sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-29 11:21:54 +03:00
Code
fbdcf2663b
samba-mirror/source3/smbd/change_trust_pw.c

101 lines
3.3 KiB
C
Raw Normal View History

Broke out change trust account password routines into separate file since they're only used in one place anyway (timeout_processing() in process.c) (This used to be commit d1e5d5d62fcb5da30e3f2619721c5146db753f3c)
2001-05-17 06:52:45 +04:00
/*
Removed version number from file header. Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2002-01-30 09:08:46 +03:00
* Unix SMB/CIFS implementation.
A farily large commit: - Move rpc_client/cli_trust.c to smbd/change_trust_pw.c - It hasn't been used by anything else since smbpasswd lost its -j - Add a TALLOC_CTX to the auth subsytem. These are only valid for the length of the calls to the individual modules, if you want a longer context hide it in your private data. Similarly, all returns (like the server_info) should still be malloced. - Move the 'ntdomain' module (security=domain in oldspeak) over to use the new libsmb domain logon code. Also rework much of the code to use some better helper functions for the connection - getting us much better error returns (the new code is NTSTATUS). The only remaining thing to do is to figure out if tpot's 0xdead 0xbeef for the LUID feilds is sufficient, or if we should do random LUIDs as per the old code. Similarly, I'll move winbind over to this when I get a chance. This leaves the SPOOLSS code and some cli_pipe code as the only stuff still in rpc_client, at least as far as smbd is concerned. While I've given this a basic rundown, any testing is as always appriciated. Andrew Bartlett (This used to be commit d870edce76ecca259230fbdbdacd0c86793b4837)
2002-01-01 06:10:32 +03:00
* Periodic Trust account password changing.
Broke out change trust account password routines into separate file since they're only used in one place anyway (timeout_processing() in process.c) (This used to be commit d1e5d5d62fcb5da30e3f2619721c5146db753f3c)
2001-05-17 06:52:45 +04:00
* Copyright (C) Andrew Tridgell 1992-1997,
* Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
* Copyright (C) Paul Ashton 1997.
* Copyright (C) Jeremy Allison 1998.
OK. Smbpasswd -j is DEAD. This moves the rest of the functionality into the 'net rpc join' code. Futhermore, this moves that entire area over to the libsmb codebase, rather than the crufty old rpc_client stuff. I have also fixed up the smbpasswd -a -m bug in the process. We also have a new 'net rpc changetrustpw' that can be called from a cron-job to regularly change the trust account password, for sites that run winbind but not smbd. With a little more work, we can kill rpc_client from smbd entirly! (It is mostly the domain auth stuff - which I can rework - and the spoolss stuff that sombody else will need to look over). Andrew Bartlett (This used to be commit 575897e879fc175ba702adf245384033342c903d)
2001-12-05 14:00:26 +03:00
* Copyright (C) Andrew Bartlett 2001.
Broke out change trust account password routines into separate file since they're only used in one place anyway (timeout_processing() in process.c) (This used to be commit d1e5d5d62fcb5da30e3f2619721c5146db753f3c)
2001-05-17 06:52:45 +04:00
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 18:09:03 +04:00
/************************************************************************
Change the trust account password for a domain.
************************************************************************/
Broke out change trust account password routines into separate file since they're only used in one place anyway (timeout_processing() in process.c) (This used to be commit d1e5d5d62fcb5da30e3f2619721c5146db753f3c)
2001-05-17 06:52:45 +04:00
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 18:09:03 +04:00
NTSTATUS change_trust_account_password( const char *domain, const char *remote_machine)
Broke out change trust account password routines into separate file since they're only used in one place anyway (timeout_processing() in process.c) (This used to be commit d1e5d5d62fcb5da30e3f2619721c5146db753f3c)
2001-05-17 06:52:45 +04:00
{
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 18:09:03 +04:00
NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
struct in_addr pdc_ip;
fstring dc_name;
r10656: BIG merge from trunk. Features not copied over * \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck) (This used to be commit 939c3cb5d78e3a2236209b296aa8aba8bdce32d3)
2005-09-30 21:13:37 +04:00
struct cli_state *cli = NULL;
struct rpc_pipe_client *netlogon_pipe = NULL;
I *love* removing code :-). Removed 4 files that weren't being used. All this stuff was being pulled in due to *one* unneeded call to fetch a domain SID which smbpasswd already puts in the database... Jeremy. (This used to be commit 6bf2505cce7db770fd4db5b19999a78588e96b58)
2001-11-16 21:32:32 +03:00
adding some debugs while tracking down a bug (This used to be commit 627ff578613b8762415cc03cbbaff68e70f96dbf)
2003-08-26 07:13:39 +04:00
DEBUG(5,("change_trust_account_password: Attempting to change trust account password in domain %s....\n",
domain));
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 18:09:03 +04:00
if (remote_machine == NULL || !strcmp(remote_machine, "*")) {
/* Use the PDC *only* for this */
if ( !get_pdc_ip(domain, &pdc_ip) ) {
DEBUG(0,("Can't get IP for PDC for domain %s\n", domain));
goto failed;
}
I *love* removing code :-). Removed 4 files that weren't being used. All this stuff was being pulled in due to *one* unneeded call to fetch a domain SID which smbpasswd already puts in the database... Jeremy. (This used to be commit 6bf2505cce7db770fd4db5b19999a78588e96b58)
2001-11-16 21:32:32 +03:00
large change: *) consolidates the dc location routines again (dns and netbios) get_dc_list() or get_sorted_dc_list() is the authoritative means of locating DC's again. (also inludes a flag to get_dc_list() to define if this should be a DNS only lookup or not) (however, if you set "name resolve order = hosts wins" you could still get DNS queries for domain name IFF ldap_domain2hostlist() fails. The answer? Fix your DNS setup) *) enabled DOMAIN<0x1c> lookups to be funneled through resolve_hosts resulting in a call to ldap_domain2hostlist() if lp_security() == SEC_ADS *) enables name cache for winbind ADS backend *) enable the negative connection cache for winbind ADS backend *) removes some old dead code *) consolidates some duplicate code *) moves the internal_name_resolve() to use an IP/port pair to deal with SRV RR dns replies. The namecache code also supports the IP:port syntax now as well. *) removes 'ads server' and moves the functionality back into 'password server' (which can support "hostname:port" syntax now but works fine with defaults depending on the value of lp_security()) (This used to be commit d7f7fcda425bef380441509734eca33da943c091)
2003-06-25 21:41:05 +04:00
if ( !name_status_find( domain, 0x1b, 0x20, pdc_ip, dc_name) )
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 18:09:03 +04:00
goto failed;
Fix for bug #273 - smbd crash on machine account change. Someone only half changed the code to use dc_name instead of remote machine... Found via back trace from Dariush Forouher <dariush@forouher.de>. Jeremy. (This used to be commit 963b24ac1a721a8b0d348b578f25b1d8cb7e2124)
2003-09-10 22:34:57 +04:00
} else {
/* supoport old deprecated "smbpasswd -j DOMAIN -r MACHINE" behavior */
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 18:09:03 +04:00
fstrcpy( dc_name, remote_machine );
}
/* if this next call fails, then give up. We can't do
password changes on BDC's --jerry */
Fix for bug #273 - smbd crash on machine account change. Someone only half changed the code to use dc_name instead of remote machine... Found via back trace from Dariush Forouher <dariush@forouher.de>. Jeremy. (This used to be commit 963b24ac1a721a8b0d348b578f25b1d8cb7e2124)
2003-09-10 22:34:57 +04:00
if (!NT_STATUS_IS_OK(cli_full_connection(&cli, global_myname(), dc_name,
updated the 3.0 branch from the head branch - ready for alpha18 (This used to be commit 03ac082dcb375b6f3ca3d810a6a6367542bc23ce)
2002-07-15 14:35:28 +04:00
NULL, 0,
OK. Smbpasswd -j is DEAD. This moves the rest of the functionality into the 'net rpc join' code. Futhermore, this moves that entire area over to the libsmb codebase, rather than the crufty old rpc_client stuff. I have also fixed up the smbpasswd -a -m bug in the process. We also have a new 'net rpc changetrustpw' that can be called from a cron-job to regularly change the trust account password, for sites that run winbind but not smbd. With a little more work, we can kill rpc_client from smbd entirly! (It is mostly the domain auth stuff - which I can rework - and the spoolss stuff that sombody else will need to look over). Andrew Bartlett (This used to be commit 575897e879fc175ba702adf245384033342c903d)
2001-12-05 14:00:26 +03:00
"IPC$", "IPC",
"", "",
Fix for bug #273 - smbd crash on machine account change. Someone only half changed the code to use dc_name instead of remote machine... Found via back trace from Dariush Forouher <dariush@forouher.de>. Jeremy. (This used to be commit 963b24ac1a721a8b0d348b578f25b1d8cb7e2124)
2003-09-10 22:34:57 +04:00
"", 0, Undefined, NULL))) {
DEBUG(0,("modify_trust_password: Connection to %s failed!\n", dc_name));
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 18:09:03 +04:00
nt_status = NT_STATUS_UNSUCCESSFUL;
goto failed;
merges from HEAD - change_trust_account_password() must always talk to PDC (This used to be commit af2fa4385015dce8dedafe80e02a0115892e508e)
2002-12-04 23:57:48 +03:00
}
OK. Smbpasswd -j is DEAD. This moves the rest of the functionality into the 'net rpc join' code. Futhermore, this moves that entire area over to the libsmb codebase, rather than the crufty old rpc_client stuff. I have also fixed up the smbpasswd -a -m bug in the process. We also have a new 'net rpc changetrustpw' that can be called from a cron-job to regularly change the trust account password, for sites that run winbind but not smbd. With a little more work, we can kill rpc_client from smbd entirly! (It is mostly the domain auth stuff - which I can rework - and the spoolss stuff that sombody else will need to look over). Andrew Bartlett (This used to be commit 575897e879fc175ba702adf245384033342c903d)
2001-12-05 14:00:26 +03:00
merges from HEAD - change_trust_account_password() must always talk to PDC (This used to be commit af2fa4385015dce8dedafe80e02a0115892e508e)
2002-12-04 23:57:48 +03:00
/*
* Ok - we have an anonymous connection to the IPC$ share.
* Now start the NT Domain stuff :-).
*/
r10656: BIG merge from trunk. Features not copied over * \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck) (This used to be commit 939c3cb5d78e3a2236209b296aa8aba8bdce32d3)
2005-09-30 21:13:37 +04:00
/* Shouldn't we open this with schannel ? JRA. */
netlogon_pipe = cli_rpc_pipe_open_noauth(cli, PI_NETLOGON, &nt_status);
if (!netlogon_pipe) {
merges from HEAD - change_trust_account_password() must always talk to PDC (This used to be commit af2fa4385015dce8dedafe80e02a0115892e508e)
2002-12-04 23:57:48 +03:00
DEBUG(0,("modify_trust_password: unable to open the domain client session to machine %s. Error was : %s.\n",
r10656: BIG merge from trunk. Features not copied over * \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck) (This used to be commit 939c3cb5d78e3a2236209b296aa8aba8bdce32d3)
2005-09-30 21:13:37 +04:00
dc_name, nt_errstr(nt_status)));
merges from HEAD - change_trust_account_password() must always talk to PDC (This used to be commit af2fa4385015dce8dedafe80e02a0115892e508e)
2002-12-04 23:57:48 +03:00
cli_shutdown(cli);
r16945: Sync trunk -> 3.0 for 3.0.24 code. Still need to do the upper layer directories but this is what everyone is waiting for.... Jeremy. (This used to be commit 9dafb7f48ca3e7af956b0a7d1720c2546fc4cfb8)
2006-07-11 22:01:26 +04:00
cli = NULL;
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 18:09:03 +04:00
goto failed;
merges from HEAD - change_trust_account_password() must always talk to PDC (This used to be commit af2fa4385015dce8dedafe80e02a0115892e508e)
2002-12-04 23:57:48 +03:00
}
r10656: BIG merge from trunk. Features not copied over * \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck) (This used to be commit 939c3cb5d78e3a2236209b296aa8aba8bdce32d3)
2005-09-30 21:13:37 +04:00
nt_status = trust_pw_find_change_and_store_it(netlogon_pipe, cli->mem_ctx, domain);
OK. Smbpasswd -j is DEAD. This moves the rest of the functionality into the 'net rpc join' code. Futhermore, this moves that entire area over to the libsmb codebase, rather than the crufty old rpc_client stuff. I have also fixed up the smbpasswd -a -m bug in the process. We also have a new 'net rpc changetrustpw' that can be called from a cron-job to regularly change the trust account password, for sites that run winbind but not smbd. With a little more work, we can kill rpc_client from smbd entirly! (It is mostly the domain auth stuff - which I can rework - and the spoolss stuff that sombody else will need to look over). Andrew Bartlett (This used to be commit 575897e879fc175ba702adf245384033342c903d)
2001-12-05 14:00:26 +03:00
merges from HEAD - change_trust_account_password() must always talk to PDC (This used to be commit af2fa4385015dce8dedafe80e02a0115892e508e)
2002-12-04 23:57:48 +03:00
cli_shutdown(cli);
r16945: Sync trunk -> 3.0 for 3.0.24 code. Still need to do the upper layer directories but this is what everyone is waiting for.... Jeremy. (This used to be commit 9dafb7f48ca3e7af956b0a7d1720c2546fc4cfb8)
2006-07-11 22:01:26 +04:00
cli = NULL;
merges from HEAD - change_trust_account_password() must always talk to PDC (This used to be commit af2fa4385015dce8dedafe80e02a0115892e508e)
2002-12-04 23:57:48 +03:00
failed:
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 18:09:03 +04:00
if (!NT_STATUS_IS_OK(nt_status)) {
merges from HEAD - change_trust_account_password() must always talk to PDC (This used to be commit af2fa4385015dce8dedafe80e02a0115892e508e)
2002-12-04 23:57:48 +03:00
DEBUG(0,("%s : change_trust_account_password: Failed to change password for domain %s.\n",
r16945: Sync trunk -> 3.0 for 3.0.24 code. Still need to do the upper layer directories but this is what everyone is waiting for.... Jeremy. (This used to be commit 9dafb7f48ca3e7af956b0a7d1720c2546fc4cfb8)
2006-07-11 22:01:26 +04:00
current_timestring(False), domain));
merges from HEAD - change_trust_account_password() must always talk to PDC (This used to be commit af2fa4385015dce8dedafe80e02a0115892e508e)
2002-12-04 23:57:48 +03:00
}
adding some debugs while tracking down a bug (This used to be commit 627ff578613b8762415cc03cbbaff68e70f96dbf)
2003-08-26 07:13:39 +04:00
else
DEBUG(5,("change_trust_account_password: sucess!\n"));
OK. Smbpasswd -j is DEAD. This moves the rest of the functionality into the 'net rpc join' code. Futhermore, this moves that entire area over to the libsmb codebase, rather than the crufty old rpc_client stuff. I have also fixed up the smbpasswd -a -m bug in the process. We also have a new 'net rpc changetrustpw' that can be called from a cron-job to regularly change the trust account password, for sites that run winbind but not smbd. With a little more work, we can kill rpc_client from smbd entirly! (It is mostly the domain auth stuff - which I can rework - and the spoolss stuff that sombody else will need to look over). Andrew Bartlett (This used to be commit 575897e879fc175ba702adf245384033342c903d)
2001-12-05 14:00:26 +03:00
Merge from HEAD - save the type of channel used to contact the DC. This allows us to join as a BDC, without appearing on the network as one until we have the database replicated, and the admin changes the configuration. This also change the SID retreval order from secrets.tdb, so we no longer require a 'net rpc getsid' - the sid fetch during the domain join is sufficient. Also minor fixes to 'net'. Andrew Bartlett (This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
2003-04-21 18:09:03 +04:00
return nt_status;
Broke out change trust account password routines into separate file since they're only used in one place anyway (timeout_processing() in process.c) (This used to be commit d1e5d5d62fcb5da30e3f2619721c5146db753f3c)
2001-05-17 06:52:45 +04:00
}
Copy Permalink