sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-22 05:57:43 +03:00
Code

Modify winbindd to use authenticated user info from secrets.tdb when making

Browse Source 
IPC$ connections to domain controllers.
(This used to be commit 1217ef28a6c18c085fcb2eac3bf04866c166d959)
This commit is contained in:
Tim Potter 2001-12-11 05:19:15 +00:00
parent f4dfa9b6b2
commit 6cc5e2edc1
3 changed files with 39 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
source3/Makefile.in
View File

@ -439,7 +439,8 @@ WINBINDD_OBJ = \
$(GROUPDB_OBJ) $(PROFILE_OBJ) \
$(NECESSARY_BECAUSE_SAMBA_DEPENDENCIES_ARE_SO_BROKEN_OBJ)
WBINFO_OBJ = nsswitch/wbinfo.o libsmb/smbencrypt.o libsmb/smbdes.o
WBINFO_OBJ = nsswitch/wbinfo.o libsmb/smbencrypt.o libsmb/smbdes.o \
passdb/secrets.o
WINBIND_NSS_OBJ = nsswitch/winbind_nss.o nsswitch/wb_common.o
@ -713,10 +714,11 @@ nsswitch/pam_winbind.so: $(PAM_WINBIND_OBJ) bin/.dummy
@echo Linking $@
@$(LINK) $(LDSHFLAGS) -o $@ $(PAM_WINBIND_OBJ)
bin/wbinfo: $(WBINFO_OBJ) $(PARAM_OBJ) $(LIB_OBJ) $(NOPROTO_OBJ) $(UBIQX_OBJ) bin/.dummy
bin/wbinfo: $(WBINFO_OBJ) $(PARAM_OBJ) $(LIB_OBJ) $(NOPROTO_OBJ) \
$(UBIQX_OBJ) @BUILD_POPT@ bin/.dummy
@echo Linking $@
@$(LINK) -o $@ $(WBINFO_OBJ) $(PARAM_OBJ) $(LIB_OBJ) $(NOPROTO_OBJ) \
$(UBIQX_OBJ) $(LIBS)
$(UBIQX_OBJ) $(LIBS) @BUILD_POPT@
bin/pam_smbpass.@SHLIBEXT@: $(PAM_SMBPASS_PICOOBJ)
@echo "Linking shared library $@"

5
source3/nsswitch/winbindd.h
View File

@ -194,4 +194,9 @@ typedef struct {
#define SETENV(name, value, overwrite) ;
#endif
/* Authenticated user info is stored in secrets.tdb under these keys */
#define SECRETS_AUTH_USER "SECRETS/AUTH_USER"
#define SECRETS_AUTH_PASSWORD "SECRETS/AUTH_PASSWORD"
#endif /* _WINBINDD_H */

31
source3/nsswitch/winbindd_cm.c
View File

@ -182,6 +182,34 @@ static BOOL cm_get_dc_name(char *domain, fstring srv_name)
return True;
}
/* Choose between anonymous or authenticated connections. We need to use
an authenticated connection if DCs have the RestrictAnonymous registry
entry set > 0, or the "Additional restrictions for anonymous
connections" set in the win2k Local Security Policy. */
void cm_init_creds(struct ntuser_creds *creds)
{
char *username, *password;
ZERO_STRUCTP(creds);
creds->pwd.null_pwd = True; /* anonymoose */
username = secrets_fetch(SECRETS_AUTH_USER, NULL);
password = secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
if (username && *username) {
pwd_set_cleartext(&creds->pwd, password);
fstrcpy(creds->user_name, username);
fstrcpy(creds->domain, lp_workgroup());
DEBUG(3, ("IPC$ connections done %s\\%s\n", creds->domain,
creds->user_name));
} else
DEBUG(3, ("IPC$ connections done anonymously\n"));
}
/* Open a new smb pipe connection to a DC on a given domain. Cache
negative creation attempts so we don't try and connect to broken
machines too often. */
@ -257,8 +285,7 @@ static BOOL cm_open_connection(char *domain, char *pipe_name,
make_nmb_name(&called, dns_to_netbios_name(new_conn->controller), 0x20);
make_nmb_name(&calling, dns_to_netbios_name(global_myname), 0);
ZERO_STRUCT(creds);
creds.pwd.null_pwd = 1;
cm_init_creds(&creds);
cli_init_creds(new_conn->cli, &creds);