2003-07-01 21:51:52 +04:00
/*
2002-01-30 09:08:46 +03:00
Unix SMB / CIFS implementation .
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
Authentication utility functions
Copyright ( C ) Andrew Tridgell 1992 - 1998
2011-07-18 16:26:31 +04:00
Copyright ( C ) Andrew Bartlett 2001 - 2011
2001-11-04 02:34:24 +03:00
Copyright ( C ) Jeremy Allison 2000 - 2001
2002-09-25 19:19:00 +04:00
Copyright ( C ) Rafal Szczesniak 2002
2011-07-18 06:38:05 +04:00
Copyright ( C ) Volker Lendecke 2006 - 2008
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
2007-07-09 23:25:36 +04:00
the Free Software Foundation ; either version 3 of the License , or
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
( at your option ) any later version .
2010-02-17 00:07:22 +03:00
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
2010-02-17 00:07:22 +03:00
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
You should have received a copy of the GNU General Public License
2007-07-10 04:52:41 +04:00
along with this program . If not , see < http : //www.gnu.org/licenses/>.
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
*/
2001-10-02 08:29:50 +04:00
# include "includes.h"
2011-03-25 04:28:05 +03:00
# include "auth.h"
2016-12-27 15:52:00 +03:00
# include "lib/util_unixsids.h"
2009-03-16 13:27:58 +03:00
# include "../libcli/auth/libcli_auth.h"
2010-05-18 02:16:40 +04:00
# include "../lib/crypto/arcfour.h"
2010-08-18 19:17:42 +04:00
# include "rpc_client/init_lsa.h"
2010-10-12 08:27:50 +04:00
# include "../libcli/security/security.h"
2011-03-02 18:11:00 +03:00
# include "../lib/util/util_pw.h"
2011-02-25 00:30:16 +03:00
# include "lib/winbind_util.h"
2011-03-22 18:50:02 +03:00
# include "passdb.h"
2011-07-18 06:38:05 +04:00
# include "../librpc/gen_ndr/ndr_auth.h"
2011-07-18 06:58:25 +04:00
# include "../auth/auth_sam_reply.h"
2012-03-23 10:30:34 +04:00
# include "../librpc/gen_ndr/idmap.h"
2012-07-23 06:47:01 +04:00
# include "lib/param/loadparm.h"
2016-03-01 12:25:54 +03:00
# include "../lib/tsocket/tsocket.h"
2017-12-03 00:35:36 +03:00
# include "rpc_client/util_netlogon.h"
2018-03-07 02:51:51 +03:00
# include "source4/auth/auth.h"
2018-08-30 17:33:25 +03:00
# include "auth/auth_util.h"
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
2002-07-15 14:35:28 +04:00
# undef DBGC_CLASS
# define DBGC_CLASS DBGC_AUTH
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
/****************************************************************************
Create a UNIX user on demand .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2009-04-01 23:42:47 +04:00
static int _smb_create_user ( const char * domain , const char * unix_username , const char * homedir )
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
{
2007-11-14 21:37:18 +03:00
TALLOC_CTX * ctx = talloc_tos ( ) ;
char * add_script ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
int ret ;
2014-02-04 06:09:00 +04:00
add_script = lp_add_user_script ( ctx ) ;
2007-11-14 21:37:18 +03:00
if ( ! add_script | | ! * add_script ) {
2001-11-04 02:34:24 +03:00
return - 1 ;
2007-11-14 21:37:18 +03:00
}
add_script = talloc_all_string_sub ( ctx ,
add_script ,
" %u " ,
unix_username ) ;
if ( ! add_script ) {
return - 1 ;
}
if ( domain ) {
add_script = talloc_all_string_sub ( ctx ,
add_script ,
" %D " ,
domain ) ;
if ( ! add_script ) {
return - 1 ;
}
}
if ( homedir ) {
add_script = talloc_all_string_sub ( ctx ,
add_script ,
" %H " ,
homedir ) ;
if ( ! add_script ) {
return - 1 ;
}
}
2016-10-12 18:55:15 +03:00
ret = smbrun ( add_script , NULL , NULL ) ;
2005-03-03 19:52:44 +03:00
flush_pwnam_cache ( ) ;
2007-11-14 21:37:18 +03:00
DEBUG ( ret ? 0 : 3 ,
( " smb_create_user: Running the command `%s' gave %d \n " ,
add_script , ret ) ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
return ret ;
}
2001-10-31 13:46:25 +03:00
/****************************************************************************
Create an auth_usersupplied_data structure after appropriate mapping .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2014-03-27 00:17:15 +04:00
NTSTATUS make_user_info_map ( TALLOC_CTX * mem_ctx ,
struct auth_usersupplied_info * * user_info ,
2009-02-11 02:50:39 +03:00
const char * smb_name ,
const char * client_domain ,
2010-06-01 05:23:50 +04:00
const char * workstation_name ,
2011-06-08 20:55:37 +04:00
const struct tsocket_address * remote_address ,
2017-02-24 03:29:12 +03:00
const struct tsocket_address * local_address ,
2017-02-20 04:52:07 +03:00
const char * service_description ,
2012-01-30 15:44:28 +04:00
const DATA_BLOB * lm_pwd ,
const DATA_BLOB * nt_pwd ,
2010-06-01 15:52:01 +04:00
const struct samr_Password * lm_interactive_pwd ,
const struct samr_Password * nt_interactive_pwd ,
const char * plaintext ,
enum auth_password_state password_state )
2001-10-31 13:46:25 +03:00
{
2001-11-11 14:34:46 +03:00
const char * domain ;
2006-05-06 23:24:35 +04:00
NTSTATUS result ;
2007-10-19 04:40:25 +04:00
bool was_mapped ;
2010-11-09 23:07:25 +03:00
char * internal_username = NULL ;
was_mapped = map_username ( talloc_tos ( ) , smb_name , & internal_username ) ;
if ( ! internal_username ) {
return NT_STATUS_NO_MEMORY ;
}
2009-02-11 02:50:39 +03:00
DEBUG ( 5 , ( " Mapping user [%s] \\ [%s] from workstation [%s] \n " ,
2010-06-01 05:23:50 +04:00
client_domain , smb_name , workstation_name ) ) ;
2009-02-11 02:50:39 +03:00
2017-06-12 16:35:41 +03:00
/*
* We let the auth stack canonicalize , username
* and domain .
*/
2009-05-28 04:14:49 +04:00
domain = client_domain ;
2002-01-18 11:12:10 +03:00
2014-03-27 00:17:15 +04:00
result = make_user_info ( mem_ctx , user_info , smb_name , internal_username ,
2017-02-20 04:52:07 +03:00
client_domain , domain , workstation_name ,
2017-02-24 03:29:12 +03:00
remote_address , local_address ,
service_description , lm_pwd , nt_pwd ,
2017-02-20 04:52:07 +03:00
lm_interactive_pwd , nt_interactive_pwd ,
plaintext , password_state ) ;
2006-05-06 23:24:35 +04:00
if ( NT_STATUS_IS_OK ( result ) ) {
2010-06-01 15:52:01 +04:00
/* We have tried mapping */
2011-07-19 14:15:12 +04:00
( * user_info ) - > mapped_state = true ;
2010-06-01 15:52:01 +04:00
/* did we actually map the user to a different name? */
2006-05-06 23:24:35 +04:00
( * user_info ) - > was_mapped = was_mapped ;
}
return result ;
2001-10-31 13:46:25 +03:00
}
/****************************************************************************
Create an auth_usersupplied_data , making the DATA_BLOBs here .
2001-11-22 00:10:13 +03:00
Decrypt and encrypt the passwords .
2001-10-31 13:46:25 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2014-03-27 00:17:15 +04:00
bool make_user_info_netlogon_network ( TALLOC_CTX * mem_ctx ,
struct auth_usersupplied_info * * user_info ,
2002-01-20 11:58:21 +03:00
const char * smb_name ,
const char * client_domain ,
2010-06-01 05:23:50 +04:00
const char * workstation_name ,
2011-06-08 20:55:37 +04:00
const struct tsocket_address * remote_address ,
2017-02-24 03:29:12 +03:00
const struct tsocket_address * local_address ,
2015-05-11 04:17:56 +03:00
uint32_t logon_parameters ,
2006-02-04 01:19:41 +03:00
const uchar * lm_network_pwd ,
int lm_pwd_len ,
const uchar * nt_network_pwd ,
int nt_pwd_len )
2001-10-31 13:46:25 +03:00
{
2007-10-19 04:40:25 +04:00
bool ret ;
2006-02-04 01:19:41 +03:00
NTSTATUS status ;
2001-10-31 13:46:25 +03:00
DATA_BLOB lm_blob = data_blob ( lm_network_pwd , lm_pwd_len ) ;
DATA_BLOB nt_blob = data_blob ( nt_network_pwd , nt_pwd_len ) ;
2001-11-01 08:02:41 +03:00
2014-03-27 00:17:15 +04:00
status = make_user_info_map ( mem_ctx , user_info ,
2006-02-04 01:19:41 +03:00
smb_name , client_domain ,
2010-06-01 05:23:50 +04:00
workstation_name ,
2011-06-08 20:55:37 +04:00
remote_address ,
2017-02-24 03:29:12 +03:00
local_address ,
2017-02-20 04:52:07 +03:00
" SamLogon " ,
2006-02-04 01:19:41 +03:00
lm_pwd_len ? & lm_blob : NULL ,
nt_pwd_len ? & nt_blob : NULL ,
NULL , NULL , NULL ,
2010-06-01 15:52:01 +04:00
AUTH_PASSWORD_RESPONSE ) ;
2005-11-08 09:19:34 +03:00
2006-02-04 01:19:41 +03:00
if ( NT_STATUS_IS_OK ( status ) ) {
2005-11-08 09:19:34 +03:00
( * user_info ) - > logon_parameters = logon_parameters ;
}
2011-07-19 14:15:45 +04:00
ret = NT_STATUS_IS_OK ( status ) ? true : false ;
2005-11-08 09:19:34 +03:00
2001-10-31 13:46:25 +03:00
data_blob_free ( & lm_blob ) ;
data_blob_free ( & nt_blob ) ;
return ret ;
}
/****************************************************************************
Create an auth_usersupplied_data , making the DATA_BLOBs here .
2001-11-22 00:10:13 +03:00
Decrypt and encrypt the passwords .
2001-10-31 13:46:25 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2014-03-27 00:17:15 +04:00
bool make_user_info_netlogon_interactive ( TALLOC_CTX * mem_ctx ,
struct auth_usersupplied_info * * user_info ,
2002-01-05 07:55:41 +03:00
const char * smb_name ,
const char * client_domain ,
2010-06-01 05:23:50 +04:00
const char * workstation_name ,
2011-06-08 20:55:37 +04:00
const struct tsocket_address * remote_address ,
2017-02-24 03:29:12 +03:00
const struct tsocket_address * local_address ,
2015-05-11 04:17:56 +03:00
uint32_t logon_parameters ,
2002-01-05 07:55:41 +03:00
const uchar chal [ 8 ] ,
const uchar lm_interactive_pwd [ 16 ] ,
2012-12-05 22:49:52 +04:00
const uchar nt_interactive_pwd [ 16 ] )
2001-10-31 13:46:25 +03:00
{
2010-06-01 15:52:01 +04:00
struct samr_Password lm_pwd ;
struct samr_Password nt_pwd ;
2001-10-31 13:46:25 +03:00
unsigned char local_lm_response [ 24 ] ;
unsigned char local_nt_response [ 24 ] ;
2010-02-17 00:07:22 +03:00
2006-02-04 01:19:41 +03:00
if ( lm_interactive_pwd )
2010-06-01 15:52:01 +04:00
memcpy ( lm_pwd . hash , lm_interactive_pwd , sizeof ( lm_pwd . hash ) ) ;
2006-02-04 01:19:41 +03:00
if ( nt_interactive_pwd )
2010-06-01 15:52:01 +04:00
memcpy ( nt_pwd . hash , nt_interactive_pwd , sizeof ( nt_pwd . hash ) ) ;
2010-02-17 00:07:22 +03:00
2004-04-03 19:41:32 +04:00
if ( lm_interactive_pwd )
2010-06-01 15:52:01 +04:00
SMBOWFencrypt ( lm_pwd . hash , chal ,
2006-02-04 01:19:41 +03:00
local_lm_response ) ;
2004-04-03 19:41:32 +04:00
if ( nt_interactive_pwd )
2010-06-01 15:52:01 +04:00
SMBOWFencrypt ( nt_pwd . hash , chal ,
2006-02-04 01:19:41 +03:00
local_nt_response ) ;
2010-02-17 00:07:22 +03:00
2001-10-31 13:46:25 +03:00
{
2007-10-19 04:40:25 +04:00
bool ret ;
2002-09-25 19:19:00 +04:00
NTSTATUS nt_status ;
2012-12-06 21:13:23 +04:00
DATA_BLOB local_lm_blob = data_blob_null ;
DATA_BLOB local_nt_blob = data_blob_null ;
2001-10-31 13:46:25 +03:00
2004-04-03 19:41:32 +04:00
if ( lm_interactive_pwd ) {
2006-02-04 01:19:41 +03:00
local_lm_blob = data_blob ( local_lm_response ,
sizeof ( local_lm_response ) ) ;
2004-04-03 19:41:32 +04:00
}
2010-02-17 00:07:22 +03:00
2004-04-03 19:41:32 +04:00
if ( nt_interactive_pwd ) {
2006-02-04 01:19:41 +03:00
local_nt_blob = data_blob ( local_nt_response ,
sizeof ( local_nt_response ) ) ;
2004-04-03 19:41:32 +04:00
}
2001-11-01 08:02:41 +03:00
2006-02-04 01:19:41 +03:00
nt_status = make_user_info_map (
2014-03-27 00:17:15 +04:00
mem_ctx ,
2006-02-04 01:19:41 +03:00
user_info ,
2010-06-01 05:23:50 +04:00
smb_name , client_domain , workstation_name ,
2011-06-08 20:55:37 +04:00
remote_address ,
2017-02-24 03:29:12 +03:00
local_address ,
2017-02-20 04:52:07 +03:00
" SamLogon " ,
2006-02-04 01:19:41 +03:00
lm_interactive_pwd ? & local_lm_blob : NULL ,
nt_interactive_pwd ? & local_nt_blob : NULL ,
2010-06-01 15:52:01 +04:00
lm_interactive_pwd ? & lm_pwd : NULL ,
nt_interactive_pwd ? & nt_pwd : NULL ,
NULL , AUTH_PASSWORD_HASH ) ;
2004-04-03 19:41:32 +04:00
2005-11-08 09:19:34 +03:00
if ( NT_STATUS_IS_OK ( nt_status ) ) {
( * user_info ) - > logon_parameters = logon_parameters ;
}
2011-07-19 14:15:45 +04:00
ret = NT_STATUS_IS_OK ( nt_status ) ? true : false ;
2001-10-31 13:46:25 +03:00
data_blob_free ( & local_lm_blob ) ;
data_blob_free ( & local_nt_blob ) ;
return ret ;
}
}
/****************************************************************************
Create an auth_usersupplied_data structure
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2014-03-27 00:17:15 +04:00
bool make_user_info_for_reply ( TALLOC_CTX * mem_ctx ,
struct auth_usersupplied_info * * user_info ,
2002-01-20 11:58:21 +03:00
const char * smb_name ,
const char * client_domain ,
2011-06-08 20:55:37 +04:00
const struct tsocket_address * remote_address ,
2017-02-24 03:29:12 +03:00
const struct tsocket_address * local_address ,
2017-02-20 04:52:07 +03:00
const char * service_description ,
2015-05-11 04:17:56 +03:00
const uint8_t chal [ 8 ] ,
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
DATA_BLOB plaintext_password )
2001-10-31 13:46:25 +03:00
{
DATA_BLOB local_lm_blob ;
DATA_BLOB local_nt_blob ;
2002-09-25 19:19:00 +04:00
NTSTATUS ret = NT_STATUS_UNSUCCESSFUL ;
2010-06-01 15:52:01 +04:00
char * plaintext_password_string ;
2001-10-31 13:46:25 +03:00
/*
* Not encrypted - do so .
*/
2010-02-17 00:07:22 +03:00
2006-02-04 01:19:41 +03:00
DEBUG ( 5 , ( " make_user_info_for_reply: User passwords not in encrypted "
" format. \n " ) ) ;
2010-03-22 23:05:29 +03:00
if ( plaintext_password . data & & plaintext_password . length ) {
2001-10-31 13:46:25 +03:00
unsigned char local_lm_response [ 24 ] ;
2010-02-17 00:07:22 +03:00
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
# ifdef DEBUG_PASSWORD
2006-02-04 01:19:41 +03:00
DEBUG ( 10 , ( " Unencrypted password (len %d): \n " ,
( int ) plaintext_password . length ) ) ;
2007-03-28 17:34:59 +04:00
dump_data ( 100 , plaintext_password . data ,
2006-02-04 01:19:41 +03:00
plaintext_password . length ) ;
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
# endif
2001-10-31 13:46:25 +03:00
2006-02-04 01:19:41 +03:00
SMBencrypt ( ( const char * ) plaintext_password . data ,
( const uchar * ) chal , local_lm_response ) ;
2001-10-31 13:46:25 +03:00
local_lm_blob = data_blob ( local_lm_response , 24 ) ;
2010-02-17 00:07:22 +03:00
2001-11-22 00:10:13 +03:00
/* We can't do an NT hash here, as the password needs to be
case insensitive */
2007-05-14 16:16:20 +04:00
local_nt_blob = data_blob_null ;
2001-10-31 13:46:25 +03:00
} else {
2007-05-14 16:16:20 +04:00
local_lm_blob = data_blob_null ;
local_nt_blob = data_blob_null ;
2001-10-31 13:46:25 +03:00
}
2010-02-17 00:07:22 +03:00
2010-06-01 15:52:01 +04:00
plaintext_password_string = talloc_strndup ( talloc_tos ( ) ,
( const char * ) plaintext_password . data ,
plaintext_password . length ) ;
if ( ! plaintext_password_string ) {
2011-07-19 14:15:45 +04:00
return false ;
2010-06-01 15:52:01 +04:00
}
2014-03-27 00:17:15 +04:00
ret = make_user_info ( mem_ctx ,
2012-02-03 10:09:37 +04:00
user_info , smb_name , smb_name , client_domain , client_domain ,
2006-02-04 01:19:41 +03:00
get_remote_machine_name ( ) ,
2011-06-08 20:55:37 +04:00
remote_address ,
2017-02-24 03:29:12 +03:00
local_address ,
2017-02-20 04:52:07 +03:00
service_description ,
2006-02-04 01:19:41 +03:00
local_lm_blob . data ? & local_lm_blob : NULL ,
local_nt_blob . data ? & local_nt_blob : NULL ,
NULL , NULL ,
2010-06-01 15:52:01 +04:00
plaintext_password_string ,
AUTH_PASSWORD_PLAIN ) ;
if ( plaintext_password_string ) {
memset ( plaintext_password_string , ' \0 ' , strlen ( plaintext_password_string ) ) ;
talloc_free ( plaintext_password_string ) ;
}
2010-02-17 00:07:22 +03:00
2001-10-31 13:46:25 +03:00
data_blob_free ( & local_lm_blob ) ;
2011-07-19 14:15:45 +04:00
return NT_STATUS_IS_OK ( ret ) ? true : false ;
2001-10-31 13:46:25 +03:00
}
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
/****************************************************************************
Create an auth_usersupplied_data structure
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2014-03-27 00:17:15 +04:00
NTSTATUS make_user_info_for_reply_enc ( TALLOC_CTX * mem_ctx ,
struct auth_usersupplied_info * * user_info ,
2002-09-25 19:19:00 +04:00
const char * smb_name ,
2011-06-08 20:55:37 +04:00
const char * client_domain ,
const struct tsocket_address * remote_address ,
2017-02-24 03:29:12 +03:00
const struct tsocket_address * local_address ,
2017-02-20 04:52:07 +03:00
const char * service_description ,
DATA_BLOB lm_resp , DATA_BLOB nt_resp )
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
{
2016-03-01 12:25:54 +03:00
bool allow_raw = lp_raw_ntlmv2_auth ( ) ;
if ( ! allow_raw & & nt_resp . length > = 48 ) {
/*
* NTLMv2_RESPONSE has at least 48 bytes
* and should only be supported via NTLMSSP .
*/
DEBUG ( 2 , ( " Rejecting raw NTLMv2 authentication with "
" user [%s \\ %s] from[%s] \n " ,
client_domain , smb_name ,
tsocket_address_string ( remote_address , mem_ctx ) ) ) ;
return NT_STATUS_INVALID_PARAMETER ;
}
2014-03-27 00:17:15 +04:00
return make_user_info ( mem_ctx ,
user_info , smb_name , smb_name ,
2017-02-24 03:29:12 +03:00
client_domain , client_domain ,
2012-02-03 10:09:37 +04:00
get_remote_machine_name ( ) ,
remote_address ,
2017-02-24 03:29:12 +03:00
local_address ,
2017-02-20 04:52:07 +03:00
service_description ,
2012-02-03 10:09:37 +04:00
lm_resp . data & & ( lm_resp . length > 0 ) ? & lm_resp : NULL ,
nt_resp . data & & ( nt_resp . length > 0 ) ? & nt_resp : NULL ,
NULL , NULL , NULL ,
AUTH_PASSWORD_RESPONSE ) ;
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
}
2001-11-09 01:19:01 +03:00
/****************************************************************************
2011-07-19 14:11:22 +04:00
Create a guest user_info blob , for anonymous authentication .
2001-11-09 01:19:01 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2014-03-27 00:17:15 +04:00
bool make_user_info_guest ( TALLOC_CTX * mem_ctx ,
const struct tsocket_address * remote_address ,
2017-02-24 03:29:12 +03:00
const struct tsocket_address * local_address ,
2017-02-20 04:52:07 +03:00
const char * service_description ,
2011-06-08 20:55:37 +04:00
struct auth_usersupplied_info * * user_info )
2001-11-09 01:19:01 +03:00
{
2002-09-25 19:19:00 +04:00
NTSTATUS nt_status ;
2001-11-09 01:19:01 +03:00
2014-03-27 00:17:15 +04:00
nt_status = make_user_info ( mem_ctx ,
user_info ,
2004-04-03 19:41:32 +04:00
" " , " " ,
" " , " " ,
" " ,
2011-06-08 20:55:37 +04:00
remote_address ,
2017-02-24 03:29:12 +03:00
local_address ,
2017-02-20 04:52:07 +03:00
service_description ,
2004-04-03 19:41:32 +04:00
NULL , NULL ,
NULL , NULL ,
NULL ,
2010-06-01 15:52:01 +04:00
AUTH_PASSWORD_RESPONSE ) ;
2010-02-17 00:07:22 +03:00
2011-07-19 14:15:45 +04:00
return NT_STATUS_IS_OK ( nt_status ) ? true : false ;
2002-09-25 19:19:00 +04:00
}
2010-08-26 16:08:22 +04:00
static NTSTATUS log_nt_token ( struct security_token * token )
2006-02-04 01:19:41 +03:00
{
2008-08-15 01:36:02 +04:00
TALLOC_CTX * frame = talloc_stackframe ( ) ;
2006-02-04 01:19:41 +03:00
char * command ;
char * group_sidstr ;
size_t i ;
2012-07-18 09:37:23 +04:00
if ( ( lp_log_nt_token_command ( frame ) = = NULL ) | |
( strlen ( lp_log_nt_token_command ( frame ) ) = = 0 ) ) {
2008-08-15 01:36:02 +04:00
TALLOC_FREE ( frame ) ;
2006-02-04 01:19:41 +03:00
return NT_STATUS_OK ;
2005-02-11 13:32:46 +03:00
}
2008-08-15 01:36:02 +04:00
group_sidstr = talloc_strdup ( frame , " " ) ;
2006-02-04 01:19:41 +03:00
for ( i = 1 ; i < token - > num_sids ; i + + ) {
group_sidstr = talloc_asprintf (
2008-08-15 01:36:02 +04:00
frame , " %s %s " , group_sidstr ,
2010-08-31 03:32:52 +04:00
sid_string_talloc ( frame , & token - > sids [ i ] ) ) ;
2006-02-04 01:19:41 +03:00
}
2002-09-25 19:19:00 +04:00
2006-02-04 01:19:41 +03:00
command = talloc_string_sub (
2012-07-18 09:37:23 +04:00
frame , lp_log_nt_token_command ( frame ) ,
2010-08-31 03:32:52 +04:00
" %s " , sid_string_talloc ( frame , & token - > sids [ 0 ] ) ) ;
2008-08-15 01:36:02 +04:00
command = talloc_string_sub ( frame , command , " %t " , group_sidstr ) ;
2002-09-25 19:19:00 +04:00
2006-02-04 01:19:41 +03:00
if ( command = = NULL ) {
2008-08-15 01:36:02 +04:00
TALLOC_FREE ( frame ) ;
2006-02-04 01:19:41 +03:00
return NT_STATUS_NO_MEMORY ;
}
DEBUG ( 8 , ( " running command: [%s] \n " , command ) ) ;
2016-10-12 18:55:15 +03:00
if ( smbrun ( command , NULL , NULL ) ! = 0 ) {
2006-02-04 01:19:41 +03:00
DEBUG ( 0 , ( " Could not log NT token \n " ) ) ;
2008-08-15 01:36:02 +04:00
TALLOC_FREE ( frame ) ;
2006-02-04 01:19:41 +03:00
return NT_STATUS_ACCESS_DENIED ;
}
2008-08-15 01:36:02 +04:00
TALLOC_FREE ( frame ) ;
2006-02-04 01:19:41 +03:00
return NT_STATUS_OK ;
}
2002-09-25 19:19:00 +04:00
2006-02-04 01:19:41 +03:00
/*
2010-05-27 11:41:56 +04:00
* Create the token to use from server_info - > info3 and
2006-02-04 01:19:41 +03:00
* server_info - > sids ( the info3 / sam groups ) . Find the unix gids .
*/
2005-09-30 21:13:37 +04:00
2011-02-11 03:50:37 +03:00
NTSTATUS create_local_token ( TALLOC_CTX * mem_ctx ,
2011-04-06 00:46:26 +04:00
const struct auth_serversupplied_info * server_info ,
2011-02-11 03:50:37 +03:00
DATA_BLOB * session_key ,
2011-07-26 07:37:36 +04:00
const char * smb_username , /* for ->sanitized_username, for %U subs */
2011-07-18 07:06:47 +04:00
struct auth_session_info * * session_info_out )
2005-09-30 21:13:37 +04:00
{
2011-03-23 20:31:38 +03:00
struct security_token * t ;
2006-02-04 01:19:41 +03:00
NTSTATUS status ;
size_t i ;
2009-02-11 13:46:18 +03:00
struct dom_sid tmp_sid ;
2011-07-18 07:06:47 +04:00
struct auth_session_info * session_info ;
2012-03-23 10:30:34 +04:00
struct unixid * ids ;
2011-07-26 07:37:36 +04:00
fstring tmp ;
2011-02-11 03:50:37 +03:00
/* Ensure we can't possible take a code path leading to a
* null defref . */
if ( ! server_info ) {
return NT_STATUS_LOGON_FAILURE ;
}
2018-03-02 19:07:11 +03:00
if ( server_info - > cached_session_info ! = NULL ) {
session_info = copy_session_info ( mem_ctx ,
server_info - > cached_session_info ) ;
if ( session_info = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
/* This is a potentially untrusted username for use in %U */
alpha_strcpy ( tmp , smb_username , " . _-$ " , sizeof ( tmp ) ) ;
session_info - > unix_info - > sanitized_username =
talloc_strdup ( session_info - > unix_info , tmp ) ;
if ( session_info - > unix_info - > sanitized_username = = NULL ) {
TALLOC_FREE ( session_info ) ;
return NT_STATUS_NO_MEMORY ;
}
2018-04-09 21:44:00 +03:00
session_info - > unique_session_token = GUID_random ( ) ;
2018-03-02 19:07:11 +03:00
* session_info_out = session_info ;
return NT_STATUS_OK ;
}
2011-07-19 09:58:20 +04:00
session_info = talloc_zero ( mem_ctx , struct auth_session_info ) ;
2011-02-11 03:50:37 +03:00
if ( ! session_info ) {
return NT_STATUS_NO_MEMORY ;
}
2011-07-18 05:40:36 +04:00
session_info - > unix_token = talloc_zero ( session_info , struct security_unix_token ) ;
2011-07-18 05:30:55 +04:00
if ( ! session_info - > unix_token ) {
TALLOC_FREE ( session_info ) ;
return NT_STATUS_NO_MEMORY ;
}
session_info - > unix_token - > uid = server_info - > utok . uid ;
session_info - > unix_token - > gid = server_info - > utok . gid ;
session_info - > unix_info = talloc_zero ( session_info , struct auth_user_info_unix ) ;
if ( ! session_info - > unix_info ) {
TALLOC_FREE ( session_info ) ;
return NT_STATUS_NO_MEMORY ;
}
session_info - > unix_info - > unix_name = talloc_strdup ( session_info , server_info - > unix_name ) ;
if ( ! session_info - > unix_info - > unix_name ) {
TALLOC_FREE ( session_info ) ;
return NT_STATUS_NO_MEMORY ;
}
2011-07-26 07:37:36 +04:00
/* This is a potentially untrusted username for use in %U */
alpha_strcpy ( tmp , smb_username , " . _-$ " , sizeof ( tmp ) ) ;
session_info - > unix_info - > sanitized_username =
talloc_strdup ( session_info - > unix_info , tmp ) ;
2011-07-18 05:30:55 +04:00
2011-02-11 03:50:37 +03:00
if ( session_key ) {
2011-02-14 03:35:21 +03:00
data_blob_free ( & session_info - > session_key ) ;
session_info - > session_key = data_blob_talloc ( session_info ,
2011-02-11 03:50:37 +03:00
session_key - > data ,
session_key - > length ) ;
2011-02-14 03:35:21 +03:00
if ( ! session_info - > session_key . data & & session_key - > length ) {
2011-02-11 03:50:37 +03:00
return NT_STATUS_NO_MEMORY ;
}
2011-07-18 05:40:36 +04:00
} else {
session_info - > session_key = data_blob_talloc ( session_info , server_info - > session_key . data ,
server_info - > session_key . length ) ;
2011-02-11 03:50:37 +03:00
}
2011-12-21 10:26:23 +04:00
/* We need to populate session_info->info with the information found in server_info->info3 */
status = make_user_info_SamBaseInfo ( session_info , " " , & server_info - > info3 - > base ,
server_info - > guest = = false ,
& session_info - > info ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 0 , ( " conversion of info3 into auth_user_info failed! \n " ) ) ;
TALLOC_FREE ( session_info ) ;
return status ;
}
2006-07-13 20:28:38 +04:00
/*
* If winbind is not around , we can not make much use of the SIDs the
* domain controller provided us with . Likewise if the user name was
* mapped to some local unix user .
*/
2006-08-04 04:00:15 +04:00
if ( ( ( lp_server_role ( ) = = ROLE_DOMAIN_MEMBER ) & & ! winbind_ping ( ) ) | |
2011-07-15 11:57:35 +04:00
( server_info - > nss_token ) ) {
2011-07-22 01:02:10 +04:00
char * found_username = NULL ;
2011-02-11 03:50:37 +03:00
status = create_token_from_username ( session_info ,
2011-07-18 04:14:19 +04:00
server_info - > unix_name ,
server_info - > guest ,
2011-07-15 08:59:14 +04:00
& session_info - > unix_token - > uid ,
& session_info - > unix_token - > gid ,
2011-07-22 01:02:10 +04:00
& found_username ,
2011-02-11 03:50:37 +03:00
& session_info - > security_token ) ;
2011-07-22 01:02:10 +04:00
if ( NT_STATUS_IS_OK ( status ) ) {
session_info - > unix_info - > unix_name = found_username ;
}
2006-05-06 23:24:35 +04:00
} else {
2011-02-11 03:50:37 +03:00
status = create_local_nt_token_from_info3 ( session_info ,
2011-07-18 04:14:19 +04:00
server_info - > guest ,
server_info - > info3 ,
& server_info - > extra ,
2011-02-11 03:50:37 +03:00
& session_info - > security_token ) ;
2006-03-08 18:18:14 +03:00
}
2006-07-13 19:03:46 +04:00
2006-07-13 19:37:58 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
return status ;
}
2008-08-15 01:36:02 +04:00
2006-02-04 01:19:41 +03:00
/* Convert the SIDs to gids. */
2011-07-15 08:59:14 +04:00
session_info - > unix_token - > ngroups = 0 ;
session_info - > unix_token - > groups = NULL ;
2006-02-04 01:19:41 +03:00
2011-03-23 20:31:38 +03:00
t = session_info - > security_token ;
2012-03-23 10:30:34 +04:00
ids = talloc_array ( talloc_tos ( ) , struct unixid ,
2011-03-23 20:31:38 +03:00
t - > num_sids ) ;
if ( ids = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
2012-05-02 11:48:28 +04:00
if ( ! sids_to_unixids ( t - > sids , t - > num_sids , ids ) ) {
2011-03-23 20:31:38 +03:00
TALLOC_FREE ( ids ) ;
return NT_STATUS_NO_MEMORY ;
}
2011-10-12 22:52:09 +04:00
for ( i = 0 ; i < t - > num_sids ; i + + ) {
2006-02-04 01:19:41 +03:00
2012-03-23 10:30:34 +04:00
if ( i = = 0 & & ids [ i ] . type ! = ID_TYPE_BOTH ) {
2011-10-12 22:52:09 +04:00
continue ;
}
2006-02-04 01:19:41 +03:00
2012-03-23 10:30:34 +04:00
if ( ids [ i ] . type ! = ID_TYPE_GID & &
ids [ i ] . type ! = ID_TYPE_BOTH ) {
2007-04-20 02:26:09 +04:00
DEBUG ( 10 , ( " Could not convert SID %s to gid, "
2011-03-23 20:31:38 +03:00
" ignoring it \n " ,
sid_string_dbg ( & t - > sids [ i ] ) ) ) ;
2007-04-20 02:26:09 +04:00
continue ;
2006-12-09 05:58:18 +03:00
}
2017-10-04 16:04:01 +03:00
if ( ! add_gid_to_array_unique ( session_info - > unix_token ,
ids [ i ] . id ,
2011-07-15 08:59:14 +04:00
& session_info - > unix_token - > groups ,
& session_info - > unix_token - > ngroups ) ) {
2011-03-16 20:45:50 +03:00
return NT_STATUS_NO_MEMORY ;
}
2006-02-04 01:19:41 +03:00
}
2009-02-11 13:46:18 +03:00
/*
* Add the " Unix Group " SID for each gid to catch mapped groups
* and their Unix equivalent . This is to solve the backwards
* compatibility problem of ' valid users = + ntadmin ' where
* ntadmin has been paired with " Domain Admins " in the group
* mapping table . Otherwise smb . conf would need to be changed
* to ' valid user = " Domain Admins " ' . - - jerry
*
* For consistency we also add the " Unix User " SID ,
* so that the complete unix token is represented within
* the nt token .
*/
2011-07-15 08:59:14 +04:00
uid_to_unix_users_sid ( session_info - > unix_token - > uid , & tmp_sid ) ;
2018-03-02 18:37:58 +03:00
add_sid_to_array_unique ( session_info - > security_token , & tmp_sid ,
& session_info - > security_token - > sids ,
& session_info - > security_token - > num_sids ) ;
2010-07-11 19:30:53 +04:00
2018-03-02 18:37:58 +03:00
gid_to_unix_groups_sid ( session_info - > unix_token - > gid , & tmp_sid ) ;
2011-02-11 03:50:37 +03:00
add_sid_to_array_unique ( session_info - > security_token , & tmp_sid ,
& session_info - > security_token - > sids ,
& session_info - > security_token - > num_sids ) ;
2009-02-11 13:46:18 +03:00
2011-07-15 08:59:14 +04:00
for ( i = 0 ; i < session_info - > unix_token - > ngroups ; i + + ) {
gid_to_unix_groups_sid ( session_info - > unix_token - > groups [ i ] , & tmp_sid ) ;
2011-02-11 03:50:37 +03:00
add_sid_to_array_unique ( session_info - > security_token , & tmp_sid ,
& session_info - > security_token - > sids ,
& session_info - > security_token - > num_sids ) ;
2009-02-11 13:46:18 +03:00
}
2011-02-11 03:50:37 +03:00
security_token_debug ( DBGC_AUTH , 10 , session_info - > security_token ) ;
2009-02-11 13:46:18 +03:00
debug_unix_user_token ( DBGC_AUTH , 10 ,
2011-07-15 08:59:14 +04:00
session_info - > unix_token - > uid ,
session_info - > unix_token - > gid ,
session_info - > unix_token - > ngroups ,
session_info - > unix_token - > groups ) ;
2006-02-04 01:19:41 +03:00
2011-02-11 03:50:37 +03:00
status = log_nt_token ( session_info - > security_token ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
return status ;
}
2018-04-09 21:44:00 +03:00
session_info - > unique_session_token = GUID_random ( ) ;
2011-02-11 03:50:37 +03:00
* session_info_out = session_info ;
return NT_STATUS_OK ;
2005-09-30 21:13:37 +04:00
}
2018-03-07 02:21:13 +03:00
NTSTATUS auth3_user_info_dc_add_hints ( struct auth_user_info_dc * user_info_dc ,
uid_t uid ,
gid_t gid ,
uint32_t flags )
{
uint32_t orig_num_sids = user_info_dc - > num_sids ;
struct dom_sid tmp_sid = { 0 , } ;
NTSTATUS status ;
/*
* We add S - 5 - 88 - 1 - X in order to pass the uid
* for the unix token .
*/
sid_compose ( & tmp_sid ,
& global_sid_Unix_NFS_Users ,
( uint32_t ) uid ) ;
status = add_sid_to_array_unique ( user_info_dc - > sids ,
& tmp_sid ,
& user_info_dc - > sids ,
& user_info_dc - > num_sids ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 0 , ( " add_sid_to_array_unique failed: %s \n " ,
nt_errstr ( status ) ) ) ;
goto fail ;
}
/*
* We add S - 5 - 88 - 2 - X in order to pass the gid
* for the unix token .
*/
sid_compose ( & tmp_sid ,
& global_sid_Unix_NFS_Groups ,
( uint32_t ) gid ) ;
status = add_sid_to_array_unique ( user_info_dc - > sids ,
& tmp_sid ,
& user_info_dc - > sids ,
& user_info_dc - > num_sids ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 0 , ( " add_sid_to_array_unique failed: %s \n " ,
nt_errstr ( status ) ) ) ;
goto fail ;
}
/*
* We add S - 5 - 88 - 3 - X in order to pass some flags
* ( AUTH3_UNIX_HINT_ * ) to auth3_create_session_info ( ) .
*/
sid_compose ( & tmp_sid ,
& global_sid_Unix_NFS_Mode ,
flags ) ;
status = add_sid_to_array_unique ( user_info_dc - > sids ,
& tmp_sid ,
& user_info_dc - > sids ,
& user_info_dc - > num_sids ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 0 , ( " add_sid_to_array_unique failed: %s \n " ,
nt_errstr ( status ) ) ) ;
goto fail ;
}
return NT_STATUS_OK ;
fail :
user_info_dc - > num_sids = orig_num_sids ;
return status ;
}
NTSTATUS auth3_session_info_create ( TALLOC_CTX * mem_ctx ,
const struct auth_user_info_dc * user_info_dc ,
const char * original_user_name ,
uint32_t session_info_flags ,
struct auth_session_info * * session_info_out )
{
TALLOC_CTX * frame = talloc_stackframe ( ) ;
struct auth_session_info * session_info = NULL ;
uid_t hint_uid = - 1 ;
bool found_hint_uid = false ;
uid_t hint_gid = - 1 ;
bool found_hint_gid = false ;
uint32_t hint_flags = 0 ;
bool found_hint_flags = false ;
bool need_getpwuid = false ;
struct unixid * ids = NULL ;
uint32_t num_gids = 0 ;
gid_t * gids = NULL ;
struct dom_sid tmp_sid = { 0 , } ;
fstring tmp = { 0 , } ;
NTSTATUS status ;
size_t i ;
bool ok ;
* session_info_out = NULL ;
if ( user_info_dc - > num_sids = = 0 ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
if ( user_info_dc - > info = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
if ( user_info_dc - > info - > account_name = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
session_info = talloc_zero ( mem_ctx , struct auth_session_info ) ;
if ( session_info = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
/* keep this under frame for easier cleanup */
talloc_reparent ( mem_ctx , frame , session_info ) ;
session_info - > info = auth_user_info_copy ( session_info ,
user_info_dc - > info ) ;
if ( session_info - > info = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
session_info - > security_token = talloc_zero ( session_info ,
struct security_token ) ;
if ( session_info - > security_token = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
/*
* Avoid a lot of reallocations and allocate what we ' ll
* use in most cases .
*/
session_info - > security_token - > sids = talloc_zero_array (
session_info - > security_token ,
struct dom_sid ,
user_info_dc - > num_sids ) ;
if ( session_info - > security_token - > sids = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
for ( i = PRIMARY_USER_SID_INDEX ; i < user_info_dc - > num_sids ; i + + ) {
struct security_token * nt_token = session_info - > security_token ;
int cmp ;
/*
* S - 1 - 5 - 88 - X - Y sids are only used to give hints
* to the unix token construction .
*
* S - 1 - 5 - 88 - 1 - Y gives the uid = Y
* S - 1 - 5 - 88 - 2 - Y gives the gid = Y
* S - 1 - 5 - 88 - 3 - Y gives flags = Y : AUTH3_UNIX_HINT_ *
*/
cmp = dom_sid_compare_domain ( & global_sid_Unix_NFS ,
& user_info_dc - > sids [ i ] ) ;
if ( cmp = = 0 ) {
bool match ;
uint32_t hint = 0 ;
match = sid_peek_rid ( & user_info_dc - > sids [ i ] , & hint ) ;
if ( ! match ) {
continue ;
}
match = dom_sid_in_domain ( & global_sid_Unix_NFS_Users ,
& user_info_dc - > sids [ i ] ) ;
if ( match ) {
if ( found_hint_uid ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
found_hint_uid = true ;
hint_uid = ( uid_t ) hint ;
continue ;
}
match = dom_sid_in_domain ( & global_sid_Unix_NFS_Groups ,
& user_info_dc - > sids [ i ] ) ;
if ( match ) {
if ( found_hint_gid ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
found_hint_gid = true ;
hint_gid = ( gid_t ) hint ;
continue ;
}
match = dom_sid_in_domain ( & global_sid_Unix_NFS_Mode ,
& user_info_dc - > sids [ i ] ) ;
if ( match ) {
if ( found_hint_flags ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
found_hint_flags = true ;
hint_flags = hint ;
continue ;
}
continue ;
}
status = add_sid_to_array_unique ( nt_token - > sids ,
& user_info_dc - > sids [ i ] ,
& nt_token - > sids ,
& nt_token - > num_sids ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
TALLOC_FREE ( frame ) ;
return status ;
}
}
/*
* We need at least one usable SID
*/
if ( session_info - > security_token - > num_sids = = 0 ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
/*
* We need all tree hints : uid , gid , flags
* or none of them .
*/
if ( found_hint_uid | | found_hint_gid | | found_hint_flags ) {
if ( ! found_hint_uid ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
if ( ! found_hint_gid ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
if ( ! found_hint_flags ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
}
if ( session_info - > info - > authenticated ) {
session_info_flags | = AUTH_SESSION_INFO_AUTHENTICATED ;
}
status = finalize_local_nt_token ( session_info - > security_token ,
session_info_flags ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
TALLOC_FREE ( frame ) ;
return status ;
}
/*
* unless set otherwise , the session key is the user session
* key from the auth subsystem
*/
if ( user_info_dc - > user_session_key . length ! = 0 ) {
session_info - > session_key = data_blob_dup_talloc ( session_info ,
user_info_dc - > user_session_key ) ;
if ( session_info - > session_key . data = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
}
if ( ! ( session_info_flags & AUTH_SESSION_INFO_UNIX_TOKEN ) ) {
goto done ;
}
session_info - > unix_token = talloc_zero ( session_info , struct security_unix_token ) ;
if ( session_info - > unix_token = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
session_info - > unix_token - > uid = - 1 ;
session_info - > unix_token - > gid = - 1 ;
session_info - > unix_info = talloc_zero ( session_info , struct auth_user_info_unix ) ;
if ( session_info - > unix_info = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
/* Convert the SIDs to uid/gids. */
ids = talloc_zero_array ( frame , struct unixid ,
session_info - > security_token - > num_sids ) ;
if ( ids = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
if ( ! ( hint_flags & AUTH3_UNIX_HINT_DONT_TRANSLATE_FROM_SIDS ) ) {
ok = sids_to_unixids ( session_info - > security_token - > sids ,
session_info - > security_token - > num_sids ,
ids ) ;
if ( ! ok ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
}
if ( found_hint_uid ) {
session_info - > unix_token - > uid = hint_uid ;
} else if ( ids [ 0 ] . type = = ID_TYPE_UID ) {
/*
* The primary SID resolves to a UID only .
*/
session_info - > unix_token - > uid = ids [ 0 ] . id ;
} else if ( ids [ 0 ] . type = = ID_TYPE_BOTH ) {
/*
* The primary SID resolves to a UID and GID ,
* use it as uid and add it as first element
* to the groups array .
*/
session_info - > unix_token - > uid = ids [ 0 ] . id ;
ok = add_gid_to_array_unique ( session_info - > unix_token ,
session_info - > unix_token - > uid ,
& session_info - > unix_token - > groups ,
& session_info - > unix_token - > ngroups ) ;
if ( ! ok ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
} else {
/*
* It we can ' t get a uid , we can ' t imporsonate
* the user .
*/
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
if ( found_hint_gid ) {
session_info - > unix_token - > gid = hint_gid ;
} else {
need_getpwuid = true ;
}
if ( hint_flags & AUTH3_UNIX_HINT_QUALIFIED_NAME ) {
session_info - > unix_info - > unix_name =
talloc_asprintf ( session_info - > unix_info ,
" %s%c%s " ,
session_info - > info - > domain_name ,
* lp_winbind_separator ( ) ,
session_info - > info - > account_name ) ;
if ( session_info - > unix_info - > unix_name = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
} else if ( hint_flags & AUTH3_UNIX_HINT_ISLOLATED_NAME ) {
session_info - > unix_info - > unix_name =
talloc_strdup ( session_info - > unix_info ,
session_info - > info - > account_name ) ;
if ( session_info - > unix_info - > unix_name = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
} else {
need_getpwuid = true ;
}
if ( need_getpwuid ) {
struct passwd * pwd = NULL ;
/*
* Ask the system for the primary gid
* and the real unix name .
*/
pwd = getpwuid_alloc ( frame , session_info - > unix_token - > uid ) ;
if ( pwd = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
if ( ! found_hint_gid ) {
session_info - > unix_token - > gid = pwd - > pw_gid ;
}
session_info - > unix_info - > unix_name =
talloc_strdup ( session_info - > unix_info , pwd - > pw_name ) ;
if ( session_info - > unix_info - > unix_name = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
TALLOC_FREE ( pwd ) ;
}
ok = add_gid_to_array_unique ( session_info - > unix_token ,
session_info - > unix_token - > gid ,
& session_info - > unix_token - > groups ,
& session_info - > unix_token - > ngroups ) ;
if ( ! ok ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
/* This is a potentially untrusted username for use in %U */
alpha_strcpy ( tmp , original_user_name , " . _-$ " , sizeof ( tmp ) ) ;
session_info - > unix_info - > sanitized_username =
talloc_strdup ( session_info - > unix_info , tmp ) ;
if ( session_info - > unix_info - > sanitized_username = = NULL ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
for ( i = 0 ; i < session_info - > security_token - > num_sids ; i + + ) {
if ( ids [ i ] . type ! = ID_TYPE_GID & &
ids [ i ] . type ! = ID_TYPE_BOTH ) {
struct security_token * nt_token =
session_info - > security_token ;
DEBUG ( 10 , ( " Could not convert SID %s to gid, "
" ignoring it \n " ,
sid_string_dbg ( & nt_token - > sids [ i ] ) ) ) ;
continue ;
}
ok = add_gid_to_array_unique ( session_info - > unix_token ,
ids [ i ] . id ,
& session_info - > unix_token - > groups ,
& session_info - > unix_token - > ngroups ) ;
if ( ! ok ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
}
TALLOC_FREE ( ids ) ;
/*
* Now we must get any groups this user has been
* added to in / etc / group and merge them in .
* This has to be done in every code path
* that creates an NT token , as remote users
* may have been added to the local / etc / group
* database . Tokens created merely from the
* info3 structs ( via the DC or via the krb5 PAC )
* won ' t have these local groups . Note the
* groups added here will only be UNIX groups
* ( S - 1 - 22 - 2 - XXXX groups ) as getgroups_unix_user ( )
* turns off winbindd before calling getgroups ( ) .
*
* NB . This is duplicating work already
* done in the ' unix_user : ' case of
* create_token_from_sid ( ) but won ' t
* do anything other than be inefficient
* in that case .
*/
if ( ! ( hint_flags & AUTH3_UNIX_HINT_DONT_EXPAND_UNIX_GROUPS ) ) {
ok = getgroups_unix_user ( frame ,
session_info - > unix_info - > unix_name ,
session_info - > unix_token - > gid ,
& gids , & num_gids ) ;
if ( ! ok ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_INVALID_TOKEN ;
}
}
for ( i = 0 ; i < num_gids ; i + + ) {
ok = add_gid_to_array_unique ( session_info - > unix_token ,
gids [ i ] ,
& session_info - > unix_token - > groups ,
& session_info - > unix_token - > ngroups ) ;
if ( ! ok ) {
TALLOC_FREE ( frame ) ;
return NT_STATUS_NO_MEMORY ;
}
}
TALLOC_FREE ( gids ) ;
if ( hint_flags & AUTH3_UNIX_HINT_DONT_TRANSLATE_TO_SIDS ) {
/*
* We should not translate the unix token uid / gids
* to S - 1 - 22 - X - Y SIDs .
*/
goto done ;
}
/*
* Add the " Unix Group " SID for each gid to catch mapped groups
* and their Unix equivalent . This is to solve the backwards
* compatibility problem of ' valid users = + ntadmin ' where
* ntadmin has been paired with " Domain Admins " in the group
* mapping table . Otherwise smb . conf would need to be changed
* to ' valid user = " Domain Admins " ' . - - jerry
*
* For consistency we also add the " Unix User " SID ,
* so that the complete unix token is represented within
* the nt token .
*/
uid_to_unix_users_sid ( session_info - > unix_token - > uid , & tmp_sid ) ;
status = add_sid_to_array_unique ( session_info - > security_token , & tmp_sid ,
& session_info - > security_token - > sids ,
& session_info - > security_token - > num_sids ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
TALLOC_FREE ( frame ) ;
return status ;
}
gid_to_unix_groups_sid ( session_info - > unix_token - > gid , & tmp_sid ) ;
status = add_sid_to_array_unique ( session_info - > security_token , & tmp_sid ,
& session_info - > security_token - > sids ,
& session_info - > security_token - > num_sids ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
TALLOC_FREE ( frame ) ;
return status ;
}
for ( i = 0 ; i < session_info - > unix_token - > ngroups ; i + + ) {
struct security_token * nt_token = session_info - > security_token ;
gid_to_unix_groups_sid ( session_info - > unix_token - > groups [ i ] ,
& tmp_sid ) ;
status = add_sid_to_array_unique ( nt_token - > sids ,
& tmp_sid ,
& nt_token - > sids ,
& nt_token - > num_sids ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
TALLOC_FREE ( frame ) ;
return status ;
}
}
done :
security_token_debug ( DBGC_AUTH , 10 , session_info - > security_token ) ;
if ( session_info - > unix_token ! = NULL ) {
debug_unix_user_token ( DBGC_AUTH , 10 ,
session_info - > unix_token - > uid ,
session_info - > unix_token - > gid ,
session_info - > unix_token - > ngroups ,
session_info - > unix_token - > groups ) ;
}
status = log_nt_token ( session_info - > security_token ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
TALLOC_FREE ( frame ) ;
return status ;
}
2018-04-09 21:44:00 +03:00
session_info - > unique_session_token = GUID_random ( ) ;
2018-03-07 02:21:13 +03:00
* session_info_out = talloc_move ( mem_ctx , & session_info ) ;
TALLOC_FREE ( frame ) ;
return NT_STATUS_OK ;
}
2001-11-11 14:34:46 +03:00
/***************************************************************************
2008-05-03 11:52:24 +04:00
Make ( and fill ) a server_info struct from a ' struct passwd ' by conversion
2006-02-20 23:09:36 +03:00
to a struct samu
2001-11-11 14:34:46 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2013-12-13 22:11:01 +04:00
NTSTATUS make_server_info_pw ( TALLOC_CTX * mem_ctx ,
const char * unix_username ,
const struct passwd * pwd ,
struct auth_serversupplied_info * * server_info )
2001-10-31 13:46:25 +03:00
{
2006-02-04 01:19:41 +03:00
NTSTATUS status ;
2013-12-13 22:19:02 +04:00
TALLOC_CTX * tmp_ctx = NULL ;
2010-01-10 16:24:22 +03:00
struct auth_serversupplied_info * result ;
2010-02-17 00:07:22 +03:00
2013-12-13 22:11:01 +04:00
tmp_ctx = talloc_stackframe ( ) ;
if ( tmp_ctx = = NULL ) {
2010-05-28 19:14:01 +04:00
return NT_STATUS_NO_MEMORY ;
}
2013-12-13 22:19:02 +04:00
result = make_server_info ( tmp_ctx ) ;
2006-06-12 15:03:49 +04:00
if ( result = = NULL ) {
2013-12-13 22:19:02 +04:00
status = NT_STATUS_NO_MEMORY ;
goto done ;
2003-06-12 18:24:15 +04:00
}
2013-12-13 22:19:02 +04:00
status = passwd_to_SamInfo3 ( result ,
unix_username ,
pwd ,
2015-01-14 00:45:16 +03:00
& result - > info3 ,
& result - > extra ) ;
2010-05-27 11:41:56 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2013-12-13 22:19:02 +04:00
goto done ;
2010-05-27 11:41:56 +04:00
}
2006-02-04 01:19:41 +03:00
result - > unix_name = talloc_strdup ( result , unix_username ) ;
2011-07-26 07:43:33 +04:00
if ( result - > unix_name = = NULL ) {
2013-12-13 22:19:02 +04:00
status = NT_STATUS_NO_MEMORY ;
goto done ;
2008-05-11 02:25:55 +04:00
}
2008-06-19 18:54:12 +04:00
result - > utok . uid = pwd - > pw_uid ;
result - > utok . gid = pwd - > pw_gid ;
2003-06-12 18:24:15 +04:00
2013-12-13 22:19:02 +04:00
* server_info = talloc_steal ( mem_ctx , result ) ;
status = NT_STATUS_OK ;
done :
talloc_free ( tmp_ctx ) ;
2006-02-04 01:19:41 +03:00
2013-12-13 22:19:02 +04:00
return status ;
2001-10-31 13:46:25 +03:00
}
2010-08-18 19:17:42 +04:00
static NTSTATUS get_guest_info3 ( TALLOC_CTX * mem_ctx ,
struct netr_SamInfo3 * info3 )
{
2014-02-03 06:22:13 +04:00
const char * guest_account = lp_guest_account ( ) ;
2010-08-18 19:17:42 +04:00
struct dom_sid domain_sid ;
struct passwd * pwd ;
const char * tmp ;
2010-10-20 19:16:23 +04:00
pwd = Get_Pwnam_alloc ( mem_ctx , guest_account ) ;
2010-08-18 19:17:42 +04:00
if ( pwd = = NULL ) {
DEBUG ( 0 , ( " SamInfo3_for_guest: Unable to locate guest "
" account [%s]! \n " , guest_account ) ) ;
return NT_STATUS_NO_SUCH_USER ;
}
2011-07-19 14:11:22 +04:00
/* Set account name */
2010-08-18 19:17:42 +04:00
tmp = talloc_strdup ( mem_ctx , pwd - > pw_name ) ;
if ( tmp = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
init_lsa_String ( & info3 - > base . account_name , tmp ) ;
/* Set domain name */
tmp = talloc_strdup ( mem_ctx , get_global_sam_name ( ) ) ;
if ( tmp = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
2011-10-22 00:10:43 +04:00
init_lsa_StringLarge ( & info3 - > base . logon_domain , tmp ) ;
2010-08-18 19:17:42 +04:00
/* Domain sid */
sid_copy ( & domain_sid , get_global_sam_sid ( ) ) ;
2010-08-26 19:21:39 +04:00
info3 - > base . domain_sid = dom_sid_dup ( mem_ctx , & domain_sid ) ;
2010-08-18 19:17:42 +04:00
if ( info3 - > base . domain_sid = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
/* Guest rid */
info3 - > base . rid = DOMAIN_RID_GUEST ;
/* Primary gid */
2012-07-15 08:38:18 +04:00
info3 - > base . primary_gid = DOMAIN_RID_GUESTS ;
2010-08-18 19:17:42 +04:00
2011-07-19 04:51:08 +04:00
/* Set as guest */
info3 - > base . user_flags = NETLOGON_GUEST ;
2010-08-18 19:17:42 +04:00
TALLOC_FREE ( pwd ) ;
2010-09-01 12:51:13 +04:00
return NT_STATUS_OK ;
2010-08-18 19:17:42 +04:00
}
2001-11-11 14:34:46 +03:00
/***************************************************************************
2002-09-25 19:19:00 +04:00
Make ( and fill ) a user_info struct for a guest login .
2006-02-04 01:19:41 +03:00
This * must * succeed for smbd to start . If there is no mapping entry for
the guest gid , then create one .
2011-02-11 03:50:37 +03:00
The resulting structure is a ' session_info ' because
create_local_token ( ) has already been called on it . This is quite
2011-07-19 14:11:22 +04:00
nasty , as the auth subsystem isn ' t expect this , but the behavior is
2011-02-11 03:50:37 +03:00
left as - is for now .
2006-06-11 20:13:41 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2001-11-11 14:34:46 +03:00
2018-02-13 14:05:29 +03:00
static NTSTATUS make_new_session_info_guest ( TALLOC_CTX * mem_ctx ,
struct auth_session_info * * _session_info ,
struct auth_serversupplied_info * * _server_info )
2001-10-31 13:46:25 +03:00
{
2018-02-13 14:05:29 +03:00
struct auth_session_info * session_info = NULL ;
struct auth_serversupplied_info * server_info = NULL ;
2014-02-03 06:22:13 +04:00
const char * guest_account = lp_guest_account ( ) ;
2011-06-09 09:31:03 +04:00
const char * domain = lp_netbios_name ( ) ;
2010-08-18 19:17:42 +04:00
struct netr_SamInfo3 info3 ;
TALLOC_CTX * tmp_ctx ;
2006-02-04 01:19:41 +03:00
NTSTATUS status ;
2002-09-25 19:19:00 +04:00
2010-08-18 19:17:42 +04:00
tmp_ctx = talloc_stackframe ( ) ;
if ( tmp_ctx = = NULL ) {
2006-02-21 17:34:11 +03:00
return NT_STATUS_NO_MEMORY ;
2001-10-31 13:46:25 +03:00
}
2010-08-18 19:17:42 +04:00
ZERO_STRUCT ( info3 ) ;
2006-02-04 01:19:41 +03:00
2010-08-18 19:17:42 +04:00
status = get_guest_info3 ( tmp_ctx , & info3 ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
2011-06-15 16:08:23 +04:00
DEBUG ( 0 , ( " get_guest_info3 failed with %s \n " ,
nt_errstr ( status ) ) ) ;
2010-08-18 19:17:42 +04:00
goto done ;
2001-10-31 13:46:25 +03:00
}
2010-08-18 19:17:42 +04:00
status = make_server_info_info3 ( tmp_ctx ,
guest_account ,
domain ,
2018-02-13 14:05:29 +03:00
& server_info ,
2010-08-18 19:17:42 +04:00
& info3 ) ;
2006-02-04 01:19:41 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2011-06-15 16:08:23 +04:00
DEBUG ( 0 , ( " make_server_info_info3 failed with %s \n " ,
nt_errstr ( status ) ) ) ;
2010-08-18 19:17:42 +04:00
goto done ;
2003-02-24 05:35:54 +03:00
}
2010-02-17 00:07:22 +03:00
2018-02-13 14:05:29 +03:00
server_info - > guest = true ;
2002-09-25 19:19:00 +04:00
2011-02-11 03:50:37 +03:00
/* This should not be done here (we should produce a server
* info , and later construct a session info from it ) , but for
2011-07-19 14:11:22 +04:00
* now this does not change the previous behavior */
2018-02-13 14:05:29 +03:00
status = create_local_token ( tmp_ctx , server_info , NULL ,
server_info - > info3 - > base . account_name . string ,
& session_info ) ;
2006-02-04 01:19:41 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2011-06-15 16:08:23 +04:00
DEBUG ( 0 , ( " create_local_token failed: %s \n " ,
nt_errstr ( status ) ) ) ;
2010-08-18 19:17:42 +04:00
goto done ;
2006-02-04 01:19:41 +03:00
}
/* annoying, but the Guest really does have a session key, and it is
all zeros ! */
2018-02-13 14:05:29 +03:00
session_info - > session_key = data_blob_talloc_zero ( session_info , 16 ) ;
* _session_info = talloc_move ( mem_ctx , & session_info ) ;
* _server_info = talloc_move ( mem_ctx , & server_info ) ;
2006-02-04 01:19:41 +03:00
2010-08-18 19:17:42 +04:00
status = NT_STATUS_OK ;
done :
TALLOC_FREE ( tmp_ctx ) ;
2011-06-15 16:09:50 +04:00
return status ;
2001-10-31 13:46:25 +03:00
}
2012-06-03 17:12:22 +04:00
/***************************************************************************
Make ( and fill ) a auth_session_info struct for a system user login .
This * must * succeed for smbd to start .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2012-02-03 11:19:36 +04:00
2012-06-03 17:12:22 +04:00
static NTSTATUS make_new_session_info_system ( TALLOC_CTX * mem_ctx ,
struct auth_session_info * * session_info )
2012-05-14 12:31:32 +04:00
{
2018-03-07 02:51:51 +03:00
TALLOC_CTX * frame = talloc_stackframe ( ) ;
struct auth_user_info_dc * user_info_dc = NULL ;
uid_t uid = - 1 ;
gid_t gid = - 1 ;
uint32_t hint_flags = 0 ;
uint32_t session_info_flags = 0 ;
2012-06-03 17:12:22 +04:00
NTSTATUS status ;
2012-05-14 12:31:32 +04:00
2018-03-07 02:51:51 +03:00
status = auth_system_user_info_dc ( frame , lp_netbios_name ( ) ,
& user_info_dc ) ;
2012-05-14 12:31:32 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2018-03-07 02:51:51 +03:00
DEBUG ( 0 , ( " auth_system_user_info_dc failed: %s \n " ,
2012-05-14 12:31:32 +04:00
nt_errstr ( status ) ) ) ;
goto done ;
}
2018-03-07 02:51:51 +03:00
/*
* Just get the initial uid / gid
* and don ' t expand the unix groups .
*/
uid = sec_initial_uid ( ) ;
gid = sec_initial_gid ( ) ;
hint_flags | = AUTH3_UNIX_HINT_DONT_EXPAND_UNIX_GROUPS ;
2012-06-12 11:15:19 +04:00
2018-03-07 02:51:51 +03:00
/*
* Also avoid sid mapping to gids ,
* as well as adding the unix_token uid / gids as
* S - 1 - 22 - X - Y SIDs to the nt token .
*/
hint_flags | = AUTH3_UNIX_HINT_DONT_TRANSLATE_FROM_SIDS ;
hint_flags | = AUTH3_UNIX_HINT_DONT_TRANSLATE_TO_SIDS ;
2012-06-12 11:15:19 +04:00
2018-03-07 02:51:51 +03:00
/*
* The unix name will be " NT AUTHORITY+SYSTEM " ,
* where ' + ' is the " winbind separator " character .
*/
hint_flags | = AUTH3_UNIX_HINT_QUALIFIED_NAME ;
status = auth3_user_info_dc_add_hints ( user_info_dc ,
uid ,
gid ,
hint_flags ) ;
2012-05-14 12:31:32 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2018-03-07 02:51:51 +03:00
DEBUG ( 0 , ( " auth3_user_info_dc_add_hints failed: %s \n " ,
nt_errstr ( status ) ) ) ;
2012-05-14 12:31:32 +04:00
goto done ;
}
2018-03-07 02:51:51 +03:00
session_info_flags | = AUTH_SESSION_INFO_SIMPLE_PRIVILEGES ;
session_info_flags | = AUTH_SESSION_INFO_UNIX_TOKEN ;
status = auth3_session_info_create ( mem_ctx , user_info_dc ,
user_info_dc - > info - > account_name ,
session_info_flags ,
session_info ) ;
2012-05-14 12:31:32 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2018-03-07 02:51:51 +03:00
DEBUG ( 0 , ( " auth3_session_info_create failed: %s \n " ,
2012-05-14 12:31:32 +04:00
nt_errstr ( status ) ) ) ;
goto done ;
}
2012-06-03 17:12:22 +04:00
done :
2018-03-07 02:51:51 +03:00
TALLOC_FREE ( frame ) ;
2012-06-03 17:12:22 +04:00
return status ;
2010-04-14 17:15:32 +04:00
}
2018-03-02 16:39:44 +03:00
static NTSTATUS make_new_session_info_anonymous ( TALLOC_CTX * mem_ctx ,
struct auth_session_info * * session_info )
{
TALLOC_CTX * frame = talloc_stackframe ( ) ;
const char * guest_account = lp_guest_account ( ) ;
struct auth_user_info_dc * user_info_dc = NULL ;
struct passwd * pwd = NULL ;
uint32_t hint_flags = 0 ;
uint32_t session_info_flags = 0 ;
NTSTATUS status ;
/*
* We use the guest account for the unix token
* while we use a true anonymous nt token .
*
* It ' s very important to have a separate
* nt token for anonymous .
*/
pwd = Get_Pwnam_alloc ( frame , guest_account ) ;
if ( pwd = = NULL ) {
DBG_ERR ( " Unable to locate guest account [%s]! \n " ,
guest_account ) ;
status = NT_STATUS_NO_SUCH_USER ;
goto done ;
}
status = auth_anonymous_user_info_dc ( frame , lp_netbios_name ( ) ,
& user_info_dc ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 0 , ( " auth_anonymous_user_info_dc failed: %s \n " ,
nt_errstr ( status ) ) ) ;
goto done ;
}
/*
* Note we don ' t pass AUTH3_UNIX_HINT_QUALIFIED_NAME
* nor AUTH3_UNIX_HINT_ISOLATED_NAME here
* as we want the unix name be found by getpwuid_alloc ( ) .
*/
status = auth3_user_info_dc_add_hints ( user_info_dc ,
pwd - > pw_uid ,
pwd - > pw_gid ,
hint_flags ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 0 , ( " auth3_user_info_dc_add_hints failed: %s \n " ,
nt_errstr ( status ) ) ) ;
goto done ;
}
/*
* In future we may want to remove
* AUTH_SESSION_INFO_DEFAULT_GROUPS .
*
* Similar to Windows with EveryoneIncludesAnonymous
* and RestrictAnonymous .
*
* We may introduce AUTH_SESSION_INFO_ANON_WORLD . . .
*
* But for this is required to keep the existing tests
* working .
*/
session_info_flags | = AUTH_SESSION_INFO_DEFAULT_GROUPS ;
session_info_flags | = AUTH_SESSION_INFO_SIMPLE_PRIVILEGES ;
session_info_flags | = AUTH_SESSION_INFO_UNIX_TOKEN ;
status = auth3_session_info_create ( mem_ctx , user_info_dc ,
" " ,
session_info_flags ,
session_info ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
DEBUG ( 0 , ( " auth3_session_info_create failed: %s \n " ,
nt_errstr ( status ) ) ) ;
goto done ;
}
done :
TALLOC_FREE ( frame ) ;
return status ;
}
2008-05-06 19:47:26 +04:00
/****************************************************************************
2011-07-18 07:06:47 +04:00
Fake a auth_session_info just from a username ( as a
2011-02-11 03:50:37 +03:00
session_info structure , with create_local_token ( ) already called on
it .
2008-05-06 19:47:26 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2011-02-11 03:50:37 +03:00
NTSTATUS make_session_info_from_username ( TALLOC_CTX * mem_ctx ,
const char * username ,
bool is_guest ,
2011-07-18 07:06:47 +04:00
struct auth_session_info * * session_info )
2008-05-06 19:47:26 +04:00
{
2008-05-11 02:25:55 +04:00
struct passwd * pwd ;
2008-05-06 19:47:26 +04:00
NTSTATUS status ;
2012-06-03 17:12:22 +04:00
struct auth_serversupplied_info * result ;
2013-12-13 22:11:01 +04:00
TALLOC_CTX * tmp_ctx ;
2008-05-06 19:47:26 +04:00
2013-12-13 22:11:01 +04:00
tmp_ctx = talloc_stackframe ( ) ;
if ( tmp_ctx = = NULL ) {
return NT_STATUS_NO_MEMORY ;
2008-05-06 19:47:26 +04:00
}
2013-12-13 22:11:01 +04:00
pwd = Get_Pwnam_alloc ( tmp_ctx , username ) ;
if ( pwd = = NULL ) {
status = NT_STATUS_NO_SUCH_USER ;
goto done ;
}
2008-05-06 19:47:26 +04:00
2013-12-13 22:11:01 +04:00
status = make_server_info_pw ( tmp_ctx , pwd - > pw_name , pwd , & result ) ;
2008-05-11 02:25:55 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2013-12-13 22:11:01 +04:00
goto done ;
2008-05-06 19:47:26 +04:00
}
2012-06-03 17:12:22 +04:00
result - > nss_token = true ;
result - > guest = is_guest ;
/* Now turn the server_info into a session_info with the full token etc */
2013-12-13 22:11:01 +04:00
status = create_local_token ( mem_ctx ,
result ,
NULL ,
pwd - > pw_name ,
session_info ) ;
done :
talloc_free ( tmp_ctx ) ;
2012-06-03 17:12:22 +04:00
2011-02-11 03:50:37 +03:00
return status ;
2008-05-06 19:47:26 +04:00
}
2011-07-15 12:05:42 +04:00
/* This function MUST only used to create the cached server_info for
* guest .
*
* This is a lossy conversion . Variables known to be lost so far
2011-07-18 04:20:25 +04:00
* include :
*
* - nss_token ( not needed because the only read doesn ' t happen
2011-07-15 12:05:42 +04:00
* for the GUEST user , as this routine populates - > security_token
2011-07-18 04:20:25 +04:00
*
2011-07-18 05:31:49 +04:00
* - extra ( not needed because the guest account must have valid RIDs per the output of get_guest_info3 ( ) )
2011-07-18 05:22:50 +04:00
*
* - The ' server_info ' parameter allows the missing ' info3 ' to be copied across .
2011-07-15 12:05:42 +04:00
*/
2011-07-18 05:22:50 +04:00
static struct auth_serversupplied_info * copy_session_info_serverinfo_guest ( TALLOC_CTX * mem_ctx ,
2011-07-18 07:06:47 +04:00
const struct auth_session_info * src ,
2011-07-18 05:22:50 +04:00
struct auth_serversupplied_info * server_info )
2011-07-15 05:38:49 +04:00
{
struct auth_serversupplied_info * dst ;
2018-01-11 11:06:31 +03:00
NTSTATUS status ;
2011-07-15 05:38:49 +04:00
dst = make_server_info ( mem_ctx ) ;
if ( dst = = NULL ) {
return NULL ;
}
2011-07-15 10:09:52 +04:00
/* This element must be provided to convert back to an auth_serversupplied_info */
SMB_ASSERT ( src - > unix_info ) ;
2011-07-19 05:57:05 +04:00
dst - > guest = true ;
2011-07-15 08:59:14 +04:00
2011-07-18 05:31:49 +04:00
/* This element must be provided to convert back to an
2011-07-19 14:11:22 +04:00
* auth_serversupplied_info . This needs to be from the
2011-07-18 07:06:47 +04:00
* auth_session_info because the group values in particular
2011-07-18 05:31:49 +04:00
* may change during create_local_token ( ) processing */
2011-07-15 08:59:14 +04:00
SMB_ASSERT ( src - > unix_token ) ;
dst - > utok . uid = src - > unix_token - > uid ;
dst - > utok . gid = src - > unix_token - > gid ;
dst - > utok . ngroups = src - > unix_token - > ngroups ;
if ( src - > unix_token - > ngroups ! = 0 ) {
2011-07-15 05:38:49 +04:00
dst - > utok . groups = ( gid_t * ) talloc_memdup (
2011-07-15 08:59:14 +04:00
dst , src - > unix_token - > groups ,
2011-07-15 05:38:49 +04:00
sizeof ( gid_t ) * dst - > utok . ngroups ) ;
} else {
dst - > utok . groups = NULL ;
}
2011-07-15 12:05:42 +04:00
/* We must have a security_token as otherwise the lossy
* conversion without nss_token would cause create_local_token
* to take the wrong path */
SMB_ASSERT ( src - > security_token ) ;
2011-07-15 05:38:49 +04:00
dst - > session_key = data_blob_talloc ( dst , src - > session_key . data ,
src - > session_key . length ) ;
2011-07-15 11:45:48 +04:00
/* This is OK because this functions is only used for the
* GUEST account , which has all - zero keys for both values */
dst - > lm_session_key = data_blob_talloc ( dst , src - > session_key . data ,
src - > session_key . length ) ;
2011-07-15 05:38:49 +04:00
2018-01-11 11:06:31 +03:00
status = copy_netr_SamInfo3 ( dst ,
server_info - > info3 ,
& dst - > info3 ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
2011-07-15 05:38:49 +04:00
TALLOC_FREE ( dst ) ;
return NULL ;
}
2011-07-15 09:55:31 +04:00
dst - > unix_name = talloc_strdup ( dst , src - > unix_info - > unix_name ) ;
2011-07-15 05:38:49 +04:00
if ( ! dst - > unix_name ) {
TALLOC_FREE ( dst ) ;
return NULL ;
}
2018-03-02 19:07:11 +03:00
dst - > cached_session_info = src ;
2011-07-15 05:38:49 +04:00
return dst ;
}
2008-06-24 16:18:55 +04:00
/*
* Set a new session key . Used in the rpc server where we have to override the
* SMB level session key with SystemLibraryDTC
*/
2011-07-18 07:06:47 +04:00
bool session_info_set_session_key ( struct auth_session_info * info ,
2008-06-24 16:18:55 +04:00
DATA_BLOB session_key )
{
2011-02-14 03:35:21 +03:00
TALLOC_FREE ( info - > session_key . data ) ;
2008-06-24 16:18:55 +04:00
2011-02-14 03:35:21 +03:00
info - > session_key = data_blob_talloc (
2008-06-24 16:18:55 +04:00
info , session_key . data , session_key . length ) ;
2011-02-14 03:35:21 +03:00
return ( info - > session_key . data ! = NULL ) ;
2008-06-24 16:18:55 +04:00
}
2011-07-18 07:06:47 +04:00
static struct auth_session_info * guest_info = NULL ;
2018-03-02 16:39:44 +03:00
static struct auth_session_info * anonymous_info = NULL ;
2004-11-06 01:53:35 +03:00
2011-07-18 05:22:50 +04:00
static struct auth_serversupplied_info * guest_server_info = NULL ;
2018-02-13 14:09:12 +03:00
bool init_guest_session_info ( TALLOC_CTX * mem_ctx )
2004-11-06 01:53:35 +03:00
{
2018-02-13 14:09:12 +03:00
NTSTATUS status ;
2004-11-06 01:53:35 +03:00
if ( guest_info ! = NULL )
2011-07-19 14:15:12 +04:00
return true ;
2004-11-06 01:53:35 +03:00
2018-02-13 14:09:12 +03:00
status = make_new_session_info_guest ( mem_ctx ,
& guest_info ,
& guest_server_info ) ;
2018-03-02 16:39:44 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
return false ;
}
status = make_new_session_info_anonymous ( mem_ctx ,
& anonymous_info ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
return false ;
}
return true ;
2004-11-06 01:53:35 +03:00
}
2008-05-06 19:26:49 +04:00
NTSTATUS make_server_info_guest ( TALLOC_CTX * mem_ctx ,
2010-01-10 16:24:22 +03:00
struct auth_serversupplied_info * * server_info )
2004-11-06 01:53:35 +03:00
{
2011-07-18 05:22:50 +04:00
/* This is trickier than it would appear to need to be because
* we are trying to avoid certain costly operations when the
2011-07-18 07:06:47 +04:00
* structure is converted to a ' auth_session_info ' again in
2011-07-18 05:22:50 +04:00
* create_local_token ( ) */
* server_info = copy_session_info_serverinfo_guest ( mem_ctx , guest_info , guest_server_info ) ;
2004-11-06 01:53:35 +03:00
return ( * server_info ! = NULL ) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY ;
}
2011-07-15 06:45:17 +04:00
NTSTATUS make_session_info_guest ( TALLOC_CTX * mem_ctx ,
2011-07-18 07:06:47 +04:00
struct auth_session_info * * session_info )
2011-07-15 06:45:17 +04:00
{
* session_info = copy_session_info ( mem_ctx , guest_info ) ;
return ( * session_info ! = NULL ) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY ;
}
2018-03-02 16:39:44 +03:00
NTSTATUS make_server_info_anonymous ( TALLOC_CTX * mem_ctx ,
struct auth_serversupplied_info * * server_info )
{
if ( anonymous_info = = NULL ) {
return NT_STATUS_UNSUCCESSFUL ;
}
/*
* This is trickier than it would appear to need to be because
* we are trying to avoid certain costly operations when the
* structure is converted to a ' auth_session_info ' again in
* create_local_token ( )
*
* We use a guest server_info , but with the anonymous session info ,
* which means create_local_token ( ) will return a copy
* of the anonymous token .
*
* The server info is just used as legacy in order to
* keep existing code working . Maybe some debug messages
* will still refer to guest instead of anonymous .
*/
* server_info = copy_session_info_serverinfo_guest ( mem_ctx , anonymous_info ,
guest_server_info ) ;
if ( * server_info = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
return NT_STATUS_OK ;
}
NTSTATUS make_session_info_anonymous ( TALLOC_CTX * mem_ctx ,
struct auth_session_info * * session_info )
{
if ( anonymous_info = = NULL ) {
return NT_STATUS_UNSUCCESSFUL ;
}
* session_info = copy_session_info ( mem_ctx , anonymous_info ) ;
if ( * session_info = = NULL ) {
return NT_STATUS_NO_MEMORY ;
}
return NT_STATUS_OK ;
}
2011-07-18 07:06:47 +04:00
static struct auth_session_info * system_info = NULL ;
2010-04-14 17:15:32 +04:00
2018-02-13 14:12:06 +03:00
NTSTATUS init_system_session_info ( TALLOC_CTX * mem_ctx )
2010-04-14 17:15:32 +04:00
{
if ( system_info ! = NULL )
2011-02-19 22:05:07 +03:00
return NT_STATUS_OK ;
2010-04-14 17:15:32 +04:00
2018-02-13 14:12:06 +03:00
return make_new_session_info_system ( mem_ctx , & system_info ) ;
2010-04-14 17:15:32 +04:00
}
2011-02-21 12:25:52 +03:00
NTSTATUS make_session_info_system ( TALLOC_CTX * mem_ctx ,
2011-07-18 07:06:47 +04:00
struct auth_session_info * * session_info )
2010-04-14 17:15:32 +04:00
{
if ( system_info = = NULL ) return NT_STATUS_UNSUCCESSFUL ;
2011-07-15 06:45:17 +04:00
* session_info = copy_session_info ( mem_ctx , system_info ) ;
2011-02-21 12:25:52 +03:00
return ( * session_info ! = NULL ) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY ;
2010-04-14 17:15:32 +04:00
}
2011-07-18 07:06:47 +04:00
const struct auth_session_info * get_session_info_system ( void )
2010-09-09 13:00:18 +04:00
{
return system_info ;
}
2003-06-12 11:21:26 +04:00
/***************************************************************************
Purely internal function for make_server_info_info3
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2010-05-27 11:41:56 +04:00
static NTSTATUS check_account ( TALLOC_CTX * mem_ctx , const char * domain ,
const char * username , char * * found_username ,
2010-05-29 19:02:47 +04:00
struct passwd * * pwd ,
2010-05-27 11:41:56 +04:00
bool * username_was_mapped )
2003-06-11 20:36:04 +04:00
{
2010-11-09 23:07:25 +03:00
char * orig_dom_user = NULL ;
char * dom_user = NULL ;
char * lower_username = NULL ;
char * real_username = NULL ;
2003-06-11 20:36:04 +04:00
struct passwd * passwd ;
2010-11-09 23:07:25 +03:00
lower_username = talloc_strdup ( mem_ctx , username ) ;
if ( ! lower_username ) {
return NT_STATUS_NO_MEMORY ;
}
2012-08-09 04:01:00 +04:00
if ( ! strlower_m ( lower_username ) ) {
return NT_STATUS_INVALID_PARAMETER ;
}
2004-10-23 00:15:24 +04:00
2010-11-09 23:07:25 +03:00
orig_dom_user = talloc_asprintf ( mem_ctx ,
" %s%c%s " ,
domain ,
* lp_winbind_separator ( ) ,
lower_username ) ;
if ( ! orig_dom_user ) {
return NT_STATUS_NO_MEMORY ;
}
2003-06-11 20:36:04 +04:00
2010-05-27 11:41:56 +04:00
/* Get the passwd struct. Try to create the account if necessary. */
2003-06-11 20:36:04 +04:00
2010-11-09 23:07:25 +03:00
* username_was_mapped = map_username ( mem_ctx , orig_dom_user , & dom_user ) ;
if ( ! dom_user ) {
return NT_STATUS_NO_MEMORY ;
}
2004-10-23 00:15:24 +04:00
2011-07-19 14:15:12 +04:00
passwd = smb_getpwnam ( mem_ctx , dom_user , & real_username , true ) ;
2010-05-28 22:14:27 +04:00
if ( ! passwd ) {
DEBUG ( 3 , ( " Failed to find authenticated user %s via "
" getpwnam(), denying access. \n " , dom_user ) ) ;
2003-06-11 20:36:04 +04:00
return NT_STATUS_NO_SUCH_USER ;
2010-05-28 22:14:27 +04:00
}
2003-06-11 20:36:04 +04:00
2010-11-09 23:07:25 +03:00
if ( ! real_username ) {
return NT_STATUS_NO_MEMORY ;
}
2010-05-29 19:02:47 +04:00
* pwd = passwd ;
2003-06-12 18:24:15 +04:00
2011-07-19 14:11:22 +04:00
/* This is pointless -- there is no support for differing
2003-10-07 20:34:23 +04:00
unix and windows names . Make sure to always store the
2003-10-20 20:49:45 +04:00
one we actually looked up and succeeded . Have I mentioned
2003-10-07 20:34:23 +04:00
why I hate the ' winbind use default domain ' parameter ?
- - jerry */
2010-02-17 00:07:22 +03:00
2004-03-16 19:41:54 +03:00
* found_username = talloc_strdup ( mem_ctx , real_username ) ;
2010-02-17 00:07:22 +03:00
2010-05-28 22:14:27 +04:00
return NT_STATUS_OK ;
2003-06-11 20:36:04 +04:00
}
2003-10-20 20:49:45 +04:00
/****************************************************************************
2003-11-06 20:28:44 +03:00
Wrapper to allow the getpwnam ( ) call to strip the domain name and
try again in case a local UNIX user is already there . Also run through
the username if we fallback to the username only .
2003-10-20 20:49:45 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2010-02-17 00:07:22 +03:00
2010-08-21 02:56:37 +04:00
struct passwd * smb_getpwnam ( TALLOC_CTX * mem_ctx , const char * domuser ,
2010-11-09 23:07:25 +03:00
char * * p_save_username , bool create )
2003-10-20 20:49:45 +04:00
{
2003-12-06 05:34:02 +03:00
struct passwd * pw = NULL ;
2010-11-09 23:07:25 +03:00
char * p = NULL ;
char * username = NULL ;
2010-02-17 00:07:22 +03:00
2004-03-16 19:41:54 +03:00
/* we only save a copy of the username it has been mangled
by winbindd use default domain */
2010-11-09 23:07:25 +03:00
* p_save_username = NULL ;
2010-02-17 00:07:22 +03:00
2004-07-07 01:43:12 +04:00
/* don't call map_username() here since it has to be done higher
2010-04-09 18:49:02 +04:00
up the stack so we don ' t call it multiple times */
2004-07-07 01:43:12 +04:00
2010-11-09 23:07:25 +03:00
username = talloc_strdup ( mem_ctx , domuser ) ;
if ( ! username ) {
return NULL ;
}
2010-02-17 00:07:22 +03:00
2004-07-07 01:43:12 +04:00
p = strchr_m ( username , * lp_winbind_separator ( ) ) ;
2010-02-17 00:07:22 +03:00
2004-03-16 19:41:54 +03:00
/* code for a DOMAIN\user string */
2010-02-17 00:07:22 +03:00
2004-03-16 19:41:54 +03:00
if ( p ) {
2006-02-04 01:19:41 +03:00
pw = Get_Pwnam_alloc ( mem_ctx , domuser ) ;
2010-11-09 23:07:25 +03:00
if ( pw ) {
2004-03-16 19:41:54 +03:00
/* make sure we get the case of the username correct */
/* work around 'winbind use default domain = yes' */
2012-10-29 15:09:22 +04:00
if ( lp_winbind_use_default_domain ( ) & &
! strchr_m ( pw - > pw_name , * lp_winbind_separator ( ) ) ) {
2004-03-16 19:41:54 +03:00
char * domain ;
2010-02-17 00:07:22 +03:00
2004-07-07 01:43:12 +04:00
/* split the domain and username into 2 strings */
2004-03-16 19:41:54 +03:00
* p = ' \0 ' ;
2004-07-07 01:43:12 +04:00
domain = username ;
2010-11-09 23:07:25 +03:00
* p_save_username = talloc_asprintf ( mem_ctx ,
" %s%c%s " ,
domain ,
* lp_winbind_separator ( ) ,
pw - > pw_name ) ;
if ( ! * p_save_username ) {
TALLOC_FREE ( pw ) ;
return NULL ;
}
} else {
* p_save_username = talloc_strdup ( mem_ctx , pw - > pw_name ) ;
2004-03-16 19:41:54 +03:00
}
2003-10-20 20:49:45 +04:00
2010-11-09 23:07:25 +03:00
/* whew -- done! */
2004-03-16 19:41:54 +03:00
return pw ;
}
2003-10-20 20:49:45 +04:00
2004-03-16 19:41:54 +03:00
/* setup for lookup of just the username */
2004-07-07 01:43:12 +04:00
/* remember that p and username are overlapping memory */
2003-10-20 20:49:45 +04:00
2004-03-16 23:28:47 +03:00
p + + ;
2010-11-09 23:07:25 +03:00
username = talloc_strdup ( mem_ctx , p ) ;
if ( ! username ) {
return NULL ;
}
2004-03-16 19:41:54 +03:00
}
2010-02-17 00:07:22 +03:00
2004-03-16 19:41:54 +03:00
/* just lookup a plain username */
2010-02-17 00:07:22 +03:00
2006-02-04 01:19:41 +03:00
pw = Get_Pwnam_alloc ( mem_ctx , username ) ;
2010-02-17 00:07:22 +03:00
2006-04-14 23:36:36 +04:00
/* Create local user if requested but only if winbindd
is not running . We need to protect against cases
where winbindd is failing and then prematurely
creating users in / etc / passwd */
2010-02-17 00:07:22 +03:00
2006-04-14 23:36:36 +04:00
if ( ! pw & & create & & ! winbind_ping ( ) ) {
2004-03-16 19:41:54 +03:00
/* Don't add a machine account. */
2004-07-07 01:43:12 +04:00
if ( username [ strlen ( username ) - 1 ] = = ' $ ' )
2004-03-16 19:41:54 +03:00
return NULL ;
2003-10-20 20:49:45 +04:00
2009-04-01 23:42:47 +04:00
_smb_create_user ( NULL , username , NULL ) ;
2006-02-04 01:19:41 +03:00
pw = Get_Pwnam_alloc ( mem_ctx , username ) ;
2003-11-06 20:28:44 +03:00
}
2010-02-17 00:07:22 +03:00
2004-03-16 19:41:54 +03:00
/* one last check for a valid passwd struct */
2010-02-17 00:07:22 +03:00
2010-11-09 23:07:25 +03:00
if ( pw ) {
* p_save_username = talloc_strdup ( mem_ctx , pw - > pw_name ) ;
}
2003-12-06 05:34:02 +03:00
return pw ;
2003-10-20 20:49:45 +04:00
}
2002-07-15 14:35:28 +04:00
/***************************************************************************
Make a server_info struct from the info3 returned by a domain logon
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS make_server_info_info3 ( TALLOC_CTX * mem_ctx ,
const char * sent_nt_username ,
const char * domain ,
2010-01-10 16:24:22 +03:00
struct auth_serversupplied_info * * server_info ,
2014-06-17 09:49:29 +04:00
const struct netr_SamInfo3 * info3 )
2002-07-15 14:35:28 +04:00
{
NTSTATUS nt_status = NT_STATUS_OK ;
2007-12-23 01:10:06 +03:00
char * found_username = NULL ;
2002-07-15 14:35:28 +04:00
const char * nt_domain ;
const char * nt_username ;
2012-07-15 06:22:44 +04:00
struct dom_sid user_sid ;
struct dom_sid group_sid ;
2007-10-19 04:40:25 +04:00
bool username_was_mapped ;
2010-05-29 19:02:47 +04:00
struct passwd * pwd ;
2010-01-10 16:24:22 +03:00
struct auth_serversupplied_info * result ;
2015-08-19 17:19:30 +03:00
TALLOC_CTX * tmp_ctx = talloc_stackframe ( ) ;
2006-02-04 01:19:41 +03:00
2002-07-15 14:35:28 +04:00
/*
Here is where we should check the list of
trusted domains , and verify that the SID
matches .
*/
2012-07-15 06:22:44 +04:00
if ( ! sid_compose ( & user_sid , info3 - > base . domain_sid , info3 - > base . rid ) ) {
2015-08-19 17:19:30 +03:00
nt_status = NT_STATUS_INVALID_PARAMETER ;
goto out ;
2012-07-15 06:22:44 +04:00
}
if ( ! sid_compose ( & group_sid , info3 - > base . domain_sid ,
info3 - > base . primary_gid ) ) {
2015-08-19 17:19:30 +03:00
nt_status = NT_STATUS_INVALID_PARAMETER ;
goto out ;
2012-07-15 06:22:44 +04:00
}
2015-08-19 17:19:30 +03:00
nt_username = talloc_strdup ( tmp_ctx , info3 - > base . account_name . string ) ;
2008-02-16 21:08:22 +03:00
if ( ! nt_username ) {
2006-02-04 01:19:41 +03:00
/* If the server didn't give us one, just use the one we sent
* them */
2002-07-15 14:35:28 +04:00
nt_username = sent_nt_username ;
}
2011-10-22 00:10:43 +04:00
nt_domain = talloc_strdup ( mem_ctx , info3 - > base . logon_domain . string ) ;
2008-02-16 21:08:22 +03:00
if ( ! nt_domain ) {
2006-02-04 01:19:41 +03:00
/* If the server didn't give us one, just use the one we sent
* them */
2003-12-31 03:31:43 +03:00
nt_domain = domain ;
2002-07-15 14:35:28 +04:00
}
2010-02-17 00:07:22 +03:00
2010-05-27 11:41:56 +04:00
/* If getpwnam() fails try the add user script (2.2.x behavior).
2004-10-23 00:15:24 +04:00
We use the _unmapped_ username here in an attempt to provide
consistent username mapping behavior between kerberos and NTLM [ SSP ]
2006-02-04 01:19:41 +03:00
authentication in domain mode security . I . E . Username mapping
should be applied to the fully qualified username
( e . g . DOMAIN \ user ) and not just the login name . Yes this means we
called map_username ( ) unnecessarily in make_user_info_map ( ) but
that is how the current code is designed . Making the change here
is the least disruptive place . - - jerry */
2010-02-17 00:07:22 +03:00
2006-05-02 16:13:23 +04:00
/* this call will try to create the user if necessary */
2015-08-19 17:19:30 +03:00
nt_status = check_account ( tmp_ctx ,
2015-08-19 17:24:08 +03:00
nt_domain ,
nt_username ,
& found_username ,
& pwd ,
& username_was_mapped ) ;
2003-07-07 09:11:10 +04:00
2010-05-28 22:14:27 +04:00
if ( ! NT_STATUS_IS_OK ( nt_status ) ) {
2015-08-19 17:11:47 +03:00
/* Handle 'map to guest = Bad Uid */
if ( NT_STATUS_EQUAL ( nt_status , NT_STATUS_NO_SUCH_USER ) & &
( lp_security ( ) = = SEC_ADS | | lp_security ( ) = = SEC_DOMAIN ) & &
lp_map_to_guest ( ) = = MAP_TO_GUEST_ON_BAD_UID ) {
DBG_NOTICE ( " Try to map %s to guest account " ,
nt_username ) ;
2015-08-19 17:19:30 +03:00
nt_status = make_server_info_guest ( tmp_ctx , & result ) ;
if ( NT_STATUS_IS_OK ( nt_status ) ) {
* server_info = talloc_move ( mem_ctx , & result ) ;
}
2015-08-19 17:11:47 +03:00
}
2015-08-19 17:19:30 +03:00
goto out ;
2010-05-28 22:14:27 +04:00
}
2015-08-19 17:19:30 +03:00
result = make_server_info ( tmp_ctx ) ;
2006-02-04 01:19:41 +03:00
if ( result = = NULL ) {
2002-09-25 19:19:00 +04:00
DEBUG ( 4 , ( " make_server_info failed! \n " ) ) ;
2015-08-19 17:19:30 +03:00
nt_status = NT_STATUS_NO_MEMORY ;
goto out ;
2002-07-15 14:35:28 +04:00
}
2006-02-04 01:19:41 +03:00
result - > unix_name = talloc_strdup ( result , found_username ) ;
2003-07-03 18:36:42 +04:00
2010-05-27 11:41:56 +04:00
/* copy in the info3 */
2018-01-11 11:06:31 +03:00
nt_status = copy_netr_SamInfo3 ( result ,
info3 ,
& result - > info3 ) ;
if ( ! NT_STATUS_IS_OK ( nt_status ) ) {
2015-08-19 17:19:30 +03:00
goto out ;
2010-06-25 19:06:00 +04:00
}
2010-05-27 11:41:56 +04:00
2003-06-12 18:24:15 +04:00
/* Fill in the unix info we found on the way */
2012-07-15 06:22:44 +04:00
2010-05-29 19:02:47 +04:00
result - > utok . uid = pwd - > pw_uid ;
result - > utok . gid = pwd - > pw_gid ;
2002-09-25 19:19:00 +04:00
Changes all over the shop, but all towards:
- NTLM2 support in the server
- KEY_EXCH support in the server
- variable length session keys.
In detail:
- NTLM2 is an extension of NTLMv1, that is compatible with existing
domain controllers (unlike NTLMv2, which requires a DC upgrade).
* This is known as 'NTLMv2 session security' *
(This is not yet implemented on the RPC pipes however, so there may
well still be issues for PDC setups, particuarly around password
changes. We do not fully understand the sign/seal implications of
NTLM2 on RPC pipes.)
This requires modifications to our authentication subsystem, as we
must handle the 'challege' input into the challenge-response algorithm
being changed. This also needs to be turned off for
'security=server', which does not support this.
- KEY_EXCH is another 'security' mechanism, whereby the session key
actually used by the server is sent by the client, rather than being
the shared-secret directly or indirectly.
- As both these methods change the session key, the auth subsystem
needed to be changed, to 'override' session keys provided by the
backend.
- There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation.
- The 'names blob' in NTLMSSP is always in unicode - never in ascii.
Don't make an ascii version ever.
- The other big change is to allow variable length session keys. We
have always assumed that session keys are 16 bytes long - and padded
to this length if shorter. However, Kerberos session keys are 8 bytes
long, when the krb5 login uses DES.
* This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. *
- Add better DEBUG() messages to ntlm_auth, warning administrators of
misconfigurations that prevent access to the privileged pipe. This
should help reduce some of the 'it just doesn't work' issues.
- Fix data_blob_talloc() to behave the same way data_blob() does when
passed a NULL data pointer. (just allocate)
REMEMBER to make clean after this commit - I have changed plenty of data structures...
(This used to be commit f3bbc87b0dac63426cda6fac7a295d3aad810ecc)
2003-11-22 16:19:38 +03:00
/* ensure we are never given NULL session keys */
2007-12-28 19:02:34 +03:00
2016-12-31 15:45:51 +03:00
if ( all_zero ( info3 - > base . key . key , sizeof ( info3 - > base . key . key ) ) ) {
2011-02-14 03:35:21 +03:00
result - > session_key = data_blob_null ;
Changes all over the shop, but all towards:
- NTLM2 support in the server
- KEY_EXCH support in the server
- variable length session keys.
In detail:
- NTLM2 is an extension of NTLMv1, that is compatible with existing
domain controllers (unlike NTLMv2, which requires a DC upgrade).
* This is known as 'NTLMv2 session security' *
(This is not yet implemented on the RPC pipes however, so there may
well still be issues for PDC setups, particuarly around password
changes. We do not fully understand the sign/seal implications of
NTLM2 on RPC pipes.)
This requires modifications to our authentication subsystem, as we
must handle the 'challege' input into the challenge-response algorithm
being changed. This also needs to be turned off for
'security=server', which does not support this.
- KEY_EXCH is another 'security' mechanism, whereby the session key
actually used by the server is sent by the client, rather than being
the shared-secret directly or indirectly.
- As both these methods change the session key, the auth subsystem
needed to be changed, to 'override' session keys provided by the
backend.
- There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation.
- The 'names blob' in NTLMSSP is always in unicode - never in ascii.
Don't make an ascii version ever.
- The other big change is to allow variable length session keys. We
have always assumed that session keys are 16 bytes long - and padded
to this length if shorter. However, Kerberos session keys are 8 bytes
long, when the krb5 login uses DES.
* This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. *
- Add better DEBUG() messages to ntlm_auth, warning administrators of
misconfigurations that prevent access to the privileged pipe. This
should help reduce some of the 'it just doesn't work' issues.
- Fix data_blob_talloc() to behave the same way data_blob() does when
passed a NULL data pointer. (just allocate)
REMEMBER to make clean after this commit - I have changed plenty of data structures...
(This used to be commit f3bbc87b0dac63426cda6fac7a295d3aad810ecc)
2003-11-22 16:19:38 +03:00
} else {
2011-02-14 03:35:21 +03:00
result - > session_key = data_blob_talloc (
2008-02-16 21:08:22 +03:00
result , info3 - > base . key . key ,
sizeof ( info3 - > base . key . key ) ) ;
Changes all over the shop, but all towards:
- NTLM2 support in the server
- KEY_EXCH support in the server
- variable length session keys.
In detail:
- NTLM2 is an extension of NTLMv1, that is compatible with existing
domain controllers (unlike NTLMv2, which requires a DC upgrade).
* This is known as 'NTLMv2 session security' *
(This is not yet implemented on the RPC pipes however, so there may
well still be issues for PDC setups, particuarly around password
changes. We do not fully understand the sign/seal implications of
NTLM2 on RPC pipes.)
This requires modifications to our authentication subsystem, as we
must handle the 'challege' input into the challenge-response algorithm
being changed. This also needs to be turned off for
'security=server', which does not support this.
- KEY_EXCH is another 'security' mechanism, whereby the session key
actually used by the server is sent by the client, rather than being
the shared-secret directly or indirectly.
- As both these methods change the session key, the auth subsystem
needed to be changed, to 'override' session keys provided by the
backend.
- There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation.
- The 'names blob' in NTLMSSP is always in unicode - never in ascii.
Don't make an ascii version ever.
- The other big change is to allow variable length session keys. We
have always assumed that session keys are 16 bytes long - and padded
to this length if shorter. However, Kerberos session keys are 8 bytes
long, when the krb5 login uses DES.
* This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. *
- Add better DEBUG() messages to ntlm_auth, warning administrators of
misconfigurations that prevent access to the privileged pipe. This
should help reduce some of the 'it just doesn't work' issues.
- Fix data_blob_talloc() to behave the same way data_blob() does when
passed a NULL data pointer. (just allocate)
REMEMBER to make clean after this commit - I have changed plenty of data structures...
(This used to be commit f3bbc87b0dac63426cda6fac7a295d3aad810ecc)
2003-11-22 16:19:38 +03:00
}
2003-03-24 12:54:13 +03:00
2016-12-31 15:45:51 +03:00
if ( all_zero ( info3 - > base . LMSessKey . key ,
sizeof ( info3 - > base . LMSessKey . key ) ) ) {
2007-05-14 16:16:20 +04:00
result - > lm_session_key = data_blob_null ;
Changes all over the shop, but all towards:
- NTLM2 support in the server
- KEY_EXCH support in the server
- variable length session keys.
In detail:
- NTLM2 is an extension of NTLMv1, that is compatible with existing
domain controllers (unlike NTLMv2, which requires a DC upgrade).
* This is known as 'NTLMv2 session security' *
(This is not yet implemented on the RPC pipes however, so there may
well still be issues for PDC setups, particuarly around password
changes. We do not fully understand the sign/seal implications of
NTLM2 on RPC pipes.)
This requires modifications to our authentication subsystem, as we
must handle the 'challege' input into the challenge-response algorithm
being changed. This also needs to be turned off for
'security=server', which does not support this.
- KEY_EXCH is another 'security' mechanism, whereby the session key
actually used by the server is sent by the client, rather than being
the shared-secret directly or indirectly.
- As both these methods change the session key, the auth subsystem
needed to be changed, to 'override' session keys provided by the
backend.
- There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation.
- The 'names blob' in NTLMSSP is always in unicode - never in ascii.
Don't make an ascii version ever.
- The other big change is to allow variable length session keys. We
have always assumed that session keys are 16 bytes long - and padded
to this length if shorter. However, Kerberos session keys are 8 bytes
long, when the krb5 login uses DES.
* This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. *
- Add better DEBUG() messages to ntlm_auth, warning administrators of
misconfigurations that prevent access to the privileged pipe. This
should help reduce some of the 'it just doesn't work' issues.
- Fix data_blob_talloc() to behave the same way data_blob() does when
passed a NULL data pointer. (just allocate)
REMEMBER to make clean after this commit - I have changed plenty of data structures...
(This used to be commit f3bbc87b0dac63426cda6fac7a295d3aad810ecc)
2003-11-22 16:19:38 +03:00
} else {
2006-02-04 01:19:41 +03:00
result - > lm_session_key = data_blob_talloc (
2008-02-16 21:08:22 +03:00
result , info3 - > base . LMSessKey . key ,
sizeof ( info3 - > base . LMSessKey . key ) ) ;
2006-02-04 01:19:41 +03:00
}
2008-05-06 19:37:00 +04:00
result - > nss_token | = username_was_mapped ;
2006-05-06 23:24:35 +04:00
2011-07-19 04:43:23 +04:00
result - > guest = ( info3 - > base . user_flags & NETLOGON_GUEST ) ;
2015-08-19 17:19:30 +03:00
* server_info = talloc_move ( mem_ctx , & result ) ;
2004-12-20 14:36:39 +03:00
2015-08-19 17:19:30 +03:00
nt_status = NT_STATUS_OK ;
out :
talloc_free ( tmp_ctx ) ;
return nt_status ;
2008-02-04 20:18:36 +03:00
}
/*****************************************************************************
Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
NTSTATUS make_server_info_wbcAuthUserInfo ( TALLOC_CTX * mem_ctx ,
const char * sent_nt_username ,
const char * domain ,
const struct wbcAuthUserInfo * info ,
2010-01-10 16:24:22 +03:00
struct auth_serversupplied_info * * server_info )
2008-02-04 20:18:36 +03:00
{
2016-01-07 17:10:26 +03:00
struct netr_SamInfo3 info3 ;
struct netr_SamInfo6 * info6 ;
2008-02-04 20:18:36 +03:00
2016-01-07 17:10:26 +03:00
info6 = wbcAuthUserInfo_to_netr_SamInfo6 ( mem_ctx , info ) ;
if ( ! info6 ) {
2008-02-04 20:18:36 +03:00
return NT_STATUS_NO_MEMORY ;
}
2016-01-07 17:10:26 +03:00
info3 . base = info6 - > base ;
info3 . sidcount = info6 - > sidcount ;
info3 . sids = info6 - > sids ;
2010-05-27 11:41:56 +04:00
return make_server_info_info3 ( mem_ctx ,
sent_nt_username , domain ,
2016-01-07 17:10:26 +03:00
server_info , & info3 ) ;
2002-07-15 14:35:28 +04:00
}
2003-07-01 21:51:52 +04:00
/**
* Verify whether or not given domain is trusted .
*
2017-06-19 11:43:25 +03:00
* This should only be used on a DC .
*
2003-07-01 21:51:52 +04:00
* @ param domain_name name of the domain to be verified
2009-11-14 03:23:05 +03:00
* @ return true if domain is one of the trusted ones or
2003-07-01 21:51:52 +04:00
* false if otherwise
* */
2007-10-19 04:40:25 +04:00
bool is_trusted_domain ( const char * dom_name )
2003-07-01 21:51:52 +04:00
{
2007-10-19 04:40:25 +04:00
bool ret ;
2003-07-01 21:51:52 +04:00
2017-06-19 11:43:25 +03:00
if ( ! IS_DC ) {
2011-07-19 14:15:45 +04:00
return false ;
2017-06-19 11:43:25 +03:00
}
2003-07-08 21:19:37 +04:00
2009-11-14 03:12:22 +03:00
if ( dom_name = = NULL | | dom_name [ 0 ] = = ' \0 ' ) {
return false ;
2009-11-14 03:21:42 +03:00
}
if ( strequal ( dom_name , get_global_sam_name ( ) ) ) {
return false ;
2009-11-14 03:12:22 +03:00
}
2017-06-19 11:43:25 +03:00
become_root ( ) ;
DEBUG ( 5 , ( " is_trusted_domain: Checking for domain trust with "
" [%s] \n " , dom_name ) ) ;
ret = pdb_get_trusteddom_pw ( dom_name , NULL , NULL , NULL ) ;
unbecome_root ( ) ;
2003-07-01 21:51:52 +04:00
2017-06-19 11:43:25 +03:00
return ret ;
2003-07-01 21:51:52 +04:00
}
2002-01-05 07:55:41 +03:00
2011-07-22 05:33:52 +04:00
/*
on a logon error possibly map the error to success if " map to guest "
is set approriately
*/
2014-02-18 16:52:49 +04:00
NTSTATUS do_map_to_guest_server_info ( TALLOC_CTX * mem_ctx ,
NTSTATUS status ,
const char * user ,
const char * domain ,
struct auth_serversupplied_info * * server_info )
2011-07-22 05:33:52 +04:00
{
user = user ? user : " " ;
domain = domain ? domain : " " ;
if ( NT_STATUS_EQUAL ( status , NT_STATUS_NO_SUCH_USER ) ) {
if ( ( lp_map_to_guest ( ) = = MAP_TO_GUEST_ON_BAD_USER ) | |
( lp_map_to_guest ( ) = = MAP_TO_GUEST_ON_BAD_PASSWORD ) ) {
DEBUG ( 3 , ( " No such user %s [%s] - using guest account \n " ,
user , domain ) ) ;
2014-02-18 16:52:49 +04:00
return make_server_info_guest ( mem_ctx , server_info ) ;
2011-07-22 05:33:52 +04:00
}
2011-07-27 07:20:59 +04:00
} else if ( NT_STATUS_EQUAL ( status , NT_STATUS_WRONG_PASSWORD ) ) {
2011-07-22 05:33:52 +04:00
if ( lp_map_to_guest ( ) = = MAP_TO_GUEST_ON_BAD_PASSWORD ) {
DEBUG ( 3 , ( " Registered username %s for guest access \n " ,
user ) ) ;
2014-02-18 16:52:49 +04:00
return make_server_info_guest ( mem_ctx , server_info ) ;
2011-07-22 05:33:52 +04:00
}
}
return status ;
}
2012-03-02 18:18:16 +04:00
/*
Extract session key from a session info and return it in a blob
if intent is KEY_USE_16BYTES , truncate it to 16 bytes
See sections 3.2 .4 .15 and 3.3 .4 .2 of MS - SMB
Also see https : //lists.samba.org/archive/cifs-protocol/2012-January/002265.html for details
Note that returned session_key is referencing the original key , it is supposed to be
short - lived . If original session_info - > session_key is gone , the reference will be broken .
*/
NTSTATUS session_extract_session_key ( const struct auth_session_info * session_info , DATA_BLOB * session_key , enum session_key_use_intent intent )
{
if ( session_key = = NULL | | session_info = = NULL ) {
return NT_STATUS_INVALID_PARAMETER ;
}
if ( session_info - > session_key . length = = 0 ) {
return NT_STATUS_NO_USER_SESSION_KEY ;
}
* session_key = session_info - > session_key ;
if ( intent = = KEY_USE_16BYTES ) {
session_key - > length = MIN ( session_info - > session_key . length , 16 ) ;
}
return NT_STATUS_OK ;
}