mirror of
https://github.com/samba-team/samba.git
synced 2025-01-07 17:18:11 +03:00
8ba00d147b
This moves the rest of the functionality into the 'net rpc join' code.
Futhermore, this moves that entire area over to the libsmb codebase, rather
than the crufty old rpc_client stuff.
I have also fixed up the smbpasswd -a -m bug in the process.
We also have a new 'net rpc changetrustpw' that can be called from a
cron-job to regularly change the trust account password, for sites
that run winbind but not smbd.
With a little more work, we can kill rpc_client from smbd entirly!
(It is mostly the domain auth stuff - which I can rework - and the
spoolss stuff that sombody else will need to look over).
Andrew Bartlett
(This used to be commit 575897e879)
117 lines
3.8 KiB
C
117 lines
3.8 KiB
C
/*
|
|
* Unix SMB/Netbios implementation.
|
|
* Version 3.0
|
|
* Routines to change
|
|
* Copyright (C) Andrew Bartlett 2001.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
*/
|
|
|
|
#include "includes.h"
|
|
|
|
extern pstring global_myname;
|
|
|
|
/*********************************************************
|
|
Change the domain password on the PDC.
|
|
|
|
Just changes the password betwen the two values specified.
|
|
|
|
Caller must have the cli connected to the netlogon pipe
|
|
already.
|
|
**********************************************************/
|
|
static NTSTATUS just_change_the_password(struct cli_state *cli, TALLOC_CTX *mem_ctx,
|
|
unsigned char orig_trust_passwd_hash[16],
|
|
unsigned char new_trust_passwd_hash[16])
|
|
{
|
|
NTSTATUS result;
|
|
result = new_cli_nt_setup_creds(cli, orig_trust_passwd_hash);
|
|
|
|
if (!NT_STATUS_IS_OK(result)) {
|
|
DEBUG(0,("just_change_the_password: unable to setup creds (%s)!\n",
|
|
get_nt_error_msg(result)));
|
|
return result;
|
|
}
|
|
|
|
result = cli_net_srv_pwset(cli, mem_ctx, global_myname, new_trust_passwd_hash);
|
|
|
|
if (!NT_STATUS_IS_OK(result)) {
|
|
DEBUG(0,("just_change_the_password: unable to change password (%s)!\n",
|
|
get_nt_error_msg(result)));
|
|
}
|
|
return result;
|
|
}
|
|
|
|
/*********************************************************
|
|
Change the domain password on the PDC.
|
|
Store the password ourselves, but use the supplied password
|
|
Caller must have already setup the connection to the NETLOGON pipe
|
|
**********************************************************/
|
|
|
|
NTSTATUS trust_pw_change_and_store_it(struct cli_state *cli, TALLOC_CTX *mem_ctx,
|
|
unsigned char orig_trust_passwd_hash[16])
|
|
{
|
|
unsigned char new_trust_passwd_hash[16];
|
|
char *new_trust_passwd;
|
|
char *str;
|
|
NTSTATUS nt_status;
|
|
|
|
/* Create a random machine account password */
|
|
str = generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
|
|
new_trust_passwd = talloc_strdup(mem_ctx, str);
|
|
|
|
E_md4hash((uchar *)new_trust_passwd, new_trust_passwd_hash);
|
|
|
|
nt_status = just_change_the_password(cli, mem_ctx, orig_trust_passwd_hash,
|
|
new_trust_passwd_hash);
|
|
|
|
if (NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(3,("%s : change_trust_account_password: Changed password.\n", timestring(False)));
|
|
/*
|
|
* Return the result of trying to write the new password
|
|
* back into the trust account file.
|
|
*/
|
|
if (!secrets_store_machine_password(new_trust_passwd)) {
|
|
nt_status = NT_STATUS_UNSUCCESSFUL;
|
|
}
|
|
}
|
|
|
|
return nt_status;
|
|
}
|
|
|
|
/*********************************************************
|
|
Change the domain password on the PDC.
|
|
Do most of the legwork ourselfs. Caller must have
|
|
already setup the connection to the NETLOGON pipe
|
|
**********************************************************/
|
|
|
|
NTSTATUS trust_pw_find_change_and_store_it(struct cli_state *cli, TALLOC_CTX *mem_ctx, char *domain)
|
|
{
|
|
unsigned char old_trust_passwd_hash[16];
|
|
char *up_domain;
|
|
|
|
up_domain = talloc_strdup(mem_ctx, domain);
|
|
|
|
if (!secrets_fetch_trust_account_password(domain,
|
|
old_trust_passwd_hash,
|
|
NULL)) {
|
|
DEBUG(0, ("could not fetch domain secrets for domain %s!\n", domain));
|
|
return NT_STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
return trust_pw_change_and_store_it(cli, mem_ctx, old_trust_passwd_hash);
|
|
|
|
}
|
|
|