1
0
mirror of https://github.com/samba-team/samba.git synced 2025-02-05 21:57:51 +03:00

40 Commits

Author SHA1 Message Date
Andrew Bartlett
9746ad12bd This is the fix for the PAM bug I probably introduced in the previous commit,
which I will confirm once I can find a box it would break on in the first place.

(this is the pam accounts as nobody thing we had with 2.2.0)

Andrew Bartlett
-
Andrew Bartlett
b30b6202f3 This is my 'Authentication Rewrite' version 1.01, mostly as submitted to
samba-technical a few weeks ago.

The idea here is to standardize the checking of user names and passwords,
thereby ensuring that all authtentications pass the same standards.  The
interface currently implemented in as

nt_status = check_password(user_info, server_info)

where user_info contains (mostly) the authentication data, and server_info
contains things like the user-id they got, and their resolved user name.

The current ugliness with the way the structures are created will be killed
the next revision, when they will be created and malloced by creator functions.

This patch also includes the first implementation of NTLMv2 in HEAD, but which
needs some more testing.  We also add a hack to allow plaintext passwords to be
compared with smbpasswd, not the system password database.

Finally, this patch probably reintroduces the PAM accounts bug we had in
2.2.0, I'll fix that once this hits the tree.  (I've just finished testing
it on a wide variety of platforms, so I want to get this patch in).
-
Jeremy Allison
eea1c30df2 Fix case insensitive password change code.
Fixed crash bug with un-zeroed talloced memory.
Jeremy.
-
Andrew Bartlett
04f090c224 This removes unused paramaters from various authtication functions, and should
not change behaviour.

This should make my later diffs smaller, where I actualy start cleaning up this
mess...

Andrew Bartlett
-
Jeremy Allison
79574c07ed Password changing via PAM works now. DONT CHANGE THIS UNLESS YOU RE-TEST !!!!!!
Jeremy.
-
Jeremy Allison
e94957d548 Added Andrew's pam password change stuff. Needs some testing but looks good !
Jeremy.
-
Jeremy Allison
70bdf8e761 Fixed up the oldpw prompts. Made the matching case insensitive.
Jeremy.
-
Jeremy Allison
47b4d82536 Had to add a "pam password change" parameter (defaults to "off") and inlined
the pam password change code to ensure that existing and working password
chat scripts don't break with 2.2.1. PAM password changing has to be explicitly
requested.
Allowed wildcards in pam password change matching (matches password chat
script matching). Had to add const (sorry Tim :-) to ms_fnmatch() to
stop warnings. Don't worry - the const changes are isolated and don't
cause any other warnings :-).
Jeremy.
-
Jeremy Allison
52a9226a5a Runtime check for broken PAM systems with no appdata_ptr support. This
should eventually be an autoconf test with a #ifdef workaround. I *HATE* pam :-).
Jeremy.
-
Jeremy Allison
d9b960b4a5 Stop coredump on pam password change with pam_pwdb.so module on error.
Jeremy.
-
Jeremy Allison
acc3e7a057 Added Andrew Bartlett's fixes to my changes to his original patch (at the
court of king caractacus, was just passing by... :-).
Jeremy.
-
Jeremy Allison
6b2dd14205 Allow pam code to compile on Solaris (which doesn't have PAM_AUTHTOK_RECOVER_ERR).
Jeremy.
-
Jeremy Allison
c4d3df4f14 Fixing consts in pam code.
Jeremy.
-
Jeremy Allison
1648ac64a7 Based on an original PAM patch by Andrew Bartlett, re-written by me to
remove global static PAM variables, and to tidy up the PAM internals code.
Now looks like the rest of Samba.
Still needs testing.
Jeremy.
-
Jeremy Allison
59aa99f390 Added "obey pam restrictions" parameter - default to "off".
Only set this to "on" if you know you have your PAM set up correctly.....
NB. Doesn't apply to plaintext password authentication, which must use
pam when compiled in.
Jeremy.
-
Jeremy Allison
4db22afeed Fix more free twice bugs.
Jeremy.
-
Jeremy Allison
c4048fcdb6 Fix for bug in code for pam_session failure - pam_end called twice.
Jeremy.
-
Jeremy Allison
d4b1c0be2e Added smb_ prefix to all Samba wrapper pam functions.
Fixed off by one bug using StrnCpy instead of strdup().
Jeremy.
-
Jeremy Allison
071c799f47 Commit of a modified version of Andrew Bartlett's patch that removes the
horrid utmp hostname parameter - now uses the client name instead.
Also tidies up some of the unencrypted password checking when PAM
is compiled in.
FIXME ! An pam_accountcheck() is being called even when smb encrypted
passwords are negotiated. Is this the correct thing to do when winbindd
is running ! This needs *SEVERE* testing....
Jeremy.
-
John Terpstra
44f96771c3 Oops. Typos. -
John Terpstra
72812e4cf1 Added error reporting to pam_session code. -
Andrew Tridgell
f52a5014ee merge from 2.2 -
Jeremy Allison
89589895e3 patch from Steve Langasek <vorlon@netexpress.net> to make sure we
don't use pam_setcred() if we haven't called pam_authenticate()
Merge from 2.2
Jeremy.
-
John Terpstra
02e84267f7 Updated with Andrew Bartlett patch. -
Jeremy Allison
add847778b Merged John's changes.
Jeremy.
-
John Terpstra
88b6043b4e Updating pampass from Samba-2.2 code tree. ===> JHT -
Jeremy Allison
3c4c649951 passdb/pass_check.c: Ensure second check is done only if given username is all in caps.
rpc_server/srv_srvsvc_nt.c: Added "CONFIGFILE" arg to scripts so path to smb.conf is given.
Jeremy.
-
Jeremy Allison
ecd00e258c Added JohnT and Andrew Bartlett's PAM changes.
Jeremy.
-
Gerald Carter
57165d1578 add pam_setcred() call to pam_auth(). Patch was submited last Oct.
jerry
-
Jeremy Allison
c2099cfb03 Getting back to a compilable state (not there yet but close).
Added patches for random -> sys_random.
Added set_effective_xxx patches for AFS code.
Memory allocation changes in spoolss code.
Jeremy.
-
Jeremy Allison
148628b616 Added sys_fork() and sys_getpid() functions to stop the overhead
of doing a system call every time we want to just get our pid.
Jeremy.
-
Luke Leighton
96717211ed indent update to make t easier to see setuid mods in TNG. some
code from these modules i had to leave out (nothing to do withj setuid)
-
Andrew Tridgell
453a822a76 first pass at updating head branch to be to be the same as the SAMBA_2_0 branch -
Tim Potter
36d7cb4ccc Moved code that changes the pw_passwd entry (i.e shadow password and
weird unixware stuff) into _Get_Pwnam() to fix a memory allocation bug.

Note that the Get_Pwnam() function now returns a const struct passwd *
as a hint to other developers not to change entries in the struct
passwd.
-
Luke Leighton
073c8652c1 pass_check.c could receive encrypted password: printing it out as a %s
results in garbage.  with no password length argument doing dump_data(
100, password, strlen(password)) is the next best alternative.
-
Jeremy Allison
548634915f Added Kerberos4 support patches from Johan Hedin <johanh@fusion.kth.se>
Jeremy.
-
Andrew Tridgell
7b154dc431 some cleanups to use ZERO_STRUCT() and friends -
Andrew Tridgell
a564e46627 got rid of calls to update_protected_database(). It was causing core
dumps. It is gone until someone can tell us why its needed and what it
does. (It was only used on OSF1 and core dumped there anyway!)
-
Andrew Tridgell
76e523907c use user instead of this_user to prevent global shadowing -
Andrew Tridgell
90d93889d7 split the system password checking routines out of smbd/password.c and
into passdb/pass_check.c. This means SWAT no longer needs to link to
smbd/password.c
-