-/*
+/*
Unix SMB/CIFS implementation.
samr server password set/change handling
Copyright (C) Andrew Tridgell 2004
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
-
+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "rpc_server/dcerpc_server.h"
-#include "rpc_server/common/common.h"
#include "rpc_server/samr/dcesrv_samr.h"
#include "system/time.h"
-#include "lib/crypto/crypto.h"
-#include "ads.h"
-#include "libcli/ldap/ldap.h"
+#include "../lib/crypto/crypto.h"
#include "dsdb/samdb/samdb.h"
#include "auth/auth.h"
-#include "rpc_server/samr/proto.h"
#include "libcli/auth/libcli_auth.h"
-#include "db_wrap.h"
-
-/*
- samr_ChangePasswordUser
-*/
-NTSTATUS samr_ChangePasswordUser(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
- struct samr_ChangePasswordUser *r)
+#include "../lib/util/util_ldb.h"
+#include "rpc_server/samr/proto.h"
+#include "auth/auth_sam.h"
+
+static void log_password_change_event(struct imessaging_context *msg_ctx,
+ struct loadparm_context *lp_ctx,
+ const struct tsocket_address *remote_client_address,
+ const struct tsocket_address *local_server_address,
+ const char *auth_description,
+ const char *password_type,
+ const char *original_client_name,
+ const char *account_name_from_db,
+ NTSTATUS status,
+ struct dom_sid *sid)
{
- struct dcesrv_handle *h;
- struct samr_account_state *a_state;
- struct ldb_context *sam_ctx;
- struct ldb_message **res, *msg;
- int ret;
- struct samr_Password new_lmPwdHash, new_ntPwdHash, checkHash;
- struct samr_Password *lm_pwd, *nt_pwd;
- NTSTATUS status = NT_STATUS_OK;
- const char * const attrs[] = { "lmPwdHash", "ntPwdHash" , NULL };
-
- DCESRV_PULL_HANDLE(h, r->in.user_handle, SAMR_HANDLE_USER);
-
- a_state = h->data;
-
- /* basic sanity checking on parameters. Do this before any database ops */
- if (!r->in.lm_present || !r->in.nt_present ||
- !r->in.old_lm_crypted || !r->in.new_lm_crypted ||
- !r->in.old_nt_crypted || !r->in.new_nt_crypted) {
- /* we should really handle a change with lm not
- present */
- return NT_STATUS_INVALID_PARAMETER_MIX;
- }
- if (!r->in.cross1_present || !r->in.nt_cross) {
- return NT_STATUS_NT_CROSS_ENCRYPTION_REQUIRED;
- }
- if (!r->in.cross2_present || !r->in.lm_cross) {
- return NT_STATUS_LM_CROSS_ENCRYPTION_REQUIRED;
- }
-
- /* To change a password we need to open as system */
- sam_ctx = samdb_connect(mem_ctx, system_session(mem_ctx));
- if (sam_ctx == NULL) {
- return NT_STATUS_INVALID_SYSTEM_SERVICE;
- }
-
- ret = ldb_transaction_start(sam_ctx);
- if (ret) {
- DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
- return NT_STATUS_TRANSACTION_ABORTED;
- }
-
- /* fetch the old hashes */
- ret = gendb_search_dn(sam_ctx, mem_ctx,
- a_state->account_dn, &res, attrs);
- if (ret != 1) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_WRONG_PASSWORD;
- }
- msg = res[0];
-
- status = samdb_result_passwords(mem_ctx, msg, &lm_pwd, &nt_pwd);
- if (!NT_STATUS_IS_OK(status) || !lm_pwd || !nt_pwd) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_WRONG_PASSWORD;
- }
-
- /* decrypt and check the new lm hash */
- D_P16(lm_pwd->hash, r->in.new_lm_crypted->hash, new_lmPwdHash.hash);
- D_P16(new_lmPwdHash.hash, r->in.old_lm_crypted->hash, checkHash.hash);
- if (memcmp(checkHash.hash, lm_pwd, 16) != 0) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_WRONG_PASSWORD;
- }
-
- /* decrypt and check the new nt hash */
- D_P16(nt_pwd->hash, r->in.new_nt_crypted->hash, new_ntPwdHash.hash);
- D_P16(new_ntPwdHash.hash, r->in.old_nt_crypted->hash, checkHash.hash);
- if (memcmp(checkHash.hash, nt_pwd, 16) != 0) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_WRONG_PASSWORD;
- }
-
- /* check the nt cross hash */
- D_P16(lm_pwd->hash, r->in.nt_cross->hash, checkHash.hash);
- if (memcmp(checkHash.hash, new_ntPwdHash.hash, 16) != 0) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_WRONG_PASSWORD;
- }
-
- /* check the lm cross hash */
- D_P16(nt_pwd->hash, r->in.lm_cross->hash, checkHash.hash);
- if (memcmp(checkHash.hash, new_lmPwdHash.hash, 16) != 0) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_WRONG_PASSWORD;
- }
-
- msg = ldb_msg_new(mem_ctx);
- if (msg == NULL) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- msg->dn = ldb_dn_copy(msg, a_state->account_dn);
- if (!msg->dn) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- /* set the password on the user DN specified. This may fail
- * due to password policies */
- status = samdb_set_password(sam_ctx, mem_ctx,
- a_state->account_dn, a_state->domain_state->domain_dn,
- msg, NULL, &new_lmPwdHash, &new_ntPwdHash,
- True, /* this is a user password change */
- True, /* run restriction tests */
- NULL,
- NULL);
- if (!NT_STATUS_IS_OK(status)) {
- ldb_transaction_cancel(sam_ctx);
- return status;
- }
-
- /* The above call only setup the modifications, this actually
- * makes the write to the database. */
- ret = samdb_replace(sam_ctx, mem_ctx, msg);
- if (ret != 0) {
- DEBUG(2,("Failed to modify record to change password on %s: %s\n",
- ldb_dn_linearize(mem_ctx, a_state->account_dn),
- ldb_errstring(sam_ctx)));
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
- }
+ /*
+ * Forcing this via the NTLM auth structure is not ideal, but
+ * it is the most practical option right now, and ensures the
+ * logs are consistent, even if some elements are always NULL.
+ */
+ struct auth_usersupplied_info ui = {
+ .mapped_state = true,
+ .was_mapped = true,
+ .client = {
+ .account_name = original_client_name,
+ .domain_name = lpcfg_sam_name(lp_ctx),
+ },
+ .mapped = {
+ .account_name = account_name_from_db,
+ .domain_name = lpcfg_sam_name(lp_ctx),
+ },
+ .remote_host = remote_client_address,
+ .local_host = local_server_address,
+ .service_description = "SAMR Password Change",
+ .auth_description = auth_description,
+ .password_type = password_type,
+ };
+
+ log_authentication_event(msg_ctx,
+ lp_ctx,
+ &ui,
+ status,
+ ui.mapped.domain_name,
+ ui.mapped.account_name,
+ NULL,
+ sid);
+}
+/*
+ samr_ChangePasswordUser
- /* And this confirms it in a transaction commit */
- ret = ldb_transaction_commit(sam_ctx);
- if (ret != 0) {
- DEBUG(1,("Failed to commit transaction to change password on %s: %s\n",
- ldb_dn_linearize(mem_ctx, a_state->account_dn),
- ldb_errstring(sam_ctx)));
- return NT_STATUS_TRANSACTION_ABORTED;
- }
+ So old it is just not worth implementing
+ because it does not supply a plaintext and so we can't do password
+ complexity checking and cannot update all the other password hashes.
- return NT_STATUS_OK;
+*/
+NTSTATUS dcesrv_samr_ChangePasswordUser(struct dcesrv_call_state *dce_call,
+ TALLOC_CTX *mem_ctx,
+ struct samr_ChangePasswordUser *r)
+{
+ return NT_STATUS_NOT_IMPLEMENTED;
}
-/*
- samr_OemChangePasswordUser2
+/*
+ samr_OemChangePasswordUser2
*/
-NTSTATUS samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
- struct samr_OemChangePasswordUser2 *r)
+NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call,
+ TALLOC_CTX *mem_ctx,
+ struct samr_OemChangePasswordUser2 *r)
{
- NTSTATUS status;
- char new_pass[512];
- uint32_t new_pass_len;
+ NTSTATUS status = NT_STATUS_WRONG_PASSWORD;
+ DATA_BLOB new_password, new_unicode_password;
+ char *new_pass;
struct samr_CryptPassword *pwbuf = r->in.password;
struct ldb_context *sam_ctx;
- const struct ldb_dn *user_dn;
+ struct ldb_dn *user_dn;
int ret;
- struct ldb_message **res, *mod;
- const char * const attrs[] = { "objectSid", "lmPwdHash", NULL };
+ struct ldb_message **res;
+ const char * const attrs[] = { "objectSid", "dBCSPwd",
+ "userAccountControl",
+ "msDS-User-Account-Control-Computed",
+ "badPwdCount", "badPasswordTime",
+ "samAccountName",
+ NULL };
struct samr_Password *lm_pwd;
DATA_BLOB lm_pwd_blob;
uint8_t new_lm_hash[16];
struct samr_Password lm_verifier;
+ size_t unicode_pw_len;
+ size_t converted_size = 0;
+ const char *user_samAccountName = NULL;
+ struct dom_sid *user_objectSid = NULL;
if (pwbuf == NULL) {
- return NT_STATUS_WRONG_PASSWORD;
+ return NT_STATUS_INVALID_PARAMETER;
}
- /* To change a password we need to open as system */
- sam_ctx = samdb_connect(mem_ctx, system_session(mem_ctx));
- if (sam_ctx == NULL) {
- return NT_STATUS_INVALID_SYSTEM_SERVICE;
+ if (r->in.hash == NULL) {
+ return NT_STATUS_INVALID_PARAMETER;
}
- ret = ldb_transaction_start(sam_ctx);
- if (ret) {
- DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
- return NT_STATUS_TRANSACTION_ABORTED;
+ /* this call can only work with lanman auth */
+ if (!lpcfg_lanman_auth(dce_call->conn->dce_ctx->lp_ctx)) {
+ return NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER;
+ }
+
+ /* Connect to a SAMDB with system privileges for fetching the old pw
+ * hashes. */
+ sam_ctx = samdb_connect(mem_ctx,
+ dce_call->event_ctx,
+ dce_call->conn->dce_ctx->lp_ctx,
+ system_session(dce_call->conn->dce_ctx->lp_ctx),
+ dce_call->conn->remote_address,
+ 0);
+ if (sam_ctx == NULL) {
+ return NT_STATUS_INVALID_SYSTEM_SERVICE;
}
/* we need the users dn and the domain dn (derived from the
user SID). We also need the current lm password hash in
order to decrypt the incoming password */
- ret = gendb_search(sam_ctx,
+ ret = gendb_search(sam_ctx,
mem_ctx, NULL, &res, attrs,
"(&(sAMAccountName=%s)(objectclass=user))",
- r->in.account->string);
+ ldb_binary_encode_string(mem_ctx, r->in.account->string));
if (ret != 1) {
- ldb_transaction_cancel(sam_ctx);
- /* Don't give the game away: (don't allow anonymous users to prove the existance of usernames) */
- return NT_STATUS_WRONG_PASSWORD;
+ status = NT_STATUS_NO_SUCH_USER; /* Converted to WRONG_PASSWORD below */
+ goto failed;
}
user_dn = res[0]->dn;
- status = samdb_result_passwords(mem_ctx, res[0], &lm_pwd, NULL);
- if (!NT_STATUS_IS_OK(status) || !lm_pwd) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_WRONG_PASSWORD;
+ user_samAccountName = ldb_msg_find_attr_as_string(res[0], "samAccountName", NULL);
+ user_objectSid = samdb_result_dom_sid(res, res[0], "objectSid");
+
+ status = samdb_result_passwords(mem_ctx, dce_call->conn->dce_ctx->lp_ctx,
+ res[0], &lm_pwd, NULL);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto failed;
+ } else if (!lm_pwd) {
+ status = NT_STATUS_WRONG_PASSWORD;
+ goto failed;
}
/* decrypt the password we have been given */
- lm_pwd_blob = data_blob(lm_pwd->hash, sizeof(lm_pwd->hash));
+ lm_pwd_blob = data_blob(lm_pwd->hash, sizeof(lm_pwd->hash));
arcfour_crypt_blob(pwbuf->data, 516, &lm_pwd_blob);
data_blob_free(&lm_pwd_blob);
-
- if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
- &new_pass_len, STR_ASCII)) {
- ldb_transaction_cancel(sam_ctx);
+
+ if (!extract_pw_from_buffer(mem_ctx, pwbuf->data, &new_password)) {
DEBUG(3,("samr: failed to decode password buffer\n"));
- return NT_STATUS_WRONG_PASSWORD;
+ authsam_update_bad_pwd_count(sam_ctx, res[0], ldb_get_default_basedn(sam_ctx));
+ status = NT_STATUS_WRONG_PASSWORD;
+ goto failed;
}
- /* check LM verifier */
- if (lm_pwd == NULL || r->in.hash == NULL) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_WRONG_PASSWORD;
+ if (!convert_string_talloc_handle(mem_ctx, lpcfg_iconv_handle(dce_call->conn->dce_ctx->lp_ctx),
+ CH_DOS, CH_UNIX,
+ (const char *)new_password.data,
+ new_password.length,
+ (void **)&new_pass, &converted_size)) {
+ DEBUG(3,("samr: failed to convert incoming password buffer to unix charset\n"));
+ authsam_update_bad_pwd_count(sam_ctx, res[0], ldb_get_default_basedn(sam_ctx));
+ status = NT_STATUS_WRONG_PASSWORD;
+ goto failed;
}
+ if (!convert_string_talloc_handle(mem_ctx, lpcfg_iconv_handle(dce_call->conn->dce_ctx->lp_ctx),
+ CH_DOS, CH_UTF16,
+ (const char *)new_password.data,
+ new_password.length,
+ (void **)&new_unicode_password.data, &unicode_pw_len)) {
+ DEBUG(3,("samr: failed to convert incoming password buffer to UTF16 charset\n"));
+ authsam_update_bad_pwd_count(sam_ctx, res[0], ldb_get_default_basedn(sam_ctx));
+ status = NT_STATUS_WRONG_PASSWORD;
+ goto failed;
+ }
+ new_unicode_password.length = unicode_pw_len;
+
E_deshash(new_pass, new_lm_hash);
E_old_pw_hash(new_lm_hash, lm_pwd->hash, lm_verifier.hash);
if (memcmp(lm_verifier.hash, r->in.hash->hash, 16) != 0) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_WRONG_PASSWORD;
+ authsam_update_bad_pwd_count(sam_ctx, res[0], ldb_get_default_basedn(sam_ctx));
+ status = NT_STATUS_WRONG_PASSWORD;
+ goto failed;
}
- mod = ldb_msg_new(mem_ctx);
- if (mod == NULL) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_NO_MEMORY;
+ /* Connect to a SAMDB with user privileges for the password change */
+ sam_ctx = samdb_connect(mem_ctx,
+ dce_call->event_ctx,
+ dce_call->conn->dce_ctx->lp_ctx,
+ dce_call->conn->auth_state.session_info,
+ dce_call->conn->remote_address,
+ 0);
+ if (sam_ctx == NULL) {
+ return NT_STATUS_INVALID_SYSTEM_SERVICE;
}
- mod->dn = ldb_dn_copy(mod, user_dn);
- if (!mod->dn) {
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_NO_MEMORY;
+ /* Start transaction */
+ ret = ldb_transaction_start(sam_ctx);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
+ return NT_STATUS_TRANSACTION_ABORTED;
}
- /* set the password on the user DN specified. This may fail
- * due to password policies */
+ /* Performs the password modification. We pass the old hashes read out
+ * from the database since they were already checked against the user-
+ * provided ones. */
status = samdb_set_password(sam_ctx, mem_ctx,
- user_dn, NULL,
- mod, new_pass,
+ user_dn, NULL,
+ &new_unicode_password,
NULL, NULL,
- True, /* this is a user password change */
- True, /* run restriction tests */
- NULL,
+ lm_pwd, NULL, /* this is a user password change */
+ NULL,
NULL);
if (!NT_STATUS_IS_OK(status)) {
ldb_transaction_cancel(sam_ctx);
- return status;
- }
-
- /* The above call only setup the modifications, this actually
- * makes the write to the database. */
- ret = samdb_replace(sam_ctx, mem_ctx, mod);
- if (ret != 0) {
- DEBUG(2,("Failed to modify record to change password on %s: %s\n",
- ldb_dn_linearize(mem_ctx, user_dn),
- ldb_errstring(sam_ctx)));
- ldb_transaction_cancel(sam_ctx);
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ goto failed;
}
/* And this confirms it in a transaction commit */
ret = ldb_transaction_commit(sam_ctx);
- if (ret != 0) {
+ if (ret != LDB_SUCCESS) {
DEBUG(1,("Failed to commit transaction to change password on %s: %s\n",
- ldb_dn_linearize(mem_ctx, user_dn),
+ ldb_dn_get_linearized(user_dn),
ldb_errstring(sam_ctx)));
- return NT_STATUS_TRANSACTION_ABORTED;
+ status = NT_STATUS_TRANSACTION_ABORTED;
+ goto failed;
+ }
+
+ status = NT_STATUS_OK;
+
+failed:
+
+ log_password_change_event(dce_call->conn->msg_ctx,
+ dce_call->conn->dce_ctx->lp_ctx,
+ dce_call->conn->remote_address,
+ dce_call->conn->local_address,
+ "OemChangePasswordUser2",
+ "RC4/DES using LanMan-hash",
+ r->in.account->string,
+ user_samAccountName,
+ status,
+ user_objectSid);
+ if (NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_OK;
+ }
+ /* Only update the badPwdCount if we found the user */
+ if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
+ authsam_update_bad_pwd_count(sam_ctx, res[0], ldb_get_default_basedn(sam_ctx));
+ } else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
+ /* Don't give the game away: (don't allow anonymous users to prove the existence of usernames) */
+ status = NT_STATUS_WRONG_PASSWORD;
}
- return NT_STATUS_OK;
+ return status;
}
-/*
- samr_ChangePasswordUser3
+/*
+ samr_ChangePasswordUser3
*/
-NTSTATUS samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
- TALLOC_CTX *mem_ctx,
- struct samr_ChangePasswordUser3 *r)
-{
- NTSTATUS status;
- char new_pass[512];
- uint32_t new_pass_len;
+NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
+ TALLOC_CTX *mem_ctx,
+ struct samr_ChangePasswordUser3 *r)
+{
+ NTSTATUS status = NT_STATUS_WRONG_PASSWORD;
+ DATA_BLOB new_password;
struct ldb_context *sam_ctx = NULL;
- const struct ldb_dn *user_dn;
+ struct ldb_dn *user_dn = NULL;
int ret;
- struct ldb_message **res, *mod;
- const char * const attrs[] = { "ntPwdHash", "lmPwdHash", NULL };
+ struct ldb_message **res;
+ const char * const attrs[] = { "unicodePwd", "dBCSPwd",
+ "userAccountControl",
+ "msDS-User-Account-Control-Computed",
+ "badPwdCount", "badPasswordTime",
+ "objectSid", NULL };
struct samr_Password *nt_pwd, *lm_pwd;
DATA_BLOB nt_pwd_blob;
struct samr_DomInfo1 *dominfo = NULL;
- struct samr_ChangeReject *reject = NULL;
- enum samr_RejectReason reason = SAMR_REJECT_OTHER;
+ struct userPwdChangeFailureInformation *reject = NULL;
+ enum samPwdChangeReason reason = SAM_PWD_CHANGE_NO_ERROR;
uint8_t new_nt_hash[16], new_lm_hash[16];
struct samr_Password nt_verifier, lm_verifier;
+ const char *user_samAccountName = NULL;
+ struct dom_sid *user_objectSid = NULL;
+ enum ntlm_auth_level ntlm_auth_level
+ = lpcfg_ntlm_auth(dce_call->conn->dce_ctx->lp_ctx);
+
+ *r->out.dominfo = NULL;
+ *r->out.reject = NULL;
- ZERO_STRUCT(r->out);
+ /* this call should be disabled without NTLM auth */
+ if (ntlm_auth_level == NTLM_AUTH_DISABLED) {
+ DBG_WARNING("NTLM password changes not"
+ "permitted by configuration.\n");
+ return NT_STATUS_NTLM_BLOCKED;
+ }
if (r->in.nt_password == NULL ||
r->in.nt_verifier == NULL) {
return NT_STATUS_INVALID_PARAMETER;
}
- /* To change a password we need to open as system */
- sam_ctx = samdb_connect(mem_ctx, system_session(mem_ctx));
+ /* Connect to a SAMDB with system privileges for fetching the old pw
+ * hashes. */
+ sam_ctx = samdb_connect(mem_ctx,
+ dce_call->event_ctx,
+ dce_call->conn->dce_ctx->lp_ctx,
+ system_session(dce_call->conn->dce_ctx->lp_ctx),
+ dce_call->conn->remote_address,
+ 0);
if (sam_ctx == NULL) {
return NT_STATUS_INVALID_SYSTEM_SERVICE;
}
- ret = ldb_transaction_start(sam_ctx);
- if (ret) {
- talloc_free(sam_ctx);
- DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
- return NT_STATUS_TRANSACTION_ABORTED;
- }
-
/* we need the users dn and the domain dn (derived from the
user SID). We also need the current lm and nt password hashes
in order to decrypt the incoming passwords */
- ret = gendb_search(sam_ctx,
+ ret = gendb_search(sam_ctx,
mem_ctx, NULL, &res, attrs,
"(&(sAMAccountName=%s)(objectclass=user))",
- r->in.account->string);
+ ldb_binary_encode_string(mem_ctx, r->in.account->string));
if (ret != 1) {
- /* Don't give the game away: (don't allow anonymous users to prove the existance of usernames) */
- status = NT_STATUS_WRONG_PASSWORD;
+ status = NT_STATUS_NO_SUCH_USER; /* Converted to WRONG_PASSWORD below */
goto failed;
}
user_dn = res[0]->dn;
+ user_samAccountName = ldb_msg_find_attr_as_string(res[0], "samAccountName", NULL);
+ user_objectSid = samdb_result_dom_sid(res, res[0], "objectSid");
- status = samdb_result_passwords(mem_ctx, res[0], &lm_pwd, &nt_pwd);
+ status = samdb_result_passwords(mem_ctx, dce_call->conn->dce_ctx->lp_ctx,
+ res[0], &lm_pwd, &nt_pwd);
if (!NT_STATUS_IS_OK(status) ) {
goto failed;
}
arcfour_crypt_blob(r->in.nt_password->data, 516, &nt_pwd_blob);
data_blob_free(&nt_pwd_blob);
- if (!decode_pw_buffer(r->in.nt_password->data, new_pass, sizeof(new_pass),
- &new_pass_len, STR_UNICODE)) {
+ if (!extract_pw_from_buffer(mem_ctx, r->in.nt_password->data, &new_password)) {
DEBUG(3,("samr: failed to decode password buffer\n"));
- status = NT_STATUS_WRONG_PASSWORD;
+ status = NT_STATUS_WRONG_PASSWORD;
goto failed;
}
}
/* check NT verifier */
- E_md4hash(new_pass, new_nt_hash);
+ mdfour(new_nt_hash, new_password.data, new_password.length);
+
E_old_pw_hash(new_nt_hash, nt_pwd->hash, nt_verifier.hash);
if (memcmp(nt_verifier.hash, r->in.nt_verifier->hash, 16) != 0) {
status = NT_STATUS_WRONG_PASSWORD;
goto failed;
}
- /* check LM verifier */
+ /* check LM verifier (really not needed as we just checked the
+ * much stronger NT hash, but the RPC-SAMR test checks for
+ * this) */
if (lm_pwd && r->in.lm_verifier != NULL) {
- E_deshash(new_pass, new_lm_hash);
- E_old_pw_hash(new_nt_hash, lm_pwd->hash, lm_verifier.hash);
- if (memcmp(lm_verifier.hash, r->in.lm_verifier->hash, 16) != 0) {
- status = NT_STATUS_WRONG_PASSWORD;
- goto failed;
+ char *new_pass;
+ size_t converted_size = 0;
+
+ if (!convert_string_talloc_handle(mem_ctx, lpcfg_iconv_handle(dce_call->conn->dce_ctx->lp_ctx),
+ CH_UTF16, CH_UNIX,
+ (const char *)new_password.data,
+ new_password.length,
+ (void **)&new_pass, &converted_size)) {
+ E_deshash(new_pass, new_lm_hash);
+ E_old_pw_hash(new_nt_hash, lm_pwd->hash, lm_verifier.hash);
+ if (memcmp(lm_verifier.hash, r->in.lm_verifier->hash, 16) != 0) {
+ status = NT_STATUS_WRONG_PASSWORD;
+ goto failed;
+ }
}
}
-
- mod = ldb_msg_new(mem_ctx);
- if (mod == NULL) {
- return NT_STATUS_NO_MEMORY;
+ /* Connect to a SAMDB with user privileges for the password change */
+ sam_ctx = samdb_connect(mem_ctx,
+ dce_call->event_ctx,
+ dce_call->conn->dce_ctx->lp_ctx,
+ dce_call->conn->auth_state.session_info,
+ dce_call->conn->remote_address,
+ 0);
+ if (sam_ctx == NULL) {
+ return NT_STATUS_INVALID_SYSTEM_SERVICE;
}
- mod->dn = ldb_dn_copy(mod, user_dn);
- if (!mod->dn) {
- status = NT_STATUS_NO_MEMORY;
- goto failed;
+ ret = ldb_transaction_start(sam_ctx);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(sam_ctx)));
+ return NT_STATUS_TRANSACTION_ABORTED;
}
- /* set the password on the user DN specified. This may fail
- * due to password policies */
+ /* Performs the password modification. We pass the old hashes read out
+ * from the database since they were already checked against the user-
+ * provided ones. */
status = samdb_set_password(sam_ctx, mem_ctx,
- user_dn, NULL,
- mod, new_pass,
+ user_dn, NULL,
+ &new_password,
NULL, NULL,
- True, /* this is a user password change */
- True, /* run restriction tests */
- &reason,
+ lm_pwd, nt_pwd, /* this is a user password change */
+ &reason,
&dominfo);
- if (!NT_STATUS_IS_OK(status)) {
- goto failed;
- }
- /* The above call only setup the modifications, this actually
- * makes the write to the database. */
- ret = samdb_replace(sam_ctx, mem_ctx, mod);
- if (ret != 0) {
- DEBUG(2,("samdb_replace failed to change password for %s: %s\n",
- ldb_dn_linearize(mem_ctx, user_dn),
- ldb_errstring(sam_ctx)));
- status = NT_STATUS_UNSUCCESSFUL;
+ if (!NT_STATUS_IS_OK(status)) {
+ ldb_transaction_cancel(sam_ctx);
goto failed;
}
/* And this confirms it in a transaction commit */
ret = ldb_transaction_commit(sam_ctx);
- if (ret != 0) {
+ if (ret != LDB_SUCCESS) {
DEBUG(1,("Failed to commit transaction to change password on %s: %s\n",
- ldb_dn_linearize(mem_ctx, user_dn),
+ ldb_dn_get_linearized(user_dn),
ldb_errstring(sam_ctx)));
status = NT_STATUS_TRANSACTION_ABORTED;
goto failed;
}
- return NT_STATUS_OK;
+ status = NT_STATUS_OK;
failed:
- ldb_transaction_cancel(sam_ctx);
- talloc_free(sam_ctx);
- reject = talloc(mem_ctx, struct samr_ChangeReject);
- r->out.dominfo = dominfo;
- r->out.reject = reject;
+ log_password_change_event(dce_call->conn->msg_ctx,
+ dce_call->conn->dce_ctx->lp_ctx,
+ dce_call->conn->remote_address,
+ dce_call->conn->local_address,
+ "samr_ChangePasswordUser3",
+ "RC4/DES using NTLM-hash",
+ r->in.account->string,
+ user_samAccountName,
+ status,
+ user_objectSid);
+ if (NT_STATUS_IS_OK(status)) {
+ return NT_STATUS_OK;
+ }
+
+ /* Only update the badPwdCount if we found the user */
+ if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)) {
+ authsam_update_bad_pwd_count(sam_ctx, res[0], ldb_get_default_basedn(sam_ctx));
+ } else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
+ /* Don't give the game away: (don't allow anonymous users to prove the existence of usernames) */
+ status = NT_STATUS_WRONG_PASSWORD;
+ }
+
+ reject = talloc_zero(mem_ctx, struct userPwdChangeFailureInformation);
+ if (reject != NULL) {
+ reject->extendedFailureReason = reason;
- if (reject == NULL) {
- return status;
+ *r->out.reject = reject;
}
- ZERO_STRUCTP(reject);
- reject->reason = reason;
+ *r->out.dominfo = dominfo;
return status;
}
-
-/*
- samr_ChangePasswordUser2
+/*
+ samr_ChangePasswordUser2
easy - just a subset of samr_ChangePasswordUser3
*/
-NTSTATUS samr_ChangePasswordUser2(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
- struct samr_ChangePasswordUser2 *r)
+NTSTATUS dcesrv_samr_ChangePasswordUser2(struct dcesrv_call_state *dce_call,
+ TALLOC_CTX *mem_ctx,
+ struct samr_ChangePasswordUser2 *r)
{
struct samr_ChangePasswordUser3 r2;
+ struct samr_DomInfo1 *dominfo = NULL;
+ struct userPwdChangeFailureInformation *reject = NULL;
r2.in.server = r->in.server;
r2.in.account = r->in.account;
r2.in.lm_password = r->in.lm_password;
r2.in.lm_verifier = r->in.lm_verifier;
r2.in.password3 = NULL;
+ r2.out.dominfo = &dominfo;
+ r2.out.reject = &reject;
- return samr_ChangePasswordUser3(dce_call, mem_ctx, &r2);
+ return dcesrv_samr_ChangePasswordUser3(dce_call, mem_ctx, &r2);
}
-/*
- check that a password is sufficiently complex
-*/
-static BOOL samdb_password_complexity_ok(const char *pass)
-{
- return check_password_quality(pass);
-}
-
-/*
- set the user password using plaintext, obeying any user or domain
- password restrictions
-
- note that this function doesn't actually store the result in the
- database, it just fills in the "mod" structure with ldb modify
- elements to setup the correct change when samdb_replace() is
- called. This allows the caller to combine the change with other
- changes (as is needed by some of the set user info levels)
-
- The caller should probably have a transaction wrapping this
-*/
-NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
- const struct ldb_dn *user_dn,
- const struct ldb_dn *domain_dn,
- struct ldb_message *mod,
- const char *new_pass,
- struct samr_Password *lmNewHash,
- struct samr_Password *ntNewHash,
- BOOL user_change,
- BOOL restrictions,
- enum samr_RejectReason *reject_reason,
- struct samr_DomInfo1 **_dominfo)
-{
- const char * const user_attrs[] = { "userAccountControl", "sambaLMPwdHistory",
- "sambaNTPwdHistory",
- "lmPwdHash", "ntPwdHash",
- "objectSid",
- "pwdLastSet", NULL };
- const char * const domain_attrs[] = { "pwdProperties", "pwdHistoryLength",
- "maxPwdAge", "minPwdAge",
- "minPwdLength", NULL };
- NTTIME pwdLastSet;
- int64_t minPwdAge;
- uint_t minPwdLength, pwdProperties, pwdHistoryLength;
- uint_t userAccountControl;
- struct samr_Password *sambaLMPwdHistory, *sambaNTPwdHistory, *lmPwdHash, *ntPwdHash;
- struct samr_Password local_lmNewHash, local_ntNewHash;
- int sambaLMPwdHistory_len, sambaNTPwdHistory_len;
- struct dom_sid *domain_sid;
- struct ldb_message **res;
- int count;
- time_t now = time(NULL);
- NTTIME now_nt;
- int i;
-
- /* we need to know the time to compute password age */
- unix_to_nt_time(&now_nt, now);
-
- /* pull all the user parameters */
- count = gendb_search_dn(ctx, mem_ctx, user_dn, &res, user_attrs);
- if (count != 1) {
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
- }
- userAccountControl = samdb_result_uint(res[0], "userAccountControl", 0);
- sambaLMPwdHistory_len = samdb_result_hashes(mem_ctx, res[0],
- "sambaLMPwdHistory", &sambaLMPwdHistory);
- sambaNTPwdHistory_len = samdb_result_hashes(mem_ctx, res[0],
- "sambaNTPwdHistory", &sambaNTPwdHistory);
- lmPwdHash = samdb_result_hash(mem_ctx, res[0], "lmPwdHash");
- ntPwdHash = samdb_result_hash(mem_ctx, res[0], "ntPwdHash");
- pwdLastSet = samdb_result_uint64(res[0], "pwdLastSet", 0);
-
- if (domain_dn) {
- /* pull the domain parameters */
- count = gendb_search_dn(ctx, mem_ctx, domain_dn, &res, domain_attrs);
- if (count != 1) {
- return NT_STATUS_NO_SUCH_DOMAIN;
- }
- } else {
- /* work out the domain sid, and pull the domain from there */
- domain_sid = samdb_result_sid_prefix(mem_ctx, res[0], "objectSid");
- if (domain_sid == NULL) {
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
- }
-
- count = gendb_search(ctx, mem_ctx, NULL, &res, domain_attrs,
- "(objectSid=%s)",
- ldap_encode_ndr_dom_sid(mem_ctx, domain_sid));
- if (count != 1) {
- return NT_STATUS_NO_SUCH_DOMAIN;
- }
- }
-
- pwdProperties = samdb_result_uint(res[0], "pwdProperties", 0);
- pwdHistoryLength = samdb_result_uint(res[0], "pwdHistoryLength", 0);
- minPwdLength = samdb_result_uint(res[0], "minPwdLength", 0);
- minPwdAge = samdb_result_int64(res[0], "minPwdAge", 0);
-
- if (_dominfo) {
- struct samr_DomInfo1 *dominfo;
- /* on failure we need to fill in the reject reasons */
- dominfo = talloc(mem_ctx, struct samr_DomInfo1);
- if (dominfo == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
- dominfo->min_password_length = minPwdLength;
- dominfo->password_properties = pwdProperties;
- dominfo->password_history_length = pwdHistoryLength;
- dominfo->max_password_age = minPwdAge;
- dominfo->min_password_age = minPwdAge;
- *_dominfo = dominfo;
- }
-
- if (new_pass) {
- /* check the various password restrictions */
- if (restrictions && minPwdLength > strlen_m(new_pass)) {
- if (reject_reason) {
- *reject_reason = SAMR_REJECT_TOO_SHORT;
- }
- return NT_STATUS_PASSWORD_RESTRICTION;
- }
-
- /* possibly check password complexity */
- if (restrictions && pwdProperties & DOMAIN_PASSWORD_COMPLEX &&
- !samdb_password_complexity_ok(new_pass)) {
- if (reject_reason) {
- *reject_reason = SAMR_REJECT_COMPLEXITY;
- }
- return NT_STATUS_PASSWORD_RESTRICTION;
- }
-
- /* compute the new nt and lm hashes */
- if (E_deshash(new_pass, local_lmNewHash.hash)) {
- lmNewHash = &local_lmNewHash;
- }
- E_md4hash(new_pass, local_ntNewHash.hash);
- ntNewHash = &local_ntNewHash;
- }
-
- if (restrictions && user_change) {
- /* are all password changes disallowed? */
- if (pwdProperties & DOMAIN_REFUSE_PASSWORD_CHANGE) {
- if (reject_reason) {
- *reject_reason = SAMR_REJECT_OTHER;
- }
- return NT_STATUS_PASSWORD_RESTRICTION;
- }
-
- /* can this user change password? */
- if (userAccountControl & UF_PASSWD_CANT_CHANGE) {
- if (reject_reason) {
- *reject_reason = SAMR_REJECT_OTHER;
- }
- return NT_STATUS_PASSWORD_RESTRICTION;
- }
-
- /* yes, this is a minus. The ages are in negative 100nsec units! */
- if (pwdLastSet - minPwdAge > now_nt) {
- if (reject_reason) {
- *reject_reason = SAMR_REJECT_OTHER;
- }
- return NT_STATUS_PASSWORD_RESTRICTION;
- }
-
- /* check the immediately past password */
- if (pwdHistoryLength > 0) {
- if (lmNewHash && lmPwdHash && memcmp(lmNewHash->hash, lmPwdHash->hash, 16) == 0) {
- if (reject_reason) {
- *reject_reason = SAMR_REJECT_COMPLEXITY;
- }
- return NT_STATUS_PASSWORD_RESTRICTION;
- }
- if (ntNewHash && ntPwdHash && memcmp(ntNewHash->hash, ntPwdHash->hash, 16) == 0) {
- if (reject_reason) {
- *reject_reason = SAMR_REJECT_COMPLEXITY;
- }
- return NT_STATUS_PASSWORD_RESTRICTION;
- }
- }
-
- /* check the password history */
- sambaLMPwdHistory_len = MIN(sambaLMPwdHistory_len, pwdHistoryLength);
- sambaNTPwdHistory_len = MIN(sambaNTPwdHistory_len, pwdHistoryLength);
-
- for (i=0; lmNewHash && i<sambaLMPwdHistory_len;i++) {
- if (memcmp(lmNewHash->hash, sambaLMPwdHistory[i].hash, 16) == 0) {
- if (reject_reason) {
- *reject_reason = SAMR_REJECT_COMPLEXITY;
- }
- return NT_STATUS_PASSWORD_RESTRICTION;
- }
- }
- for (i=0; ntNewHash && i<sambaNTPwdHistory_len;i++) {
- if (memcmp(ntNewHash->hash, sambaNTPwdHistory[i].hash, 16) == 0) {
- if (reject_reason) {
- *reject_reason = SAMR_REJECT_COMPLEXITY;
- }
- return NT_STATUS_PASSWORD_RESTRICTION;
- }
- }
- }
-
-#define CHECK_RET(x) do { if (x != 0) return NT_STATUS_NO_MEMORY; } while(0)
-
- /* the password is acceptable. Start forming the new fields */
- if (new_pass) {
- /* if we know the cleartext, then only set it.
- * Modules in ldb will set all the appropriate
- * hashes */
- CHECK_RET(samdb_msg_add_string(ctx, mem_ctx, mod,
- "sambaPassword", new_pass));
- } else {
- /* We don't have the cleartext, so delete the old one
- * and set what we have of the hashes */
- CHECK_RET(samdb_msg_add_delete(ctx, mem_ctx, mod, "sambaPassword"));
-
- if (lmNewHash) {
- CHECK_RET(samdb_msg_add_hash(ctx, mem_ctx, mod, "lmPwdHash", lmNewHash));
- } else {
- CHECK_RET(samdb_msg_add_delete(ctx, mem_ctx, mod, "lmPwdHash"));
- }
-
- if (ntNewHash) {
- CHECK_RET(samdb_msg_add_hash(ctx, mem_ctx, mod, "ntPwdHash", ntNewHash));
- } else {
- CHECK_RET(samdb_msg_add_delete(ctx, mem_ctx, mod, "ntPwdHash"));
- }
- }
-
- return NT_STATUS_OK;
-}
-
/*
set password via a samr_CryptPassword buffer
- this will in the 'msg' with modify operations that will update the user
- password when applied
*/
NTSTATUS samr_set_password(struct dcesrv_call_state *dce_call,
- void *sam_ctx,
- const struct ldb_dn *account_dn, const struct ldb_dn *domain_dn,
+ struct ldb_context *sam_ctx,
+ struct ldb_dn *account_dn, struct ldb_dn *domain_dn,
TALLOC_CTX *mem_ctx,
- struct ldb_message *msg,
struct samr_CryptPassword *pwbuf)
{
NTSTATUS nt_status;
- char new_pass[512];
- uint32_t new_pass_len;
+ DATA_BLOB new_password;
DATA_BLOB session_key = data_blob(NULL, 0);
nt_status = dcesrv_fetch_session_key(dce_call->conn, &session_key);
if (!NT_STATUS_IS_OK(nt_status)) {
- return nt_status;
+ DEBUG(3,("samr: failed to get session key: %s "
+ "=> NT_STATUS_WRONG_PASSWORD\n",
+ nt_errstr(nt_status)));
+ return NT_STATUS_WRONG_PASSWORD;
}
arcfour_crypt_blob(pwbuf->data, 516, &session_key);
- if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
- &new_pass_len, STR_UNICODE)) {
+ if (!extract_pw_from_buffer(mem_ctx, pwbuf->data, &new_password)) {
DEBUG(3,("samr: failed to decode password buffer\n"));
return NT_STATUS_WRONG_PASSWORD;
}
/* set the password - samdb needs to know both the domain and user DNs,
so the domain password policy can be used */
return samdb_set_password(sam_ctx, mem_ctx,
- account_dn, domain_dn,
- msg, new_pass,
+ account_dn, domain_dn,
+ &new_password,
NULL, NULL,
- False, /* This is a password set, not change */
- True, /* run restriction tests */
+ NULL, NULL, /* This is a password set, not change */
NULL, NULL);
}
/*
set password via a samr_CryptPasswordEx buffer
- this will in the 'msg' with modify operations that will update the user
- password when applied
*/
NTSTATUS samr_set_password_ex(struct dcesrv_call_state *dce_call,
struct ldb_context *sam_ctx,
- const struct ldb_dn *account_dn, const struct ldb_dn *domain_dn,
+ struct ldb_dn *account_dn,
+ struct ldb_dn *domain_dn,
TALLOC_CTX *mem_ctx,
- struct ldb_message *msg,
struct samr_CryptPasswordEx *pwbuf)
{
NTSTATUS nt_status;
- char new_pass[512];
- uint32_t new_pass_len;
+ DATA_BLOB new_password;
DATA_BLOB co_session_key;
DATA_BLOB session_key = data_blob(NULL, 0);
- struct MD5Context ctx;
+ MD5_CTX ctx;
nt_status = dcesrv_fetch_session_key(dce_call->conn, &session_key);
if (!NT_STATUS_IS_OK(nt_status)) {
- return nt_status;
+ DEBUG(3,("samr: failed to get session key: %s "
+ "=> NT_STATUS_WRONG_PASSWORD\n",
+ nt_errstr(nt_status)));
+ return NT_STATUS_WRONG_PASSWORD;
}
co_session_key = data_blob_talloc(mem_ctx, NULL, 16);
MD5Update(&ctx, &pwbuf->data[516], 16);
MD5Update(&ctx, session_key.data, session_key.length);
MD5Final(co_session_key.data, &ctx);
-
+
arcfour_crypt_blob(pwbuf->data, 516, &co_session_key);
- if (!decode_pw_buffer(pwbuf->data, new_pass, sizeof(new_pass),
- &new_pass_len, STR_UNICODE)) {
+ if (!extract_pw_from_buffer(mem_ctx, pwbuf->data, &new_password)) {
DEBUG(3,("samr: failed to decode password buffer\n"));
return NT_STATUS_WRONG_PASSWORD;
}
/* set the password - samdb needs to know both the domain and user DNs,
so the domain password policy can be used */
return samdb_set_password(sam_ctx, mem_ctx,
- account_dn, domain_dn,
- msg, new_pass,
+ account_dn, domain_dn,
+ &new_password,
NULL, NULL,
- False, /* This is a password set, not change */
- True, /* run restriction tests */
+ NULL, NULL, /* This is a password set, not change */
NULL, NULL);
}
/*
- set the user password using plaintext, obeying any user or domain
- password restrictions
-
- This wrapper function takes a SID as input, rather than a user DN,
- and actually performs the password change
-
+ set password via encrypted NT and LM hash buffers
*/
-NTSTATUS samdb_set_password_sid(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
- const struct dom_sid *user_sid,
- const char *new_pass,
- struct samr_Password *lmNewHash,
- struct samr_Password *ntNewHash,
- BOOL user_change,
- BOOL restrictions,
- enum samr_RejectReason *reject_reason,
- struct samr_DomInfo1 **_dominfo)
+NTSTATUS samr_set_password_buffers(struct dcesrv_call_state *dce_call,
+ struct ldb_context *sam_ctx,
+ struct ldb_dn *account_dn,
+ struct ldb_dn *domain_dn,
+ TALLOC_CTX *mem_ctx,
+ const uint8_t *lm_pwd_hash,
+ const uint8_t *nt_pwd_hash)
{
- NTSTATUS nt_status;
- struct ldb_dn *user_dn;
- struct ldb_message *msg;
- int ret;
+ struct samr_Password *d_lm_pwd_hash = NULL, *d_nt_pwd_hash = NULL;
+ uint8_t random_session_key[16] = { 0, };
+ DATA_BLOB session_key = data_blob(NULL, 0);
+ DATA_BLOB in, out;
+ NTSTATUS nt_status = NT_STATUS_OK;
- ret = ldb_transaction_start(ctx);
- if (ret) {
- DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(ctx)));
- return NT_STATUS_TRANSACTION_ABORTED;
+ nt_status = dcesrv_fetch_session_key(dce_call->conn, &session_key);
+ if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_USER_SESSION_KEY)) {
+ DEBUG(3,("samr: failed to get session key: %s "
+ "=> use a random session key\n",
+ nt_errstr(nt_status)));
+
+ /*
+ * Windows just uses a random key
+ */
+ generate_random_buffer(random_session_key,
+ sizeof(random_session_key));
+ session_key = data_blob_const(random_session_key,
+ sizeof(random_session_key));
+ nt_status = NT_STATUS_OK;
}
-
- user_dn = samdb_search_dn(ctx, mem_ctx, NULL,
- "(&(objectSid=%s)(objectClass=user))",
- ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
- if (!user_dn) {
- ldb_transaction_cancel(ctx);
- DEBUG(3, ("samdb_set_password_sid: SID %s not found in samdb, returning NO_SUCH_USER\n",
- dom_sid_string(mem_ctx, user_sid)));
- return NT_STATUS_NO_SUCH_USER;
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
}
- msg = ldb_msg_new(mem_ctx);
- if (msg == NULL) {
- ldb_transaction_cancel(ctx);
- return NT_STATUS_NO_MEMORY;
- }
+ if (lm_pwd_hash != NULL) {
+ in = data_blob_const(lm_pwd_hash, 16);
+ out = data_blob_talloc_zero(mem_ctx, 16);
- msg->dn = ldb_dn_copy(msg, user_dn);
- if (!msg->dn) {
- ldb_transaction_cancel(ctx);
- return NT_STATUS_NO_MEMORY;
- }
+ sess_crypt_blob(&out, &in, &session_key, false);
- nt_status = samdb_set_password(ctx, mem_ctx,
- user_dn, NULL,
- msg, new_pass,
- lmNewHash, ntNewHash,
- user_change, /* This is a password set, not change */
- restrictions, /* run restriction tests */
- reject_reason, _dominfo);
- if (!NT_STATUS_IS_OK(nt_status)) {
- ldb_transaction_cancel(ctx);
- return nt_status;
+ d_lm_pwd_hash = (struct samr_Password *) out.data;
}
-
- /* modify the samdb record */
- ret = samdb_replace(ctx, mem_ctx, msg);
- if (ret != 0) {
- ldb_transaction_cancel(ctx);
- return NT_STATUS_ACCESS_DENIED;
+ if (nt_pwd_hash != NULL) {
+ in = data_blob_const(nt_pwd_hash, 16);
+ out = data_blob_talloc_zero(mem_ctx, 16);
+
+ sess_crypt_blob(&out, &in, &session_key, false);
+
+ d_nt_pwd_hash = (struct samr_Password *) out.data;
}
- ret = ldb_transaction_commit(ctx);
- if (ret != 0) {
- DEBUG(0,("Failed to commit transaction to change password on %s: %s\n",
- ldb_dn_linearize(mem_ctx, msg->dn),
- ldb_errstring(ctx)));
- return NT_STATUS_TRANSACTION_ABORTED;
+ if ((d_lm_pwd_hash != NULL) || (d_nt_pwd_hash != NULL)) {
+ nt_status = samdb_set_password(sam_ctx, mem_ctx, account_dn,
+ domain_dn, NULL,
+ d_lm_pwd_hash, d_nt_pwd_hash,
+ NULL, NULL, /* this is a password set */
+ NULL, NULL);
}
- return NT_STATUS_OK;
+
+ return nt_status;
}
git.samba.org / amitay / samba.git / blobdiff