mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
9729bdf89f
This will allow the target service (as determined from the IDL) to be passed to GSSAPI (rather than the current, incorrect, "cifs"). Andrew Bartlett Signed-off-by: Stefan Metzmacher <metze@samba.org>
490 lines
13 KiB
C
490 lines
13 KiB
C
/*
|
|
Samba Unix/Linux SMB client library
|
|
Distributed SMB/CIFS Server Management Utility
|
|
Copyright (C) 2006 Volker Lendecke (vl@samba.org)
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
#include "includes.h"
|
|
#include "utils/net.h"
|
|
#include "rpc_client/rpc_client.h"
|
|
#include "../librpc/gen_ndr/ndr_samr_c.h"
|
|
#include "../libcli/security/security.h"
|
|
|
|
/*
|
|
* Do something with the account policies. Read them all, run a function on
|
|
* them and possibly write them back. "fn" has to return the container index
|
|
* it has modified, it can return 0 for no change.
|
|
*/
|
|
|
|
static NTSTATUS rpc_sh_acct_do(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct rpc_pipe_client *pipe_hnd,
|
|
int argc, const char **argv,
|
|
int (*fn)(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct samr_DomInfo1 *i1,
|
|
struct samr_DomInfo3 *i3,
|
|
struct samr_DomInfo12 *i12,
|
|
int argc, const char **argv))
|
|
{
|
|
struct policy_handle connect_pol, domain_pol;
|
|
NTSTATUS status, result;
|
|
union samr_DomainInfo *info1 = NULL;
|
|
union samr_DomainInfo *info3 = NULL;
|
|
union samr_DomainInfo *info12 = NULL;
|
|
int store;
|
|
struct dcerpc_binding_handle *b = pipe_hnd->binding_handle;
|
|
|
|
ZERO_STRUCT(connect_pol);
|
|
ZERO_STRUCT(domain_pol);
|
|
|
|
/* Get sam policy handle */
|
|
|
|
status = dcerpc_samr_Connect2(b, mem_ctx,
|
|
pipe_hnd->desthost,
|
|
MAXIMUM_ALLOWED_ACCESS,
|
|
&connect_pol,
|
|
&result);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto done;
|
|
}
|
|
if (!NT_STATUS_IS_OK(result)) {
|
|
status = result;
|
|
goto done;
|
|
}
|
|
|
|
/* Get domain policy handle */
|
|
|
|
status = dcerpc_samr_OpenDomain(b, mem_ctx,
|
|
&connect_pol,
|
|
MAXIMUM_ALLOWED_ACCESS,
|
|
ctx->domain_sid,
|
|
&domain_pol,
|
|
&result);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto done;
|
|
}
|
|
if (!NT_STATUS_IS_OK(result)) {
|
|
status = result;
|
|
goto done;
|
|
}
|
|
|
|
status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
|
|
&domain_pol,
|
|
1,
|
|
&info1,
|
|
&result);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto done;
|
|
}
|
|
if (!NT_STATUS_IS_OK(result)) {
|
|
status = result;
|
|
d_fprintf(stderr, _("query_domain_info level 1 failed: %s\n"),
|
|
nt_errstr(result));
|
|
goto done;
|
|
}
|
|
|
|
status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
|
|
&domain_pol,
|
|
3,
|
|
&info3,
|
|
&result);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto done;
|
|
}
|
|
if (!NT_STATUS_IS_OK(result)) {
|
|
status = result;
|
|
d_fprintf(stderr, _("query_domain_info level 3 failed: %s\n"),
|
|
nt_errstr(result));
|
|
goto done;
|
|
}
|
|
|
|
status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
|
|
&domain_pol,
|
|
12,
|
|
&info12,
|
|
&result);
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto done;
|
|
}
|
|
if (!NT_STATUS_IS_OK(result)) {
|
|
status = result;
|
|
d_fprintf(stderr, _("query_domain_info level 12 failed: %s\n"),
|
|
nt_errstr(result));
|
|
goto done;
|
|
}
|
|
|
|
store = fn(c, mem_ctx, ctx, &info1->info1, &info3->info3,
|
|
&info12->info12, argc, argv);
|
|
|
|
if (store <= 0) {
|
|
/* Don't save anything */
|
|
goto done;
|
|
}
|
|
|
|
switch (store) {
|
|
case 1:
|
|
status = dcerpc_samr_SetDomainInfo(b, mem_ctx,
|
|
&domain_pol,
|
|
1,
|
|
info1,
|
|
&result);
|
|
break;
|
|
case 3:
|
|
status = dcerpc_samr_SetDomainInfo(b, mem_ctx,
|
|
&domain_pol,
|
|
3,
|
|
info3,
|
|
&result);
|
|
break;
|
|
case 12:
|
|
status = dcerpc_samr_SetDomainInfo(b, mem_ctx,
|
|
&domain_pol,
|
|
12,
|
|
info12,
|
|
&result);
|
|
break;
|
|
default:
|
|
d_fprintf(stderr, _("Got unexpected info level %d\n"), store);
|
|
status = NT_STATUS_INTERNAL_ERROR;
|
|
goto done;
|
|
}
|
|
|
|
if (!NT_STATUS_IS_OK(status)) {
|
|
goto done;
|
|
}
|
|
|
|
status = result;
|
|
|
|
done:
|
|
if (is_valid_policy_hnd(&domain_pol)) {
|
|
dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
|
|
}
|
|
if (is_valid_policy_hnd(&connect_pol)) {
|
|
dcerpc_samr_Close(b, mem_ctx, &connect_pol, &result);
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
static int account_show(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx, struct rpc_sh_ctx *ctx,
|
|
struct samr_DomInfo1 *i1,
|
|
struct samr_DomInfo3 *i3,
|
|
struct samr_DomInfo12 *i12,
|
|
int argc, const char **argv)
|
|
{
|
|
if (argc != 0) {
|
|
d_fprintf(stderr, "%s %s\n", _("Usage:"), ctx->whoami);
|
|
return -1;
|
|
}
|
|
|
|
d_printf(_("Minimum password length: %d\n"), i1->min_password_length);
|
|
d_printf(_("Password history length: %d\n"),
|
|
i1->password_history_length);
|
|
|
|
d_printf(_("Minimum password age: "));
|
|
if (!nt_time_is_zero((NTTIME *)&i1->min_password_age)) {
|
|
time_t t = nt_time_to_unix_abs((NTTIME *)&i1->min_password_age);
|
|
d_printf(_("%d seconds\n"), (int)t);
|
|
} else {
|
|
d_printf(_("not set\n"));
|
|
}
|
|
|
|
d_printf(_("Maximum password age: "));
|
|
if (nt_time_is_set((NTTIME *)&i1->max_password_age)) {
|
|
time_t t = nt_time_to_unix_abs((NTTIME *)&i1->max_password_age);
|
|
d_printf(_("%d seconds\n"), (int)t);
|
|
} else {
|
|
d_printf(_("not set\n"));
|
|
}
|
|
|
|
d_printf(_("Bad logon attempts: %d\n"), i12->lockout_threshold);
|
|
|
|
if (i12->lockout_threshold != 0) {
|
|
|
|
d_printf(_("Account lockout duration: "));
|
|
if (nt_time_is_set(&i12->lockout_duration)) {
|
|
time_t t = nt_time_to_unix_abs(&i12->lockout_duration);
|
|
d_printf(_("%d seconds\n"), (int)t);
|
|
} else {
|
|
d_printf(_("not set\n"));
|
|
}
|
|
|
|
d_printf(_("Bad password count reset after: "));
|
|
if (nt_time_is_set(&i12->lockout_window)) {
|
|
time_t t = nt_time_to_unix_abs(&i12->lockout_window);
|
|
d_printf(_("%d seconds\n"), (int)t);
|
|
} else {
|
|
d_printf(_("not set\n"));
|
|
}
|
|
}
|
|
|
|
d_printf(_("Disconnect users when logon hours expire: %s\n"),
|
|
nt_time_is_zero(&i3->force_logoff_time) ? _("yes") : _("no"));
|
|
|
|
d_printf(_("User must logon to change password: %s\n"),
|
|
(i1->password_properties & 0x2) ? _("yes") : _("no"));
|
|
|
|
return 0; /* Don't save */
|
|
}
|
|
|
|
static NTSTATUS rpc_sh_acct_pol_show(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct rpc_pipe_client *pipe_hnd,
|
|
int argc, const char **argv) {
|
|
return rpc_sh_acct_do(c, mem_ctx, ctx, pipe_hnd, argc, argv,
|
|
account_show);
|
|
}
|
|
|
|
static int account_set_badpw(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx, struct rpc_sh_ctx *ctx,
|
|
struct samr_DomInfo1 *i1,
|
|
struct samr_DomInfo3 *i3,
|
|
struct samr_DomInfo12 *i12,
|
|
int argc, const char **argv)
|
|
{
|
|
if (argc != 1) {
|
|
d_fprintf(stderr, "%s %s <count>\n", _("Usage:"), ctx->whoami);
|
|
return -1;
|
|
}
|
|
|
|
i12->lockout_threshold = atoi(argv[0]);
|
|
d_printf(_("Setting bad password count to %d\n"),
|
|
i12->lockout_threshold);
|
|
|
|
return 12;
|
|
}
|
|
|
|
static NTSTATUS rpc_sh_acct_set_badpw(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct rpc_pipe_client *pipe_hnd,
|
|
int argc, const char **argv)
|
|
{
|
|
return rpc_sh_acct_do(c, mem_ctx, ctx, pipe_hnd, argc, argv,
|
|
account_set_badpw);
|
|
}
|
|
|
|
static int account_set_lockduration(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct samr_DomInfo1 *i1,
|
|
struct samr_DomInfo3 *i3,
|
|
struct samr_DomInfo12 *i12,
|
|
int argc, const char **argv)
|
|
{
|
|
if (argc != 1) {
|
|
d_fprintf(stderr, _("Usage: %s <count>\n"), ctx->whoami);
|
|
return -1;
|
|
}
|
|
|
|
unix_to_nt_time_abs(&i12->lockout_duration, atoi(argv[0]));
|
|
d_printf(_("Setting lockout duration to %d seconds\n"),
|
|
(int)nt_time_to_unix_abs(&i12->lockout_duration));
|
|
|
|
return 12;
|
|
}
|
|
|
|
static NTSTATUS rpc_sh_acct_set_lockduration(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct rpc_pipe_client *pipe_hnd,
|
|
int argc, const char **argv)
|
|
{
|
|
return rpc_sh_acct_do(c, mem_ctx, ctx, pipe_hnd, argc, argv,
|
|
account_set_lockduration);
|
|
}
|
|
|
|
static int account_set_resetduration(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct samr_DomInfo1 *i1,
|
|
struct samr_DomInfo3 *i3,
|
|
struct samr_DomInfo12 *i12,
|
|
int argc, const char **argv)
|
|
{
|
|
if (argc != 1) {
|
|
d_fprintf(stderr, _("Usage: %s <count>\n"), ctx->whoami);
|
|
return -1;
|
|
}
|
|
|
|
unix_to_nt_time_abs(&i12->lockout_window, atoi(argv[0]));
|
|
d_printf(_("Setting bad password reset duration to %d seconds\n"),
|
|
(int)nt_time_to_unix_abs(&i12->lockout_window));
|
|
|
|
return 12;
|
|
}
|
|
|
|
static NTSTATUS rpc_sh_acct_set_resetduration(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct rpc_pipe_client *pipe_hnd,
|
|
int argc, const char **argv)
|
|
{
|
|
return rpc_sh_acct_do(c, mem_ctx, ctx, pipe_hnd, argc, argv,
|
|
account_set_resetduration);
|
|
}
|
|
|
|
static int account_set_minpwage(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct samr_DomInfo1 *i1,
|
|
struct samr_DomInfo3 *i3,
|
|
struct samr_DomInfo12 *i12,
|
|
int argc, const char **argv)
|
|
{
|
|
if (argc != 1) {
|
|
d_fprintf(stderr, _("Usage: %s <count>\n"), ctx->whoami);
|
|
return -1;
|
|
}
|
|
|
|
unix_to_nt_time_abs((NTTIME *)&i1->min_password_age, atoi(argv[0]));
|
|
d_printf(_("Setting minimum password age to %d seconds\n"),
|
|
(int)nt_time_to_unix_abs((NTTIME *)&i1->min_password_age));
|
|
|
|
return 1;
|
|
}
|
|
|
|
static NTSTATUS rpc_sh_acct_set_minpwage(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct rpc_pipe_client *pipe_hnd,
|
|
int argc, const char **argv)
|
|
{
|
|
return rpc_sh_acct_do(c, mem_ctx, ctx, pipe_hnd, argc, argv,
|
|
account_set_minpwage);
|
|
}
|
|
|
|
static int account_set_maxpwage(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct samr_DomInfo1 *i1,
|
|
struct samr_DomInfo3 *i3,
|
|
struct samr_DomInfo12 *i12,
|
|
int argc, const char **argv)
|
|
{
|
|
if (argc != 1) {
|
|
d_fprintf(stderr, _("Usage: %s <count>\n"), ctx->whoami);
|
|
return -1;
|
|
}
|
|
|
|
unix_to_nt_time_abs((NTTIME *)&i1->max_password_age, atoi(argv[0]));
|
|
d_printf(_("Setting maximum password age to %d seconds\n"),
|
|
(int)nt_time_to_unix_abs((NTTIME *)&i1->max_password_age));
|
|
|
|
return 1;
|
|
}
|
|
|
|
static NTSTATUS rpc_sh_acct_set_maxpwage(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct rpc_pipe_client *pipe_hnd,
|
|
int argc, const char **argv)
|
|
{
|
|
return rpc_sh_acct_do(c, mem_ctx, ctx, pipe_hnd, argc, argv,
|
|
account_set_maxpwage);
|
|
}
|
|
|
|
static int account_set_minpwlen(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct samr_DomInfo1 *i1,
|
|
struct samr_DomInfo3 *i3,
|
|
struct samr_DomInfo12 *i12,
|
|
int argc, const char **argv)
|
|
{
|
|
if (argc != 1) {
|
|
d_fprintf(stderr, _("Usage: %s <count>\n"), ctx->whoami);
|
|
return -1;
|
|
}
|
|
|
|
i1->min_password_length = atoi(argv[0]);
|
|
d_printf(_("Setting minimum password length to %d\n"),
|
|
i1->min_password_length);
|
|
|
|
return 1;
|
|
}
|
|
|
|
static NTSTATUS rpc_sh_acct_set_minpwlen(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct rpc_pipe_client *pipe_hnd,
|
|
int argc, const char **argv)
|
|
{
|
|
return rpc_sh_acct_do(c, mem_ctx, ctx, pipe_hnd, argc, argv,
|
|
account_set_minpwlen);
|
|
}
|
|
|
|
static int account_set_pwhistlen(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct samr_DomInfo1 *i1,
|
|
struct samr_DomInfo3 *i3,
|
|
struct samr_DomInfo12 *i12,
|
|
int argc, const char **argv)
|
|
{
|
|
if (argc != 1) {
|
|
d_fprintf(stderr, _("Usage: %s <count>\n"), ctx->whoami);
|
|
return -1;
|
|
}
|
|
|
|
i1->password_history_length = atoi(argv[0]);
|
|
d_printf(_("Setting password history length to %d\n"),
|
|
i1->password_history_length);
|
|
|
|
return 1;
|
|
}
|
|
|
|
static NTSTATUS rpc_sh_acct_set_pwhistlen(struct net_context *c,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx,
|
|
struct rpc_pipe_client *pipe_hnd,
|
|
int argc, const char **argv)
|
|
{
|
|
return rpc_sh_acct_do(c, mem_ctx, ctx, pipe_hnd, argc, argv,
|
|
account_set_pwhistlen);
|
|
}
|
|
|
|
struct rpc_sh_cmd *net_rpc_acct_cmds(struct net_context *c, TALLOC_CTX *mem_ctx,
|
|
struct rpc_sh_ctx *ctx)
|
|
{
|
|
static struct rpc_sh_cmd cmds[9] = {
|
|
{ "show", NULL, &ndr_table_samr, rpc_sh_acct_pol_show,
|
|
N_("Show current account policy settings") },
|
|
{ "badpw", NULL, &ndr_table_samr, rpc_sh_acct_set_badpw,
|
|
N_("Set bad password count before lockout") },
|
|
{ "lockduration", NULL, &ndr_table_samr, rpc_sh_acct_set_lockduration,
|
|
N_("Set account lockout duration") },
|
|
{ "resetduration", NULL, &ndr_table_samr,
|
|
rpc_sh_acct_set_resetduration,
|
|
N_("Set bad password count reset duration") },
|
|
{ "minpwage", NULL, &ndr_table_samr, rpc_sh_acct_set_minpwage,
|
|
N_("Set minimum password age") },
|
|
{ "maxpwage", NULL, &ndr_table_samr, rpc_sh_acct_set_maxpwage,
|
|
N_("Set maximum password age") },
|
|
{ "minpwlen", NULL, &ndr_table_samr, rpc_sh_acct_set_minpwlen,
|
|
N_("Set minimum password length") },
|
|
{ "pwhistlen", NULL, &ndr_table_samr, rpc_sh_acct_set_pwhistlen,
|
|
N_("Set the password history length") },
|
|
{ NULL, NULL, 0, NULL, NULL }
|
|
};
|
|
|
|
return cmds;
|
|
}
|