
}
}
}
endnetgrent ( ) ;
}
# endif
# if HAVE_GETGRNAM
{
struct group * gptr = ( struct group * ) getgrnam ( group ) ;
char * * member ;
if ( gptr )
{
member = gptr - > gr_mem ;
while ( member & & * member )
{
static fstring name ;
strcpy ( name , * member ) ;
if ( user_ok ( name , snum ) & &
1996-10-02 18:06:17 +04:00
password_ok ( name , password , pwlen , NULL ) )
1996-05-04 11:50:46 +04:00
return ( & name [ 0 ] ) ;
member + + ;
}
# ifdef GROUP_CHECK_PWENT
{
struct passwd * pwd ;
static fstring tm ;
setpwent ( ) ;
while ( pwd = getpwent ( ) ) {
if ( * ( pwd - > pw_passwd ) & & pwd - > pw_gid = = gptr - > gr_gid ) {
/* This Entry have PASSWORD and same GID then check pwd */
1996-10-02 18:06:17 +04:00
if ( password_ok ( NULL , password , pwlen , pwd ) ) {
1996-05-04 11:50:46 +04:00
strcpy ( tm , pwd - > pw_name ) ;
endpwent ( ) ;
return tm ;
}
}
}
endpwent ( ) ;
}
# endif /* GROUP_CHECK_PWENT */
}
}
# endif
return ( NULL ) ;
}
/****************************************************************************
check for authority to login to a service with a given username / password
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL authorise_login ( int snum , char * user , char * password , int pwlen ,
1996-10-26 00:18:28 +04:00
BOOL * guest , BOOL * force , uint16 vuid )
1996-05-04 11:50:46 +04:00
{
BOOL ok = False ;
* guest = False ;
# if DEBUG_PASSWORD
DEBUG ( 100 , ( " checking authorisation on user=%s pass=%s \n " , user , password ) ) ;
# endif
1997-08-11 22:06:44 +04:00
/* there are several possibilities:
1996-05-04 11:50:46 +04:00
1 ) login as the given user with given password
2 ) login as a previously registered username with the given password
3 ) login as a session list username with the given password
4 ) login as a previously validated user / password pair
5 ) login as the " user = " user with given password
6 ) login as the " user = " user with no password ( guest connection )
7 ) login as guest user with no password
if the service is guest_only then steps 1 to 5 are skipped
*/
if ( GUEST_ONLY ( snum ) ) * force = True ;
if ( ! ( GUEST_ONLY ( snum ) & & GUEST_OK ( snum ) ) )
{
1996-10-26 00:18:28 +04:00
user_struct * vuser = get_valid_user_struct ( vuid ) ;
1996-05-04 11:50:46 +04:00
/* check the given username and password */
if ( ! ok & & ( * user ) & & user_ok ( user , snum ) ) {
1996-10-02 18:06:17 +04:00
ok = password_ok ( user , password , pwlen , NULL ) ;
1996-05-04 11:50:46 +04:00
if ( ok ) DEBUG ( 3 , ( " ACCEPTED: given username password ok \n " ) ) ;
}
/* check for a previously registered guest username */
1996-10-26 00:18:28 +04:00
if ( ! ok & & ( vuser ! = 0 ) & & vuser - > guest ) {
if ( user_ok ( vuser - > name , snum ) & &
password_ok ( vuser - > name , password , pwlen , NULL ) ) {
strcpy ( user , vuser - > name ) ;
vuser - > guest = False ;
1996-05-04 11:50:46 +04:00
DEBUG ( 3 , ( " ACCEPTED: given password with registered user %s \n " , user ) ) ;
ok = True ;
}
}
/* now check the list of session users */
if ( ! ok )
{
char * auser ;
char * user_list = strdup ( session_users ) ;
if ( ! user_list ) return ( False ) ;
for ( auser = strtok ( user_list , LIST_SEP ) ;
! ok & & auser ;
auser = strtok ( NULL , LIST_SEP ) )
{
fstring user2 ;
strcpy ( user2 , auser ) ;
if ( ! user_ok ( user2 , snum ) ) continue ;
1996-10-02 18:06:17 +04:00
if ( password_ok ( user2 , password , pwlen , NULL ) ) {
1996-05-04 11:50:46 +04:00
ok = True ;
strcpy ( user , user2 ) ;
DEBUG ( 3 , ( " ACCEPTED: session list username and given password ok \n " ) ) ;
}
}
free ( user_list ) ;
}
/* check for a previously validated username/password pair */
if ( ! ok & & ! lp_revalidate ( snum ) & &
1996-10-26 00:18:28 +04:00
( vuser ! = 0 ) & & ! vuser - > guest & &
user_ok ( vuser - > name , snum ) ) {
strcpy ( user , vuser - > name ) ;
1996-05-04 11:50:46 +04:00
* guest = False ;
DEBUG ( 3 , ( " ACCEPTED: validated uid ok as non-guest \n " ) ) ;
ok = True ;
}
/* check for a rhosts entry */
if ( ! ok & & user_ok ( user , snum ) & & check_hosts_equiv ( user ) ) {
ok = True ;
DEBUG ( 3 , ( " ACCEPTED: hosts equiv or rhosts entry \n " ) ) ;
}
/* check the user= fields and the given password */
if ( ! ok & & lp_username ( snum ) ) {
char * auser ;
pstring user_list ;
StrnCpy ( user_list , lp_username ( snum ) , sizeof ( pstring ) ) ;
string_sub ( user_list , " %S " , lp_servicename ( snum ) ) ;
for ( auser = strtok ( user_list , LIST_SEP ) ;
auser & & ! ok ;
auser = strtok ( NULL , LIST_SEP ) )
{
if ( * auser = = ' @ ' )
{
auser = validate_group ( auser + 1 , password , pwlen , snum ) ;
if ( auser )
{
ok = True ;
strcpy ( user , auser ) ;
DEBUG ( 3 , ( " ACCEPTED: group username and given password ok \n " ) ) ;
}
}
else
{
fstring user2 ;
strcpy ( user2 , auser ) ;
if ( user_ok ( user2 , snum ) & &
1996-10-02 18:06:17 +04:00
password_ok ( user2 , password , pwlen , NULL ) )
1996-05-04 11:50:46 +04:00
{
ok = True ;
strcpy ( user , user2 ) ;
DEBUG ( 3 , ( " ACCEPTED: user list username and given password ok \n " ) ) ;
}
}
}
}
} /* not guest only */
/* check for a normal guest connection */
if ( ! ok & & GUEST_OK ( snum ) )
{
fstring guestname ;
StrnCpy ( guestname , lp_guestaccount ( snum ) , sizeof ( guestname ) - 1 ) ;
if ( Get_Pwnam ( guestname , True ) )
{
strcpy ( user , guestname ) ;
ok = True ;
DEBUG ( 3 , ( " ACCEPTED: guest account and guest ok \n " ) ) ;
}
else
DEBUG ( 0 , ( " Invalid guest account %s?? \n " , guestname ) ) ;
* guest = True ;
* force = True ;
}
if ( ok & & ! user_ok ( user , snum ) )
{
DEBUG ( 0 , ( " rejected invalid user %s \n " , user ) ) ;
ok = False ;
}
return ( ok ) ;
}
/****************************************************************************
read the a hosts . equiv or . rhosts file and check if it
allows this user from this machine
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static BOOL check_user_equiv ( char * user , char * remote , char * equiv_file )
{
pstring buf ;
int plus_allowed = 1 ;
char * file_host ;
char * file_user ;
FILE * fp = fopen ( equiv_file , " r " ) ;
DEBUG ( 5 , ( " check_user_equiv %s %s %s \n " , user , remote , equiv_file ) ) ;
if ( ! fp ) return False ;
while ( fgets ( buf , sizeof ( buf ) , fp ) )
{
trim_string ( buf , " " , " " ) ;
if ( buf [ 0 ] ! = ' # ' & & buf [ 0 ] ! = ' \n ' )
{
BOOL is_group = False ;
int plus = 1 ;
char * bp = buf ;
if ( strcmp ( buf , " NO_PLUS \n " ) = = 0 )
{
DEBUG ( 6 , ( " check_user_equiv NO_PLUS \n " ) ) ;
plus_allowed = 0 ;
}
else {
if ( buf [ 0 ] = = ' + ' )
{
bp + + ;
if ( * bp = = ' \n ' & & plus_allowed )
{
/* a bare plus means everbody allowed */
DEBUG ( 6 , ( " check_user_equiv everybody allowed \n " ) ) ;
fclose ( fp ) ;
return True ;
}
}
else if ( buf [ 0 ] = = ' - ' )
{
bp + + ;
plus = 0 ;
}
if ( * bp = = ' @ ' )
{
is_group = True ;
bp + + ;
}
file_host = strtok ( bp , " \t \n " ) ;
file_user = strtok ( NULL , " \t \n " ) ;
1997-07-18 00:11:58 +04:00
DEBUG ( 7 , ( " check_user_equiv %s %s \n " , file_host ? file_host : " (null) " ,
file_user ? file_user : " (null) " ) ) ;
1996-05-04 11:50:46 +04:00
if ( file_host & & * file_host )
{
BOOL host_ok = False ;
# ifdef NETGROUP
if ( is_group )
{
static char * mydomain = NULL ;
if ( ! mydomain )
yp_get_default_domain ( & mydomain ) ;
1996-05-04 14:45:50 +04:00
if ( mydomain & & innetgr ( file_host , remote , user , mydomain ) )
1996-05-04 11:50:46 +04:00
host_ok = True ;
}
# else
if ( is_group )
{
DEBUG ( 1 , ( " Netgroups not configured - add -DNETGROUP and recompile \n " ) ) ;
continue ;
}
# endif
/* is it this host */
/* the fact that remote has come from a call of gethostbyaddr
* means that it may have the fully qualified domain name
* so we could look up the file version to get it into
* a canonical form , but I would rather just type it
* in full in the equiv file
*/
if ( ! host_ok & & ! is_group & & strequal ( remote , file_host ) )
host_ok = True ;
if ( ! host_ok )
continue ;
/* is it this user */
if ( file_user = = 0 | | strequal ( user , file_user ) )
{
fclose ( fp ) ;
DEBUG ( 5 , ( " check_user_equiv matched %s%s %s \n " ,
( plus ? " + " : " - " ) , file_host ,
( file_user ? file_user : " " ) ) ) ;
return ( plus ? True : False ) ;
}
}
}
}
}
fclose ( fp ) ;
return False ;
}
/****************************************************************************
check for a possible hosts equiv or rhosts entry for the user
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL check_hosts_equiv ( char * user )
{
char * fname = NULL ;
pstring rhostsfile ;
struct passwd * pass = Get_Pwnam ( user , True ) ;
if ( ! pass )
return ( False ) ;
fname = lp_hosts_equiv ( ) ;
/* note: don't allow hosts.equiv on root */
if ( fname & & * fname & & ( pass - > pw_uid ! = 0 ) )
{
1996-10-05 14:41:13 +04:00
if ( check_user_equiv ( user , client_name ( ) , fname ) )
1996-05-04 11:50:46 +04:00
return ( True ) ;
}
if ( lp_use_rhosts ( ) )
{
char * home = get_home_dir ( user ) ;
if ( home )
{
sprintf ( rhostsfile , " %s/.rhosts " , home ) ;
1996-10-05 14:41:13 +04:00
if ( check_user_equiv ( user , client_name ( ) , rhostsfile ) )
1996-05-04 11:50:46 +04:00
return ( True ) ;
}
}
return ( False ) ;
}
1997-11-10 22:23:17 +03:00
static struct cli_state cli ;
/****************************************************************************
return the client state structure
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
struct cli_state * server_client ( void )
{
return & cli ;
}
/****************************************************************************
support for server level security
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
struct cli_state * server_cryptkey ( void )
{
fstring desthost ;
struct in_addr dest_ip ;
extern fstring local_machine ;
char * p ;
if ( ! cli_initialise ( & cli ) )
return NULL ;
for ( p = strtok ( lp_passwordserver ( ) , LIST_SEP ) ; p ; p = strtok ( NULL , LIST_SEP ) ) {
fstrcpy ( desthost , p ) ;
standard_sub_basic ( desthost ) ;
strupper ( desthost ) ;
1998-03-16 23:59:47 +03:00
if ( ! resolve_name ( desthost , & dest_ip ) ) {
DEBUG ( 1 , ( " server_cryptkey: Can't resolve address for %s \n " , p ) ) ;
continue ;
}
1997-11-10 22:23:17 +03:00
if ( ismyip ( dest_ip ) ) {
DEBUG ( 1 , ( " Password server loop - disabling password server %s \n " , p ) ) ;
continue ;
}
if ( cli_connect ( & cli , desthost , & dest_ip ) ) {
DEBUG ( 3 , ( " connected to password server %s \n " , p ) ) ;
break ;
}
}
if ( ! p ) {
DEBUG ( 1 , ( " password server not available \n " ) ) ;
cli_shutdown ( & cli ) ;
return NULL ;
}
if ( ! cli_session_request ( & cli , desthost , 0x20 , local_machine ) ) {
DEBUG ( 1 , ( " %s rejected the session \n " , desthost ) ) ;
cli_shutdown ( & cli ) ;
return NULL ;
}
DEBUG ( 3 , ( " got session \n " ) ) ;
if ( ! cli_negprot ( & cli ) ) {
DEBUG ( 1 , ( " %s rejected the negprot \n " , desthost ) ) ;
cli_shutdown ( & cli ) ;
return NULL ;
}
if ( cli . protocol < PROTOCOL_LANMAN2 | |
! ( cli . sec_mode & 1 ) ) {
DEBUG ( 1 , ( " %s isn't in user level security mode \n " , desthost ) ) ;
cli_shutdown ( & cli ) ;
return NULL ;
}
DEBUG ( 3 , ( " password server OK \n " ) ) ;
return & cli ;
}
/****************************************************************************
validate a password with the password server
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL server_validate ( char * user , char * domain ,
char * pass , int passlen ,
char * ntpass , int ntpasslen )
{
extern fstring local_machine ;
if ( ! cli . initialised ) {
DEBUG ( 1 , ( " password server %s is not connected \n " , cli . desthost ) ) ;
return ( False ) ;
}
if ( ! cli_session_setup ( & cli , user , pass , passlen , ntpass , ntpasslen , domain ) ) {
DEBUG ( 1 , ( " password server %s rejected the password \n " , cli . desthost ) ) ;
return False ;
}
/* if logged in as guest then reject */
if ( ( SVAL ( cli . inbuf , smb_vwv2 ) & 1 ) ! = 0 ) {
DEBUG ( 1 , ( " password server %s gave us guest only \n " , cli . desthost ) ) ;
return ( False ) ;
}
if ( ! cli_send_tconX ( & cli , " IPC$ " , " IPC " , " " , 1 ) ) {
DEBUG ( 1 , ( " password server %s refused IPC$ connect \n " , cli . desthost ) ) ;
return False ;
}
1998-02-07 15:15:20 +03:00
/*
* This patch from Rob Nielsen < ran @ adc . com > makes doing
* the NetWksaUserLogon a dynamic , rather than compile - time
* parameter , defaulting to on . This is somewhat dangerous
* as it allows people to turn off this neccessary check ,
* but so many people have had problems with this that I
* think it is a neccessary change . JRA .
*/
if ( lp_net_wksta_user_logon ( ) ) {
DEBUG ( 3 , ( " trying NetWkstaUserLogon with password server %s \n " , cli . desthost ) ) ;
if ( ! cli_NetWkstaUserLogon ( & cli , user , local_machine ) ) {
DEBUG ( 1 , ( " password server %s failed NetWkstaUserLogon \n " , cli . desthost ) ) ;
cli_tdis ( & cli ) ;
return False ;
}
1997-11-10 22:23:17 +03:00
1998-02-07 15:15:20 +03:00
if ( cli . privilages = = 0 ) {
DEBUG ( 1 , ( " password server %s gave guest privilages \n " , cli . desthost ) ) ;
cli_tdis ( & cli ) ;
return False ;
}
1997-11-10 22:23:17 +03:00
1998-02-07 15:15:20 +03:00
if ( ! strequal ( cli . eff_name , user ) ) {
DEBUG ( 1 , ( " password server %s gave different username %s \n " ,
cli . desthost ,
cli . eff_name ) ) ;
cli_tdis ( & cli ) ;
return False ;
}
1997-11-10 22:23:17 +03:00
}
1998-02-07 15:15:20 +03:00
else {
DEBUG ( 3 , ( " skipping NetWkstaUserLogon with password server %s \n " , cli . desthost ) ) ;
}
1997-11-10 22:23:17 +03:00
DEBUG ( 3 , ( " password server %s accepted the password \n " , cli . desthost ) ) ;
cli_tdis ( & cli ) ;
return ( True ) ;
}