1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Commit Graph

439 Commits

Author SHA1 Message Date
Herb Lewis
8efa4bd901 smbsh need CC not SHLD
(This used to be commit 690c1fae9c)
2002-02-07 20:20:05 +00:00
Andrew Bartlett
ed389ee8dc Drastic impromvents to pam_winbind.
This adds code to do generic PAM -> NTSTATUS and NTSTATUS -> PAM error
conversions, and uses them to make the error handling in pam_winbind sane.

In particular, pam_winbind now uses PAM error codes, not silly '-1, -2 ...'
stuff, and logs the NTSTATUS error that winbind now sends over the pipe.

Added code to wbinfo to display these - makes a big difference in debugging
winbindd.

The main change here is the code to allow pam_winbind password changing to
correctly stack - This code ripped from pam_unix, and the copyright attached.
(Same as for all pam modules, including pam_winbind)

Andrew Bartlett
(This used to be commit dc1a72f896)
2002-02-05 09:40:36 +00:00
Jim McDonough
47f7fb01a8 Add ldap_printer.c build for ADS printer objects.
(This used to be commit 085f5ab03e)
2002-02-01 16:17:39 +00:00
Andrew Bartlett
c08186b947 An attempt at producing the correct Makefile magic for wrepld_proto.h to be
automatically generated on first 'make'.  This wasn't being picked up by the
build farm becouse of the explicit 'make proto'.

The 'make proto' bit isn't somthing our alpha testers know about (its certainly
not clearly documented) and its meant to be automatic.

I hope this works...

Andrew Bartlett
(This used to be commit 3a413ef1ea)
2002-01-30 10:50:07 +00:00
Jean-François Micouleau
2452515a16 that's the wins replication daemon !
there are still some work to do on it but it's already functionnal.

        J.F.
(This used to be commit 2506c98d19)
2002-01-25 22:53:49 +00:00
Andrew Bartlett
1a74d8d1f0 This is another *BIG* change...
Samba now features a pluggable passdb interface, along the same lines as the
one in use in the auth subsystem.  In this case, only one backend may be active
at a time by the 'normal' interface, and only one backend per passdb_context is
permitted outside that.

This pluggable interface is designed to allow any number of passdb backends to
be compiled in, with the selection at runtime.  The 'passdb backend' paramater
has been created (and documented!) to support this.

As such, configure has been modfied to allow (for example) --with-ldap and the
old smbpasswd to be selected at the same time.

This patch also introduces two new backends:  smbpasswd_nua and tdbsam_nua.
These two backends accept 'non unix accounts', where the user does *not* exist
in /etc/passwd.  These accounts' don't have UIDs in the unix sense, but to
avoid conflicts in the algroitmic mapping of RIDs, they use the values
specified in the 'non unix account range' paramter - in the same way as the
winbind ranges are specifed.

While I was at it, I cleaned up some of the code in pdb_tdb (code copied
directly from smbpasswd and not really considered properly).  Most of this was
to do with % macro expansion on stored data.  It isn't easy to get the macros
into the tdb, and the first password change will 'expand' them.  tdbsam needs
to use a similar system to pdb_ldap in this regard.

This patch only makes minor adjustments to pdb_nisplus and pdb_ldap, becouse I
don't have the test facilities for these.  I plan to incoroprate at least
pdb_ldap into this scheme after consultation with Jerry.

Each (converted) passdb module now no longer has any 'static' variables, and
only exports 1 init function outside its .c file.

The non-unix-account support in this patch has been proven!  It is now possible
to join a win2k machine to a Samba PDC without an account in /etc/passwd!

Other changes:

Minor interface adjustments:
pdb_delete_sam_account() now takes a SAM_ACCOUNT, not a char*.

pdb_update_sam_account() no longer takes the 'override' argument that was being
ignored so often (every other passdb backend).  Extra checks have been added in
some places.

Minor code changes:
smbpasswd no longer attempts to initialise the passdb at startup, this is
now done on first use.

pdbedit has lost some of its 'machine account' logic, as this behaviour is now
controlled by the passdb subsystem directly.

The samr subsystem no longer calls 'local password change', but does the pdb
interactions directly.  This allow the ACB_ flags specifed to be transferred
direct to the backend, without interference.

Doco:

I've updated the doco to reflect some of the changes, and removed some paramters
no longer applicable to HEAD.
(This used to be commit ff354c99c5)
2002-01-20 14:30:58 +00:00
Andrew Bartlett
c311d24ce3 A nice *big* change to the fundemental way we do things.
Samba (ab)uses the returns from getpwnam() a lot - in particular it keeps
them around for a long time - often past the next call...

This adds a getpwnam_alloc and a getpwuid_alloc to the collection.

These function as expected, returning a malloced structure that can be
free()ed with passwd_free(&passwd).

This patch also cuts down on the number of calls to getpwnam - mostly by
taking advantage of the fact that the passdb interface is already
case-insensiteve.

With this patch most of the recursive cases have been removed (that I know
of) and the problems are reduced further by not using the sys_ interface
in the new code.  This means that pointers to the cache won't be affected.
(This is a tempoary HACK, I intend to kill the password cache entirly).

The only change I'm a little worried about is the change to
rpc_server/srv_samr_nt.c for private groups.  In this case we are getting
groups from the new group mapping DB.  Do we still need to check for private
groups?  I've toned down the check to a case sensitve match with the new code,
but we might be able to kill it entirly.

I've also added a make_modifyable_passwd() function, that copies a passwd
struct into the form that the old sys_getpw* code provided.  As far as I can
tell this is only actually used in the pass_check.c crazies, where I moved
the final 'special case' for shadow passwords (out of _Get_Pwnam()).

The matching case for getpwent() is dealt with already, in lib/util_getent.c

Also included in here is a small change to register the [homes] share at vuid
creation rather than just in one varient of the session setup.  (This picks
up the SPNEGO cases).  The home directory is now stored on the vuid, and I
am hoping this might provide a saner way to do %H substitions.

TODO:  Kill off remaining Get_Pwnam_Modify calls (they are not needed), change
the remaining sys_getpwnam() callers to use getpwnam_alloc() and move
Get_Pwnam to return an allocated struct.

Andrew Bartlett
(This used to be commit 1d86c7f942)
2002-01-17 08:45:58 +00:00
Andrew Bartlett
e895b9004e Many thanks to Alexander Bokovoy <a.bokovoy@sam-solutions.net>.
This work was sponsored by Optifacio Software Services, Inc.

Andrew Bartlett

(various e-mails announcements merged into some form of commit message below:)

This patch which adds basics of universal groups support
into Samba 3. Currently, only Winbind with RPC calls supports this, ADS
support requires additional (possibly huge) work on KRB5 PAC. However,
basic infrastructure is here.

This patch adds:

1. Storing of universal groups for particular user logged into Samba
software (smbd/ two winbind-pam methods) into netlogon_unigrp.tdb as array
of uint32 supplemental group rids keyed as DOMAIN_SID/USER_RID in tdb.

2. Fetching of unversal groups for given user rid and domain sid from
netlogon_unigrp.tdb.

Since this is used in both smbd and winbindd, main code is in
source/lib/netlogon_uingrp.c. Dependencies are added to AUTH_OBJ as
UNIGRP_OBJ and WINBINDD_OBJ as UNIGRP_OBJ.

This patch has had a few versions, the final version in particular:

Many thanks to Andrew Bartlett for critics and comments, and partly
rewritten code.

New:
- updated fetching code to changed byte order macros
- moved functions to proper namespace
- optimized memory usage by reusing caller's memory context
- enhanced code to more follow Samba coding rules

Todo:
- proper universal group expiration after timeout
(This used to be commit 80c2aefbe7)
2002-01-12 23:57:10 +00:00
Andrew Bartlett
973c0b3257 Thanks to vance for spotting the missing Makefile.in commit.
This should make things a little happier...

Andrew Bartlett
(This used to be commit 6ce467a65f)
2002-01-12 02:06:17 +00:00
Martin Pool
6c7050ea95 Add two more memory-debug smbcontrol messages: these ones should
prompt dmalloc to log information about what happening, so you can see
in flight why smbd is getting bloated.
(This used to be commit bcb443c5c4)
2002-01-09 08:27:15 +00:00
Andrew Tridgell
1803e9cc0f - fixed my breakage of CPPFLAGS
- allow winbindd and wbinfo to build without shared libraries
(This used to be commit d5db2518be)
2002-01-08 04:44:15 +00:00
Andrew Tridgell
6c14b8c387 - use CFLAGS when linking shared libs (for things like -64 on irix)
- don't attempt to build winbindd if we can't do shared libs
(This used to be commit c98158f3f8)
2002-01-07 11:42:12 +00:00
Andrew Bartlett
2e28f8ff0e I've decided to move the auth code around a bit more...
The auth_authsupplied_info typedef is now just a plain struct - auth_context,
but it has been modified to contain the function pointers to the rest
of the auth subsystem's components.

(Who needs non-static functions anyway?)

In working all this mess out, I fixed a number of memory leaks and moved the
entire auth subsystem over to talloc().

Note that the TALLOC_CTX attached to the auth_context can be rather long-lived,
it is provided for things that are intended to live as long.  (The
global_negprot_auth_context lasts the whole life of the smbd).

I've also adjusted a few things in auth_domain.c, mainly passing the domain as
a paramater to a few functions instead of looking up lp_workgroup().  I'm
hopign to make this entire thing a bit more trusted domains (as PDC) freindly
in the near future.

Other than that, I moved a bit of the code around, hence the rather messy diff.

Andrew Bartlett
(This used to be commit 12f5515f55)
2002-01-05 04:55:41 +00:00
Martin Pool
91ec6cf19f smbd should register to receive MSG_REQ_POOL_USAGE. Response should
be information about memory usage, but this is not done yet.
(This used to be commit 830a126a44)
2002-01-03 03:53:41 +00:00
Jeremy Allison
bf8e91e362 We should be SHLD not LINK when creating shared libraries.
Tidyup in passdb.c
Jeremy.
(This used to be commit 676eea502a)
2002-01-02 21:54:38 +00:00
Tim Potter
f7b29c59ba Removed reference to rpc_client/cli_netlogon.o from dependencies for
samsync.  The libsmb version should do fine.
(This used to be commit 001fe3481f)
2002-01-02 00:52:30 +00:00
Andrew Bartlett
2de935d89f Further rpc_client removal, this time from winbindd.
Also removed the dependency on auth_util.o, which makes things nicer.

Finally, this kills off the NECESSARY_BECAUSE_SAMBA_DEPENDENCIES_ARE_SO_BROKEN_OBJ
makefile variable - becouse Samba dependencies are starting to be sane again!

Andrew Bartlett
(This used to be commit 4609edcac3)
2002-01-01 04:50:45 +00:00
Andrew Bartlett
4a6d1318bd A farily large commit:
- Move rpc_client/cli_trust.c to smbd/change_trust_pw.c
  - It hasn't been used by anything else since smbpasswd lost its -j

 - Add a TALLOC_CTX to the auth subsytem.  These are only valid for the length
   of the calls to the individual modules, if you want a longer context hide it
   in your private data.

   Similarly, all returns (like the server_info) should still be malloced.

 - Move the 'ntdomain' module (security=domain in oldspeak) over to use the new
   libsmb domain logon code.  Also rework much of the code to use some better
   helper functions for the connection - getting us much better error returns
   (the new code is NTSTATUS).

   The only remaining thing to do is to figure out if tpot's 0xdead 0xbeef for
   the LUID feilds is sufficient, or if we should do random LUIDs as per the old
   code.

   Similarly, I'll move winbind over to this when I get a chance.

This leaves the SPOOLSS code and some cli_pipe code as the only stuff still in
rpc_client, at least as far as smbd is concerned.

While I've given this a basic rundown, any testing is as always appriciated.

Andrew Bartlett
(This used to be commit d870edce76)
2002-01-01 03:10:32 +00:00
Andrew Bartlett
34037e2479 Make Samba compile on RH 6.2 again.
We now include the libber.h file if required, but currently we just don't use
ldap.  (I'll chase this up).

In the meantime, I've moved the ads_status code about, its now in its own file,
and has a couple of #ifdefs to allow smbd to link - becouse the lack of LDAP
caused HAVE_ADS to be undefined. (I hope its not too ugly).

Andrew Bartlett
(This used to be commit 14407c87e2)
2001-12-30 05:59:43 +00:00
Gerald Carter
ca87fe7176 merge from 2.2
(This used to be commit 6697e46183)
2001-12-21 20:04:22 +00:00
Herb Lewis
c10bc7b9a1 remove duplicate lines
(This used to be commit b60d6f1197)
2001-12-21 05:13:36 +00:00
Andrew Tridgell
6722cfc3e6 added net lookup command
(This used to be commit 51268c512d)
2001-12-20 07:42:00 +00:00
Andrew Tridgell
6c7e9dfb29 net ads password and net ads chostpass commands from Remus Koos
(This used to be commit 412e79c448)
2001-12-20 03:54:52 +00:00
Jeremy Allison
2fe6d5d5a1 Added AC_CHECK_FUNCS(syslog vsyslog).
nsswitch code uses vsyslog without checking for it.
Provide replacement for vsyslog in lib/snprintf if not found by configure.
Jeremy.
(This used to be commit ab2e55cdb3)
2001-12-19 19:18:37 +00:00
Martin Pool
806ebe9240 Add a very trivial talloc torture program, bin/talloctort. Not built
by default.
(This used to be commit e339066995)
2001-12-19 04:46:35 +00:00
Jeremy Allison
9c1120faeb Allow HPUX to link with new ACL code.
Jeremy.
(This used to be commit ad9a5a26e0)
2001-12-15 02:46:48 +00:00
Jeremy Allison
43e325d991 Added the group enum code from 2.2
Jeremy.
(This used to be commit 59e01a22c5)
2001-12-14 21:51:09 +00:00
Andrew Tridgell
9a83100c65 -Insswitch/ breaks the build by preventing include of <nss.h> from working
(This used to be commit 1ef9862540)
2001-12-13 13:54:39 +00:00
Herb Lewis
ed7caa2ecf allow IRIX to build nsswitch/libnss_wins.so
(This used to be commit 564bfd7728)
2001-12-12 16:08:32 +00:00
Jean-François Micouleau
a5ba214479 added a -V[erbose] option to samsync. Decode a lot of information
I'm looking at chaining the credentials

	J.F.
(This used to be commit d49c8e4d3d)
2001-12-12 15:25:22 +00:00
Herb Lewis
fb8b642a98 add PATH_FLAGS to .po32 objects so dynconfig builds with smbwrapper
(This used to be commit 5bf6f91937)
2001-12-11 20:41:31 +00:00
Andrew Tridgell
32ba2c889f added a net time command. Allow display or set of system time based on
a SMB server

particularly useful for ADS is:

	net time set -S DOMAIN#1B

this makes kerberos clock skew problems go away :)
(This used to be commit b3ba2293d0)
2001-12-11 05:21:50 +00:00
Tim Potter
6cc5e2edc1 Modify winbindd to use authenticated user info from secrets.tdb when making
IPC$ connections to domain controllers.
(This used to be commit 1217ef28a6)
2001-12-11 05:19:15 +00:00
Tim Potter
b872787f01 Doing some research into ACLs on the LSA and SAM policy objects.
- added lsaquerysecobj to rpcclient
 - renamed querysecobj to samquerysecobj
 - removed duplicated display_sec_acl() code from cmd_spoolss.c and
   cmd_samr.c and moved it into display_sec.c
(This used to be commit 59b2e3f408)
2001-12-11 02:17:26 +00:00
Martin Pool
43069e5475 Also show LDFLAGS/LDSHFLAGS when starting compilation, because they're
not visible later on.
(This used to be commit 8edd29e099)
2001-12-10 06:23:28 +00:00
Andrew Tridgell
5d378a280f added internal sasl/gssapi code. This means we are no longer dependent on cyrus-sasl which makes the code much less fragile. Also added code to auto-determine the server name or realm
(This used to be commit 435fdf276a)
2001-12-08 11:18:56 +00:00
Herb Lewis
7218f88e81 include/build_env.h wasn't getting built by default with new rules unless
you did make headers - fixed
(This used to be commit ce84993e8e)
2001-12-07 01:01:28 +00:00
Herb Lewis
8d0eb004a0 OK I think this does what everyone wants with the .headers.stamp
it gets removed on a make clean
it gets created on a make headers (if it doesn't already exist)

This makes it so I only rebuild everthing once after a make clean and
also so nothing gets rebuilt after jfm does a make headers (proto)
(This used to be commit bc918bce10)
2001-12-07 00:37:31 +00:00
Jean-François Micouleau
0069985ce3 remove .headers.stamp from the delheaders definition
It forced a complete build to occur each time the proto are rebuild !

	J.F.
(This used to be commit 9866c18193)
2001-12-06 12:57:50 +00:00
Herb Lewis
549e904d3f merge from 2.2
don't set WINBIND variables unless configure was run --with-winbind
(This used to be commit 83ec4c0f4d)
2001-12-05 21:08:17 +00:00
Herb Lewis
f3e6f2d953 dont add -I./popt to CFLAGS it really belongs in FLAGS1 with other include
paths. This make it hard to use a script that overrides CFLAGS options.
(This used to be commit 646b5ae752)
2001-12-05 19:45:30 +00:00
Andrew Bartlett
8ba00d147b OK. Smbpasswd -j is DEAD.
This moves the rest of the functionality into the 'net rpc join' code.

Futhermore, this moves that entire area over to the libsmb codebase, rather
than the crufty old rpc_client stuff.

I have also fixed up the smbpasswd -a -m bug in the process.

We also have a new 'net rpc changetrustpw' that can be called from a
cron-job to regularly change the trust account password, for sites
that run winbind but not smbd.

With a little more work, we can kill rpc_client from smbd entirly!
(It is mostly the domain auth stuff - which I can rework - and the
spoolss stuff that sombody else will need to look over).

Andrew Bartlett
(This used to be commit 575897e879)
2001-12-05 11:00:26 +00:00
Jean-François Micouleau
e9894404ba move proto.h and build_env.h from $(srcdir)/include to $(builddir)/include
tridge, martin, if you think it's wrong , you can revert it.

	J.F.
(This used to be commit f057d62aae)
2001-12-04 21:58:37 +00:00
Andrew Bartlett
3bc87626ae Add 'net rpc join' to match the ADS equiv.
This kills off the offending code in smbpasswd -j -Uab%c

In the process we have changed from unsing compelatly random passwords
to random, 15 char ascii strings.  While this does produce a decrese in
entropy, it is still vastly greater than we need, considering the application.

In the meantime this allows us to actually *type* the machine account
password duruign debugging.

This code also adds a 'check' step to the join, confirming that the
stored password does indeed do somthing of value :-)

Andrew Bartlett
(This used to be commit c0b7ee6ee5)
2001-12-04 05:03:03 +00:00
Jean-François Micouleau
cdf9b42754 added a tdb to store the account policy informations.
You can change them with either usermanager->policies->account
or from a command prompt on NT/W2K: net accounts /domain

we can add a rpc accounts to the net command. As the net_rpc.c is still
empty, I did not start. How should I add command to it ? Should I take the
rpcclient/cmd_xxx functions and call them from there ?

alse changed the SAM_UNK_INFO_3 parser, it's an NTTIME. This one is more
for jeremy ;-)

        J.F.
(This used to be commit bc28a8eebd)
2001-12-03 17:14:23 +00:00
Andrew Tridgell
92f47c03e0 make proto should build winbindd_proto.h as well
(This used to be commit c8339ce5c8)
2001-12-03 08:15:18 +00:00
Andrew Tridgell
2285b99cb1 added a basic ADS backend to winbind. More work needed, but at
least basic operations work
(This used to be commit 88241cab98)
2001-12-03 06:04:18 +00:00
Andrew Bartlett
feb4f52f13 This is another major rework of the 'net' command.
This time, all the existing functionality has been moved into
'net rap', ready for new commands in the 'net ads' and 'net rpc' categories.

In particular, we hope to have the abilty to autoselect the appropriate
backend to use based on smb.conf or other paramaters.

This will allow 'net user' to work no matter what the remote server.

The new 'net rpc' command will soon gain a 'net rpc join' and a
'net rpc user' based on the existing samba code.

Also in this commit, the connection establishment code has been almost entirly
reworked, and now has some minor sense of sainity to it.
In particular, we can now connect to hosts *other* than localhost!

We also have the ability to state on a per-command basis whether the 'localhost'
is a sane default value.  (A net join, for example, would not be sane against
localhost).

Unfortunetly we have had to make the basic paramaters global variables, but
the 'cli' is not opened and closed on a per-command basis.

Andrew Bartlett
(This used to be commit 8739d426ca)
2001-12-03 04:39:23 +00:00
Andrew Tridgell
7f9fe00d35 added nsstest target
fixed winbindd_rpc.o typo
(This used to be commit 2ce7f38fe9)
2001-12-03 04:09:43 +00:00
Andrew Tridgell
78169af90a split winbindd_enum_dom_groups into the new backend structure
also created winbindd_rpc.c which contains the functions that
have been converted to the new structure. There will soon be
a winbindd_ads.c for the ldap backend
(This used to be commit e4ccc602ba)
2001-12-03 01:23:42 +00:00