mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
a0a32cf5d5
This correctly updates pwdLastSet field on win2k3 server.
rafal
(This used to be commit dd6d44c166
)
345 lines
10 KiB
C
345 lines
10 KiB
C
/*
|
|
Samba Unix/Linux SMB client library
|
|
net ads commands
|
|
Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
|
|
Copyright (C) 2001 Remus Koos (remuskoos@yahoo.com)
|
|
Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
|
|
Copyright (C) 2006 Gerald (Jerry) Carter (jerry@samba.org)
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "includes.h"
|
|
#include "utils/net.h"
|
|
|
|
/* Macro for checking RPC error codes to make things more readable */
|
|
|
|
#define CHECK_RPC_ERR(rpc, msg) \
|
|
if (!NT_STATUS_IS_OK(result = rpc)) { \
|
|
DEBUG(0, (msg ": %s\n", nt_errstr(result))); \
|
|
goto done; \
|
|
}
|
|
|
|
#define CHECK_RPC_ERR_DEBUG(rpc, debug_args) \
|
|
if (!NT_STATUS_IS_OK(result = rpc)) { \
|
|
DEBUG(0, debug_args); \
|
|
goto done; \
|
|
}
|
|
|
|
/*******************************************************************
|
|
Leave an AD domain. Windows XP disables the machine account.
|
|
We'll try the same. The old code would do an LDAP delete.
|
|
That only worked using the machine creds because added the machine
|
|
with full control to the computer object's ACL.
|
|
*******************************************************************/
|
|
|
|
NTSTATUS netdom_leave_domain( TALLOC_CTX *mem_ctx, struct cli_state *cli,
|
|
DOM_SID *dom_sid )
|
|
{
|
|
struct rpc_pipe_client *pipe_hnd = NULL;
|
|
POLICY_HND sam_pol, domain_pol, user_pol;
|
|
NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
|
|
char *acct_name;
|
|
uint32 flags = 0x3e8;
|
|
const char *const_acct_name;
|
|
uint32 user_rid;
|
|
uint32 num_rids, *name_types, *user_rids;
|
|
SAM_USERINFO_CTR ctr, *qctr = NULL;
|
|
SAM_USER_INFO_16 p16;
|
|
|
|
/* Open the domain */
|
|
|
|
if ( (pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status)) == NULL ) {
|
|
DEBUG(0, ("Error connecting to SAM pipe. Error was %s\n",
|
|
nt_errstr(status) ));
|
|
return status;
|
|
}
|
|
|
|
status = rpccli_samr_connect(pipe_hnd, mem_ctx,
|
|
SEC_RIGHTS_MAXIMUM_ALLOWED, &sam_pol);
|
|
if ( !NT_STATUS_IS_OK(status) )
|
|
return status;
|
|
|
|
|
|
status = rpccli_samr_open_domain(pipe_hnd, mem_ctx, &sam_pol,
|
|
SEC_RIGHTS_MAXIMUM_ALLOWED, dom_sid, &domain_pol);
|
|
if ( !NT_STATUS_IS_OK(status) )
|
|
return status;
|
|
|
|
/* Create domain user */
|
|
|
|
acct_name = talloc_asprintf(mem_ctx, "%s$", global_myname());
|
|
strlower_m(acct_name);
|
|
const_acct_name = acct_name;
|
|
|
|
status = rpccli_samr_lookup_names(pipe_hnd, mem_ctx,
|
|
&domain_pol, flags, 1, &const_acct_name,
|
|
&num_rids, &user_rids, &name_types);
|
|
if ( !NT_STATUS_IS_OK(status) )
|
|
return status;
|
|
|
|
if ( name_types[0] != SID_NAME_USER) {
|
|
DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name, name_types[0]));
|
|
return NT_STATUS_INVALID_WORKSTATION;
|
|
}
|
|
|
|
user_rid = user_rids[0];
|
|
|
|
/* Open handle on user */
|
|
|
|
status = rpccli_samr_open_user(pipe_hnd, mem_ctx, &domain_pol,
|
|
SEC_RIGHTS_MAXIMUM_ALLOWED, user_rid, &user_pol);
|
|
if ( !NT_STATUS_IS_OK(status) ) {
|
|
goto done;
|
|
}
|
|
|
|
/* Get user info */
|
|
|
|
status = rpccli_samr_query_userinfo(pipe_hnd, mem_ctx, &user_pol, 16, &qctr);
|
|
if ( !NT_STATUS_IS_OK(status) ) {
|
|
rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
|
|
goto done;
|
|
}
|
|
|
|
/* now disable and setuser info */
|
|
|
|
ZERO_STRUCT(ctr);
|
|
ctr.switch_value = 16;
|
|
ctr.info.id16 = &p16;
|
|
|
|
p16.acb_info = qctr->info.id16->acb_info | ACB_DISABLED;
|
|
|
|
status = rpccli_samr_set_userinfo2(pipe_hnd, mem_ctx, &user_pol, 16,
|
|
&cli->user_session_key, &ctr);
|
|
|
|
rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
|
|
|
|
done:
|
|
rpccli_samr_close(pipe_hnd, mem_ctx, &domain_pol);
|
|
rpccli_samr_close(pipe_hnd, mem_ctx, &sam_pol);
|
|
|
|
cli_rpc_pipe_close(pipe_hnd); /* Done with this pipe */
|
|
|
|
return status;
|
|
}
|
|
|
|
/*******************************************************************
|
|
Store the machine password and domain SID
|
|
********************************************************************/
|
|
|
|
int netdom_store_machine_account( const char *domain, DOM_SID *sid, const char *pw )
|
|
{
|
|
if (!secrets_store_domain_sid(domain, sid)) {
|
|
DEBUG(1,("Failed to save domain sid\n"));
|
|
return -1;
|
|
}
|
|
|
|
if (!secrets_store_machine_password(pw, domain, SEC_CHAN_WKSTA)) {
|
|
DEBUG(1,("Failed to save machine password\n"));
|
|
return -1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*******************************************************************
|
|
********************************************************************/
|
|
|
|
NTSTATUS netdom_get_domain_sid( TALLOC_CTX *mem_ctx, struct cli_state *cli,
|
|
char **domain, DOM_SID **sid )
|
|
{
|
|
struct rpc_pipe_client *pipe_hnd = NULL;
|
|
POLICY_HND lsa_pol;
|
|
NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
|
|
|
|
if ( (pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_LSARPC, &status)) == NULL ) {
|
|
DEBUG(0, ("Error connecting to LSA pipe. Error was %s\n",
|
|
nt_errstr(status) ));
|
|
return status;
|
|
}
|
|
|
|
status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
|
|
SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
|
|
if ( !NT_STATUS_IS_OK(status) )
|
|
return status;
|
|
|
|
status = rpccli_lsa_query_info_policy(pipe_hnd, mem_ctx,
|
|
&lsa_pol, 5, domain, sid);
|
|
if ( !NT_STATUS_IS_OK(status) )
|
|
return status;
|
|
|
|
rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
|
|
cli_rpc_pipe_close(pipe_hnd); /* Done with this pipe */
|
|
|
|
/* Bail out if domain didn't get set. */
|
|
if (!domain) {
|
|
DEBUG(0, ("Could not get domain name.\n"));
|
|
return NT_STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
return NT_STATUS_OK;
|
|
}
|
|
|
|
/*******************************************************************
|
|
Do the domain join
|
|
********************************************************************/
|
|
|
|
NTSTATUS netdom_join_domain( TALLOC_CTX *mem_ctx, struct cli_state *cli,
|
|
DOM_SID *dom_sid, const char *clear_pw,
|
|
enum netdom_domain_t dom_type )
|
|
{
|
|
struct rpc_pipe_client *pipe_hnd = NULL;
|
|
POLICY_HND sam_pol, domain_pol, user_pol;
|
|
NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
|
|
char *acct_name;
|
|
const char *const_acct_name;
|
|
uint32 user_rid;
|
|
uint32 num_rids, *name_types, *user_rids;
|
|
uint32 flags = 0x3e8;
|
|
uint32 acb_info = ACB_WSTRUST;
|
|
uint32 fields_present;
|
|
uchar pwbuf[532];
|
|
SAM_USERINFO_CTR ctr;
|
|
SAM_USER_INFO_25 p25;
|
|
const int infolevel = 25;
|
|
struct MD5Context md5ctx;
|
|
uchar md5buffer[16];
|
|
DATA_BLOB digested_session_key;
|
|
uchar md4_trust_password[16];
|
|
|
|
/* Open the domain */
|
|
|
|
if ( (pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status)) == NULL ) {
|
|
DEBUG(0, ("Error connecting to SAM pipe. Error was %s\n",
|
|
nt_errstr(status) ));
|
|
return status;
|
|
}
|
|
|
|
status = rpccli_samr_connect(pipe_hnd, mem_ctx,
|
|
SEC_RIGHTS_MAXIMUM_ALLOWED, &sam_pol);
|
|
if ( !NT_STATUS_IS_OK(status) )
|
|
return status;
|
|
|
|
|
|
status = rpccli_samr_open_domain(pipe_hnd, mem_ctx, &sam_pol,
|
|
SEC_RIGHTS_MAXIMUM_ALLOWED, dom_sid, &domain_pol);
|
|
if ( !NT_STATUS_IS_OK(status) )
|
|
return status;
|
|
|
|
/* Create domain user */
|
|
|
|
acct_name = talloc_asprintf(mem_ctx, "%s$", global_myname());
|
|
strlower_m(acct_name);
|
|
const_acct_name = acct_name;
|
|
|
|
/* Don't try to set any acb_info flags other than ACB_WSTRUST */
|
|
|
|
status = rpccli_samr_create_dom_user(pipe_hnd, mem_ctx, &domain_pol,
|
|
acct_name, acb_info, 0xe005000b, &user_pol, &user_rid);
|
|
|
|
if ( !NT_STATUS_IS_OK(status)
|
|
&& !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS))
|
|
{
|
|
d_fprintf(stderr, "Creation of workstation account failed\n");
|
|
|
|
/* If NT_STATUS_ACCESS_DENIED then we have a valid
|
|
username/password combo but the user does not have
|
|
administrator access. */
|
|
|
|
if (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED))
|
|
d_fprintf(stderr, "User specified does not have administrator privileges\n");
|
|
|
|
return status;
|
|
}
|
|
|
|
/* We *must* do this.... don't ask... */
|
|
|
|
if (NT_STATUS_IS_OK(status)) {
|
|
rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
|
|
}
|
|
|
|
status = rpccli_samr_lookup_names(pipe_hnd, mem_ctx,
|
|
&domain_pol, flags, 1, &const_acct_name,
|
|
&num_rids, &user_rids, &name_types);
|
|
if ( !NT_STATUS_IS_OK(status) )
|
|
return status;
|
|
|
|
if ( name_types[0] != SID_NAME_USER) {
|
|
DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name, name_types[0]));
|
|
return NT_STATUS_INVALID_WORKSTATION;
|
|
}
|
|
|
|
user_rid = user_rids[0];
|
|
|
|
/* Open handle on user */
|
|
|
|
status = rpccli_samr_open_user(pipe_hnd, mem_ctx, &domain_pol,
|
|
SEC_RIGHTS_MAXIMUM_ALLOWED, user_rid, &user_pol);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
return status;
|
|
}
|
|
|
|
/* Create a random machine account password and generate the hash */
|
|
|
|
E_md4hash(clear_pw, md4_trust_password);
|
|
encode_pw_buffer(pwbuf, clear_pw, STR_UNICODE);
|
|
|
|
generate_random_buffer((uint8*)md5buffer, sizeof(md5buffer));
|
|
digested_session_key = data_blob_talloc(mem_ctx, 0, 16);
|
|
|
|
MD5Init(&md5ctx);
|
|
MD5Update(&md5ctx, md5buffer, sizeof(md5buffer));
|
|
MD5Update(&md5ctx, cli->user_session_key.data, cli->user_session_key.length);
|
|
MD5Final(digested_session_key.data, &md5ctx);
|
|
|
|
SamOEMhashBlob(pwbuf, sizeof(pwbuf), &digested_session_key);
|
|
memcpy(&pwbuf[516], md5buffer, sizeof(md5buffer));
|
|
|
|
/* Fill in the additional account flags now */
|
|
|
|
acb_info |= ACB_PWNOEXP;
|
|
if ( dom_type == ND_TYPE_AD ) {
|
|
#if !defined(ENCTYPE_ARCFOUR_HMAC)
|
|
acb_info |= ACB_USE_DES_KEY_ONLY;
|
|
#endif
|
|
;;
|
|
}
|
|
|
|
/* Set password and account flags on machine account */
|
|
|
|
ZERO_STRUCT(ctr);
|
|
ZERO_STRUCT(p25);
|
|
|
|
fields_present = ACCT_NT_PWD_SET | ACCT_LM_PWD_SET | ACCT_FLAGS;
|
|
init_sam_user_info25P(&p25, fields_present, acb_info, (char *)pwbuf);
|
|
|
|
ctr.switch_value = infolevel;
|
|
ctr.info.id25 = &p25;
|
|
|
|
status = rpccli_samr_set_userinfo2(pipe_hnd, mem_ctx, &user_pol,
|
|
infolevel, &cli->user_session_key, &ctr);
|
|
|
|
if ( !NT_STATUS_IS_OK(status) ) {
|
|
d_fprintf( stderr, "Failed to set password for machine account (%s)\n",
|
|
nt_errstr(status));
|
|
return status;
|
|
}
|
|
|
|
rpccli_samr_close(pipe_hnd, mem_ctx, &user_pol);
|
|
cli_rpc_pipe_close(pipe_hnd); /* Done with this pipe */
|
|
|
|
return status;
|
|
}
|
|
|