2000-05-09 15:43:00 +04:00
/*
Unix SMB / Netbios implementation .
Version 3.0
2001-11-23 03:14:04 +03:00
Winbind daemon - pam auth funcions
2000-05-09 15:43:00 +04:00
Copyright ( C ) Andrew Tridgell 2000
2001-08-23 06:55:42 +04:00
Copyright ( C ) Tim Potter 2001
Copyright ( C ) Andrew Bartlett 2001
2000-05-09 15:43:00 +04:00
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation ; either version 2 of the License , or
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
along with this program ; if not , write to the Free Software
Foundation , Inc . , 675 Mass Ave , Cambridge , MA 0213 9 , USA .
*/
# include "winbindd.h"
2001-12-10 04:05:50 +03:00
/* Return a password structure from a username. */
2000-05-09 15:43:00 +04:00
enum winbindd_result winbindd_pam_auth ( struct winbindd_cli_state * state )
{
2001-09-04 11:13:01 +04:00
NTSTATUS result ;
2001-11-05 03:21:17 +03:00
fstring name_domain , name_user ;
2001-05-17 10:08:49 +04:00
int passlen ;
2001-08-12 15:19:57 +04:00
unsigned char trust_passwd [ 16 ] ;
time_t last_change_time ;
2001-11-05 03:21:17 +03:00
uint32 smb_uid_low ;
NET_USER_INFO_3 info3 ;
2002-01-15 01:08:47 +03:00
struct cli_state * cli = NULL ;
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
uchar chal [ 8 ] ;
2002-01-01 07:50:45 +03:00
TALLOC_CTX * mem_ctx ;
DATA_BLOB lm_resp ;
DATA_BLOB nt_resp ;
extern pstring global_myname ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
2001-05-07 08:32:40 +04:00
DEBUG ( 3 , ( " [%5d]: pam auth %s \n " , state - > pid ,
state - > request . data . auth . user ) ) ;
2000-05-09 15:43:00 +04:00
2002-01-01 07:50:45 +03:00
if ( ! ( mem_ctx = talloc_init_named ( " winbind pam auth for %s " , state - > request . data . auth . user ) ) ) {
DEBUG ( 0 , ( " winbindd_pam_auth: could not talloc_init()! \n " ) ) ;
return WINBINDD_ERROR ;
}
2000-05-09 15:43:00 +04:00
/* Parse domain and username */
2002-01-10 13:23:54 +03:00
2001-12-05 07:17:39 +03:00
if ( ! parse_domain_user ( state - > request . data . auth . user , name_domain ,
2002-01-10 13:23:54 +03:00
name_user ) ) {
DEBUG ( 5 , ( " no domain seperator (%s) in username (%s) - failing fauth \n " , lp_winbind_separator ( ) , state - > request . data . auth . user ) ) ;
2002-01-15 01:08:47 +03:00
talloc_destroy ( mem_ctx ) ;
2001-05-17 10:08:49 +04:00
return WINBINDD_ERROR ;
2002-01-10 13:23:54 +03:00
}
2000-05-09 15:43:00 +04:00
2001-05-17 10:08:49 +04:00
passlen = strlen ( state - > request . data . auth . pass ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
2002-01-01 07:50:45 +03:00
if ( ! * state - > request . data . auth . pass ) {
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
return WINBINDD_ERROR ;
2002-01-15 01:08:47 +03:00
talloc_destroy ( mem_ctx ) ;
2002-01-01 07:50:45 +03:00
} else {
unsigned char local_lm_response [ 24 ] ;
unsigned char local_nt_response [ 24 ] ;
generate_random_buffer ( chal , 8 , False ) ;
SMBencrypt ( ( const uchar * ) state - > request . data . auth . pass , chal , local_lm_response ) ;
SMBNTencrypt ( ( const uchar * ) state - > request . data . auth . pass , chal , local_nt_response ) ;
2002-01-10 13:23:54 +03:00
lm_resp = data_blob_talloc ( mem_ctx , local_lm_response , sizeof ( local_lm_response ) ) ;
nt_resp = data_blob_talloc ( mem_ctx , local_nt_response , sizeof ( local_nt_response ) ) ;
2002-01-01 07:50:45 +03:00
}
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
2001-08-12 15:19:57 +04:00
/*
* Get the machine account password for our primary domain
*/
2001-11-05 03:21:17 +03:00
if ( ! secrets_fetch_trust_account_password (
lp_workgroup ( ) , trust_passwd , & last_change_time ) ) {
DEBUG ( 0 , ( " winbindd_pam_auth: could not fetch trust account "
" password for domain %s \n " , lp_workgroup ( ) ) ) ;
2002-01-15 01:08:47 +03:00
talloc_destroy ( mem_ctx ) ;
2001-08-12 15:19:57 +04:00
return WINBINDD_ERROR ;
}
2001-11-05 03:21:17 +03:00
/* We really don't care what LUID we give the user. */
generate_random_buffer ( ( unsigned char * ) & smb_uid_low , 4 , False ) ;
ZERO_STRUCT ( info3 ) ;
2001-11-23 03:14:04 +03:00
result = cm_get_netlogon_cli ( lp_workgroup ( ) , trust_passwd , & cli ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
2001-11-05 03:21:17 +03:00
DEBUG ( 3 , ( " could not open handle to NETLOGON pipe \n " ) ) ;
2001-11-23 03:14:04 +03:00
goto done ;
2001-10-05 04:20:06 +04:00
}
2002-01-01 07:50:45 +03:00
result = cli_netlogon_sam_network_logon ( cli , mem_ctx ,
name_user , name_domain ,
global_myname , chal ,
lm_resp , nt_resp ,
& info3 ) ;
2002-01-13 02:57:10 +03:00
uni_group_cache_store_netlogon ( mem_ctx , & info3 ) ;
2002-01-01 07:50:45 +03:00
done :
2001-06-07 08:35:01 +04:00
2002-01-15 01:08:47 +03:00
if ( cli )
cli_shutdown ( cli ) ;
2001-08-22 06:48:16 +04:00
2002-01-01 07:50:45 +03:00
talloc_destroy ( mem_ctx ) ;
2001-09-04 11:13:01 +04:00
return NT_STATUS_IS_OK ( result ) ? WINBINDD_OK : WINBINDD_ERROR ;
2001-08-22 06:48:16 +04:00
}
2002-01-10 13:23:54 +03:00
2001-08-22 06:48:16 +04:00
/* Challenge Response Authentication Protocol */
enum winbindd_result winbindd_pam_auth_crap ( struct winbindd_cli_state * state )
{
2001-09-04 11:13:01 +04:00
NTSTATUS result ;
2001-08-22 06:48:16 +04:00
unsigned char trust_passwd [ 16 ] ;
time_t last_change_time ;
2001-11-05 03:21:17 +03:00
NET_USER_INFO_3 info3 ;
2002-01-15 01:08:47 +03:00
struct cli_state * cli = NULL ;
2002-01-01 07:50:45 +03:00
TALLOC_CTX * mem_ctx ;
DATA_BLOB lm_resp , nt_resp ;
extern pstring global_myname ;
2001-08-22 06:48:16 +04:00
2002-01-10 13:23:54 +03:00
DEBUG ( 3 , ( " [%5d]: pam auth crap domain: %s user: %s \n " , state - > pid ,
state - > request . data . auth_crap . user , state - > request . data . auth_crap . user ) ) ;
2001-08-22 06:48:16 +04:00
2002-01-10 13:23:54 +03:00
if ( ! ( mem_ctx = talloc_init_named ( " winbind pam auth crap for %s " , state - > request . data . auth . user ) ) ) {
2002-01-01 07:50:45 +03:00
DEBUG ( 0 , ( " winbindd_pam_auth_crap: could not talloc_init()! \n " ) ) ;
return WINBINDD_ERROR ;
}
2001-08-22 06:48:16 +04:00
2002-01-10 13:23:54 +03:00
lm_resp = data_blob_talloc ( mem_ctx , state - > request . data . auth_crap . lm_resp , state - > request . data . auth_crap . lm_resp_len ) ;
nt_resp = data_blob_talloc ( mem_ctx , state - > request . data . auth_crap . nt_resp , state - > request . data . auth_crap . nt_resp_len ) ;
2001-08-22 06:48:16 +04:00
/*
* Get the machine account password for our primary domain
*/
2001-11-05 03:21:17 +03:00
if ( ! secrets_fetch_trust_account_password (
lp_workgroup ( ) , trust_passwd , & last_change_time ) ) {
DEBUG ( 0 , ( " winbindd_pam_auth: could not fetch trust account "
" password for domain %s \n " , lp_workgroup ( ) ) ) ;
2002-01-15 01:08:47 +03:00
talloc_destroy ( mem_ctx ) ;
2001-08-22 06:48:16 +04:00
return WINBINDD_ERROR ;
}
2001-11-05 03:21:17 +03:00
ZERO_STRUCT ( info3 ) ;
2001-11-23 03:14:04 +03:00
result = cm_get_netlogon_cli ( lp_workgroup ( ) , trust_passwd , & cli ) ;
if ( ! NT_STATUS_IS_OK ( result ) ) {
2001-11-05 03:21:17 +03:00
DEBUG ( 3 , ( " could not open handle to NETLOGON pipe \n " ) ) ;
2001-11-23 03:14:04 +03:00
goto done ;
2001-10-05 04:20:06 +04:00
}
2002-01-01 07:50:45 +03:00
result = cli_netlogon_sam_network_logon ( cli , mem_ctx ,
2002-01-10 13:23:54 +03:00
state - > request . data . auth_crap . user , state - > request . data . auth_crap . domain ,
2002-01-01 07:50:45 +03:00
global_myname , state - > request . data . auth_crap . chal ,
lm_resp , nt_resp ,
& info3 ) ;
2002-01-13 02:57:10 +03:00
uni_group_cache_store_netlogon ( mem_ctx , & info3 ) ;
2002-01-01 07:50:45 +03:00
done :
talloc_destroy ( mem_ctx ) ;
2000-05-09 15:43:00 +04:00
2002-01-15 01:08:47 +03:00
if ( cli )
cli_shutdown ( cli ) ;
2001-10-31 09:20:58 +03:00
2001-09-04 11:13:01 +04:00
return NT_STATUS_IS_OK ( result ) ? WINBINDD_OK : WINBINDD_ERROR ;
2000-05-09 15:43:00 +04:00
}
2001-05-07 08:32:40 +04:00
/* Change a user password */
enum winbindd_result winbindd_pam_chauthtok ( struct winbindd_cli_state * state )
{
2001-12-05 07:17:39 +03:00
char * oldpass , * newpass ;
fstring domain , user ;
uchar nt_oldhash [ 16 ] ;
uchar lm_oldhash [ 16 ] ;
2001-05-07 08:32:40 +04:00
2001-12-05 07:17:39 +03:00
DEBUG ( 3 , ( " [%5d]: pam chauthtok %s \n " , state - > pid ,
state - > request . data . chauthtok . user ) ) ;
2001-05-07 08:32:40 +04:00
2001-12-05 07:17:39 +03:00
/* Setup crap */
2001-05-07 08:32:40 +04:00
2001-12-05 07:17:39 +03:00
if ( state = = NULL )
return WINBINDD_ERROR ;
2001-05-07 08:32:40 +04:00
2001-12-05 07:17:39 +03:00
if ( ! parse_domain_user ( state - > request . data . chauthtok . user , domain , user ) )
return WINBINDD_ERROR ;
2001-05-07 08:32:40 +04:00
2001-12-05 07:17:39 +03:00
oldpass = state - > request . data . chauthtok . oldpass ;
newpass = state - > request . data . chauthtok . newpass ;
2001-05-07 08:32:40 +04:00
2001-12-05 07:17:39 +03:00
nt_lm_owf_gen ( oldpass , nt_oldhash , lm_oldhash ) ;
2001-05-07 08:32:40 +04:00
2001-12-05 07:17:39 +03:00
/* Change password */
2001-05-07 08:32:40 +04:00
#if 0
2001-12-05 07:17:39 +03:00
/* XXX */
2001-05-07 08:32:40 +04:00
2001-12-05 07:17:39 +03:00
if ( ! msrpc_sam_ntchange_pwd ( server_state . controller , domain , user ,
lm_oldhash , nt_oldhash , newpass ) ) {
DEBUG ( 0 , ( " password change failed for user %s/%s \n " , domain , user ) ) ;
return WINBINDD_ERROR ;
}
2001-05-07 08:32:40 +04:00
# endif
2001-12-05 07:17:39 +03:00
return WINBINDD_OK ;
2001-05-07 08:32:40 +04:00
}