sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-14 19:24:43 +03:00
Code
samba-mirror/source3/pam_smbpass/pam_smb_passwd.c

359 lines
10 KiB
C
Raw Normal View History

Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
/*
Unix SMB/CIFS implementation.
Use PAM to update user passwords in the local SAM
Copyright (C) Steve Langasek 1998-2003
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
r23779: Change from v2 or later to v3 or later. Jeremy. (This used to be commit 407e6e695b8366369b7c76af1ff76869b45347b3)
2007-07-09 19:25:36 +00:00
the Free Software Foundation; either version 3 of the License, or
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
r23784: use the GPLv3 boilerplate as recommended by the FSF and the license text (This used to be commit b0132e94fc5fef936aa766fb99a306b3628e9f07)
2007-07-10 00:52:41 +00:00
along with this program. If not, see <http://www.gnu.org/licenses/>.
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
*/
/* indicate the following groups are defined */
#define PAM_SM_PASSWORD
#include "includes.h"
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
/* This is only used in the Sun implementation. FIXME: we really
want a define here that distinguishes between the Solaris PAM
and others (including FreeBSD). */
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
#ifndef LINUX
r23095: Support systems that have their PAM headers in /usr/include/pam. (This used to be commit f1e8de4b576b3954d456cb64c02417908bab8da4)
2007-05-23 20:31:28 +00:00
#if defined(HAVE_SECURITY_PAM_APPL_H)
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
#include <security/pam_appl.h>
r23095: Support systems that have their PAM headers in /usr/include/pam. (This used to be commit f1e8de4b576b3954d456cb64c02417908bab8da4)
2007-05-23 20:31:28 +00:00
#elif defined(HAVE_PAM_PAM_APPL_H)
#include <pam/pam_appl.h>
#endif
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
#endif
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
r23095: Support systems that have their PAM headers in /usr/include/pam. (This used to be commit f1e8de4b576b3954d456cb64c02417908bab8da4)
2007-05-23 20:31:28 +00:00
#if defined(HAVE_SECURITY_PAM_MODULES_H)
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
#include <security/pam_modules.h>
r23095: Support systems that have their PAM headers in /usr/include/pam. (This used to be commit f1e8de4b576b3954d456cb64c02417908bab8da4)
2007-05-23 20:31:28 +00:00
#elif defined(HAVE_PAM_PAM_MODULES_H)
#include <pam/pam_modules.h>
#endif
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
#include "general.h"
#include "support.h"
updates from 2.2 (This used to be commit 398b4ff0d40d89b3e96d481807f85f15b7a7966a)
2002-01-12 23:12:13 +00:00
int smb_update_db( pam_handle_t *pamh, int ctrl, const char *user, const char *pass_new )
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
{
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
int retval;
Remove pstrings from pam_smbpass - make local_password_change return malloced strings. Jeremy. (This used to be commit f652fe2bdb7a3a36e83dcf4b08347543fdffb9f0)
2007-11-21 17:42:52 -08:00
char *err_str = NULL;
char *msg_str = NULL;
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
Remove pstrings from pam_smbpass - make local_password_change return malloced strings. Jeremy. (This used to be commit f652fe2bdb7a3a36e83dcf4b08347543fdffb9f0)
2007-11-21 17:42:52 -08:00
retval = NT_STATUS_IS_OK(local_password_change(user, LOCAL_SET_PASSWORD, pass_new,
&err_str,
&msg_str));
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
if (!retval) {
Remove pstrings from pam_smbpass - make local_password_change return malloced strings. Jeremy. (This used to be commit f652fe2bdb7a3a36e83dcf4b08347543fdffb9f0)
2007-11-21 17:42:52 -08:00
if (err_str) {
make_remark(pamh, ctrl, PAM_ERROR_MSG, err_str );
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
}
/* FIXME: what value is appropriate here? */
retval = PAM_AUTHTOK_ERR;
} else {
Remove pstrings from pam_smbpass - make local_password_change return malloced strings. Jeremy. (This used to be commit f652fe2bdb7a3a36e83dcf4b08347543fdffb9f0)
2007-11-21 17:42:52 -08:00
if (msg_str) {
make_remark(pamh, ctrl, PAM_TEXT_INFO, msg_str );
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
}
retval = PAM_SUCCESS;
}
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
Remove pstrings from pam_smbpass - make local_password_change return malloced strings. Jeremy. (This used to be commit f652fe2bdb7a3a36e83dcf4b08347543fdffb9f0)
2007-11-21 17:42:52 -08:00
SAFE_FREE(err_str);
SAFE_FREE(msg_str);
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
return retval;
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
}
/* data tokens */
#define _SMB_OLD_AUTHTOK "-SMB-OLD-PASS"
#define _SMB_NEW_AUTHTOK "-SMB-NEW-PASS"
/*
* FUNCTION: pam_sm_chauthtok()
*
* This function is called twice by the PAM library, once with
* PAM_PRELIM_CHECK set, and then again with PAM_UPDATE_AUTHTOK set. With
* Linux-PAM, these two passes generally involve first checking the old
* token and then changing the token. This is what we do here.
*
* Having obtained a new password. The function updates the
* SMB_PASSWD_FILE file (normally, $(LIBDIR)/smbpasswd).
*/
int pam_sm_chauthtok(pam_handle_t *pamh, int flags,
int argc, const char **argv)
{
unsigned int ctrl;
int retval;
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
struct samu *sampass = NULL;
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
void (*oldsig_handler)(int);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
const char *user;
updated the 3.0 branch from the head branch - ready for alpha18 (This used to be commit 03ac082dcb375b6f3ca3d810a6a6367542bc23ce)
2002-07-15 10:35:28 +00:00
char *pass_old;
char *pass_new;
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
/* Samba initialization. */
r14577: BUG Fixes: * Add back in the import/export support to pdbedit * Fix segv in pam_smbpass * Cleanup some error paths in pdb_tdb and pdb_interface (This used to be commit df53d64910fbb96eb810102e986b3c337d54c463)
2006-03-20 10:18:23 +00:00
load_case_tables();
Eliminate global variable in_client and a plethora of extern declarations. Derrell (This used to be commit b7f34e7ef2907b498a0645ce68f2773ed7d60cdc)
2008-03-06 10:41:42 -05:00
lp_set_in_client(True);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
ctrl = set_ctrl(pamh, flags, argc, argv);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
/*
* First get the name of a user. No need to do anything if we can't
* determine this.
*/
retval = pam_get_user( pamh, &user, "Username: " );
if (retval != PAM_SUCCESS) {
if (on( SMB_DEBUG, ctrl )) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_DEBUG, "password: could not identify user");
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
}
return retval;
}
if (on( SMB_DEBUG, ctrl )) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_DEBUG, "username [%s] obtained", user);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
}
Fix bug #3727 with patch from Steve Langasek <vorlon@debian.org> Jeremy. (This used to be commit 0723760ba47a465d2ff5a22a680f1b5196eca7d8)
2007-12-12 17:26:49 -08:00
if (geteuid() != 0) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_DEBUG, "Cannot access samba password database, not running as root.");
Fix bug #3727 with patch from Steve Langasek <vorlon@debian.org> Jeremy. (This used to be commit 0723760ba47a465d2ff5a22a680f1b5196eca7d8)
2007-12-12 17:26:49 -08:00
return PAM_AUTHINFO_UNAVAIL;
}
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
/* Getting into places that might use LDAP -- protect the app
from a SIGPIPE it's not expecting */
oldsig_handler = CatchSignal(SIGPIPE, SIGNAL_CAST SIG_IGN);
r23121: Fix Bug #2727 and let pam_smbpass at least link and dlopen correctly again. Thanks to Bartlomiej Solarz-Niesluchowski <Bartlomiej.Solarz-Niesluchowski@wit.edu.pl>. Guenther (This used to be commit ba956ab8e4097d46bbad12caf2fad6857f463618)
2007-05-24 20:26:07 +00:00
if (!initialize_password_db(False, NULL)) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_ALERT, "Cannot access samba password database" );
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
return PAM_AUTHINFO_UNAVAIL;
}
/* obtain user record */
r13590: * replace all pdb_init_sam[_talloc]() calls with samu_new() * replace all pdb_{init,fill}_sam_pw() calls with samu_set_unix() (This used to be commit 6f1afa4acc93a07d0ee9940822d7715acaae634f)
2006-02-21 14:34:11 +00:00
if ( !(sampass = samu_new( NULL )) ) {
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
r13590: * replace all pdb_init_sam[_talloc]() calls with samu_new() * replace all pdb_{init,fill}_sam_pw() calls with samu_set_unix() (This used to be commit 6f1afa4acc93a07d0ee9940822d7715acaae634f)
2006-02-21 14:34:11 +00:00
return nt_status_to_pam(NT_STATUS_NO_MEMORY);
sync'ing up for 3.0alpha20 release (This used to be commit 65e7b5273bb58802bf0c389b77f7fcae0a1f6139)
2002-09-25 15:19:00 +00:00
}
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
sync'ing up for 3.0alpha20 release (This used to be commit 65e7b5273bb58802bf0c389b77f7fcae0a1f6139)
2002-09-25 15:19:00 +00:00
if (!pdb_getsampwnam(sampass,user)) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_ALERT, "Failed to find entry for user %s.", user);
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
return PAM_USER_UNKNOWN;
}
r14577: BUG Fixes: * Add back in the import/export support to pdbedit * Fix segv in pam_smbpass * Cleanup some error paths in pdb_tdb and pdb_interface (This used to be commit df53d64910fbb96eb810102e986b3c337d54c463)
2006-03-20 10:18:23 +00:00
if (on( SMB_DEBUG, ctrl )) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_DEBUG, "Located account for %s", user);
r14577: BUG Fixes: * Add back in the import/export support to pdbedit * Fix segv in pam_smbpass * Cleanup some error paths in pdb_tdb and pdb_interface (This used to be commit df53d64910fbb96eb810102e986b3c337d54c463)
2006-03-20 10:18:23 +00:00
}
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
if (flags & PAM_PRELIM_CHECK) {
/*
* obtain and verify the current password (OLDAUTHTOK) for
* the user.
*/
char *Announce;
updates from 2.2 (This used to be commit 398b4ff0d40d89b3e96d481807f85f15b7a7966a)
2002-01-12 23:12:13 +00:00
if (_smb_blankpasswd( ctrl, sampass )) {
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
TALLOC_FREE(sampass);
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
return PAM_SUCCESS;
}
/* Password change by root, or for an expired token, doesn't
require authentication. Is this a good choice? */
if (getuid() != 0 && !(flags & PAM_CHANGE_EXPIRED_AUTHTOK)) {
/* tell user what is happening */
#define greeting "Changing password for "
r7126: fixing paranoid malloc checker failures (This used to be commit b01026674fddb4179a7f002c13f5e341eaaa0a1c)
2005-05-31 01:44:44 +00:00
Announce = SMB_MALLOC_ARRAY(char, sizeof(greeting)+strlen(user));
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
if (Announce == NULL) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_CRIT, "password: out of memory");
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
TALLOC_FREE(sampass);
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
return PAM_BUF_ERR;
}
strncpy( Announce, greeting, sizeof(greeting) );
strncpy( Announce+sizeof(greeting)-1, user, strlen(user)+1 );
#undef greeting
set( SMB__OLD_PASSWD, ctrl );
updates from 2.2 (This used to be commit 398b4ff0d40d89b3e96d481807f85f15b7a7966a)
2002-01-12 23:12:13 +00:00
retval = _smb_read_password( pamh, ctrl, Announce, "Current SMB password: ",
NULL, _SMB_OLD_AUTHTOK, &pass_old );
SAFE_FREE( Announce );
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
if (retval != PAM_SUCCESS) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_NOTICE,
"password - (old) token not obtained");
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
TALLOC_FREE(sampass);
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
return retval;
}
/* verify that this is the password for this user */
updates from 2.2 (This used to be commit 398b4ff0d40d89b3e96d481807f85f15b7a7966a)
2002-01-12 23:12:13 +00:00
retval = _smb_verify_password( pamh, sampass, pass_old, ctrl );
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
} else {
pass_old = NULL;
retval = PAM_SUCCESS; /* root doesn't have to */
}
pass_old = NULL;
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
TALLOC_FREE(sampass);
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
return retval;
} else if (flags & PAM_UPDATE_AUTHTOK) {
/*
* obtain the proposed password
*/
/*
* get the old token back. NULL was ok only if root [at this
* point we assume that this has already been enforced on a
* previous call to this function].
*/
if (off( SMB_NOT_SET_PASS, ctrl )) {
s3-pamsmbpass: copy _pam_get_item and _pam_get_data from pam_winbind. Guenther
2009-05-22 17:56:37 +02:00
retval = _pam_get_item( pamh, PAM_OLDAUTHTOK,
&pass_old );
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
} else {
s3-pamsmbpass: copy _pam_get_item and _pam_get_data from pam_winbind. Guenther
2009-05-22 17:56:37 +02:00
retval = _pam_get_data( pamh, _SMB_OLD_AUTHTOK,
&pass_old );
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
if (retval == PAM_NO_MODULE_DATA) {
pass_old = NULL;
retval = PAM_SUCCESS;
}
}
if (retval != PAM_SUCCESS) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_NOTICE, "password: user not authenticated");
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
TALLOC_FREE(sampass);
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
return retval;
}
/*
* use_authtok is to force the use of a previously entered
* password -- needed for pluggable password strength checking
* or other module stacking
*/
if (on( SMB_USE_AUTHTOK, ctrl )) {
set( SMB_USE_FIRST_PASS, ctrl );
}
retval = _smb_read_password( pamh, ctrl
, NULL
, "Enter new SMB password: "
, "Retype new SMB password: "
, _SMB_NEW_AUTHTOK
, &pass_new );
if (retval != PAM_SUCCESS) {
if (on( SMB_DEBUG, ctrl )) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_ALERT,
"password: new password not obtained");
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
}
pass_old = NULL; /* tidy up */
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
TALLOC_FREE(sampass);
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
return retval;
}
/*
* At this point we know who the user is and what they
* propose as their new password. Verify that the new
* password is acceptable.
*/
if (pass_new[0] == '\0') { /* "\0" password = NULL */
pass_new = NULL;
}
retval = _pam_smb_approve_pass(pamh, ctrl, pass_old, pass_new);
if (retval != PAM_SUCCESS) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_NOTICE, "new password not acceptable");
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
pass_new = pass_old = NULL; /* tidy up */
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
TALLOC_FREE(sampass);
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
return retval;
}
/*
* By reaching here we have approved the passwords and must now
* rebuild the smb password file.
*/
/* update the password database */
retval = smb_update_db(pamh, ctrl, user, pass_new);
if (retval == PAM_SUCCESS) {
And finally IDMAP in 3_0 We really need idmap_ldap to have a good solution with ldapsam, porting it from the prvious code is beeing made, the code is really simple to do so I am confident it is not a problem to commit this code in. Not committing it would have been worst. I really would have been able to finish also the group code, maybe we can put it into a followin release after 3.0.0 even if it may be an upgrade problem. The code has been tested and seem to work right, more testing is needed for corner cases. Currently winbind pdc (working only for users and not for groups) is disabled as I was not able to make a complete group code replacement that works somewhat in a week (I have a complete patch, but there are bugs) Simo. (This used to be commit 0e58085978f984436815114a2ec347cf7899a89d)
2003-05-12 18:12:31 +00:00
uid_t uid;
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
/* password updated */
r13316: Let the carnage begin.... Sync with trunk as off r13315 (This used to be commit 17e63ac4ed8325c0d44fe62b2442449f3298559f)
2006-02-03 22:19:41 +00:00
if (!sid_to_uid(pdb_get_user_sid(sampass), &uid)) {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_NOTICE,
"Unable to get uid for user %s",
And finally IDMAP in 3_0 We really need idmap_ldap to have a good solution with ldapsam, porting it from the prvious code is beeing made, the code is really simple to do so I am confident it is not a problem to commit this code in. Not committing it would have been worst. I really would have been able to finish also the group code, maybe we can put it into a followin release after 3.0.0 even if it may be an upgrade problem. The code has been tested and seem to work right, more testing is needed for corner cases. Currently winbind pdc (working only for users and not for groups) is disabled as I was not able to make a complete group code replacement that works somewhat in a week (I have a complete patch, but there are bugs) Simo. (This used to be commit 0e58085978f984436815114a2ec347cf7899a89d)
2003-05-12 18:12:31 +00:00
pdb_get_username(sampass));
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_NOTICE, "password for (%s) changed by (%s/%d)",
And finally IDMAP in 3_0 We really need idmap_ldap to have a good solution with ldapsam, porting it from the prvious code is beeing made, the code is really simple to do so I am confident it is not a problem to commit this code in. Not committing it would have been worst. I really would have been able to finish also the group code, maybe we can put it into a followin release after 3.0.0 even if it may be an upgrade problem. The code has been tested and seem to work right, more testing is needed for corner cases. Currently winbind pdc (working only for users and not for groups) is disabled as I was not able to make a complete group code replacement that works somewhat in a week (I have a complete patch, but there are bugs) Simo. (This used to be commit 0e58085978f984436815114a2ec347cf7899a89d)
2003-05-12 18:12:31 +00:00
user, uidtoname(getuid()), getuid());
} else {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_NOTICE, "password for (%s/%d) changed by (%s/%d)",
And finally IDMAP in 3_0 We really need idmap_ldap to have a good solution with ldapsam, porting it from the prvious code is beeing made, the code is really simple to do so I am confident it is not a problem to commit this code in. Not committing it would have been worst. I really would have been able to finish also the group code, maybe we can put it into a followin release after 3.0.0 even if it may be an upgrade problem. The code has been tested and seem to work right, more testing is needed for corner cases. Currently winbind pdc (working only for users and not for groups) is disabled as I was not able to make a complete group code replacement that works somewhat in a week (I have a complete patch, but there are bugs) Simo. (This used to be commit 0e58085978f984436815114a2ec347cf7899a89d)
2003-05-12 18:12:31 +00:00
user, uid, uidtoname(getuid()), getuid());
}
} else {
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_ERR, "password change failed for user %s", user);
And finally IDMAP in 3_0 We really need idmap_ldap to have a good solution with ldapsam, porting it from the prvious code is beeing made, the code is really simple to do so I am confident it is not a problem to commit this code in. Not committing it would have been worst. I really would have been able to finish also the group code, maybe we can put it into a followin release after 3.0.0 even if it may be an upgrade problem. The code has been tested and seem to work right, more testing is needed for corner cases. Currently winbind pdc (working only for users and not for groups) is disabled as I was not able to make a complete group code replacement that works somewhat in a week (I have a complete patch, but there are bugs) Simo. (This used to be commit 0e58085978f984436815114a2ec347cf7899a89d)
2003-05-12 18:12:31 +00:00
}
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
pass_old = pass_new = NULL;
updates from 2.2 (This used to be commit 398b4ff0d40d89b3e96d481807f85f15b7a7966a)
2002-01-12 23:12:13 +00:00
if (sampass) {
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
TALLOC_FREE(sampass);
updates from 2.2 (This used to be commit 398b4ff0d40d89b3e96d481807f85f15b7a7966a)
2002-01-12 23:12:13 +00:00
sampass = NULL;
}
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
} else { /* something has broken with the library */
s3:pam_smbpass: don't call openlog() or closelog() from pam_smbpass Patch from Steve Langasek with tiny fixes by me to make it apply to master. Also see Debian bug #434372 and bugzilla #4831. Calling openlog() or closelog() inside a pam module is not good as these functions are not stackable and no program won't re-do openlog() just because a pam module might have called closelog().
2009-05-26 15:40:21 +02:00
_log_err(pamh, LOG_ALERT, "password received unknown request");
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
retval = PAM_ABORT;
}
updates from 2.2 (This used to be commit 398b4ff0d40d89b3e96d481807f85f15b7a7966a)
2002-01-12 23:12:13 +00:00
if (sampass) {
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
TALLOC_FREE(sampass);
updates from 2.2 (This used to be commit 398b4ff0d40d89b3e96d481807f85f15b7a7966a)
2002-01-12 23:12:13 +00:00
sampass = NULL;
}
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
r13576: This is the beginnings of moving the SAM_ACCOUNT data structure to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2006-02-20 20:09:36 +00:00
TALLOC_FREE(sampass);
Patch from Steve Langasek <vorlon@netexpress.net> fix up two issues in pam_smbpass. The first, more important issue is adding support for the (apparently new) LOCAL_SET_PASSWORD flag to local_password_change(), without which pam_smbpass is a complete and utter no-op. The second, lesser issue is that with the advent of ldapsam, it's possible for pam_smbpass to generate a SIGPIPE that isn't handled by the calling application. The most basic signal wrapping is put in place to prevent this. Beyond that, the only thing in the patch is a bit of reformatting to make pam_smb_passwd.c look a bit more like the rest of the code in CVS. More of that later, I'm sure. (This used to be commit 1aecda300e0b44c133fe0cd2bafb166621dbc17a)
2003-04-08 04:42:44 +00:00
CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
Added Steve Langasek <vorlon@netexpress.net> pam_smbpass PAM module code. Note: Still have to add build stuff - not ready yet. (This used to be commit 1de7022f98b64b15503aaf48c8d729789fc49781)
2001-04-24 20:00:12 +00:00
return retval;
}
/* static module data */
#ifdef PAM_STATIC
struct pam_module _pam_smbpass_passwd_modstruct = {
"pam_smbpass",
NULL,
NULL,
NULL,
NULL,
NULL,
pam_sm_chauthtok
};
#endif
Copy Permalink