1996-05-04 11:50:46 +04:00
/*
Unix SMB / Netbios implementation .
Version 1.9 .
Password and authentication handling
1998-01-22 16:27:43 +03:00
Copyright ( C ) Andrew Tridgell 1992 - 1998
1996-05-04 11:50:46 +04:00
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation ; either version 2 of the License , or
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
along with this program ; if not , write to the Free Software
Foundation , Inc . , 675 Mass Ave , Cambridge , MA 0213 9 , USA .
*/
# include "includes.h"
extern int DEBUGLEVEL ;
extern int Protocol ;
/* users from session setup */
static pstring session_users = " " ;
1998-09-26 01:01:52 +04:00
extern pstring scope ;
1998-04-25 05:12:08 +04:00
extern pstring global_myname ;
1998-04-29 04:02:57 +04:00
extern fstring global_myworkgroup ;
1998-04-23 22:54:57 +04:00
1996-05-04 11:50:46 +04:00
/* Data to do lanman1/2 password challenge. */
static unsigned char saved_challenge [ 8 ] ;
static BOOL challenge_sent = False ;
/*******************************************************************
Get the next challenge value - no repeats .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
void generate_next_challenge ( char * challenge )
{
1998-04-21 02:43:54 +04:00
#if 0
/*
* Leave this ifdef ' d out while we test
* the new crypto random number generator .
* JRA .
*/
1997-09-16 08:41:16 +04:00
unsigned char buf [ 16 ] ;
static int counter = 0 ;
struct timeval tval ;
int v1 , v2 ;
/* get a sort-of random number */
GetTimeOfDay ( & tval ) ;
v1 = ( counter + + ) + getpid ( ) + tval . tv_sec ;
v2 = ( counter + + ) * getpid ( ) + tval . tv_usec ;
SIVAL ( challenge , 0 , v1 ) ;
SIVAL ( challenge , 4 , v2 ) ;
/* mash it up with md4 */
1997-09-16 12:26:33 +04:00
mdfour ( buf , ( unsigned char * ) challenge , 8 ) ;
1998-04-21 02:43:54 +04:00
# else
unsigned char buf [ 8 ] ;
1997-09-16 08:41:16 +04:00
1998-04-21 02:43:54 +04:00
generate_random_buffer ( buf , 8 , False ) ;
# endif
1997-09-16 08:41:16 +04:00
memcpy ( saved_challenge , buf , 8 ) ;
memcpy ( challenge , buf , 8 ) ;
challenge_sent = True ;
1996-05-04 11:50:46 +04:00
}
/*******************************************************************
set the last challenge sent , usually from a password server
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-09-29 01:43:48 +04:00
BOOL set_challenge ( unsigned char * challenge )
1996-05-04 11:50:46 +04:00
{
memcpy ( saved_challenge , challenge , 8 ) ;
challenge_sent = True ;
return ( True ) ;
}
/*******************************************************************
get the last challenge sent
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-09-05 09:07:05 +04:00
static BOOL last_challenge ( unsigned char * challenge )
1996-05-04 11:50:46 +04:00
{
if ( ! challenge_sent ) return ( False ) ;
memcpy ( challenge , saved_challenge , 8 ) ;
return ( True ) ;
}
/* this holds info on user ids that are already validated for this VC */
static user_struct * validated_users = NULL ;
static int num_validated_users = 0 ;
/****************************************************************************
check if a uid has been validated , and return an pointer to the user_struct
1996-10-26 00:18:28 +04:00
if it has . NULL if not . vuid is biased by an offset . This allows us to
tell random client vuid ' s ( normally zero ) from valid vuids .
1996-05-04 11:50:46 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-26 00:18:28 +04:00
user_struct * get_valid_user_struct ( uint16 vuid )
1996-05-04 11:50:46 +04:00
{
1997-10-10 18:48:05 +04:00
if ( vuid = = UID_FIELD_INVALID )
1996-10-26 00:18:28 +04:00
return NULL ;
vuid - = VUID_OFFSET ;
1997-10-10 18:48:05 +04:00
if ( ( vuid > = ( uint16 ) num_validated_users ) | |
1998-09-30 00:24:17 +04:00
( validated_users [ vuid ] . uid = = ( uid_t ) - 1 ) | | ( validated_users [ vuid ] . gid = = ( gid_t ) - 1 ) )
1996-05-04 11:50:46 +04:00
return NULL ;
return & validated_users [ vuid ] ;
}
/****************************************************************************
invalidate a uid
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-26 00:18:28 +04:00
void invalidate_vuid ( uint16 vuid )
1996-05-04 11:50:46 +04:00
{
1996-10-26 00:18:28 +04:00
user_struct * vuser = get_valid_user_struct ( vuid ) ;
1997-10-10 18:48:05 +04:00
if ( vuser = = NULL ) return ;
1996-10-26 00:18:28 +04:00
1998-09-30 00:24:17 +04:00
vuser - > uid = ( uid_t ) - 1 ;
vuser - > gid = ( gid_t ) - 1 ;
1997-10-10 18:48:05 +04:00
vuser - > n_sids = 0 ;
1998-07-27 22:50:45 +04:00
/* same number of igroups as groups */
1997-10-10 18:48:05 +04:00
vuser - > n_groups = 0 ;
1998-09-30 00:24:17 +04:00
if ( vuser - > groups )
free ( ( char * ) vuser - > groups ) ;
1997-10-10 18:48:05 +04:00
1998-09-30 00:24:17 +04:00
if ( vuser - > sids )
free ( ( char * ) vuser - > sids ) ;
1997-10-10 18:48:05 +04:00
vuser - > sids = NULL ;
vuser - > groups = NULL ;
1996-05-04 11:50:46 +04:00
}
/****************************************************************************
return a validated username
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1996-10-26 00:18:28 +04:00
char * validated_username ( uint16 vuid )
1996-05-04 11:50:46 +04:00
{
1996-10-26 00:18:28 +04:00
user_struct * vuser = get_valid_user_struct ( vuid ) ;
1997-10-10 18:48:05 +04:00
if ( vuser = = NULL )
1996-10-26 00:18:28 +04:00
return 0 ;
return ( vuser - > name ) ;
1996-05-04 11:50:46 +04:00
}
1998-03-12 05:43:46 +03:00
/****************************************************************************
Setup the groups a user belongs to .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-09-30 00:24:17 +04:00
int setup_groups ( char * user , uid_t uid , gid_t gid , int * p_ngroups , gid_t * * p_groups )
1998-03-12 05:43:46 +03:00
{
1998-07-29 09:05:36 +04:00
int i , ngroups ;
1998-09-30 00:24:17 +04:00
gid_t grp = 0 ;
1998-10-17 00:13:26 +04:00
gid_t * groups = NULL ;
1998-07-29 09:05:36 +04:00
1998-10-17 00:13:26 +04:00
if ( - 1 = = initgroups ( user , gid ) )
{
if ( getuid ( ) = = 0 )
{
1998-07-29 09:05:36 +04:00
DEBUG ( 0 , ( " Unable to initgroups! \n " ) ) ;
1998-10-17 00:13:26 +04:00
if ( gid < 0 | | gid > 16000 | | uid < 0 | | uid > 16000 )
{
DEBUG ( 0 , ( " This is probably a problem with the account %s \n " , user ) ) ;
1998-07-29 09:05:36 +04:00
}
}
return - 1 ;
1998-03-12 05:43:46 +03:00
}
1998-07-29 09:05:36 +04:00
1998-09-30 00:24:17 +04:00
ngroups = sys_getgroups ( 0 , & grp ) ;
if ( ngroups < = 0 )
1998-10-17 00:13:26 +04:00
{
ngroups = 32 ;
}
1998-07-29 09:05:36 +04:00
1998-10-17 00:13:26 +04:00
if ( ( groups = ( gid_t * ) malloc ( sizeof ( gid_t ) * ngroups ) ) = = NULL )
{
DEBUG ( 0 , ( " setup_groups malloc fail ! \n " ) ) ;
return - 1 ;
}
1998-07-29 09:05:36 +04:00
1998-10-17 00:13:26 +04:00
ngroups = sys_getgroups ( ngroups , groups ) ;
1998-07-29 09:05:36 +04:00
( * p_ngroups ) = ngroups ;
( * p_groups ) = groups ;
1998-08-13 04:01:02 +04:00
DEBUG ( 3 , ( " %s is in %d groups: " , user , ngroups ) ) ;
1998-10-17 00:13:26 +04:00
for ( i = 0 ; i < ngroups ; i + + )
{
1998-08-13 04:01:02 +04:00
DEBUG ( 3 , ( " %s%d " , ( i ? " , " : " " ) , ( int ) groups [ i ] ) ) ;
1998-03-12 05:43:46 +03:00
}
1998-08-13 04:01:02 +04:00
DEBUG ( 3 , ( " \n " ) ) ;
1998-07-29 09:05:36 +04:00
return 0 ;
1998-03-12 05:43:46 +03:00
}
1996-05-04 11:50:46 +04:00
/****************************************************************************
register a uid / name pair as being valid and that a valid password
1996-10-26 00:18:28 +04:00
has been given . vuid is biased by an offset . This allows us to
tell random client vuid ' s ( normally zero ) from valid vuids .
1996-05-04 11:50:46 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-09-30 00:24:17 +04:00
uint16 register_vuid ( uid_t uid , gid_t gid , char * unix_name , char * requested_name , BOOL guest )
1996-05-04 11:50:46 +04:00
{
user_struct * vuser ;
1997-05-07 21:56:46 +04:00
struct passwd * pwfile ; /* for getting real name from passwd file */
1998-03-16 21:31:09 +03:00
/* Ensure no vuid gets registered in share level security. */
if ( lp_security ( ) = = SEC_SHARE )
return UID_FIELD_INVALID ;
1997-07-22 23:04:40 +04:00
#if 0
/*
* After observing MS - Exchange services writing to a Samba share
1997-10-10 18:48:05 +04:00
* I belive this code is incorrect . Each service does its own
1997-07-22 23:04:40 +04:00
* sessionsetup_and_X for the same user , and as each service shuts
* down , it does a user_logoff_and_X . As we are consolidating multiple
* sessionsetup_and_X ' s onto the same vuid here , when the first service
* shuts down , it invalidates all the open files for the other services .
* Hence I am removing this code and forcing each sessionsetup_and_X
* to get a new vuid .
* Jeremy Allison . ( jallison @ whistle . com ) .
*/
1996-10-26 00:18:28 +04:00
int i ;
for ( i = 0 ; i < num_validated_users ; i + + ) {
vuser = & validated_users [ i ] ;
1997-10-10 18:48:05 +04:00
if ( vuser - > uid = = uid )
1997-06-18 05:04:57 +04:00
return ( uint16 ) ( i + VUID_OFFSET ) ; /* User already validated */
1996-10-26 00:18:28 +04:00
}
1997-07-22 23:04:40 +04:00
# endif
1996-05-04 11:50:46 +04:00
1996-10-26 00:18:28 +04:00
validated_users = ( user_struct * ) Realloc ( validated_users ,
sizeof ( user_struct ) *
( num_validated_users + 1 ) ) ;
1996-05-04 11:50:46 +04:00
if ( ! validated_users )
{
DEBUG ( 0 , ( " Failed to realloc users struct! \n " ) ) ;
1996-11-09 04:56:20 +03:00
num_validated_users = 0 ;
1996-10-26 00:18:28 +04:00
return UID_FIELD_INVALID ;
1996-05-04 11:50:46 +04:00
}
vuser = & validated_users [ num_validated_users ] ;
1996-10-26 00:18:28 +04:00
num_validated_users + + ;
1996-05-04 11:50:46 +04:00
vuser - > uid = uid ;
vuser - > gid = gid ;
vuser - > guest = guest ;
1998-05-06 05:34:51 +04:00
fstrcpy ( vuser - > name , unix_name ) ;
fstrcpy ( vuser - > requested_name , requested_name ) ;
1996-05-04 11:50:46 +04:00
1997-10-10 18:48:05 +04:00
vuser - > n_sids = 0 ;
vuser - > sids = NULL ;
vuser - > n_groups = 0 ;
vuser - > groups = NULL ;
1996-05-04 11:50:46 +04:00
/* Find all the groups this uid is in and store them.
Used by become_user ( ) */
1998-05-06 05:34:51 +04:00
setup_groups ( unix_name , uid , gid ,
1997-10-10 18:48:05 +04:00
& vuser - > n_groups ,
1998-07-27 22:50:45 +04:00
& vuser - > groups ) ;
1996-05-04 11:50:46 +04:00
1998-09-30 00:24:17 +04:00
DEBUG ( 3 , ( " uid %d registered to name %s \n " , ( int ) uid , unix_name ) ) ;
1996-10-26 00:18:28 +04:00
1997-05-07 21:56:46 +04:00
DEBUG ( 3 , ( " Clearing default real name \n " ) ) ;
1997-10-10 18:48:05 +04:00
fstrcpy ( vuser - > real_name , " <Full Name> \0 " ) ;
1997-05-07 21:56:46 +04:00
if ( lp_unix_realname ( ) ) {
1997-10-10 18:48:05 +04:00
if ( ( pwfile = getpwnam ( vuser - > name ) ) ! = NULL )
1997-07-28 22:59:57 +04:00
{
DEBUG ( 3 , ( " User name: %s \t Real name: %s \n " , vuser - > name , pwfile - > pw_gecos ) ) ;
1997-10-10 18:48:05 +04:00
fstrcpy ( vuser - > real_name , pwfile - > pw_gecos ) ;
1997-07-28 22:59:57 +04:00
}
1997-05-07 21:56:46 +04:00
}
1996-10-26 00:18:28 +04:00
return ( uint16 ) ( ( num_validated_users - 1 ) + VUID_OFFSET ) ;
1996-05-04 11:50:46 +04:00
}
/****************************************************************************
add a name to the session users list
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
void add_session_user ( char * user )
{
fstring suser ;
StrnCpy ( suser , user , sizeof ( suser ) - 1 ) ;
if ( ! Get_Pwnam ( suser , True ) ) return ;
if ( suser & & * suser & & ! in_list ( suser , session_users , False ) )
{
if ( strlen ( suser ) + strlen ( session_users ) + 2 > = sizeof ( pstring ) )
DEBUG ( 1 , ( " Too many session users?? \n " ) ) ;
else
{
1998-05-12 04:55:32 +04:00
pstrcat ( session_users , " " ) ;
pstrcat ( session_users , suser ) ;
1996-05-04 11:50:46 +04:00
}
}
}
1998-04-30 05:39:22 +04:00
/****************************************************************************
update the encrypted smbpasswd file from the plaintext username and password
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-09-05 09:07:05 +04:00
static BOOL update_smbpassword_file ( char * user , char * password )
1997-07-18 00:11:58 +04:00
{
1998-08-10 11:04:53 +04:00
struct smb_passwd * smbpw ;
BOOL ret ;
1997-07-18 00:11:58 +04:00
1998-08-10 11:04:53 +04:00
become_root ( 0 ) ;
smbpw = getsmbpwnam ( user ) ;
unbecome_root ( 0 ) ;
1997-07-18 00:11:58 +04:00
1998-08-10 11:04:53 +04:00
if ( smbpw = = NULL ) {
DEBUG ( 0 , ( " getsmbpwnam returned NULL \n " ) ) ;
return False ;
1997-07-18 00:11:58 +04:00
}
1998-08-10 11:04:53 +04:00
/* Here, the flag is one, because we want to ignore the
XXXXXXX ' d out password */
ret = change_oem_password ( smbpw , password , True ) ;
if ( ret = = False ) {
DEBUG ( 3 , ( " change_oem_password returned False \n " ) ) ;
1997-07-18 00:11:58 +04:00
}
1998-08-10 11:04:53 +04:00
return ret ;
1996-05-04 11:50:46 +04:00
}
1998-02-27 01:58:21 +03:00
1996-05-04 11:50:46 +04:00
1997-12-03 02:27:40 +03:00
1996-05-04 11:50:46 +04:00
/****************************************************************************
core of smb password checking routine .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL smb_password_check ( char * password , unsigned char * part_passwd , unsigned char * c8 )
{
/* Finish the encryption of part_passwd. */
unsigned char p21 [ 21 ] ;
unsigned char p24 [ 24 ] ;
1997-10-10 18:48:05 +04:00
if ( part_passwd = = NULL )
1996-05-04 11:50:46 +04:00
DEBUG ( 10 , ( " No password set - allowing access \n " ) ) ;
/* No password set - always true ! */
1997-10-10 18:48:05 +04:00
if ( part_passwd = = NULL )
1996-05-04 11:50:46 +04:00
return 1 ;
memset ( p21 , ' \0 ' , 21 ) ;
memcpy ( p21 , part_passwd , 16 ) ;
E_P24 ( p21 , c8 , p24 ) ;
# if DEBUG_PASSWORD
{
int i ;
DEBUG ( 100 , ( " Part password (P16) was | " ) ) ;
for ( i = 0 ; i < 16 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) part_passwd [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
DEBUG ( 100 , ( " Password from client was | " ) ) ;
for ( i = 0 ; i < 24 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) password [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
DEBUG ( 100 , ( " Given challenge was | " ) ) ;
for ( i = 0 ; i < 8 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) c8 [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
DEBUG ( 100 , ( " Value from encryption was | " ) ) ;
for ( i = 0 ; i < 24 ; i + + )
DEBUG ( 100 , ( " %X " , ( unsigned char ) p24 [ i ] ) ) ;
DEBUG ( 100 , ( " | \n " ) ) ;
}
# endif
return ( memcmp ( p24 , password , 24 ) = = 0 ) ;
}
1998-03-12 00:11:04 +03:00
/****************************************************************************
Do a specific test for an smb password being correct , given a smb_password and
the lanman and NT responses .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-10-19 21:32:10 +04:00
BOOL smb_password_ok ( struct smb_passwd * smb_pass , uchar chal [ 8 ] ,
1998-03-12 00:11:04 +03:00
uchar lm_pass [ 24 ] , uchar nt_pass [ 24 ] )
{
1998-08-10 11:04:53 +04:00
uchar challenge [ 8 ] ;
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
if ( ! lm_pass | | ! smb_pass ) return ( False ) ;
1998-03-12 00:11:04 +03:00
1998-10-15 04:55:17 +04:00
DEBUG ( 4 , ( " Checking SMB password for user %s \n " ,
smb_pass - > smb_name ) ) ;
1998-08-10 11:04:53 +04:00
if ( smb_pass - > acct_ctrl & ACB_DISABLED ) {
DEBUG ( 3 , ( " account for user %s was disabled. \n " ,
smb_pass - > smb_name ) ) ;
return ( False ) ;
}
1998-03-12 00:11:04 +03:00
1998-10-19 21:32:10 +04:00
if ( chal = = NULL )
{
DEBUG ( 5 , ( " use last SMBnegprot challenge \n " ) ) ;
if ( ! last_challenge ( challenge ) )
{
DEBUG ( 1 , ( " no challenge done - password failed \n " ) ) ;
return False ;
}
}
else
{
DEBUG ( 5 , ( " challenge received \n " ) ) ;
memcpy ( challenge , chal , 8 ) ;
1998-08-10 11:04:53 +04:00
}
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
if ( ( Protocol > = PROTOCOL_NT1 ) & & ( smb_pass - > smb_nt_passwd ! = NULL ) ) {
/* We have the NT MD4 hash challenge available - see if we can
use it ( ie . does it exist in the smbpasswd file ) .
*/
DEBUG ( 4 , ( " smb_password_ok: Checking NT MD4 password \n " ) ) ;
if ( smb_password_check ( ( char * ) nt_pass ,
( uchar * ) smb_pass - > smb_nt_passwd ,
challenge ) ) {
DEBUG ( 4 , ( " NT MD4 password check succeeded \n " ) ) ;
return ( True ) ;
}
DEBUG ( 4 , ( " NT MD4 password check failed \n " ) ) ;
}
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
/* Try against the lanman password. smb_pass->smb_passwd == NULL means
no password , allow access . */
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
DEBUG ( 4 , ( " Checking LM MD4 password \n " ) ) ;
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
if ( ( smb_pass - > smb_passwd = = NULL ) & &
( smb_pass - > acct_ctrl & ACB_PWNOTREQ ) ) {
DEBUG ( 4 , ( " no password required for user %s \n " ,
smb_pass - > smb_name ) ) ;
return True ;
}
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
if ( ( smb_pass - > smb_passwd ! = NULL ) & &
smb_password_check ( ( char * ) lm_pass ,
( uchar * ) smb_pass - > smb_passwd , challenge ) ) {
DEBUG ( 4 , ( " LM MD4 password check succeeded \n " ) ) ;
return ( True ) ;
}
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
DEBUG ( 4 , ( " LM MD4 password check failed \n " ) ) ;
1998-03-12 00:11:04 +03:00
1998-08-10 11:04:53 +04:00
return False ;
1998-03-12 00:11:04 +03:00
}
1998-08-10 11:04:53 +04:00
1996-05-04 11:50:46 +04:00
/****************************************************************************
1998-08-10 11:04:53 +04:00
check if a username / password is OK assuming the password is a 24 byte
SMB hash
return True if the password is correct , False otherwise
1996-05-04 11:50:46 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-10-21 20:58:34 +04:00
1998-10-17 01:36:19 +04:00
BOOL pass_check_smb ( char * user , char * domain ,
1998-10-21 20:58:34 +04:00
uchar * chal , uchar * lm_pwd , uchar * nt_pwd ,
1998-10-17 01:36:19 +04:00
struct passwd * pwd )
1996-05-04 11:50:46 +04:00
{
1998-08-10 11:04:53 +04:00
struct passwd * pass ;
struct smb_passwd * smb_pass ;
1996-05-04 11:50:46 +04:00
1998-10-17 01:36:19 +04:00
if ( ! lm_pwd | | ! nt_pwd )
{
1998-08-10 11:04:53 +04:00
return ( False ) ;
}
1996-05-04 11:50:46 +04:00
1998-10-17 01:36:19 +04:00
if ( pwd ! = NULL & & user = = NULL )
{
1998-08-10 11:04:53 +04:00
pass = ( struct passwd * ) pwd ;
user = pass - > pw_name ;
1998-10-17 01:36:19 +04:00
}
else
{
1998-08-10 11:04:53 +04:00
pass = Get_Pwnam ( user , True ) ;
}
1998-04-14 04:41:59 +04:00
1998-10-17 01:41:42 +04:00
if ( pass = = NULL )
1998-10-17 01:36:19 +04:00
{
1998-10-14 10:29:20 +04:00
DEBUG ( 3 , ( " Couldn't find user %s \n " , user ) ) ;
1998-08-10 11:04:53 +04:00
return ( False ) ;
1996-05-04 11:50:46 +04:00
}
1998-08-10 11:04:53 +04:00
smb_pass = getsmbpwnam ( user ) ;
1998-03-12 00:11:04 +03:00
1998-10-17 01:41:42 +04:00
if ( smb_pass = = NULL )
1998-10-17 01:36:19 +04:00
{
1998-10-14 10:29:20 +04:00
DEBUG ( 3 , ( " Couldn't find user %s in smb_passwd file. \n " , user ) ) ;
1998-08-10 11:04:53 +04:00
return ( False ) ;
1996-05-04 11:50:46 +04:00
}
1998-08-10 11:04:53 +04:00
/* Quit if the account was disabled. */
if ( smb_pass - > acct_ctrl & ACB_DISABLED ) {
1998-10-14 10:29:20 +04:00
DEBUG ( 3 , ( " account for user %s was disabled. \n " , user ) ) ;
1998-08-10 11:04:53 +04:00
return ( False ) ;
1998-03-12 00:11:04 +03:00
}
1996-05-04 11:50:46 +04:00
1998-08-10 11:04:53 +04:00
/* Ensure the uid's match */
1998-10-17 01:36:19 +04:00
if ( smb_pass - > smb_userid ! = pass - > pw_uid )
{
1998-10-14 10:29:20 +04:00
DEBUG ( 3 , ( " Error : UNIX and SMB uids in password files do not match ! \n " ) ) ;
1998-08-10 11:04:53 +04:00
return ( False ) ;
}
1996-05-04 11:50:46 +04:00
1998-10-17 01:36:19 +04:00
if ( lm_pwd [ 0 ] = = ' \0 ' & & IS_BITS_SET_ALL ( smb_pass - > acct_ctrl , ACB_PWNOTREQ ) & & lp_null_passwords ( ) )
{
1998-10-15 04:55:17 +04:00
DEBUG ( 3 , ( " account for user %s has no password and null passwords are allowed. \n " , smb_pass - > smb_name ) ) ;
return ( True ) ;
}
1998-10-21 20:58:34 +04:00
if ( smb_password_ok ( smb_pass , chal , lm_pwd , nt_pwd ) )
1998-10-17 01:36:19 +04:00
{
1998-08-10 11:04:53 +04:00
return ( True ) ;
}
DEBUG ( 3 , ( " Error smb_password_check failed \n " ) ) ;
return False ;
1996-05-04 11:50:46 +04:00
}
1998-08-10 11:04:53 +04:00
/****************************************************************************
check if a username / password pair is OK either via the system password
database or the encrypted SMB password database
return True if the password is correct , False otherwise
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-10-17 01:36:19 +04:00
BOOL password_ok ( char * user , char * password , int pwlen , struct passwd * pwd )
1998-08-10 11:04:53 +04:00
{
1998-10-17 01:36:19 +04:00
if ( pwlen = = 24 | | ( lp_encrypted_passwords ( ) & & ( pwlen = = 0 ) & & lp_null_passwords ( ) ) )
{
/* if 24 bytes long assume it is an encrypted password */
uchar challenge [ 8 ] ;
if ( ! last_challenge ( challenge ) )
{
DEBUG ( 0 , ( " Error: challenge not done for user=%s \n " , user ) ) ;
return False ;
}
return pass_check_smb ( user , global_myworkgroup ,
1998-10-21 20:58:34 +04:00
challenge , ( uchar * ) password , ( uchar * ) password , pwd ) ;
1998-08-10 11:04:53 +04:00
}
return pass_check ( user , password , pwlen , pwd ,
lp_update_encrypted ( ) ?
update_smbpassword_file : NULL ) ;
}
1996-05-04 11:50:46 +04:00
/****************************************************************************
check if a username is valid
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL user_ok ( char * user , int snum )
{
1998-08-10 11:04:53 +04:00
pstring valid , invalid ;
BOOL ret ;
1996-05-04 11:50:46 +04:00
1998-08-10 11:04:53 +04:00
StrnCpy ( valid , lp_valid_users ( snum ) , sizeof ( pstring ) ) ;
StrnCpy ( invalid , lp_invalid_users ( snum ) , sizeof ( pstring ) ) ;
1996-05-04 11:50:46 +04:00
1998-08-10 11:04:53 +04:00
string_sub ( valid , " %S " , lp_servicename ( snum ) ) ;
string_sub ( invalid , " %S " , lp_servicename ( snum ) ) ;
ret = ! user_in_list ( user , invalid ) ;
if ( ret & & valid & & * valid ) {
ret = user_in_list ( user , valid ) ;
}
1996-05-04 11:50:46 +04:00
1998-08-10 11:04:53 +04:00
if ( ret & & lp_onlyuser ( snum ) ) {
char * user_list = lp_username ( snum ) ;
string_sub ( user_list , " %S " , lp_servicename ( snum ) ) ;
ret = user_in_list ( user , user_list ) ;
}
1996-05-04 11:50:46 +04:00
1998-08-10 11:04:53 +04:00
return ( ret ) ;
1996-05-04 11:50:46 +04:00
}
/****************************************************************************
validate a group username entry . Return the username or NULL
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static char * validate_group ( char * group , char * password , int pwlen , int snum )
{
1998-07-29 07:08:05 +04:00
# ifdef HAVE_NETGROUP
1996-05-04 11:50:46 +04:00
{
char * host , * user , * domain ;
setnetgrent ( group ) ;
while ( getnetgrent ( & host , & user , & domain ) ) {
if ( user ) {
if ( user_ok ( user , snum ) & &
1996-10-02 18:06:17 +04:00
password_ok ( user , password , pwlen , NULL ) ) {
1996-05-04 11:50:46 +04:00
endnetgrent ( ) ;
return ( user ) ;
}
}
}
endnetgrent ( ) ;
}
# endif
1998-07-29 07:08:05 +04:00
# ifdef HAVE_GETGRNAM
1996-05-04 11:50:46 +04:00
{
struct group * gptr = ( struct group * ) getgrnam ( group ) ;
char * * member ;
if ( gptr )
{
member = gptr - > gr_mem ;
while ( member & & * member )
{
static fstring name ;
1998-05-12 04:55:32 +04:00
fstrcpy ( name , * member ) ;
1996-05-04 11:50:46 +04:00
if ( user_ok ( name , snum ) & &
1996-10-02 18:06:17 +04:00
password_ok ( name , password , pwlen , NULL ) )
1996-05-04 11:50:46 +04:00
return ( & name [ 0 ] ) ;
member + + ;
}
# ifdef GROUP_CHECK_PWENT
{
struct passwd * pwd ;
static fstring tm ;
setpwent ( ) ;
while ( pwd = getpwent ( ) ) {
if ( * ( pwd - > pw_passwd ) & & pwd - > pw_gid = = gptr - > gr_gid ) {
/* This Entry have PASSWORD and same GID then check pwd */
1996-10-02 18:06:17 +04:00
if ( password_ok ( NULL , password , pwlen , pwd ) ) {
1998-05-12 04:55:32 +04:00
fstrcpy ( tm , pwd - > pw_name ) ;
1996-05-04 11:50:46 +04:00
endpwent ( ) ;
return tm ;
}
}
}
endpwent ( ) ;
}
# endif /* GROUP_CHECK_PWENT */
}
}
# endif
return ( NULL ) ;
}
/****************************************************************************
check for authority to login to a service with a given username / password
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL authorise_login ( int snum , char * user , char * password , int pwlen ,
1996-10-26 00:18:28 +04:00
BOOL * guest , BOOL * force , uint16 vuid )
1996-05-04 11:50:46 +04:00
{
BOOL ok = False ;
* guest = False ;
# if DEBUG_PASSWORD
DEBUG ( 100 , ( " checking authorisation on user=%s pass=%s \n " , user , password ) ) ;
# endif
1997-08-11 22:06:44 +04:00
/* there are several possibilities:
1996-05-04 11:50:46 +04:00
1 ) login as the given user with given password
2 ) login as a previously registered username with the given password
3 ) login as a session list username with the given password
4 ) login as a previously validated user / password pair
5 ) login as the " user = " user with given password
6 ) login as the " user = " user with no password ( guest connection )
7 ) login as guest user with no password
if the service is guest_only then steps 1 to 5 are skipped
*/
if ( GUEST_ONLY ( snum ) ) * force = True ;
if ( ! ( GUEST_ONLY ( snum ) & & GUEST_OK ( snum ) ) )
{
1996-10-26 00:18:28 +04:00
user_struct * vuser = get_valid_user_struct ( vuid ) ;
1996-05-04 11:50:46 +04:00
/* check the given username and password */
if ( ! ok & & ( * user ) & & user_ok ( user , snum ) ) {
1996-10-02 18:06:17 +04:00
ok = password_ok ( user , password , pwlen , NULL ) ;
1996-05-04 11:50:46 +04:00
if ( ok ) DEBUG ( 3 , ( " ACCEPTED: given username password ok \n " ) ) ;
}
/* check for a previously registered guest username */
1996-10-26 00:18:28 +04:00
if ( ! ok & & ( vuser ! = 0 ) & & vuser - > guest ) {
if ( user_ok ( vuser - > name , snum ) & &
password_ok ( vuser - > name , password , pwlen , NULL ) ) {
1998-05-12 04:55:32 +04:00
fstrcpy ( user , vuser - > name ) ;
1996-10-26 00:18:28 +04:00
vuser - > guest = False ;
1996-05-04 11:50:46 +04:00
DEBUG ( 3 , ( " ACCEPTED: given password with registered user %s \n " , user ) ) ;
ok = True ;
}
}
/* now check the list of session users */
1998-05-22 03:59:04 +04:00
if ( ! ok )
{
char * auser ;
char * user_list = strdup ( session_users ) ;
if ( ! user_list ) return ( False ) ;
1996-05-04 11:50:46 +04:00
1998-05-22 03:59:04 +04:00
for ( auser = strtok ( user_list , LIST_SEP ) ;
! ok & & auser ;
auser = strtok ( NULL , LIST_SEP ) )
{
fstring user2 ;
fstrcpy ( user2 , auser ) ;
if ( ! user_ok ( user2 , snum ) ) continue ;
if ( password_ok ( user2 , password , pwlen , NULL ) ) {
ok = True ;
fstrcpy ( user , user2 ) ;
DEBUG ( 3 , ( " ACCEPTED: session list username and given password ok \n " ) ) ;
}
1996-05-04 11:50:46 +04:00
}
1998-05-22 03:59:04 +04:00
free ( user_list ) ;
}
/* check for a previously validated username/password pair */
if ( ! ok & & ( ! lp_revalidate ( snum ) | | lp_security ( ) > SEC_SHARE ) & &
( vuser ! = 0 ) & & ! vuser - > guest & &
user_ok ( vuser - > name , snum ) ) {
fstrcpy ( user , vuser - > name ) ;
* guest = False ;
DEBUG ( 3 , ( " ACCEPTED: validated uid ok as non-guest \n " ) ) ;
ok = True ;
}
1996-05-04 11:50:46 +04:00
/* check for a rhosts entry */
if ( ! ok & & user_ok ( user , snum ) & & check_hosts_equiv ( user ) ) {
ok = True ;
DEBUG ( 3 , ( " ACCEPTED: hosts equiv or rhosts entry \n " ) ) ;
}
/* check the user= fields and the given password */
if ( ! ok & & lp_username ( snum ) ) {
char * auser ;
pstring user_list ;
StrnCpy ( user_list , lp_username ( snum ) , sizeof ( pstring ) ) ;
string_sub ( user_list , " %S " , lp_servicename ( snum ) ) ;
for ( auser = strtok ( user_list , LIST_SEP ) ;
auser & & ! ok ;
auser = strtok ( NULL , LIST_SEP ) )
{
if ( * auser = = ' @ ' )
{
auser = validate_group ( auser + 1 , password , pwlen , snum ) ;
if ( auser )
{
ok = True ;
1998-05-12 04:55:32 +04:00
fstrcpy ( user , auser ) ;
1996-05-04 11:50:46 +04:00
DEBUG ( 3 , ( " ACCEPTED: group username and given password ok \n " ) ) ;
}
}
else
{
fstring user2 ;
1998-05-12 04:55:32 +04:00
fstrcpy ( user2 , auser ) ;
1996-05-04 11:50:46 +04:00
if ( user_ok ( user2 , snum ) & &
1996-10-02 18:06:17 +04:00
password_ok ( user2 , password , pwlen , NULL ) )
1996-05-04 11:50:46 +04:00
{
ok = True ;
1998-05-12 04:55:32 +04:00
fstrcpy ( user , user2 ) ;
1996-05-04 11:50:46 +04:00
DEBUG ( 3 , ( " ACCEPTED: user list username and given password ok \n " ) ) ;
}
}
}
}
} /* not guest only */
/* check for a normal guest connection */
if ( ! ok & & GUEST_OK ( snum ) )
{
fstring guestname ;
StrnCpy ( guestname , lp_guestaccount ( snum ) , sizeof ( guestname ) - 1 ) ;
if ( Get_Pwnam ( guestname , True ) )
{
1998-05-12 04:55:32 +04:00
fstrcpy ( user , guestname ) ;
1996-05-04 11:50:46 +04:00
ok = True ;
DEBUG ( 3 , ( " ACCEPTED: guest account and guest ok \n " ) ) ;
}
else
DEBUG ( 0 , ( " Invalid guest account %s?? \n " , guestname ) ) ;
* guest = True ;
* force = True ;
}
if ( ok & & ! user_ok ( user , snum ) )
{
DEBUG ( 0 , ( " rejected invalid user %s \n " , user ) ) ;
ok = False ;
}
return ( ok ) ;
}
/****************************************************************************
read the a hosts . equiv or . rhosts file and check if it
allows this user from this machine
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
static BOOL check_user_equiv ( char * user , char * remote , char * equiv_file )
{
pstring buf ;
int plus_allowed = 1 ;
char * file_host ;
char * file_user ;
FILE * fp = fopen ( equiv_file , " r " ) ;
DEBUG ( 5 , ( " check_user_equiv %s %s %s \n " , user , remote , equiv_file ) ) ;
if ( ! fp ) return False ;
while ( fgets ( buf , sizeof ( buf ) , fp ) )
{
trim_string ( buf , " " , " " ) ;
if ( buf [ 0 ] ! = ' # ' & & buf [ 0 ] ! = ' \n ' )
{
BOOL is_group = False ;
int plus = 1 ;
char * bp = buf ;
if ( strcmp ( buf , " NO_PLUS \n " ) = = 0 )
{
DEBUG ( 6 , ( " check_user_equiv NO_PLUS \n " ) ) ;
plus_allowed = 0 ;
}
else {
if ( buf [ 0 ] = = ' + ' )
{
bp + + ;
if ( * bp = = ' \n ' & & plus_allowed )
{
/* a bare plus means everbody allowed */
DEBUG ( 6 , ( " check_user_equiv everybody allowed \n " ) ) ;
fclose ( fp ) ;
return True ;
}
}
else if ( buf [ 0 ] = = ' - ' )
{
bp + + ;
plus = 0 ;
}
if ( * bp = = ' @ ' )
{
is_group = True ;
bp + + ;
}
file_host = strtok ( bp , " \t \n " ) ;
file_user = strtok ( NULL , " \t \n " ) ;
1997-07-18 00:11:58 +04:00
DEBUG ( 7 , ( " check_user_equiv %s %s \n " , file_host ? file_host : " (null) " ,
file_user ? file_user : " (null) " ) ) ;
1996-05-04 11:50:46 +04:00
if ( file_host & & * file_host )
{
BOOL host_ok = False ;
1998-08-15 05:19:26 +04:00
# if defined(HAVE_NETGROUP) && defined(HAVE_YP_GET_DEFAULT_DOMAIN)
1996-05-04 11:50:46 +04:00
if ( is_group )
{
static char * mydomain = NULL ;
if ( ! mydomain )
yp_get_default_domain ( & mydomain ) ;
1996-05-04 14:45:50 +04:00
if ( mydomain & & innetgr ( file_host , remote , user , mydomain ) )
1996-05-04 11:50:46 +04:00
host_ok = True ;
}
# else
if ( is_group )
{
1998-07-29 07:08:05 +04:00
DEBUG ( 1 , ( " Netgroups not configured \n " ) ) ;
1996-05-04 11:50:46 +04:00
continue ;
}
# endif
/* is it this host */
/* the fact that remote has come from a call of gethostbyaddr
* means that it may have the fully qualified domain name
* so we could look up the file version to get it into
* a canonical form , but I would rather just type it
* in full in the equiv file
*/
if ( ! host_ok & & ! is_group & & strequal ( remote , file_host ) )
host_ok = True ;
if ( ! host_ok )
continue ;
/* is it this user */
if ( file_user = = 0 | | strequal ( user , file_user ) )
{
fclose ( fp ) ;
DEBUG ( 5 , ( " check_user_equiv matched %s%s %s \n " ,
( plus ? " + " : " - " ) , file_host ,
( file_user ? file_user : " " ) ) ) ;
return ( plus ? True : False ) ;
}
}
}
}
}
fclose ( fp ) ;
return False ;
}
/****************************************************************************
check for a possible hosts equiv or rhosts entry for the user
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL check_hosts_equiv ( char * user )
{
char * fname = NULL ;
pstring rhostsfile ;
struct passwd * pass = Get_Pwnam ( user , True ) ;
if ( ! pass )
return ( False ) ;
fname = lp_hosts_equiv ( ) ;
/* note: don't allow hosts.equiv on root */
1998-03-17 15:31:43 +03:00
if ( fname & & * fname & & ( pass - > pw_uid ! = 0 ) ) {
extern int Client ;
if ( check_user_equiv ( user , client_name ( Client ) , fname ) )
return ( True ) ;
}
1996-05-04 11:50:46 +04:00
if ( lp_use_rhosts ( ) )
{
char * home = get_home_dir ( user ) ;
1998-03-17 15:31:43 +03:00
if ( home ) {
extern int Client ;
1998-05-11 10:38:36 +04:00
slprintf ( rhostsfile , sizeof ( rhostsfile ) - 1 , " %s/.rhosts " , home ) ;
1998-03-17 15:31:43 +03:00
if ( check_user_equiv ( user , client_name ( Client ) , rhostsfile ) )
return ( True ) ;
}
1996-05-04 11:50:46 +04:00
}
return ( False ) ;
}
1997-11-10 22:23:17 +03:00
/****************************************************************************
return the client state structure
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
struct cli_state * server_client ( void )
{
1998-10-06 20:25:24 +04:00
static struct cli_state pw_cli ;
1998-04-24 00:12:17 +04:00
return & pw_cli ;
1997-11-10 22:23:17 +03:00
}
/****************************************************************************
support for server level security
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
struct cli_state * server_cryptkey ( void )
{
1998-10-06 20:25:24 +04:00
struct cli_state * cli ;
1997-11-10 22:23:17 +03:00
fstring desthost ;
struct in_addr dest_ip ;
extern fstring local_machine ;
char * p ;
1998-04-24 00:12:17 +04:00
BOOL connected_ok = False ;
1998-09-26 01:01:52 +04:00
struct nmb_name calling , called ;
1997-11-10 22:23:17 +03:00
1998-10-06 20:25:24 +04:00
cli = server_client ( ) ;
if ( ! cli_initialise ( cli ) )
1997-11-10 22:23:17 +03:00
return NULL ;
1998-04-24 00:12:17 +04:00
p = lp_passwordserver ( ) ;
1998-08-31 07:11:42 +04:00
while ( p & & next_token ( & p , desthost , LIST_SEP , sizeof ( desthost ) ) ) {
1997-11-10 22:23:17 +03:00
standard_sub_basic ( desthost ) ;
strupper ( desthost ) ;
1998-10-04 16:00:40 +04:00
if ( ! resolve_name ( desthost , & dest_ip , 0x20 ) ) {
1998-04-24 00:12:17 +04:00
DEBUG ( 1 , ( " server_cryptkey: Can't resolve address for %s \n " , desthost ) ) ;
1998-03-16 23:59:47 +03:00
continue ;
}
1997-11-10 22:23:17 +03:00
if ( ismyip ( dest_ip ) ) {
1998-04-24 00:12:17 +04:00
DEBUG ( 1 , ( " Password server loop - disabling password server %s \n " , desthost ) ) ;
1997-11-10 22:23:17 +03:00
continue ;
}
1998-10-06 20:25:24 +04:00
if ( cli_connect ( cli , desthost , & dest_ip ) ) {
1998-04-24 00:12:17 +04:00
DEBUG ( 3 , ( " connected to password server %s \n " , desthost ) ) ;
connected_ok = True ;
1997-11-10 22:23:17 +03:00
break ;
}
}
1998-04-24 00:12:17 +04:00
if ( ! connected_ok ) {
DEBUG ( 0 , ( " password server not available \n " ) ) ;
1998-10-06 20:25:24 +04:00
cli_shutdown ( cli ) ;
1997-11-10 22:23:17 +03:00
return NULL ;
}
1998-09-26 01:01:52 +04:00
make_nmb_name ( & calling , local_machine , 0x0 , scope ) ;
make_nmb_name ( & called , desthost , 0x20 , scope ) ;
1998-10-06 20:25:24 +04:00
if ( ! cli_session_request ( cli , & calling , & called ) )
1998-09-26 01:01:52 +04:00
{
1997-11-10 22:23:17 +03:00
DEBUG ( 1 , ( " %s rejected the session \n " , desthost ) ) ;
1998-10-06 20:25:24 +04:00
cli_shutdown ( cli ) ;
1997-11-10 22:23:17 +03:00
return NULL ;
}
DEBUG ( 3 , ( " got session \n " ) ) ;
1998-10-06 20:25:24 +04:00
if ( ! cli_negprot ( cli ) ) {
1997-11-10 22:23:17 +03:00
DEBUG ( 1 , ( " %s rejected the negprot \n " , desthost ) ) ;
1998-10-06 20:25:24 +04:00
cli_shutdown ( cli ) ;
1997-11-10 22:23:17 +03:00
return NULL ;
}
1998-10-06 20:25:24 +04:00
if ( cli - > protocol < PROTOCOL_LANMAN2 | |
! ( cli - > sec_mode & 1 ) ) {
1997-11-10 22:23:17 +03:00
DEBUG ( 1 , ( " %s isn't in user level security mode \n " , desthost ) ) ;
1998-10-06 20:25:24 +04:00
cli_shutdown ( cli ) ;
1997-11-10 22:23:17 +03:00
return NULL ;
}
DEBUG ( 3 , ( " password server OK \n " ) ) ;
1998-10-06 20:25:24 +04:00
return cli ;
1997-11-10 22:23:17 +03:00
}
/****************************************************************************
validate a password with the password server
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
BOOL server_validate ( char * user , char * domain ,
char * pass , int passlen ,
char * ntpass , int ntpasslen )
{
1998-10-06 20:25:24 +04:00
struct cli_state * cli ;
1997-11-10 22:23:17 +03:00
extern fstring local_machine ;
1998-04-22 04:56:38 +04:00
static unsigned char badpass [ 24 ] ;
1998-10-06 20:25:24 +04:00
cli = server_client ( ) ;
1997-11-10 22:23:17 +03:00
1998-10-06 20:25:24 +04:00
if ( ! cli - > initialised ) {
DEBUG ( 1 , ( " password server %s is not connected \n " , cli - > desthost ) ) ;
1997-11-10 22:23:17 +03:00
return ( False ) ;
}
1998-04-22 04:56:38 +04:00
if ( badpass [ 0 ] = = 0 ) {
memset ( badpass , 0x1f , sizeof ( badpass ) ) ;
}
if ( ( passlen = = sizeof ( badpass ) ) & & ! memcmp ( badpass , pass , passlen ) ) {
/* Very unlikely, our random bad password is the same as the users
password . */
memset ( badpass , badpass [ 0 ] + 1 , sizeof ( badpass ) ) ;
}
/*
* Attempt a session setup with a totally incorrect password .
* If this succeeds with the guest bit * NOT * set then the password
* server is broken and is not correctly setting the guest bit . We
* need to detect this as some versions of NT4 . x are broken . JRA .
*/
1998-10-06 20:25:24 +04:00
if ( cli_session_setup ( cli , user , ( char * ) badpass , sizeof ( badpass ) ,
1998-04-25 05:12:08 +04:00
( char * ) badpass , sizeof ( badpass ) , domain ) ) {
1998-10-06 20:25:24 +04:00
if ( ( SVAL ( cli - > inbuf , smb_vwv2 ) & 1 ) = = 0 ) {
1998-04-22 04:56:38 +04:00
DEBUG ( 0 , ( " server_validate: password server %s allows users as non-guest \
1998-10-06 20:25:24 +04:00
with a bad password . \ n " , cli->desthost));
1998-04-22 04:56:38 +04:00
DEBUG ( 0 , ( " server_validate: This is broken (and insecure) behaviour. Please do not \
use this machine as the password server . \ n " ));
1998-10-06 20:25:24 +04:00
cli_ulogoff ( cli ) ;
1998-04-22 04:56:38 +04:00
return False ;
}
1998-10-06 20:25:24 +04:00
cli_ulogoff ( cli ) ;
1998-04-22 04:56:38 +04:00
}
/*
* Now we know the password server will correctly set the guest bit , or is
* not guest enabled , we can try with the real password .
*/
1998-10-06 20:25:24 +04:00
if ( ! cli_session_setup ( cli , user , pass , passlen , ntpass , ntpasslen , domain ) ) {
DEBUG ( 1 , ( " password server %s rejected the password \n " , cli - > desthost ) ) ;
1997-11-10 22:23:17 +03:00
return False ;
}
/* if logged in as guest then reject */
1998-10-06 20:25:24 +04:00
if ( ( SVAL ( cli - > inbuf , smb_vwv2 ) & 1 ) ! = 0 ) {
DEBUG ( 1 , ( " password server %s gave us guest only \n " , cli - > desthost ) ) ;
cli_ulogoff ( cli ) ;
1997-11-10 22:23:17 +03:00
return ( False ) ;
}
1998-02-07 15:15:20 +03:00
/*
* This patch from Rob Nielsen < ran @ adc . com > makes doing
* the NetWksaUserLogon a dynamic , rather than compile - time
* parameter , defaulting to on . This is somewhat dangerous
* as it allows people to turn off this neccessary check ,
* but so many people have had problems with this that I
* think it is a neccessary change . JRA .
*/
if ( lp_net_wksta_user_logon ( ) ) {
1998-10-06 20:25:24 +04:00
DEBUG ( 3 , ( " trying NetWkstaUserLogon with password server %s \n " , cli - > desthost ) ) ;
1998-05-05 23:24:32 +04:00
1998-10-06 20:25:24 +04:00
if ( ! cli_send_tconX ( cli , " IPC$ " , " IPC " , " " , 1 ) ) {
DEBUG ( 0 , ( " password server %s refused IPC$ connect \n " , cli - > desthost ) ) ;
cli_ulogoff ( cli ) ;
1998-05-05 23:24:32 +04:00
return False ;
}
1998-10-06 20:25:24 +04:00
if ( ! cli_NetWkstaUserLogon ( cli , user , local_machine ) ) {
DEBUG ( 0 , ( " password server %s failed NetWkstaUserLogon \n " , cli - > desthost ) ) ;
cli_tdis ( cli ) ;
cli_ulogoff ( cli ) ;
1998-02-07 15:15:20 +03:00
return False ;
}
1997-11-10 22:23:17 +03:00
1998-10-06 20:25:24 +04:00
if ( cli - > privilages = = 0 ) {
DEBUG ( 0 , ( " password server %s gave guest privilages \n " , cli - > desthost ) ) ;
cli_tdis ( cli ) ;
cli_ulogoff ( cli ) ;
1998-02-07 15:15:20 +03:00
return False ;
}
1997-11-10 22:23:17 +03:00
1998-10-06 20:25:24 +04:00
if ( ! strequal ( cli - > eff_name , user ) ) {
1998-05-05 23:24:32 +04:00
DEBUG ( 0 , ( " password server %s gave different username %s \n " ,
1998-10-06 20:25:24 +04:00
cli - > desthost ,
cli - > eff_name ) ) ;
cli_tdis ( cli ) ;
cli_ulogoff ( cli ) ;
1998-02-07 15:15:20 +03:00
return False ;
}
1998-10-06 20:25:24 +04:00
cli_tdis ( cli ) ;
1997-11-10 22:23:17 +03:00
}
1998-02-07 15:15:20 +03:00
else {
1998-10-06 20:25:24 +04:00
DEBUG ( 3 , ( " skipping NetWkstaUserLogon with password server %s \n " , cli - > desthost ) ) ;
1998-02-07 15:15:20 +03:00
}
1997-11-10 22:23:17 +03:00
1998-10-06 20:25:24 +04:00
DEBUG ( 3 , ( " password server %s accepted the password \n " , cli - > desthost ) ) ;
1997-11-10 22:23:17 +03:00
1998-10-06 20:25:24 +04:00
cli_ulogoff ( cli ) ;
1997-11-10 22:23:17 +03:00
return ( True ) ;
}
1998-04-23 22:54:57 +04:00
1998-04-24 00:12:17 +04:00
/***********************************************************************
Do the same as security = server , but using NT Domain calls and a session
key from the machine password .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
1998-04-23 22:54:57 +04:00
BOOL domain_client_validate ( char * user , char * domain ,
char * smb_apasswd , int smb_apasslen ,
char * smb_ntpasswd , int smb_ntpasslen )
{
unsigned char local_challenge [ 8 ] ;
unsigned char local_lm_response [ 24 ] ;
unsigned char local_nt_reponse [ 24 ] ;
1998-05-11 19:56:01 +04:00
unsigned char trust_passwd [ 16 ] ;
1998-04-24 00:12:17 +04:00
fstring remote_machine ;
char * p ;
struct in_addr dest_ip ;
1998-04-29 04:02:57 +04:00
NET_ID_INFO_CTR ctr ;
NET_USER_INFO_3 info3 ;
1998-04-24 00:12:17 +04:00
struct cli_state cli ;
1998-04-29 04:02:57 +04:00
uint32 smb_uid_low ;
1998-04-24 00:12:17 +04:00
BOOL connected_ok = False ;
1998-09-26 01:01:52 +04:00
struct nmb_name calling , called ;
1998-04-23 22:54:57 +04:00
/*
* Check that the requested domain is not our own machine name .
* If it is , we should never check the PDC here , we use our own local
* password file .
*/
1998-04-25 05:12:08 +04:00
if ( strequal ( domain , global_myname ) ) {
1998-04-23 22:54:57 +04:00
DEBUG ( 3 , ( " domain_client_validate: Requested domain was for this machine. \n " ) ) ;
return False ;
}
/*
* Next , check that the passwords given were encrypted .
*/
1998-07-07 02:48:21 +04:00
if ( ( ( smb_apasslen ! = 24 ) & & ( smb_apasslen ! = 0 ) ) | |
( ( smb_ntpasslen ! = 24 ) & & ( smb_ntpasslen ! = 0 ) ) ) {
1998-04-23 22:54:57 +04:00
/*
* Not encrypted - do so .
*/
DEBUG ( 3 , ( " domain_client_validate: User passwords not in encrypted format. \n " ) ) ;
generate_random_buffer ( local_challenge , 8 , False ) ;
1998-05-11 10:38:36 +04:00
SMBencrypt ( ( uchar * ) smb_apasswd , local_challenge , local_lm_response ) ;
SMBNTencrypt ( ( uchar * ) smb_ntpasswd , local_challenge , local_nt_reponse ) ;
1998-04-23 22:54:57 +04:00
smb_apasslen = 24 ;
smb_ntpasslen = 24 ;
smb_apasswd = ( char * ) local_lm_response ;
smb_ntpasswd = ( char * ) local_nt_reponse ;
} else {
/*
* Encrypted - get the challenge we sent for these
* responses .
*/
if ( ! last_challenge ( local_challenge ) ) {
DEBUG ( 0 , ( " domain_client_validate: no challenge done - password failed \n " ) ) ;
return False ;
}
}
1998-04-29 04:02:57 +04:00
/*
* Get the machine account password .
*/
1998-10-16 03:51:07 +04:00
if ( ! trust_get_passwd ( trust_passwd , global_myworkgroup , global_myname ) )
{
1998-04-29 04:02:57 +04:00
return False ;
}
1998-04-23 22:54:57 +04:00
/*
* At this point , smb_apasswd points to the lanman response to
* the challenge in local_challenge , and smb_ntpasswd points to
* the NT response to the challenge in local_challenge . Ship
* these over the secure channel to a domain controller and
* see if they were valid .
*/
1998-09-05 17:24:20 +04:00
ZERO_STRUCT ( cli ) ;
1998-04-29 04:02:57 +04:00
if ( cli_initialise ( & cli ) = = False ) {
DEBUG ( 0 , ( " domain_client_validate: unable to initialize client connection. \n " ) ) ;
return False ;
}
1998-04-24 00:12:17 +04:00
/*
* Treat each name in the ' password server = ' line as a potential
* PDC / BDC . Contact each in turn and try and authenticate .
*/
p = lp_passwordserver ( ) ;
1998-08-31 07:11:42 +04:00
while ( p & & next_token ( & p , remote_machine , LIST_SEP , sizeof ( remote_machine ) ) ) {
1998-04-24 00:12:17 +04:00
standard_sub_basic ( remote_machine ) ;
strupper ( remote_machine ) ;
1998-10-04 16:00:40 +04:00
if ( ! resolve_name ( remote_machine , & dest_ip , 0x20 ) ) {
1998-04-24 00:12:17 +04:00
DEBUG ( 1 , ( " domain_client_validate: Can't resolve address for %s \n " , remote_machine ) ) ;
continue ;
}
if ( ismyip ( dest_ip ) ) {
DEBUG ( 1 , ( " domain_client_validate: Password server loop - not using password server %s \n " , remote_machine ) ) ;
continue ;
}
if ( ! cli_connect ( & cli , remote_machine , & dest_ip ) ) {
DEBUG ( 0 , ( " domain_client_validate: unable to connect to SMB server on \
machine % s . Error was : % s . \ n " , remote_machine, cli_errstr(&cli) ));
continue ;
}
1998-09-26 01:01:52 +04:00
make_nmb_name ( & calling , global_myname , 0x0 , scope ) ;
make_nmb_name ( & called , remote_machine , 0x20 , scope ) ;
1998-10-06 20:25:24 +04:00
if ( ! cli_session_request ( & cli , & calling , & called ) )
1998-09-26 01:01:52 +04:00
{
1998-04-24 00:12:17 +04:00
DEBUG ( 0 , ( " domain_client_validate: machine %s rejected the session setup. \
Error was : % s . \ n " , remote_machine, cli_errstr(&cli) ));
cli_shutdown ( & cli ) ;
continue ;
}
cli . protocol = PROTOCOL_NT1 ;
if ( ! cli_negprot ( & cli ) ) {
DEBUG ( 0 , ( " domain_client_validate: machine %s rejected the negotiate protocol. \
Error was : % s . \ n " , remote_machine, cli_errstr(&cli) ));
cli_shutdown ( & cli ) ;
continue ;
}
if ( cli . protocol ! = PROTOCOL_NT1 ) {
DEBUG ( 0 , ( " domain_client_validate: machine %s didn't negotiate NT protocol. \n " ,
remote_machine ) ) ;
cli_shutdown ( & cli ) ;
continue ;
}
/*
* Do an anonymous session setup .
*/
if ( ! cli_session_setup ( & cli , " " , " " , 0 , " " , 0 , " " ) ) {
DEBUG ( 0 , ( " domain_client_validate: machine %s rejected the session setup. \
Error was : % s . \ n " , remote_machine, cli_errstr(&cli) ));
cli_shutdown ( & cli ) ;
continue ;
}
if ( ! ( cli . sec_mode & 1 ) ) {
DEBUG ( 1 , ( " domain_client_validate: machine %s isn't in user level security mode \n " ,
remote_machine ) ) ;
cli_shutdown ( & cli ) ;
continue ;
}
if ( ! cli_send_tconX ( & cli , " IPC$ " , " IPC " , " " , 1 ) ) {
DEBUG ( 0 , ( " domain_client_validate: machine %s rejected the tconX on the IPC$ share. \
Error was : % s . \ n " , remote_machine, cli_errstr(&cli) ));
cli_shutdown ( & cli ) ;
continue ;
}
/*
* We have an anonymous connection to IPC $ .
*/
connected_ok = True ;
break ;
}
if ( ! connected_ok ) {
DEBUG ( 0 , ( " domain_client_validate: Domain password server not available. \n " ) ) ;
cli_shutdown ( & cli ) ;
return False ;
}
/*
* Ok - we have an anonymous connection to the IPC $ share .
* Now start the NT Domain stuff : - ) .
*/
1998-10-17 00:18:46 +04:00
if ( cli_nt_session_open ( & cli , PIPE_NETLOGON ) = = False ) {
1998-04-25 05:12:08 +04:00
DEBUG ( 0 , ( " domain_client_validate: unable to open the domain client session to \
machine % s . Error was : % s . \ n " , remote_machine, cli_errstr(&cli)));
1998-04-29 23:22:01 +04:00
cli_nt_session_close ( & cli ) ;
1998-04-24 02:59:19 +04:00
cli_ulogoff ( & cli ) ;
cli_shutdown ( & cli ) ;
1998-04-25 05:12:08 +04:00
return False ;
1998-04-24 02:59:19 +04:00
}
1998-05-11 19:56:01 +04:00
if ( cli_nt_setup_creds ( & cli , trust_passwd ) = = False ) {
1998-04-29 04:02:57 +04:00
DEBUG ( 0 , ( " domain_client_validate: unable to setup the PDC credentials to machine \
% s . Error was : % s . \ n " , remote_machine, cli_errstr(&cli)));
1998-04-29 23:22:01 +04:00
cli_nt_session_close ( & cli ) ;
1998-04-29 04:02:57 +04:00
cli_ulogoff ( & cli ) ;
cli_shutdown ( & cli ) ;
return False ;
}
/* We really don't care what LUID we give the user. */
generate_random_buffer ( ( unsigned char * ) & smb_uid_low , 4 , False ) ;
1998-05-11 10:38:36 +04:00
if ( cli_nt_login_network ( & cli , domain , user , smb_uid_low , ( char * ) local_challenge ,
1998-07-07 02:48:21 +04:00
( ( smb_apasslen ! = 0 ) ? smb_apasswd : NULL ) ,
( ( smb_ntpasslen ! = 0 ) ? smb_ntpasswd : NULL ) ,
& ctr , & info3 ) = = False ) {
1998-04-29 04:02:57 +04:00
DEBUG ( 0 , ( " domain_client_validate: unable to validate password for user %s in domain \
% s to Domain controller % s . Error was % s . \ n " , user, domain, remote_machine, cli_errstr(&cli)));
1998-04-29 23:22:01 +04:00
cli_nt_session_close ( & cli ) ;
1998-04-29 04:02:57 +04:00
cli_ulogoff ( & cli ) ;
cli_shutdown ( & cli ) ;
return False ;
}
/*
* Here , if we really want it , we have lots of info about the user in info3 .
*/
1998-04-29 23:22:01 +04:00
#if 0
/*
* We don ' t actually need to do this - plus it fails currently with
* NT_STATUS_INVALID_INFO_CLASS - we need to know * exactly * what to
* send here . JRA .
*/
1998-04-29 04:02:57 +04:00
if ( cli_nt_logoff ( & cli , & ctr ) = = False ) {
DEBUG ( 0 , ( " domain_client_validate: unable to log off user %s in domain \
% s to Domain controller % s . Error was % s . \ n " , user, domain, remote_machine, cli_errstr(&cli)));
1998-04-29 23:22:01 +04:00
cli_nt_session_close ( & cli ) ;
1998-04-29 04:02:57 +04:00
cli_ulogoff ( & cli ) ;
cli_shutdown ( & cli ) ;
return False ;
}
1998-04-29 23:22:01 +04:00
# endif /* 0 */
1998-04-29 04:02:57 +04:00
1998-04-29 23:22:01 +04:00
cli_nt_session_close ( & cli ) ;
1998-04-29 04:02:57 +04:00
cli_ulogoff ( & cli ) ;
cli_shutdown ( & cli ) ;
return True ;
1998-04-23 22:54:57 +04:00
}