sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-08-26 01:49:31 +03:00
Code Activity

r19980: Implement pam account stack checks when obey pam restrictions is true.

Browse Source 
It was missing for security=server/domain/ads

Simo.
(This used to be commit 550f651499)
This commit is contained in:
Simo Sorce
2006-12-01 15:06:34 +00:00
committed by Gerald (Jerry) Carter
parent ef8d6bf5f7
commit cb0402c2d3
5 changed files with 45 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
source3/auth/auth_domain.c
View File

@ -269,6 +269,17 @@ static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx,
if (NT_STATUS_IS_OK(nt_status)) {
(*server_info)->was_mapped |= user_info->was_mapped;
if ( ! (*server_info)->guest) {
/* if a real user check pam account restrictions */
/* only really perfomed if "obey pam restriction" is true */
nt_status = smb_pam_accountcheck((*server_info)->unix_name);
if ( !NT_STATUS_IS_OK(nt_status)) {
DEBUG(1, ("PAM account restriction prevents user login\n"));
cli_shutdown(cli);
return nt_status;
}
}
}
netsamlogon_cache_store( user_info->smb_name, &info3 );

10
source3/auth/auth_server.c
View File

@ -383,7 +383,15 @@ use this machine as the password server.\n"));
if ( (pass = smb_getpwnam( NULL, user_info->internal_username,
real_username, True )) != NULL )
{
nt_status = make_server_info_pw(server_info, pass->pw_name, pass);
/* if a real user check pam account restrictions */
/* only really perfomed if "obey pam restriction" is true */
nt_status = smb_pam_accountcheck(pass->pw_name);
if ( !NT_STATUS_IS_OK(nt_status)) {
DEBUG(1, ("PAM account restriction prevents user login\n"));
} else {
nt_status = make_server_info_pw(server_info, pass->pw_name, pass);
}
TALLOC_FREE(pass);
}
else

9
source3/auth/auth_unix.c
View File

@ -110,7 +110,14 @@ static NTSTATUS check_unix_security(const struct auth_context *auth_context,
if (NT_STATUS_IS_OK(nt_status)) {
if (pass) {
make_server_info_pw(server_info, pass->pw_name, pass);
/* if a real user check pam account restrictions */
/* only really perfomed if "obey pam restriction" is true */
nt_status = smb_pam_accountcheck(pass->pw_name);
if ( !NT_STATUS_IS_OK(nt_status)) {
DEBUG(1, ("PAM account restriction prevents user login\n"));
} else {
make_server_info_pw(server_info, pass->pw_name, pass);
}
} else {
/* we need to do somthing more useful here */
nt_status = NT_STATUS_NO_SUCH_USER;

2
source3/auth/auth_util.c
View File

@ -496,7 +496,7 @@ NT_USER_TOKEN *get_root_nt_token( void )
if ( token )
return token;
if ( !(pw = sys_getpwnam( "root" )) ) {
DEBUG(0,("get_root_nt_token: getpwnam\"root\") failed!\n"));
return NULL;

16
source3/smbd/sesssetup.c
View File

@ -292,6 +292,22 @@ static int reply_spnego_kerberos(connection_struct *conn,
username_was_mapped = map_username( user );
pw = smb_getpwnam( mem_ctx, user, real_username, True );
if (pw) {
/* if a real user check pam account restrictions */
/* only really perfomed if "obey pam restriction" is true */
/* do this before an eventual mappign to guest occurs */
ret = smb_pam_accountcheck(pw->pw_name);
if ( !NT_STATUS_IS_OK(ret)) {
DEBUG(1, ("PAM account restriction prevents user login\n"));
data_blob_free(&ap_rep);
data_blob_free(&session_key);
talloc_destroy(mem_ctx);
TALLOC_FREE(pw);
return ERROR_NT(nt_status_squash(ret));
}
}
if (!pw) {
/* this was originally the behavior of Samba 2.2, if a user