mirror of
https://github.com/samba-team/samba.git
synced 2024-12-25 23:21:54 +03:00
Updating pampass from Samba-2.2 code tree. ===> JHT
This commit is contained in:
John Terpstra
parent
9dd77c4fb1
commit
88b6043b4e
@ -56,7 +56,7 @@ static char *PAM_password;
|
||||
#define COPY_STRING(s) (s) ? strdup(s) : NULL
|
||||
|
||||
/*
|
||||
* Macro converted to a function to simplyify this thing
|
||||
* PAM error handler.
|
||||
*/
|
||||
static BOOL pam_error_handler(pam_handle_t *pamh, int pam_error, char *msg, int dbglvl)
|
||||
{
|
||||
@ -65,7 +65,7 @@ static BOOL pam_error_handler(pam_handle_t *pamh, int pam_error, char *msg, int
|
||||
|
||||
if( pam_error != PAM_SUCCESS)
|
||||
{
|
||||
DEBUG(dbglvl, ("PAM %s: %s\n", pam_strerror(pamh, pam_error)));
|
||||
DEBUG(dbglvl, ("PAM: %s : %s\n", msg, pam_strerror(pamh, pam_error)));
|
||||
return False;
|
||||
}
|
||||
return True;
|
||||
@ -132,6 +132,9 @@ static struct pam_conv PAM_conversation = {
|
||||
NULL
|
||||
};
|
||||
|
||||
/*
|
||||
* PAM Closing out cleanup handler
|
||||
*/
|
||||
static BOOL proc_pam_end(pam_handle_t *pamh)
|
||||
{
|
||||
int pam_error;
|
||||
@ -140,38 +143,66 @@ static BOOL proc_pam_end(pam_handle_t *pamh)
|
||||
{
|
||||
pam_error = pam_end(pamh, 0);
|
||||
if(pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
|
||||
DEBUG(4, ("PAM: PAM_END OK.\n"));
|
||||
return True;
|
||||
}
|
||||
}
|
||||
DEBUG(2,("PAM not initialised"));
|
||||
DEBUG(2,("PAM: not initialised"));
|
||||
return False;
|
||||
}
|
||||
|
||||
|
||||
static BOOL pam_auth(char *user, char *password)
|
||||
/*
|
||||
* Start PAM authentication for specified account
|
||||
*/
|
||||
static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
|
||||
{
|
||||
int pam_error;
|
||||
char * rhost;
|
||||
|
||||
DEBUG(4,("PAM: Init user: %s\n", user));
|
||||
|
||||
pam_error = pam_start("samba", user, &PAM_conversation, pamh);
|
||||
if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
|
||||
rhost = client_name();
|
||||
if (strcmp(rhost,"UNKNOWN") == 0)
|
||||
rhost = client_addr();
|
||||
|
||||
#ifdef PAM_RHOST
|
||||
DEBUG(4,("PAM: setting rhost to: %s\n", rhost));
|
||||
pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
|
||||
if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
#endif
|
||||
#ifdef PAM_TTY
|
||||
pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
|
||||
if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
#endif
|
||||
DEBUG(4,("PAM: Init passed for user: %s\n", user));
|
||||
return True;
|
||||
}
|
||||
|
||||
/*
|
||||
* PAM Authentication Handler
|
||||
*/
|
||||
static BOOL pam_auth(pam_handle_t *pamh, char *user, char *password)
|
||||
{
|
||||
pam_handle_t *pamh;
|
||||
int pam_error;
|
||||
|
||||
/*
|
||||
* Now use PAM to do authentication. Bail out if there are any
|
||||
* errors.
|
||||
*/
|
||||
|
||||
PAM_password = password;
|
||||
PAM_username = user;
|
||||
DEBUG(4,("PAM Start for User: %s\n", user));
|
||||
pam_error = pam_start("samba", user, &PAM_conversation, &pamh);
|
||||
if(!pam_error_handler(pamh, pam_error, "start failure", 2)) {
|
||||
proc_pam_end(pamh);
|
||||
return False;
|
||||
}
|
||||
|
||||
/*
|
||||
* To enable debugging set in /etc/pam.d/samba:
|
||||
* auth required /lib/security/pam_pwdb.so nullok shadow audit
|
||||
*/
|
||||
|
||||
DEBUG(4,("PAM: Authenticate User: %s\n", user));
|
||||
pam_error = pam_authenticate(pamh, PAM_SILENT); /* Can we authenticate user? */
|
||||
switch( pam_error ){
|
||||
case PAM_AUTH_ERR:
|
||||
@ -199,10 +230,18 @@ static BOOL pam_auth(char *user, char *password)
|
||||
proc_pam_end(pamh);
|
||||
return False;
|
||||
}
|
||||
/* If this point is reached, the user has been authenticated. */
|
||||
return (True);
|
||||
}
|
||||
|
||||
/*
|
||||
* Now do account management control and validation
|
||||
*/
|
||||
/*
|
||||
* PAM Account Handler
|
||||
*/
|
||||
static BOOL pam_account(pam_handle_t *pamh, char * user, char * password)
|
||||
{
|
||||
int pam_error;
|
||||
|
||||
DEBUG(4,("PAM: Account Management for User: %s\n", user));
|
||||
pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
|
||||
switch( pam_error ) {
|
||||
case PAM_AUTHTOK_EXPIRED:
|
||||
@ -218,7 +257,7 @@ static BOOL pam_auth(char *user, char *password)
|
||||
DEBUG(0, ("PAM: User is NOT permitted to access system at this time\n"));
|
||||
break;
|
||||
case PAM_USER_UNKNOWN:
|
||||
DEBUG(2, ("PAM: User \"%s\" is NOT known to account management\n", user));
|
||||
DEBUG(0, ("PAM: User \"%s\" is NOT known to account management\n", user));
|
||||
break;
|
||||
default:
|
||||
DEBUG(4, ("PAM: Account OK for User: %s\n", user));
|
||||
@ -239,54 +278,15 @@ static BOOL pam_auth(char *user, char *password)
|
||||
return False;
|
||||
}
|
||||
|
||||
if( !proc_pam_end(pamh))
|
||||
return False;
|
||||
|
||||
/* If this point is reached, the user has been authenticated. */
|
||||
DEBUG(4, ("PAM: pam_authentication passed for User: %s\n", user));
|
||||
return (True);
|
||||
}
|
||||
|
||||
#if NOTBLOCKEDOUT
|
||||
/* Start PAM authentication for specified account */
|
||||
static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
|
||||
{
|
||||
int pam_error;
|
||||
char * rhost;
|
||||
|
||||
DEBUG(4,("PAM Init for user: %s\n", user));
|
||||
|
||||
pam_error = pam_start("samba", user, &PAM_conversation, pamh);
|
||||
if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
|
||||
rhost = client_name();
|
||||
if (strcmp(rhost,"UNKNOWN") == 0)
|
||||
rhost = client_addr();
|
||||
|
||||
#ifdef PAM_RHOST
|
||||
DEBUG(4,("PAM setting rhost to: %s\n", rhost));
|
||||
pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
|
||||
if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
#endif
|
||||
|
||||
#if defined(PAM_TTY_KLUDGE) && defined(PAM_TTY)
|
||||
pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
|
||||
if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
#endif
|
||||
|
||||
return True;
|
||||
}
|
||||
|
||||
static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance)
|
||||
/*
|
||||
* PAM Internal Session Handler
|
||||
*/
|
||||
static BOOL proc_pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL flag)
|
||||
{
|
||||
int pam_error;
|
||||
|
||||
@ -294,7 +294,7 @@ static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance
|
||||
PAM_username = user;
|
||||
|
||||
#ifdef PAM_TTY
|
||||
DEBUG(4,("PAM tty set to: %s\"\n", tty));
|
||||
DEBUG(4,("PAM: tty set to: %s\n", tty));
|
||||
pam_error = pam_set_item(pamh, PAM_TTY, tty);
|
||||
if (!pam_error_handler(pamh, pam_error, "set tty failed", 0)) {
|
||||
proc_pam_end(pamh);
|
||||
@ -302,7 +302,7 @@ static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance
|
||||
}
|
||||
#endif
|
||||
|
||||
if (instance) {
|
||||
if (flag) {
|
||||
pam_error = pam_open_session(pamh, PAM_SILENT);
|
||||
if (!pam_error_handler(pamh, pam_error, "session setup failed", 0)) {
|
||||
proc_pam_end(pamh);
|
||||
@ -320,72 +320,23 @@ static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance
|
||||
return (True);
|
||||
}
|
||||
|
||||
static BOOL pam_account(pam_handle_t *pamh, char *user)
|
||||
/*
|
||||
* PAM Externally accessible Session handler
|
||||
*/
|
||||
BOOL pam_session(BOOL flag, const connection_struct *conn, char *tty)
|
||||
{
|
||||
int pam_error;
|
||||
|
||||
PAM_password = NULL;
|
||||
PAM_username = user;
|
||||
|
||||
DEBUG(4,("PAM starting account management for user: %s \n", user));
|
||||
|
||||
pam_error = pam_acct_mgmt(pamh, PAM_SILENT);
|
||||
if (!pam_error_handler(pamh, pam_error, "PAM set account management failed", 0)) {
|
||||
proc_pam_end(pamh);
|
||||
return False;
|
||||
} else {
|
||||
DEBUG(4,("PAM account management passed\n"));
|
||||
}
|
||||
|
||||
/*
|
||||
* This will allow samba to aquire a kerberos token. And, when
|
||||
* exporting an AFS cell, be able to /write/ to this cell.
|
||||
*/
|
||||
pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED));
|
||||
if (!pam_error_handler(pamh, pam_error, "set credentials failed\n", 0)) {
|
||||
proc_pam_end(pamh);
|
||||
return False;
|
||||
}
|
||||
|
||||
/* If this point is reached, the user has been authenticated. */
|
||||
return (True);
|
||||
}
|
||||
static BOOL account_pam(char *user)
|
||||
{
|
||||
/*
|
||||
* Check the account with the PAM account module:
|
||||
* - This means that accounts can be disabled
|
||||
* and or expired with avoidance of samba then just
|
||||
* bypassing the situation.
|
||||
*/
|
||||
|
||||
pam_handle_t *pamh = NULL;
|
||||
char * PAMuser;
|
||||
|
||||
PAMuser = malloc(strlen(user)+1);
|
||||
/* This is freed by PAM */
|
||||
strncpy(PAMuser, user, strlen(user)+1);
|
||||
|
||||
if (proc_pam_start(&pamh, PAMuser))
|
||||
{
|
||||
if (pam_account(pamh, PAMuser))
|
||||
{
|
||||
return proc_pam_end(pamh);
|
||||
}
|
||||
}
|
||||
proc_pam_end(pamh);
|
||||
return False;
|
||||
}
|
||||
|
||||
BOOL PAM_session(BOOL instance, const connection_struct *conn, char *tty)
|
||||
{
|
||||
pam_handle_t *pamh=NULL;
|
||||
pam_handle_t *pamh = NULL;
|
||||
char * user;
|
||||
|
||||
user = malloc(strlen(conn->user)+1);
|
||||
if ( user == NULL )
|
||||
{
|
||||
DEBUG(0, ("PAM: PAM_session Malloc Failed!\n"));
|
||||
return False;
|
||||
}
|
||||
|
||||
/* This is freed by PAM */
|
||||
strncpy(user, conn->user, strlen(conn->user)+1);
|
||||
StrnCpy(user, conn->user, strlen(conn->user)+1);
|
||||
|
||||
if (!proc_pam_start(&pamh, user))
|
||||
{
|
||||
@ -393,7 +344,7 @@ BOOL PAM_session(BOOL instance, const connection_struct *conn, char *tty)
|
||||
return False;
|
||||
}
|
||||
|
||||
if (pam_session(pamh, user, tty, instance))
|
||||
if (proc_pam_session(pamh, user, tty, flag))
|
||||
{
|
||||
return proc_pam_end(pamh);
|
||||
}
|
||||
@ -404,6 +355,9 @@ BOOL PAM_session(BOOL instance, const connection_struct *conn, char *tty)
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* PAM Password Validation Suite
|
||||
*/
|
||||
BOOL pam_passcheck(char * user, char * password)
|
||||
{
|
||||
pam_handle_t *pamh = NULL;
|
||||
@ -413,24 +367,18 @@ BOOL pam_passcheck(char * user, char * password)
|
||||
|
||||
if( proc_pam_start(&pamh, user))
|
||||
{
|
||||
if( pam_auth(user, password))
|
||||
if ( pam_auth(pamh, user, password))
|
||||
{
|
||||
if( account_pam(user))
|
||||
if ( pam_account(pamh, user, password))
|
||||
{
|
||||
return( proc_pam_end(pamh));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
proc_pam_end(pamh);
|
||||
DEBUG(0, ("PAM: System Validation Failed - Rejecting User!\n"));
|
||||
return( False );
|
||||
}
|
||||
#endif /* NOTBLOCKEDOUT */
|
||||
|
||||
BOOL pam_passcheck( char * user, char * password )
|
||||
{
|
||||
return( pam_auth( user, password ));
|
||||
|
||||
}
|
||||
#else
|
||||
|
||||
/* Do *NOT* make this function static. Doing so breaks the compile on gcc */
|
||||
|
||||
@ -56,7 +56,7 @@ static char *PAM_password;
|
||||
#define COPY_STRING(s) (s) ? strdup(s) : NULL
|
||||
|
||||
/*
|
||||
* Macro converted to a function to simplyify this thing
|
||||
* PAM error handler.
|
||||
*/
|
||||
static BOOL pam_error_handler(pam_handle_t *pamh, int pam_error, char *msg, int dbglvl)
|
||||
{
|
||||
@ -65,7 +65,7 @@ static BOOL pam_error_handler(pam_handle_t *pamh, int pam_error, char *msg, int
|
||||
|
||||
if( pam_error != PAM_SUCCESS)
|
||||
{
|
||||
DEBUG(dbglvl, ("PAM %s: %s\n", pam_strerror(pamh, pam_error)));
|
||||
DEBUG(dbglvl, ("PAM: %s : %s\n", msg, pam_strerror(pamh, pam_error)));
|
||||
return False;
|
||||
}
|
||||
return True;
|
||||
@ -132,6 +132,9 @@ static struct pam_conv PAM_conversation = {
|
||||
NULL
|
||||
};
|
||||
|
||||
/*
|
||||
* PAM Closing out cleanup handler
|
||||
*/
|
||||
static BOOL proc_pam_end(pam_handle_t *pamh)
|
||||
{
|
||||
int pam_error;
|
||||
@ -140,38 +143,66 @@ static BOOL proc_pam_end(pam_handle_t *pamh)
|
||||
{
|
||||
pam_error = pam_end(pamh, 0);
|
||||
if(pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
|
||||
DEBUG(4, ("PAM: PAM_END OK.\n"));
|
||||
return True;
|
||||
}
|
||||
}
|
||||
DEBUG(2,("PAM not initialised"));
|
||||
DEBUG(2,("PAM: not initialised"));
|
||||
return False;
|
||||
}
|
||||
|
||||
|
||||
static BOOL pam_auth(char *user, char *password)
|
||||
/*
|
||||
* Start PAM authentication for specified account
|
||||
*/
|
||||
static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
|
||||
{
|
||||
int pam_error;
|
||||
char * rhost;
|
||||
|
||||
DEBUG(4,("PAM: Init user: %s\n", user));
|
||||
|
||||
pam_error = pam_start("samba", user, &PAM_conversation, pamh);
|
||||
if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
|
||||
rhost = client_name();
|
||||
if (strcmp(rhost,"UNKNOWN") == 0)
|
||||
rhost = client_addr();
|
||||
|
||||
#ifdef PAM_RHOST
|
||||
DEBUG(4,("PAM: setting rhost to: %s\n", rhost));
|
||||
pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
|
||||
if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
#endif
|
||||
#ifdef PAM_TTY
|
||||
pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
|
||||
if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
#endif
|
||||
DEBUG(4,("PAM: Init passed for user: %s\n", user));
|
||||
return True;
|
||||
}
|
||||
|
||||
/*
|
||||
* PAM Authentication Handler
|
||||
*/
|
||||
static BOOL pam_auth(pam_handle_t *pamh, char *user, char *password)
|
||||
{
|
||||
pam_handle_t *pamh;
|
||||
int pam_error;
|
||||
|
||||
/*
|
||||
* Now use PAM to do authentication. Bail out if there are any
|
||||
* errors.
|
||||
*/
|
||||
|
||||
PAM_password = password;
|
||||
PAM_username = user;
|
||||
DEBUG(4,("PAM Start for User: %s\n", user));
|
||||
pam_error = pam_start("samba", user, &PAM_conversation, &pamh);
|
||||
if(!pam_error_handler(pamh, pam_error, "start failure", 2)) {
|
||||
proc_pam_end(pamh);
|
||||
return False;
|
||||
}
|
||||
|
||||
/*
|
||||
* To enable debugging set in /etc/pam.d/samba:
|
||||
* auth required /lib/security/pam_pwdb.so nullok shadow audit
|
||||
*/
|
||||
|
||||
DEBUG(4,("PAM: Authenticate User: %s\n", user));
|
||||
pam_error = pam_authenticate(pamh, PAM_SILENT); /* Can we authenticate user? */
|
||||
switch( pam_error ){
|
||||
case PAM_AUTH_ERR:
|
||||
@ -199,10 +230,18 @@ static BOOL pam_auth(char *user, char *password)
|
||||
proc_pam_end(pamh);
|
||||
return False;
|
||||
}
|
||||
/* If this point is reached, the user has been authenticated. */
|
||||
return (True);
|
||||
}
|
||||
|
||||
/*
|
||||
* Now do account management control and validation
|
||||
*/
|
||||
/*
|
||||
* PAM Account Handler
|
||||
*/
|
||||
static BOOL pam_account(pam_handle_t *pamh, char * user, char * password)
|
||||
{
|
||||
int pam_error;
|
||||
|
||||
DEBUG(4,("PAM: Account Management for User: %s\n", user));
|
||||
pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
|
||||
switch( pam_error ) {
|
||||
case PAM_AUTHTOK_EXPIRED:
|
||||
@ -218,7 +257,7 @@ static BOOL pam_auth(char *user, char *password)
|
||||
DEBUG(0, ("PAM: User is NOT permitted to access system at this time\n"));
|
||||
break;
|
||||
case PAM_USER_UNKNOWN:
|
||||
DEBUG(2, ("PAM: User \"%s\" is NOT known to account management\n", user));
|
||||
DEBUG(0, ("PAM: User \"%s\" is NOT known to account management\n", user));
|
||||
break;
|
||||
default:
|
||||
DEBUG(4, ("PAM: Account OK for User: %s\n", user));
|
||||
@ -239,54 +278,15 @@ static BOOL pam_auth(char *user, char *password)
|
||||
return False;
|
||||
}
|
||||
|
||||
if( !proc_pam_end(pamh))
|
||||
return False;
|
||||
|
||||
/* If this point is reached, the user has been authenticated. */
|
||||
DEBUG(4, ("PAM: pam_authentication passed for User: %s\n", user));
|
||||
return (True);
|
||||
}
|
||||
|
||||
#if NOTBLOCKEDOUT
|
||||
/* Start PAM authentication for specified account */
|
||||
static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
|
||||
{
|
||||
int pam_error;
|
||||
char * rhost;
|
||||
|
||||
DEBUG(4,("PAM Init for user: %s\n", user));
|
||||
|
||||
pam_error = pam_start("samba", user, &PAM_conversation, pamh);
|
||||
if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
|
||||
rhost = client_name();
|
||||
if (strcmp(rhost,"UNKNOWN") == 0)
|
||||
rhost = client_addr();
|
||||
|
||||
#ifdef PAM_RHOST
|
||||
DEBUG(4,("PAM setting rhost to: %s\n", rhost));
|
||||
pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
|
||||
if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
#endif
|
||||
|
||||
#if defined(PAM_TTY_KLUDGE) && defined(PAM_TTY)
|
||||
pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
|
||||
if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
|
||||
proc_pam_end(*pamh);
|
||||
return False;
|
||||
}
|
||||
#endif
|
||||
|
||||
return True;
|
||||
}
|
||||
|
||||
static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance)
|
||||
/*
|
||||
* PAM Internal Session Handler
|
||||
*/
|
||||
static BOOL proc_pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL flag)
|
||||
{
|
||||
int pam_error;
|
||||
|
||||
@ -294,7 +294,7 @@ static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance
|
||||
PAM_username = user;
|
||||
|
||||
#ifdef PAM_TTY
|
||||
DEBUG(4,("PAM tty set to: %s\"\n", tty));
|
||||
DEBUG(4,("PAM: tty set to: %s\n", tty));
|
||||
pam_error = pam_set_item(pamh, PAM_TTY, tty);
|
||||
if (!pam_error_handler(pamh, pam_error, "set tty failed", 0)) {
|
||||
proc_pam_end(pamh);
|
||||
@ -302,7 +302,7 @@ static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance
|
||||
}
|
||||
#endif
|
||||
|
||||
if (instance) {
|
||||
if (flag) {
|
||||
pam_error = pam_open_session(pamh, PAM_SILENT);
|
||||
if (!pam_error_handler(pamh, pam_error, "session setup failed", 0)) {
|
||||
proc_pam_end(pamh);
|
||||
@ -320,72 +320,23 @@ static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance
|
||||
return (True);
|
||||
}
|
||||
|
||||
static BOOL pam_account(pam_handle_t *pamh, char *user)
|
||||
/*
|
||||
* PAM Externally accessible Session handler
|
||||
*/
|
||||
BOOL pam_session(BOOL flag, const connection_struct *conn, char *tty)
|
||||
{
|
||||
int pam_error;
|
||||
|
||||
PAM_password = NULL;
|
||||
PAM_username = user;
|
||||
|
||||
DEBUG(4,("PAM starting account management for user: %s \n", user));
|
||||
|
||||
pam_error = pam_acct_mgmt(pamh, PAM_SILENT);
|
||||
if (!pam_error_handler(pamh, pam_error, "PAM set account management failed", 0)) {
|
||||
proc_pam_end(pamh);
|
||||
return False;
|
||||
} else {
|
||||
DEBUG(4,("PAM account management passed\n"));
|
||||
}
|
||||
|
||||
/*
|
||||
* This will allow samba to aquire a kerberos token. And, when
|
||||
* exporting an AFS cell, be able to /write/ to this cell.
|
||||
*/
|
||||
pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED));
|
||||
if (!pam_error_handler(pamh, pam_error, "set credentials failed\n", 0)) {
|
||||
proc_pam_end(pamh);
|
||||
return False;
|
||||
}
|
||||
|
||||
/* If this point is reached, the user has been authenticated. */
|
||||
return (True);
|
||||
}
|
||||
static BOOL account_pam(char *user)
|
||||
{
|
||||
/*
|
||||
* Check the account with the PAM account module:
|
||||
* - This means that accounts can be disabled
|
||||
* and or expired with avoidance of samba then just
|
||||
* bypassing the situation.
|
||||
*/
|
||||
|
||||
pam_handle_t *pamh = NULL;
|
||||
char * PAMuser;
|
||||
|
||||
PAMuser = malloc(strlen(user)+1);
|
||||
/* This is freed by PAM */
|
||||
strncpy(PAMuser, user, strlen(user)+1);
|
||||
|
||||
if (proc_pam_start(&pamh, PAMuser))
|
||||
{
|
||||
if (pam_account(pamh, PAMuser))
|
||||
{
|
||||
return proc_pam_end(pamh);
|
||||
}
|
||||
}
|
||||
proc_pam_end(pamh);
|
||||
return False;
|
||||
}
|
||||
|
||||
BOOL PAM_session(BOOL instance, const connection_struct *conn, char *tty)
|
||||
{
|
||||
pam_handle_t *pamh=NULL;
|
||||
pam_handle_t *pamh = NULL;
|
||||
char * user;
|
||||
|
||||
user = malloc(strlen(conn->user)+1);
|
||||
if ( user == NULL )
|
||||
{
|
||||
DEBUG(0, ("PAM: PAM_session Malloc Failed!\n"));
|
||||
return False;
|
||||
}
|
||||
|
||||
/* This is freed by PAM */
|
||||
strncpy(user, conn->user, strlen(conn->user)+1);
|
||||
StrnCpy(user, conn->user, strlen(conn->user)+1);
|
||||
|
||||
if (!proc_pam_start(&pamh, user))
|
||||
{
|
||||
@ -393,7 +344,7 @@ BOOL PAM_session(BOOL instance, const connection_struct *conn, char *tty)
|
||||
return False;
|
||||
}
|
||||
|
||||
if (pam_session(pamh, user, tty, instance))
|
||||
if (proc_pam_session(pamh, user, tty, flag))
|
||||
{
|
||||
return proc_pam_end(pamh);
|
||||
}
|
||||
@ -404,6 +355,9 @@ BOOL PAM_session(BOOL instance, const connection_struct *conn, char *tty)
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* PAM Password Validation Suite
|
||||
*/
|
||||
BOOL pam_passcheck(char * user, char * password)
|
||||
{
|
||||
pam_handle_t *pamh = NULL;
|
||||
@ -413,24 +367,18 @@ BOOL pam_passcheck(char * user, char * password)
|
||||
|
||||
if( proc_pam_start(&pamh, user))
|
||||
{
|
||||
if( pam_auth(user, password))
|
||||
if ( pam_auth(pamh, user, password))
|
||||
{
|
||||
if( account_pam(user))
|
||||
if ( pam_account(pamh, user, password))
|
||||
{
|
||||
return( proc_pam_end(pamh));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
proc_pam_end(pamh);
|
||||
DEBUG(0, ("PAM: System Validation Failed - Rejecting User!\n"));
|
||||
return( False );
|
||||
}
|
||||
#endif /* NOTBLOCKEDOUT */
|
||||
|
||||
BOOL pam_passcheck( char * user, char * password )
|
||||
{
|
||||
return( pam_auth( user, password ));
|
||||
|
||||
}
|
||||
#else
|
||||
|
||||
/* Do *NOT* make this function static. Doing so breaks the compile on gcc */
|
||||
|
||||
Loading…
Reference in New Issue
Block a user