sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-12 09:18:10 +03:00
Code

merges from HEAD - change_trust_account_password() must always talk to PDC

Browse Source 
(This used to be commit af2fa43850)
This commit is contained in:
Gerald Carter 2002-12-04 20:57:48 +00:00
parent b0504a9526
commit 612e1ffdba
2 changed files with 74 additions and 82 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

150
source3/smbd/change_trust_pw.c
View File

@ -31,106 +31,98 @@
static NTSTATUS modify_trust_password( const char *domain, const char *remote_machine,
unsigned char orig_trust_passwd_hash[16])
{
struct cli_state *cli;
DOM_SID domain_sid;
NTSTATUS nt_status;
struct cli_state *cli;
DOM_SID domain_sid;
NTSTATUS nt_status;
/*
* Ensure we have the domain SID for this domain.
*/
/*
* Ensure we have the domain SID for this domain.
*/
if (!secrets_fetch_domain_sid(domain, &domain_sid)) {
DEBUG(0, ("modify_trust_password: unable to fetch domain sid.\n"));
return NT_STATUS_UNSUCCESSFUL;
}
if (!secrets_fetch_domain_sid(domain, &domain_sid)) {
DEBUG(0, ("modify_trust_password: unable to fetch domain sid.\n"));
return NT_STATUS_UNSUCCESSFUL;
}
if (!NT_STATUS_IS_OK(cli_full_connection(&cli, global_myname(), remote_machine,
if (!NT_STATUS_IS_OK(cli_full_connection(&cli, global_myname(), remote_machine,
NULL, 0,
"IPC$", "IPC",
"", "",
"", 0, NULL))) {
DEBUG(0,("modify_trust_password: Connection to %s failed!\n", remote_machine));
return NT_STATUS_UNSUCCESSFUL;
}
"", 0, NULL)))
{
DEBUG(0,("modify_trust_password: Connection to %s failed!\n", remote_machine));
return NT_STATUS_UNSUCCESSFUL;
}
/*
* Ok - we have an anonymous connection to the IPC$ share.
* Now start the NT Domain stuff :-).
*/
/*
* Ok - we have an anonymous connection to the IPC$ share.
* Now start the NT Domain stuff :-).
*/
if(cli_nt_session_open(cli, PI_NETLOGON) == False) {
DEBUG(0,("modify_trust_password: unable to open the domain client session to \
machine %s. Error was : %s.\n", remote_machine, cli_errstr(cli)));
cli_nt_session_close(cli);
cli_ulogoff(cli);
cli_shutdown(cli);
return NT_STATUS_UNSUCCESSFUL;
}
if(cli_nt_session_open(cli, PI_NETLOGON) == False) {
DEBUG(0,("modify_trust_password: unable to open the domain client session to machine %s. Error was : %s.\n",
remote_machine, cli_errstr(cli)));
cli_nt_session_close(cli);
cli_ulogoff(cli);
cli_shutdown(cli);
return NT_STATUS_UNSUCCESSFUL;
}
nt_status = trust_pw_change_and_store_it(cli, cli->mem_ctx,
nt_status = trust_pw_change_and_store_it(cli, cli->mem_ctx,
orig_trust_passwd_hash);
cli_nt_session_close(cli);
cli_ulogoff(cli);
cli_shutdown(cli);
return nt_status;
cli_nt_session_close(cli);
cli_ulogoff(cli);
cli_shutdown(cli);
return nt_status;
}
/************************************************************************
Change the trust account password for a domain.
************************************************************************/
NTSTATUS change_trust_account_password( const char *domain, const char *remote_machine_list)
NTSTATUS change_trust_account_password( const char *domain, const char *remote_machine)
{
fstring remote_machine;
unsigned char old_trust_passwd_hash[16];
time_t lct;
NTSTATUS res = NT_STATUS_UNSUCCESSFUL;
unsigned char old_trust_passwd_hash[16];
time_t lct;
NTSTATUS res = NT_STATUS_UNSUCCESSFUL;
struct in_addr pdc_ip;
fstring dc_name;
if(!secrets_fetch_trust_account_password(domain, old_trust_passwd_hash, &lct)) {
DEBUG(0,("change_trust_account_password: unable to read the machine \
account password for domain %s.\n", domain));
return NT_STATUS_UNSUCCESSFUL;
}
while(remote_machine_list &&
next_token(&remote_machine_list, remote_machine,
LIST_SEP, sizeof(remote_machine))) {
strupper(remote_machine);
if(strequal(remote_machine, "*")) {
if(!secrets_fetch_trust_account_password(domain, old_trust_passwd_hash, &lct)) {
DEBUG(0,("change_trust_account_password: unable to read the machine account password for domain %s.\n",
domain));
return NT_STATUS_UNSUCCESSFUL;
}
/*
* We have been asked to dynamcially determine the IP addresses of the PDC.
*/
if (remote_machine == NULL || !strcmp(remote_machine, "*")) {
/* Use the PDC *only* for this */
if ( !get_pdc_ip(domain, &pdc_ip) ) {
DEBUG(0,("Can't get IP for PDC for domain %s\n", domain));
goto failed;
}
struct in_addr pdc_ip;
fstring dc_name;
/* Use the PDC *only* for this. */
if(!get_pdc_ip(domain, &pdc_ip))
continue;
/*
* Try and connect to the PDC/BDC list in turn as an IP
* address used as a string.
*/
if(!lookup_dc_name(global_myname(), domain, &pdc_ip, dc_name))
continue;
if(NT_STATUS_IS_OK(res = modify_trust_password( domain, dc_name,
old_trust_passwd_hash)))
break;
} else {
res = modify_trust_password( domain, remote_machine,
old_trust_passwd_hash);
}
}
if (!NT_STATUS_IS_OK(res)) {
DEBUG(0,("%s : change_trust_account_password: Failed to change password for \
domain %s.\n", timestring(False), domain));
}
if ( !lookup_dc_name(global_myname(), domain, &pdc_ip, dc_name) )
goto failed;
}
/* supoport old deprecated "smbpasswd -j DOMAIN -r MACHINE" behavior */
else {
fstrcpy( dc_name, remote_machine );
}
/* if this next call fails, then give up. We can't do
password changes on BDC's --jerry */
res = modify_trust_password(domain, dc_name, old_trust_passwd_hash);
failed:
if (!NT_STATUS_IS_OK(res)) {
DEBUG(0,("%s : change_trust_account_password: Failed to change password for domain %s.\n",
timestring(False), domain));
}
return res;
return res;
}

6
source3/smbd/process.c
View File

@ -1175,9 +1175,9 @@ machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
return True;
}
pstrcpy(remote_machine_list, lp_passwordserver());
change_trust_account_password( lp_workgroup(), remote_machine_list);
/* always just contact the PDC here */
change_trust_account_password( lp_workgroup(), NULL);
global_machine_password_needs_changing = False;
secrets_lock_trust_account_password(lp_workgroup(), False);
}