sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-27 22:50:26 +03:00
Code

s4-lsa Implement kerberos ticket life policy

Browse Source 
We now no longer print tickets with a potentially infinite life, and
we report the same life over LSA as we use in the KDC.  We should get
this from group policy, but for now it's parametric smb.conf options.

Andrew Bartlett
This commit is contained in:
Andrew Bartlett 2010-12-09 14:17:54 +11:00
parent 22d67758ef
commit f681859eb8
8 changed files with 117 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
librpc/idl/lsa.idl
View File

@ -1064,11 +1064,14 @@ import "misc.idl", "security.idl";
);
/* Function 0x35 */
typedef [bitmap32bit] bitmap {
LSA_POLICY_KERBEROS_VALIDATE_CLIENT = 0x00000080
} lsa_krbAuthenticationOptions;
/* w2k3 returns either 0x000bbbd000000000 or 0x000a48e800000000
for reserved - gd */
typedef struct {
uint32 enforce_restrictions;
lsa_krbAuthenticationOptions authentication_options;
hyper service_tkt_lifetime;
hyper user_tkt_lifetime;
hyper user_tkt_renewaltime;

26
source4/kdc/db-glue.c
View File

@ -43,6 +43,7 @@
#include <hdb.h>
#include "kdc/samba_kdc.h"
#include "kdc/db-glue.h"
#include "kdc/kdc-policy.h"
enum samba_kdc_ent_type
{ SAMBA_KDC_ENT_TYPE_CLIENT, SAMBA_KDC_ENT_TYPE_SERVER,
@ -740,9 +741,28 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
entry_ex->entry.valid_start = NULL;
entry_ex->entry.max_life = NULL;
entry_ex->entry.max_life = malloc(sizeof(*entry_ex->entry.max_life));
if (entry_ex->entry.max_life == NULL) {
ret = ENOMEM;
goto out;
}
entry_ex->entry.max_renew = NULL;
if (ent_type == SAMBA_KDC_ENT_TYPE_SERVER) {
*entry_ex->entry.max_life = nt_time_to_unix(kdc_db_ctx->policy.service_tkt_lifetime);
} else if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT || ent_type == SAMBA_KDC_ENT_TYPE_CLIENT) {
*entry_ex->entry.max_life = nt_time_to_unix(kdc_db_ctx->policy.user_tkt_lifetime);
} else {
*entry_ex->entry.max_life = MIN(nt_time_to_unix(kdc_db_ctx->policy.service_tkt_lifetime),
nt_time_to_unix(kdc_db_ctx->policy.user_tkt_lifetime));
}
entry_ex->entry.max_renew = malloc(sizeof(*entry_ex->entry.max_life));
if (entry_ex->entry.max_renew == NULL) {
ret = ENOMEM;
goto out;
}
*entry_ex->entry.max_renew = nt_time_to_unix(kdc_db_ctx->policy.user_tkt_renewaltime);
entry_ex->entry.generation = NULL;
@ -1636,6 +1656,8 @@ NTSTATUS samba_kdc_setup_db_ctx(TALLOC_CTX *mem_ctx, struct samba_kdc_base_conte
kdc_db_ctx->ev_ctx = base_ctx->ev_ctx;
kdc_db_ctx->lp_ctx = base_ctx->lp_ctx;
kdc_get_policy(base_ctx->lp_ctx, NULL, &kdc_db_ctx->policy);
session_info = system_session(kdc_db_ctx->lp_ctx);
if (session_info == NULL) {
return NT_STATUS_INTERNAL_ERROR;

25
source4/kdc/kdc-policy.h Normal file
View File

@ -0,0 +1,25 @@
/*
Unix SMB/CIFS implementation.
KDC Policy
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2010
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
struct lsa_DomainInfoKerberos;
struct loadparm_context;
struct smb_krb5_context;
#include "kdc/kdc-policy-proto.h"

50
source4/kdc/policy.c Normal file
View File

@ -0,0 +1,50 @@
/*
Unix SMB/CIFS implementation.
KDC Policy
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2010
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "lib/util/util.h"
#include "kdc/kdc-policy.h"
#include "system/kerberos.h"
#include "auth/kerberos/kerberos.h"
#include "librpc/gen_ndr/lsa.h"
#include "param/param.h"
void kdc_get_policy(struct loadparm_context *lp_ctx,
struct smb_krb5_context *smb_krb5_context,
struct lsa_DomainInfoKerberos *k)
{
/* These should be set and stored via Group Policy, but until then, some defaults are in order */
/* Our KDC always re-validates the client */
k->authentication_options = LSA_POLICY_KERBEROS_VALIDATE_CLIENT;
unix_to_nt_time(&k->service_tkt_lifetime,
lpcfg_parm_int(lp_ctx, NULL, "kdc", "service ticket lifefime", 10) * 60 * 60);
unix_to_nt_time(&k->user_tkt_lifetime,
lpcfg_parm_int(lp_ctx, NULL, "kdc", "user ticket lifefime", 10) * 60 * 60);
unix_to_nt_time(&k->user_tkt_renewaltime,
lpcfg_parm_int(lp_ctx, NULL, "kdc", "renewal lifefime", 24*7) * 60 * 60);
if (smb_krb5_context) {
unix_to_nt_time(&k->clock_skew,
krb5_get_max_time_skew(smb_krb5_context->krb5_context));
}
k->reserved = 0;
}

1
source4/kdc/samba_kdc.h
View File

@ -36,6 +36,7 @@ struct samba_kdc_db_context {
bool rodc;
unsigned int my_krbtgt_number;
struct ldb_dn *krbtgt_dn;
struct lsa_DomainInfoKerberos policy;
};
struct samba_kdc_entry {

9
source4/kdc/wscript_build
View File

@ -38,10 +38,17 @@ bld.SAMBA_LIBRARY('pac',
bld.SAMBA_LIBRARY('db-glue',
source='db-glue.c',
deps='ldb auth_sam auth_sam_reply credentials hdb samba-hostconfig com_err',
deps='ldb auth_sam auth_sam_reply credentials hdb samba-hostconfig com_err kdc-policy',
private_library=True
)
bld.SAMBA_LIBRARY('kdc-policy',
source='policy.c',
deps='samba-hostconfig authkrb5',
private_library=True,
autoproto = 'kdc-policy-proto.h'
)
bld.SAMBA_SUBSYSTEM('MIT_SAMBA',
source='mit_samba.c',

10
source4/rpc_server/lsa/dcesrv_lsa.c
View File

@ -31,6 +31,7 @@
#include "lib/util/tsort.h"
#include "dsdb/common/util.h"
#include "libcli/security/session.h"
#include "kdc/kdc-policy.h"
/*
this type allows us to distinguish handle types
@ -3700,12 +3701,9 @@ static NTSTATUS dcesrv_lsa_QueryDomainInformationPolicy(struct dcesrv_call_state
*r->out.info = NULL;
return NT_STATUS_INTERNAL_ERROR;
}
k->enforce_restrictions = 0; /* FIXME, details missing from MS-LSAD 2.2.53 */
k->service_tkt_lifetime = 0; /* Need to find somewhere to store this, and query in KDC too */
k->user_tkt_lifetime = 0; /* Need to find somewhere to store this, and query in KDC too */
k->user_tkt_renewaltime = 0; /* Need to find somewhere to store this, and query in KDC too */
k->clock_skew = krb5_get_max_time_skew(smb_krb5_context->krb5_context);
k->reserved = 0;
kdc_get_policy(dce_call->conn->dce_ctx->lp_ctx,
smb_krb5_context,
k);
talloc_free(smb_krb5_context);
*r->out.info = info;
return NT_STATUS_OK;

2
source4/rpc_server/wscript_build
View File

@ -95,7 +95,7 @@ bld.SAMBA_MODULE('dcerpc_lsarpc',
autoproto='lsa/proto.h',
subsystem='dcerpc_server',
init_function='dcerpc_server_lsa_init',
deps='samdb DCERPC_COMMON ndr-standard LIBCLI_AUTH NDR_DSSETUP com_err security-session'
deps='samdb DCERPC_COMMON ndr-standard LIBCLI_AUTH NDR_DSSETUP com_err security-session kdc-policy'
)