sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-27 14:04:05 +03:00
Code

r2137: This is a patch I've been running at Hawker for a while.

Browse Source 
The purpose of this patch is to avoid changing the machine account
password, when it has 'already been changed'.  This occours in
situations where the secure channel between the workstation and the DC
breaks down, such as occoured in the MS04-11 security patch.  This
avoids LDAP replication load issues, due to the client changing the
password repeatedly.

We also now set the LM password to NULL explicitly, rather than the NT
password value, as this is what we get out of a vampire, or when a
long password is set (as XP seems to do these days).

Andrew Bartlett
This commit is contained in:
Andrew Bartlett 2004-08-31 19:56:16 +00:00 committed by Gerald (Jerry) Carter
parent 8ae57a8e8d
commit 1ad1317a81
1 changed files with 29 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
source/rpc_server/srv_netlog_nt.c
View File

@ -445,6 +445,7 @@ NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *
unsigned char pwd[16];
int i;
uint32 acct_ctrl;
const uchar *old_pw;
/* checks and updates credentials. creates reply credentials */
if (!(p->dc.authenticated && deal_with_creds(p->dc.sess_key, &p->dc.clnt_cred, &q_u->clnt_id.cred, &srv_cred)))
@ -482,34 +483,43 @@ NTSTATUS _net_srv_pwset(pipes_struct *p, NET_Q_SRV_PWSET *q_u, NET_R_SRV_PWSET *
return NT_STATUS_ACCOUNT_DISABLED;
}
cred_hash3( pwd, q_u->pwd, p->dc.sess_key, 0);
DEBUG(100,("Server password set : new given value was :\n"));
for(i = 0; i < 16; i++)
DEBUG(100,("%02X ", q_u->pwd[i]));
DEBUG(100,("\n"));
cred_hash3( pwd, q_u->pwd, p->dc.sess_key, 0);
old_pw = pdb_get_nt_passwd(sampass);
/* lies! nt and lm passwords are _not_ the same: don't care */
if (!pdb_set_lanman_passwd (sampass, pwd, PDB_CHANGED)) {
pdb_free_sam(&sampass);
return NT_STATUS_NO_MEMORY;
}
if (old_pw && memcmp(pwd, old_pw, 16) == 0) {
/* Avoid backend modificiations and other fun if the
client changed the password to the *same thing* */
if (!pdb_set_nt_passwd (sampass, pwd, PDB_CHANGED)) {
pdb_free_sam(&sampass);
return NT_STATUS_NO_MEMORY;
}
ret = True;
} else {
if (!pdb_set_pass_changed_now (sampass)) {
pdb_free_sam(&sampass);
/* Not quite sure what this one qualifies as, but this will do */
return NT_STATUS_UNSUCCESSFUL;
/* LM password should be NULL for machines */
if (!pdb_set_lanman_passwd (sampass, NULL, PDB_CHANGED)) {
pdb_free_sam(&sampass);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_nt_passwd (sampass, pwd, PDB_CHANGED)) {
pdb_free_sam(&sampass);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_pass_changed_now (sampass)) {
pdb_free_sam(&sampass);
/* Not quite sure what this one qualifies as, but this will do */
return NT_STATUS_UNSUCCESSFUL;
}
become_root();
ret = pdb_update_sam_account (sampass);
unbecome_root();
}
become_root();
ret = pdb_update_sam_account (sampass);
unbecome_root();
if (ret)
status = NT_STATUS_OK;