3 Copyright Andrew Tridgell <tridge@samba.org> 2000
4 Copyright Tim Potter <tpot@samba.org> 2000
5 Copyright Andrew Bartlett <abartlet@samba.org> 2002
7 largely based on pam_userdb by Christian Gafton <gafton@redhat.com>
8 also contains large slabs of code from pam_unix by Elliot Lee <sopwith@redhat.com>
9 (see copyright below for full details)
12 #include "pam_winbind.h"
16 #define MAX_PASSWD_TRIES 3
19 static void _pam_log(int err, const char *format, ...)
23 va_start(args, format);
24 openlog(MODULE_NAME, LOG_CONS|LOG_PID, LOG_AUTH);
25 vsyslog(err, format, args);
30 static int _pam_parse(int argc, const char **argv)
33 /* step through arguments */
34 for (ctrl = 0; argc-- > 0; ++argv) {
38 if (!strcmp(*argv,"debug"))
39 ctrl |= WINBIND_DEBUG_ARG;
40 else if (!strcasecmp(*argv, "use_authtok"))
41 ctrl |= WINBIND_USE_AUTHTOK_ARG;
42 else if (!strcasecmp(*argv, "use_first_pass"))
43 ctrl |= WINBIND_USE_FIRST_PASS_ARG;
44 else if (!strcasecmp(*argv, "try_first_pass"))
45 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
46 else if (!strcasecmp(*argv, "unknown_ok"))
47 ctrl |= WINBIND_UNKNOWN_OK_ARG;
49 _pam_log(LOG_ERR, "pam_parse: unknown option; %s", *argv);
56 /* --- authentication management functions --- */
58 /* Attempt a conversation */
60 static int converse(pam_handle_t *pamh, int nargs,
61 struct pam_message **message,
62 struct pam_response **response)
65 struct pam_conv *conv;
67 retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv ) ;
68 if (retval == PAM_SUCCESS) {
69 retval = conv->conv(nargs, (const struct pam_message **)message,
70 response, conv->appdata_ptr);
73 return retval; /* propagate error status */
77 static int _make_remark(pam_handle_t * pamh, int type, const char *text)
79 int retval = PAM_SUCCESS;
81 struct pam_message *pmsg[1], msg[1];
82 struct pam_response *resp;
86 msg[0].msg_style = type;
89 retval = converse(pamh, 1, pmsg, &resp);
92 _pam_drop_reply(resp, 1);
97 static int pam_winbind_request(enum winbindd_cmd req_type,
98 struct winbindd_request *request,
99 struct winbindd_response *response)
102 /* Fill in request and send down pipe */
103 init_request(request, req_type);
105 if (write_sock(request, sizeof(*request)) == -1) {
106 _pam_log(LOG_ERR, "write to socket failed!");
108 return PAM_SERVICE_ERR;
112 if (read_reply(response) == -1) {
113 _pam_log(LOG_ERR, "read from socket failed!");
115 return PAM_SERVICE_ERR;
118 /* We are done with the socket - close it and avoid mischeif */
121 /* Copy reply data from socket */
122 if (response->result != WINBINDD_OK) {
123 if (response->data.auth.pam_error != PAM_SUCCESS) {
124 _pam_log(LOG_ERR, "request failed, PAM error was %d, NT error was %s",
125 response->data.auth.pam_error,
126 response->data.auth.nt_status_string);
127 return response->data.auth.pam_error;
129 _pam_log(LOG_ERR, "request failed, but PAM error 0!");
130 return PAM_SERVICE_ERR;
137 static int pam_winbind_request_log(enum winbindd_cmd req_type,
138 struct winbindd_request *request,
139 struct winbindd_response *response,
145 retval = pam_winbind_request(req_type, request, response);
149 /* incorrect password */
150 _pam_log(LOG_WARNING, "user `%s' denied access (incorrect password)", user);
152 case PAM_ACCT_EXPIRED:
153 /* account expired */
154 _pam_log(LOG_WARNING, "user `%s' account expired", user);
156 case PAM_AUTHTOK_EXPIRED:
157 /* password expired */
158 _pam_log(LOG_WARNING, "user `%s' password expired", user);
160 case PAM_NEW_AUTHTOK_REQD:
161 /* password expired */
162 _pam_log(LOG_WARNING, "user `%s' new password required", user);
164 case PAM_USER_UNKNOWN:
165 /* the user does not exist */
166 if (ctrl & WINBIND_DEBUG_ARG)
167 _pam_log(LOG_NOTICE, "user `%s' not found",
169 if (ctrl & WINBIND_UNKNOWN_OK_ARG) {
174 if (req_type == WINBINDD_PAM_AUTH) {
175 /* Otherwise, the authentication looked good */
176 _pam_log(LOG_NOTICE, "user '%s' granted acces", user);
177 } else if (req_type == WINBINDD_PAM_CHAUTHTOK) {
178 /* Otherwise, the authentication looked good */
179 _pam_log(LOG_NOTICE, "user '%s' password changed", user);
181 /* Otherwise, the authentication looked good */
182 _pam_log(LOG_NOTICE, "user '%s' OK", user);
186 /* we don't know anything about this return value */
187 _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s'",
193 /* talk to winbindd */
194 static int winbind_auth_request(const char *user, const char *pass, int ctrl)
196 struct winbindd_request request;
197 struct winbindd_response response;
199 ZERO_STRUCT(request);
201 strncpy(request.data.auth.user, user,
202 sizeof(request.data.auth.user)-1);
204 strncpy(request.data.auth.pass, pass,
205 sizeof(request.data.auth.pass)-1);
208 return pam_winbind_request_log(WINBINDD_PAM_AUTH, &request, &response, ctrl, user);
211 /* talk to winbindd */
212 static int winbind_chauthtok_request(const char *user, const char *oldpass,
213 const char *newpass, int ctrl)
215 struct winbindd_request request;
216 struct winbindd_response response;
218 ZERO_STRUCT(request);
220 if (request.data.chauthtok.user == NULL) return -2;
222 strncpy(request.data.chauthtok.user, user,
223 sizeof(request.data.chauthtok.user) - 1);
225 if (oldpass != NULL) {
226 strncpy(request.data.chauthtok.oldpass, oldpass,
227 sizeof(request.data.chauthtok.oldpass) - 1);
229 request.data.chauthtok.oldpass[0] = '\0';
232 if (newpass != NULL) {
233 strncpy(request.data.chauthtok.newpass, newpass,
234 sizeof(request.data.chauthtok.newpass) - 1);
236 request.data.chauthtok.newpass[0] = '\0';
239 return pam_winbind_request_log(WINBINDD_PAM_CHAUTHTOK, &request, &response, ctrl, user);
243 * Checks if a user has an account
250 static int valid_user(const char *user)
252 if (getpwnam(user)) return 0;
256 static char *_pam_delete(register char *xx)
264 * obtain a password from the user
267 static int _winbind_read_password(pam_handle_t * pamh
280 * make sure nothing inappropriate gets returned
283 *pass = token = NULL;
286 * which authentication token are we getting?
289 authtok_flag = on(WINBIND__OLD_PASSWORD, ctrl) ? PAM_OLDAUTHTOK : PAM_AUTHTOK;
292 * should we obtain the password from a PAM item ?
295 if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) || on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
296 retval = pam_get_item(pamh, authtok_flag, (const void **) &item);
297 if (retval != PAM_SUCCESS) {
300 "pam_get_item returned error to unix-read-password"
303 } else if (item != NULL) { /* we have a password! */
307 } else if (on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
308 return PAM_AUTHTOK_RECOVER_ERR; /* didn't work */
309 } else if (on(WINBIND_USE_AUTHTOK_ARG, ctrl)
310 && off(WINBIND__OLD_PASSWORD, ctrl)) {
311 return PAM_AUTHTOK_RECOVER_ERR;
315 * getting here implies we will have to get the password from the
320 struct pam_message msg[3], *pmsg[3];
321 struct pam_response *resp;
324 /* prepare to converse */
326 if (comment != NULL) {
328 msg[0].msg_style = PAM_TEXT_INFO;
329 msg[0].msg = comment;
336 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
337 msg[i++].msg = prompt1;
340 if (prompt2 != NULL) {
342 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
343 msg[i++].msg = prompt2;
346 /* so call the conversation expecting i responses */
348 retval = converse(pamh, i, pmsg, &resp);
352 /* interpret the response */
354 if (retval == PAM_SUCCESS) { /* a good conversation */
356 token = x_strdup(resp[i - replies].resp);
360 /* verify that password entered correctly */
361 if (!resp[i - 1].resp
362 || strcmp(token, resp[i - 1].resp)) {
363 _pam_delete(token); /* mistyped */
364 retval = PAM_AUTHTOK_RECOVER_ERR;
365 _make_remark(pamh ,PAM_ERROR_MSG, MISTYPED_PASS);
370 ,"could not recover authentication token");
375 * tidy up the conversation (resp_retcode) is ignored
376 * -- what is it for anyway? AGM
379 _pam_drop_reply(resp, i);
382 retval = (retval == PAM_SUCCESS)
383 ? PAM_AUTHTOK_RECOVER_ERR : retval;
387 if (retval != PAM_SUCCESS) {
388 if (on(WINBIND_DEBUG_ARG, ctrl))
390 "unable to obtain a password");
393 /* 'token' is the entered password */
395 /* we store this password as an item */
397 retval = pam_set_item(pamh, authtok_flag, token);
398 _pam_delete(token); /* clean it up */
399 if (retval != PAM_SUCCESS
400 || (retval = pam_get_item(pamh, authtok_flag
401 ,(const void **) &item))
404 _pam_log(LOG_CRIT, "error manipulating password");
410 item = NULL; /* break link to password */
416 int pam_sm_authenticate(pam_handle_t *pamh, int flags,
417 int argc, const char **argv)
419 const char *username;
420 const char *password;
421 int retval = PAM_AUTH_ERR;
423 /* parse arguments */
424 int ctrl = _pam_parse(argc, argv);
426 /* Get the username */
427 retval = pam_get_user(pamh, &username, NULL);
428 if ((retval != PAM_SUCCESS) || (!username)) {
429 if (ctrl & WINBIND_DEBUG_ARG)
430 _pam_log(LOG_DEBUG,"can not get the username");
431 return PAM_SERVICE_ERR;
434 retval = _winbind_read_password(pamh, ctrl, NULL,
438 if (retval != PAM_SUCCESS) {
439 _pam_log(LOG_ERR, "Could not retrieve user's password");
440 return PAM_AUTHTOK_ERR;
443 if (ctrl & WINBIND_DEBUG_ARG) {
445 /* Let's not give too much away in the log file */
447 #ifdef DEBUG_PASSWORD
448 _pam_log(LOG_INFO, "Verify user `%s' with password `%s'",
451 _pam_log(LOG_INFO, "Verify user `%s'", username);
455 /* Now use the username to look up password */
456 return winbind_auth_request(username, password, ctrl);
460 int pam_sm_setcred(pam_handle_t *pamh, int flags,
461 int argc, const char **argv)
467 * Account management. We want to verify that the account exists
468 * before returning PAM_SUCCESS
471 int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
472 int argc, const char **argv)
474 const char *username;
475 int retval = PAM_USER_UNKNOWN;
477 /* parse arguments */
478 int ctrl = _pam_parse(argc, argv);
480 /* Get the username */
481 retval = pam_get_user(pamh, &username, NULL);
482 if ((retval != PAM_SUCCESS) || (!username)) {
483 if (ctrl & WINBIND_DEBUG_ARG)
484 _pam_log(LOG_DEBUG,"can not get the username");
485 return PAM_SERVICE_ERR;
488 /* Verify the username */
489 retval = valid_user(username);
492 /* some sort of system error. The log was already printed */
493 return PAM_SERVICE_ERR;
495 /* the user does not exist */
496 if (ctrl & WINBIND_DEBUG_ARG)
497 _pam_log(LOG_NOTICE, "user `%s' not found",
499 if (ctrl & WINBIND_UNKNOWN_OK_ARG)
501 return PAM_USER_UNKNOWN;
503 /* Otherwise, the authentication looked good */
504 _pam_log(LOG_NOTICE, "user '%s' granted acces", username);
507 /* we don't know anything about this return value */
508 _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s'",
510 return PAM_SERVICE_ERR;
513 /* should not be reached */
517 int pam_sm_open_session(pam_handle_t *pamh, int flags,
518 int argc, const char **argv)
520 /* parse arguments */
521 int ctrl = _pam_parse(argc, argv);
522 if (ctrl & WINBIND_DEBUG_ARG)
523 _pam_log(LOG_DEBUG,"libpam_winbind:pam_sm_open_session handler");
527 int pam_sm_close_session(pam_handle_t *pamh, int flags,
528 int argc, const char **argv)
530 /* parse arguments */
531 int ctrl = _pam_parse(argc, argv);
532 if (ctrl & WINBIND_DEBUG_ARG)
533 _pam_log(LOG_DEBUG,"libpam_winbind:pam_sm_close_session handler");
539 PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
540 int argc, const char **argv)
544 unsigned int ctrl = _pam_parse(argc, argv);
546 /* <DO NOT free() THESE> */
548 char *pass_old, *pass_new;
549 /* </DO NOT free() THESE> */
556 * First get the name of a user
558 retval = pam_get_user(pamh, &user, "Username: ");
559 if (retval == PAM_SUCCESS) {
561 _pam_log(LOG_ERR, "username was NULL!");
562 return PAM_USER_UNKNOWN;
564 if (retval == PAM_SUCCESS && on(WINBIND_DEBUG_ARG, ctrl))
565 _pam_log(LOG_DEBUG, "username [%s] obtained",
568 if (on(WINBIND_DEBUG_ARG, ctrl))
570 "password - could not identify user");
575 * obtain and verify the current password (OLDAUTHTOK) for
579 if (flags & PAM_PRELIM_CHECK) {
581 /* instruct user what is happening */
582 #define greeting "Changing password for "
583 Announce = (char *) malloc(sizeof(greeting) + strlen(user));
584 if (Announce == NULL) {
586 "password - out of memory");
589 (void) strcpy(Announce, greeting);
590 (void) strcpy(Announce + sizeof(greeting) - 1, user);
593 lctrl = ctrl | WINBIND__OLD_PASSWORD;
594 retval = _winbind_read_password(pamh, lctrl
596 ,"(current) NT password: "
598 ,(const char **) &pass_old);
601 if (retval != PAM_SUCCESS) {
603 ,"password - (old) token not obtained");
606 /* verify that this is the password for this user */
608 retval = winbind_auth_request(user, pass_old, ctrl);
610 if (retval != PAM_ACCT_EXPIRED
611 && retval != PAM_AUTHTOK_EXPIRED
612 && retval != PAM_NEW_AUTHTOK_REQD
613 && retval != PAM_SUCCESS) {
618 retval = pam_set_item(pamh, PAM_OLDAUTHTOK, (const void *) pass_old);
620 if (retval != PAM_SUCCESS) {
622 "failed to set PAM_OLDAUTHTOK");
624 } else if (flags & PAM_UPDATE_AUTHTOK) {
627 * obtain the proposed password
631 * get the old token back.
634 retval = pam_get_item(pamh, PAM_OLDAUTHTOK
635 ,(const void **) &pass_old);
637 if (retval != PAM_SUCCESS) {
638 _pam_log(LOG_NOTICE, "user not authenticated");
644 if (on(WINBIND_USE_AUTHTOK_ARG, lctrl)) {
645 ctrl = WINBIND_USE_FIRST_PASS_ARG | lctrl;
648 retval = PAM_AUTHTOK_ERR;
649 while ((retval != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
651 * use_authtok is to force the use of a previously entered
652 * password -- needed for pluggable password strength checking
655 retval = _winbind_read_password(pamh, lctrl
657 ,"Enter new NT password: "
658 ,"Retype new NT password: "
659 ,(const char **) &pass_new);
661 if (retval != PAM_SUCCESS) {
662 if (on(WINBIND_DEBUG_ARG, ctrl)) {
664 ,"password - new password not obtained");
666 pass_old = NULL;/* tidy up */
671 * At this point we know who the user is and what they
672 * propose as their new password. Verify that the new
673 * password is acceptable.
676 if (pass_new[0] == '\0') {/* "\0" password = NULL */
682 * By reaching here we have approved the passwords and must now
683 * rebuild the password database file.
686 retval = winbind_chauthtok_request(user, pass_old, pass_new, ctrl);
687 _pam_overwrite(pass_new);
688 _pam_overwrite(pass_old);
689 pass_old = pass_new = NULL;
691 retval = PAM_SERVICE_ERR;
699 /* static module data */
701 struct pam_module _pam_winbind_modstruct = {
707 pam_sm_close_session,
714 * Copyright (c) Andrew Tridgell <tridge@samba.org> 2000
715 * Copyright (c) Tim Potter <tpot@samba.org> 2000
716 * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
717 * Copyright (c) Jan Rêkorajski 1999.
718 * Copyright (c) Andrew G. Morgan 1996-8.
719 * Copyright (c) Alex O. Yuriev, 1996.
720 * Copyright (c) Cristian Gafton 1996.
721 * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
723 * Redistribution and use in source and binary forms, with or without
724 * modification, are permitted provided that the following conditions
726 * 1. Redistributions of source code must retain the above copyright
727 * notice, and the entire permission notice in its entirety,
728 * including the disclaimer of warranties.
729 * 2. Redistributions in binary form must reproduce the above copyright
730 * notice, this list of conditions and the following disclaimer in the
731 * documentation and/or other materials provided with the distribution.
732 * 3. The name of the author may not be used to endorse or promote
733 * products derived from this software without specific prior
734 * written permission.
736 * ALTERNATIVELY, this product may be distributed under the terms of
737 * the GNU Public License, in which case the provisions of the GPL are
738 * required INSTEAD OF the above restrictions. (This clause is
739 * necessary due to a potential bad interaction between the GPL and
740 * the restrictions contained in a BSD-style copyright.)
742 * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
743 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
744 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
745 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
746 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
747 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
748 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
749 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
750 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
751 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
752 * OF THE POSSIBILITY OF SUCH DAMAGE.