This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
/*
2002-01-30 09:08:46 +03:00
Unix SMB / CIFS implementation .
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
Password and authentication handling
Copyright ( C ) Andrew Tridgell 1992 - 2000
Copyright ( C ) Luke Kenneth Casson Leighton 1996 - 2000
Copyright ( C ) Andrew Bartlett 2001
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation ; either version 2 of the License , or
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
along with this program ; if not , write to the Free Software
Foundation , Inc . , 675 Mass Ave , Cambridge , MA 0213 9 , USA .
*/
# include "includes.h"
/****************************************************************************
core of smb password checking routine .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2001-10-31 13:46:25 +03:00
static BOOL smb_pwd_check_ntlmv1 ( DATA_BLOB nt_response ,
2002-01-05 07:55:41 +03:00
const uchar * part_passwd ,
DATA_BLOB sec_blob ,
uint8 user_sess_key [ 16 ] )
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
{
2001-10-31 13:46:25 +03:00
/* Finish the encryption of part_passwd. */
uchar p24 [ 24 ] ;
if ( part_passwd = = NULL ) {
DEBUG ( 10 , ( " No password set - DISALLOWING access \n " ) ) ;
/* No password set - always false ! */
return False ;
}
if ( sec_blob . length ! = 8 ) {
2001-11-26 07:05:28 +03:00
DEBUG ( 0 , ( " smb_pwd_check_ntlmv1: incorrect challenge size (%d) \n " , sec_blob . length ) ) ;
2001-10-31 13:46:25 +03:00
return False ;
}
if ( nt_response . length ! = 24 ) {
DEBUG ( 0 , ( " smb_pwd_check_ntlmv1: incorrect password length (%d) \n " , nt_response . length ) ) ;
return False ;
}
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
2001-10-31 13:46:25 +03:00
SMBOWFencrypt ( part_passwd , sec_blob . data , p24 ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
if ( user_sess_key ! = NULL )
{
2001-09-26 16:28:46 +04:00
SMBsesskeygen_ntv1 ( part_passwd , NULL , user_sess_key ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
}
2001-10-31 13:46:25 +03:00
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
# if DEBUG_PASSWORD
DEBUG ( 100 , ( " Part password (P16) was | " ) ) ;
dump_data ( 100 , part_passwd , 16 ) ;
DEBUG ( 100 , ( " Password from client was | " ) ) ;
2001-10-31 13:46:25 +03:00
dump_data ( 100 , nt_response . data , nt_response . length ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
DEBUG ( 100 , ( " Given challenge was | " ) ) ;
2001-10-31 13:46:25 +03:00
dump_data ( 100 , sec_blob . data , sec_blob . length ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
DEBUG ( 100 , ( " Value from encryption was | " ) ) ;
dump_data ( 100 , p24 , 24 ) ;
# endif
2001-10-31 13:46:25 +03:00
return ( memcmp ( p24 , nt_response . data , 24 ) = = 0 ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
}
/****************************************************************************
core of smb password checking routine .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2001-10-31 13:46:25 +03:00
static BOOL smb_pwd_check_ntlmv2 ( const DATA_BLOB ntv2_response ,
2002-01-05 07:55:41 +03:00
const uchar * part_passwd ,
const DATA_BLOB sec_blob ,
const char * user , const char * domain ,
uint8 user_sess_key [ 16 ] )
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
{
/* Finish the encryption of part_passwd. */
uchar kr [ 16 ] ;
2001-10-31 13:46:25 +03:00
uchar value_from_encryption [ 16 ] ;
uchar client_response [ 16 ] ;
DATA_BLOB client_key_data ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
if ( part_passwd = = NULL )
{
DEBUG ( 10 , ( " No password set - DISALLOWING access \n " ) ) ;
/* No password set - always False */
return False ;
}
2001-10-31 13:46:25 +03:00
if ( ntv2_response . length < 16 ) {
/* We MUST have more than 16 bytes, or the stuff below will go
crazy . . . */
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
DEBUG ( 0 , ( " smb_pwd_check_ntlmv2: incorrect password length (%d) \n " ,
2001-10-31 13:46:25 +03:00
ntv2_response . length ) ) ;
return False ;
}
client_key_data = data_blob ( ntv2_response . data + 16 , ntv2_response . length - 16 ) ;
2001-11-03 03:20:31 +03:00
memcpy ( client_response , ntv2_response . data , sizeof ( client_response ) ) ;
2001-10-31 13:46:25 +03:00
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
ntv2_owf_gen ( part_passwd , user , domain , kr ) ;
2001-10-31 13:46:25 +03:00
SMBOWFencrypt_ntv2 ( kr , sec_blob , client_key_data , ( char * ) value_from_encryption ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
if ( user_sess_key ! = NULL )
{
2001-10-31 13:46:25 +03:00
SMBsesskeygen_ntv2 ( kr , value_from_encryption , user_sess_key ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
}
# if DEBUG_PASSWORD
DEBUG ( 100 , ( " Part password (P16) was | " ) ) ;
dump_data ( 100 , part_passwd , 16 ) ;
DEBUG ( 100 , ( " Password from client was | " ) ) ;
2001-10-31 13:46:25 +03:00
dump_data ( 100 , ntv2_response . data , ntv2_response . length ) ;
DEBUG ( 100 , ( " Variable data from client was | " ) ) ;
2001-11-03 03:20:31 +03:00
dump_data ( 100 , client_key_data . data , client_key_data . length ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
DEBUG ( 100 , ( " Given challenge was | " ) ) ;
2001-10-31 13:46:25 +03:00
dump_data ( 100 , sec_blob . data , sec_blob . length ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
DEBUG ( 100 , ( " Value from encryption was | " ) ) ;
2001-10-31 13:46:25 +03:00
dump_data ( 100 , value_from_encryption , 16 ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
# endif
2001-10-31 13:46:25 +03:00
data_blob_clear_free ( & client_key_data ) ;
return ( memcmp ( value_from_encryption , client_response , 16 ) = = 0 ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
}
/****************************************************************************
Do a specific test for an smb password being correct , given a smb_password and
the lanman and NT responses .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2002-01-05 07:55:41 +03:00
static NTSTATUS sam_password_ok ( const struct auth_context * auth_context ,
TALLOC_CTX * mem_ctx ,
2002-01-01 06:10:32 +03:00
SAM_ACCOUNT * sampass ,
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
const auth_usersupplied_info * user_info ,
uint8 user_sess_key [ 16 ] )
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
{
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
uint16 acct_ctrl ;
This commit is number 4 of 4.
In particular this commit focuses on:
Actually adding the 'const' to the passdb interface, and the flow-on changes.
Also kill off the 'disp_info' stuff, as its no longer used.
While these changes have been mildly tested, and are pretty small, any
assistance in this is appreciated.
----
These changes introduces a large dose of 'const' to the Samba tree.
There are a number of good reasons to do this:
- I want to allow the SAM_ACCOUNT structure to move from wasteful
pstrings and fstrings to allocated strings. We can't do that if
people are modifying these outputs, as they may well make
assumptions about getting pstrings and fstrings
- I want --with-pam_smbpass to compile with a slightly sane
volume of warnings, currently its pretty bad, even in 2.2
where is compiles at all.
- Tridge assures me that he no longer opposes 'const religion'
based on the ability to #define const the problem away.
- Changed Get_Pwnam(x,y) into two variants (so that the const
parameter can work correctly): - Get_Pwnam(const x) and
Get_Pwnam_Modify(x).
- Reworked smbd/chgpasswd.c to work with these mods, passing
around a 'struct passwd' rather than the modified username
---
This finishes this line of commits off, your tree should now compile again :-)
Andrew Bartlett
(This used to be commit c95f5aeb9327347674589ae313b75bee3bf8e317)
2001-10-29 10:35:11 +03:00
const uint8 * nt_pw , * lm_pw ;
2002-01-11 08:29:09 +03:00
uint32 auth_flags ;
2001-10-31 13:46:25 +03:00
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
acct_ctrl = pdb_get_acct_ctrl ( sampass ) ;
2001-09-26 16:28:46 +04:00
if ( acct_ctrl & ACB_PWNOTREQ )
{
if ( lp_null_passwords ( ) )
{
2001-10-31 13:46:25 +03:00
DEBUG ( 3 , ( " Account for user '%s' has no password and null passwords are allowed. \n " , pdb_get_username ( sampass ) ) ) ;
2001-09-26 16:28:46 +04:00
return ( NT_STATUS_OK ) ;
}
else
{
2001-10-31 13:46:25 +03:00
DEBUG ( 3 , ( " Account for user '%s' has no password and null passwords are NOT allowed. \n " , pdb_get_username ( sampass ) ) ) ;
2001-09-26 16:28:46 +04:00
return ( NT_STATUS_LOGON_FAILURE ) ;
}
2001-10-06 05:51:57 +04:00
}
nt_pw = pdb_get_nt_passwd ( sampass ) ;
lm_pw = pdb_get_lanman_passwd ( sampass ) ;
2002-01-11 08:29:09 +03:00
auth_flags = user_info - > auth_flags ;
2001-10-31 13:46:25 +03:00
if ( nt_pw = = NULL ) {
2002-01-03 02:28:55 +03:00
DEBUG ( 3 , ( " sam_password_ok: NO NT password stored for user %s. \n " ,
2001-10-31 13:46:25 +03:00
pdb_get_username ( sampass ) ) ) ;
/* No return, we want to check the LM hash below in this case */
2002-01-11 08:29:09 +03:00
auth_flags & = ( ~ ( AUTH_FLAG_NTLMv2_RESP | AUTH_FLAG_NTLM_RESP ) ) ;
2001-10-31 13:46:25 +03:00
}
2001-11-11 14:15:28 +03:00
2002-01-11 08:29:09 +03:00
if ( auth_flags & AUTH_FLAG_NTLMv2_RESP ) {
2001-11-11 14:15:28 +03:00
/* We have the NT MD4 hash challenge available - see if we can
use it ( ie . does it exist in the smbpasswd file ) .
*/
2002-01-03 02:28:55 +03:00
DEBUG ( 4 , ( " sam_password_ok: Checking NTLMv2 password \n " ) ) ;
2001-11-11 14:15:28 +03:00
if ( smb_pwd_check_ntlmv2 ( user_info - > nt_resp ,
2002-01-05 07:55:41 +03:00
nt_pw , auth_context - > challenge ,
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
user_info - > smb_name . str ,
2001-11-11 14:15:28 +03:00
user_info - > client_domain . str ,
user_sess_key ) )
{
return NT_STATUS_OK ;
} else {
2002-01-03 02:28:55 +03:00
DEBUG ( 3 , ( " sam_password_ok: NTLMv2 password check failed \n " ) ) ;
2001-11-11 14:15:28 +03:00
return NT_STATUS_WRONG_PASSWORD ;
}
2002-01-11 08:29:09 +03:00
} else if ( auth_flags & AUTH_FLAG_NTLM_RESP ) {
2001-11-11 14:15:28 +03:00
if ( lp_ntlm_auth ( ) ) {
2001-10-06 05:51:57 +04:00
/* We have the NT MD4 hash challenge available - see if we can
use it ( ie . does it exist in the smbpasswd file ) .
*/
2002-01-03 02:28:55 +03:00
DEBUG ( 4 , ( " sam_password_ok: Checking NT MD4 password \n " ) ) ;
2001-11-11 14:15:28 +03:00
if ( smb_pwd_check_ntlmv1 ( user_info - > nt_resp ,
2002-01-05 07:55:41 +03:00
nt_pw , auth_context - > challenge ,
2001-11-11 14:15:28 +03:00
user_sess_key ) )
2001-10-06 05:51:57 +04:00
{
return NT_STATUS_OK ;
} else {
2002-01-03 02:28:55 +03:00
DEBUG ( 3 , ( " sam_password_ok: NT MD4 password check failed for user %s \n " , pdb_get_username ( sampass ) ) ) ;
2001-10-31 13:46:25 +03:00
return NT_STATUS_WRONG_PASSWORD ;
2001-10-06 05:51:57 +04:00
}
2001-11-11 14:15:28 +03:00
} else {
2002-01-03 02:28:55 +03:00
DEBUG ( 2 , ( " sam_password_ok: NTLMv1 passwords NOT PERMITTED for user %s \n " , pdb_get_username ( sampass ) ) ) ;
2001-10-31 13:46:25 +03:00
/* No return, we want to check the LM hash below in this case */
2001-11-11 14:15:28 +03:00
}
}
2001-10-31 13:46:25 +03:00
if ( lm_pw = = NULL ) {
2002-01-03 02:28:55 +03:00
DEBUG ( 3 , ( " sam_password_ok: NO LanMan password set for user %s (and no NT password supplied) \n " , pdb_get_username ( sampass ) ) ) ;
2002-01-11 08:29:09 +03:00
auth_flags & = ( ~ AUTH_FLAG_LM_RESP ) ;
2001-10-31 13:46:25 +03:00
}
2002-01-11 08:29:09 +03:00
if ( auth_flags & AUTH_FLAG_LM_RESP ) {
2001-10-31 13:46:25 +03:00
if ( user_info - > lm_resp . length ! = 24 ) {
2002-01-03 02:28:55 +03:00
DEBUG ( 2 , ( " sam_password_ok: invalid LanMan password length (%d) for user %s \n " ,
2001-10-31 13:46:25 +03:00
user_info - > nt_resp . length , pdb_get_username ( sampass ) ) ) ;
2001-09-26 16:28:46 +04:00
}
2001-10-31 13:46:25 +03:00
if ( ! lp_lanman_auth ( ) ) {
2002-01-03 02:28:55 +03:00
DEBUG ( 3 , ( " sam_password_ok: Lanman passwords NOT PERMITTED for user %s \n " , pdb_get_username ( sampass ) ) ) ;
2001-10-31 13:46:25 +03:00
return NT_STATUS_LOGON_FAILURE ;
}
2002-01-03 02:28:55 +03:00
DEBUG ( 4 , ( " sam_password_ok: Checking LM password \n " ) ) ;
2001-10-31 13:46:25 +03:00
if ( smb_pwd_check_ntlmv1 ( user_info - > lm_resp ,
2002-01-05 07:55:41 +03:00
lm_pw , auth_context - > challenge ,
2001-10-31 13:46:25 +03:00
user_sess_key ) )
{
return NT_STATUS_OK ;
} else {
2002-01-03 02:28:55 +03:00
DEBUG ( 4 , ( " sam_password_ok: LM password check failed for user %s \n " , pdb_get_username ( sampass ) ) ) ;
2001-10-31 13:46:25 +03:00
return NT_STATUS_WRONG_PASSWORD ;
}
2001-09-26 16:28:46 +04:00
}
2001-10-06 05:51:57 +04:00
2001-10-31 13:46:25 +03:00
/* Should not be reached, but if they send nothing... */
2002-01-03 02:28:55 +03:00
DEBUG ( 3 , ( " sam_password_ok: NEITHER LanMan nor NT password supplied for user %s \n " , pdb_get_username ( sampass ) ) ) ;
2001-10-31 13:46:25 +03:00
return NT_STATUS_WRONG_PASSWORD ;
2001-09-26 16:28:46 +04:00
}
/****************************************************************************
Do a specific test for a SAM_ACCOUNT being vaild for this connection
( ie not disabled , expired and the like ) .
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2002-01-01 06:10:32 +03:00
static NTSTATUS sam_account_ok ( TALLOC_CTX * mem_ctx ,
SAM_ACCOUNT * sampass ,
const auth_usersupplied_info * user_info )
2001-09-26 16:28:46 +04:00
{
uint16 acct_ctrl = pdb_get_acct_ctrl ( sampass ) ;
2001-09-16 10:35:35 +04:00
char * workstation_list ;
time_t kickoff_time ;
2001-08-17 10:06:56 +04:00
2002-01-03 02:28:55 +03:00
DEBUG ( 4 , ( " sam_account_ok: Checking SMB password for user %s \n " , pdb_get_username ( sampass ) ) ) ;
2001-09-26 16:28:46 +04:00
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
/* Quit if the account was disabled. */
2001-10-01 14:54:11 +04:00
if ( acct_ctrl & ACB_DISABLED ) {
2001-10-30 01:28:21 +03:00
DEBUG ( 1 , ( " Account for user '%s' was disabled. \n " , pdb_get_username ( sampass ) ) ) ;
2001-09-26 16:28:46 +04:00
return NT_STATUS_ACCOUNT_DISABLED ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
}
2001-09-16 10:35:35 +04:00
/* Test account expire time */
kickoff_time = pdb_get_kickoff_time ( sampass ) ;
2001-10-01 14:54:11 +04:00
if ( kickoff_time ! = 0 & & time ( NULL ) > kickoff_time ) {
2001-10-30 01:28:21 +03:00
DEBUG ( 1 , ( " Account for user '%s' has expried. \n " , pdb_get_username ( sampass ) ) ) ;
2001-10-01 14:54:11 +04:00
DEBUG ( 3 , ( " Account expired at '%ld' unix time. \n " , ( long ) kickoff_time ) ) ;
return NT_STATUS_ACCOUNT_EXPIRED ;
2001-09-16 10:35:35 +04:00
}
2001-09-26 17:11:22 +04:00
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
if ( ! ( pdb_get_acct_ctrl ( sampass ) & ACB_PWNOEXP ) ) {
time_t must_change_time = pdb_get_pass_must_change_time ( sampass ) ;
time_t last_set_time = pdb_get_pass_last_set_time ( sampass ) ;
/* check for immediate expiry "must change at next logon" */
if ( must_change_time = = 0 & & last_set_time ! = 0 ) {
DEBUG ( 1 , ( " Account for user '%s' password must change!. \n " , pdb_get_username ( sampass ) ) ) ;
return NT_STATUS_PASSWORD_MUST_CHANGE ;
}
/* check for expired password */
if ( must_change_time < time ( NULL ) & & must_change_time ! = 0 ) {
DEBUG ( 1 , ( " Account for user '%s' password expired!. \n " , pdb_get_username ( sampass ) ) ) ;
DEBUG ( 1 , ( " Password expired at '%s' (%ld) unix time. \n " , http_timestring ( must_change_time ) , ( long ) must_change_time ) ) ;
return NT_STATUS_PASSWORD_EXPIRED ;
}
}
2001-09-16 10:35:35 +04:00
/* Test workstation. Workstation list is comma separated. */
2001-09-26 17:11:22 +04:00
2002-01-01 06:10:32 +03:00
workstation_list = talloc_strdup ( mem_ctx , pdb_get_workstations ( sampass ) ) ;
2001-09-26 17:11:22 +04:00
2001-10-01 14:54:11 +04:00
if ( ! workstation_list ) return NT_STATUS_NO_MEMORY ;
if ( * workstation_list ) {
BOOL invalid_ws = True ;
char * s = workstation_list ;
2001-09-16 10:35:35 +04:00
2001-10-01 14:54:11 +04:00
fstring tok ;
2001-09-16 10:35:35 +04:00
2001-10-01 14:54:11 +04:00
while ( next_token ( & s , tok , " , " , sizeof ( tok ) ) ) {
DEBUG ( 10 , ( " checking for workstation match %s and %s (len=%d) \n " ,
tok , user_info - > wksta_name . str , user_info - > wksta_name . len ) ) ;
if ( strequal ( tok , user_info - > wksta_name . str ) ) {
invalid_ws = False ;
break ;
2001-09-16 10:35:35 +04:00
}
}
2001-10-01 14:54:11 +04:00
if ( invalid_ws )
return NT_STATUS_INVALID_WORKSTATION ;
2001-09-16 10:35:35 +04:00
}
2001-10-01 14:54:11 +04:00
2001-09-26 17:11:22 +04:00
if ( acct_ctrl & ACB_DOMTRUST ) {
2002-01-03 02:28:55 +03:00
DEBUG ( 2 , ( " sam_account_ok: Domain trust account %s denied by server \n " , pdb_get_username ( sampass ) ) ) ;
2001-09-26 17:11:22 +04:00
return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT ;
}
if ( acct_ctrl & ACB_SVRTRUST ) {
2002-01-03 02:28:55 +03:00
DEBUG ( 2 , ( " sam_account_ok: Server trust account %s denied by server \n " , pdb_get_username ( sampass ) ) ) ;
2001-09-26 17:11:22 +04:00
return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT ;
}
if ( acct_ctrl & ACB_WSTRUST ) {
2002-01-03 02:28:55 +03:00
DEBUG ( 4 , ( " sam_account_ok: Wksta trust account %s denied by server \n " , pdb_get_username ( sampass ) ) ) ;
2001-09-26 17:11:22 +04:00
return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT ;
}
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
2001-09-26 16:28:46 +04:00
return NT_STATUS_OK ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
}
/****************************************************************************
check if a username / password is OK assuming the password is a 24 byte
2001-08-17 10:06:56 +04:00
SMB hash supplied in the user_info structure
return an NT_STATUS constant .
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2002-01-05 07:55:41 +03:00
static NTSTATUS check_sam_security ( const struct auth_context * auth_context ,
void * my_private_data ,
2002-01-01 06:10:32 +03:00
TALLOC_CTX * mem_ctx ,
const auth_usersupplied_info * user_info ,
auth_serversupplied_info * * server_info )
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
{
SAM_ACCOUNT * sampass = NULL ;
BOOL ret ;
2001-09-04 11:13:01 +04:00
NTSTATUS nt_status ;
2001-10-31 13:46:25 +03:00
uint8 user_sess_key [ 16 ] ;
const uint8 * lm_hash ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
2002-01-05 07:55:41 +03:00
if ( ! user_info | | ! auth_context ) {
return NT_STATUS_UNSUCCESSFUL ;
2001-11-11 14:18:45 +03:00
}
2002-01-15 04:14:58 +03:00
/* Can't use the talloc version here, becouse the returned struct gets
kept on the server_info */
if ( ! NT_STATUS_IS_OK ( nt_status = pdb_init_sam ( & sampass ) ) ) {
return nt_status ;
2001-11-11 14:18:45 +03:00
}
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
/* get the account information */
2001-08-12 15:19:57 +04:00
become_root ( ) ;
2001-10-31 13:46:25 +03:00
ret = pdb_getsampwnam ( sampass , user_info - > internal_username . str ) ;
2001-08-12 15:19:57 +04:00
unbecome_root ( ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
if ( ret = = False )
{
2001-10-31 13:46:25 +03:00
DEBUG ( 1 , ( " Couldn't find user '%s' in passdb file. \n " , user_info - > internal_username . str ) ) ;
2001-09-29 17:08:26 +04:00
pdb_free_sam ( & sampass ) ;
2001-09-04 11:13:01 +04:00
return NT_STATUS_NO_SUCH_USER ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
}
2002-01-05 07:55:41 +03:00
nt_status = sam_password_ok ( auth_context , mem_ctx , sampass , user_info , user_sess_key ) ;
2001-09-26 16:28:46 +04:00
2001-10-31 13:46:25 +03:00
if ( ! NT_STATUS_IS_OK ( nt_status ) ) {
pdb_free_sam ( & sampass ) ;
return nt_status ;
2001-09-26 16:28:46 +04:00
}
2002-01-01 06:10:32 +03:00
nt_status = sam_account_ok ( mem_ctx , sampass , user_info ) ;
2001-10-31 13:46:25 +03:00
if ( ! NT_STATUS_IS_OK ( nt_status ) ) {
pdb_free_sam ( & sampass ) ;
return nt_status ;
}
if ( ! make_server_info_sam ( server_info , sampass ) ) {
DEBUG ( 0 , ( " failed to malloc memory for server_info \n " ) ) ;
return NT_STATUS_NO_MEMORY ;
}
lm_hash = pdb_get_lanman_passwd ( ( * server_info ) - > sam_account ) ;
if ( lm_hash ) {
memcpy ( ( * server_info ) - > first_8_lm_hash , lm_hash , 8 ) ;
}
memcpy ( ( * server_info ) - > session_key , user_sess_key , sizeof ( user_sess_key ) ) ;
This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.
The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards. The
interface currently implemented in as
nt_status = check_password(user_info, server_info)
where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.
The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.
This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing. We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.
Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree. (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
(This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-08-03 17:09:23 +04:00
return nt_status ;
}
2001-10-31 13:46:25 +03:00
2002-01-05 07:55:41 +03:00
/* module initialisation */
BOOL auth_init_sam ( struct auth_context * auth_context , auth_methods * * auth_method )
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
{
2002-01-05 07:55:41 +03:00
if ( ! make_auth_methods ( auth_context , auth_method ) ) {
This is another rather major change to the samba authenticaion
subystem.
The particular aim is to modularized the interface - so that we
can have arbitrary password back-ends.
This code adds one such back-end, a 'winbind' module to authenticate
against the winbind_auth_crap functionality. While fully-functional
this code is mainly useful as a demonstration, because we don't get
back the info3 as we would for direct ntdomain authentication.
This commit introduced the new 'auth methods' parameter, in the
spirit of the 'auth order' discussed on the lists. It is renamed
because not all the methods may be consulted, even if previous
methods fail - they may not have a suitable challenge for example.
Also, we have a 'local' authentication method, for old-style
'unix if plaintext, sam if encrypted' authentication and a
'guest' module to handle guest logins in a single place.
While this current design is not ideal, I feel that it does
provide a better infrastructure than the current design, and can
be built upon.
The following parameters have changed:
- use rhosts =
This has been replaced by the 'rhosts' authentication method,
and can be specified like 'auth methods = guest rhosts'
- hosts equiv =
This needs both this parameter and an 'auth methods' entry
to be effective. (auth methods = guest hostsequiv ....)
- plaintext to smbpasswd =
This is replaced by specifying 'sam' rather than 'local'
in the auth methods.
The security = parameter is unchanged, and now provides defaults
for the 'auth methods' parameter.
The available auth methods are:
guest
rhosts
hostsequiv
sam (passdb direct hash access)
unix (PAM, crypt() etc)
local (the combination of the above, based on encryption)
smbserver (old security=server)
ntdomain (old security=domain)
winbind (use winbind to cache DC connections)
Assistance in testing, or the production of new and interesting
authentication modules is always appreciated.
Andrew Bartlett
(This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24 15:12:38 +03:00
return False ;
}
( * auth_method ) - > auth = check_sam_security ;
return True ;
}
2001-10-31 13:46:25 +03:00
2002-01-05 07:55:41 +03:00
2001-11-26 09:47:04 +03:00
/****************************************************************************
2002-01-05 07:55:41 +03:00
Check SAM security ( above ) but with a few extra checks .
2001-11-26 09:47:04 +03:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
2002-01-05 07:55:41 +03:00
static NTSTATUS check_samstrict_security ( const struct auth_context * auth_context ,
void * my_private_data ,
2002-01-01 06:10:32 +03:00
TALLOC_CTX * mem_ctx ,
const auth_usersupplied_info * user_info ,
auth_serversupplied_info * * server_info )
2001-11-26 09:47:04 +03:00
{
2002-01-05 07:55:41 +03:00
if ( ! user_info | | ! auth_context ) {
2001-11-26 09:47:04 +03:00
return NT_STATUS_LOGON_FAILURE ;
}
/* If we are a domain member, we must not
attempt to check the password locally ,
unless it is one of our aliases . */
if ( ! is_netbios_alias_or_name ( user_info - > domain . str ) ) {
return NT_STATUS_NO_SUCH_USER ;
}
2002-01-05 07:55:41 +03:00
return check_sam_security ( auth_context , my_private_data , mem_ctx , user_info , server_info ) ;
2001-11-26 09:47:04 +03:00
}
2002-01-05 07:55:41 +03:00
/* module initialisation */
BOOL auth_init_samstrict ( struct auth_context * auth_context , auth_methods * * auth_method )
2001-11-26 09:47:04 +03:00
{
2002-01-05 07:55:41 +03:00
if ( ! make_auth_methods ( auth_context , auth_method ) ) {
2001-11-26 09:47:04 +03:00
return False ;
}
2001-10-31 13:46:25 +03:00
2001-11-26 09:47:04 +03:00
( * auth_method ) - > auth = check_samstrict_security ;
return True ;
}
2001-10-31 13:46:25 +03:00
2002-01-05 07:55:41 +03:00
