*/
#include "includes.h"
+#include "smbd/globals.h"
+#include "../libcli/auth/libcli_auth.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
+/****************************************************************************
+ Ensure primary group SID is always at position 0 in a
+ auth_serversupplied_info struct.
+****************************************************************************/
+
+static void sort_sid_array_for_smbd(auth_serversupplied_info *result,
+ const DOM_SID *pgroup_sid)
+{
+ unsigned int i;
+
+ if (!result->sids) {
+ return;
+ }
+
+ if (sid_compare(&result->sids[0], pgroup_sid)==0) {
+ return;
+ }
+
+ for (i = 1; i < result->num_sids; i++) {
+ if (sid_compare(pgroup_sid,
+ &result->sids[i]) == 0) {
+ sid_copy(&result->sids[i], &result->sids[0]);
+ sid_copy(&result->sids[0], pgroup_sid);
+ return;
+ }
+ }
+}
+
/****************************************************************************
Create a UNIX user on demand.
****************************************************************************/
-static int smb_create_user(const char *domain, const char *unix_username, const char *homedir)
+static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
{
TALLOC_CTX *ctx = talloc_tos();
char *add_script;
Create an auth_usersupplied_data structure after appropriate mapping.
****************************************************************************/
-NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
- const char *smb_name,
- const char *client_domain,
- const char *wksta_name,
- DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
- DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,
- DATA_BLOB *plaintext,
+NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
+ const char *smb_name,
+ const char *client_domain,
+ const char *wksta_name,
+ DATA_BLOB *lm_pwd,
+ DATA_BLOB *nt_pwd,
+ DATA_BLOB *lm_interactive_pwd,
+ DATA_BLOB *nt_interactive_pwd,
+ DATA_BLOB *plaintext,
bool encrypted)
{
+ struct smbd_server_connection *sconn = smbd_server_conn;
const char *domain;
NTSTATUS result;
bool was_mapped;
fstring internal_username;
fstrcpy(internal_username, smb_name);
- was_mapped = map_username(internal_username);
-
- DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
- client_domain, smb_name, wksta_name));
-
- /* don't allow "" as a domain, fixes a Win9X bug
- where it doens't supply a domain for logon script
- 'net use' commands. */
+ was_mapped = map_username(sconn, internal_username);
- if ( *client_domain )
- domain = client_domain;
- else
- domain = lp_workgroup();
+ DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
+ client_domain, smb_name, wksta_name));
- /* do what win2k does. Always map unknown domains to our own
- and let the "passdb backend" handle unknown users. */
+ domain = client_domain;
- if ( !is_trusted_domain(domain) && !strequal(domain, get_global_sam_name()) )
- domain = my_sam_name();
-
- /* we know that it is a trusted domain (and we are allowing them) or it is our domain */
-
- result = make_user_info(user_info, smb_name, internal_username,
- client_domain, domain, wksta_name,
+ /* If you connect to a Windows domain member using a bogus domain name,
+ * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
+ * the Windows box is a DC the name will become DOMAIN\user and be
+ * authenticated against AD, if the Windows box is a member server but
+ * not a DC the name will become WORKSTATION\user. A standalone
+ * non-domain member box will also map to WORKSTATION\user.
+ * This also deals with the client passing in a "" domain */
+
+ if (!is_trusted_domain(domain) &&
+ !strequal(domain, my_sam_name()))
+ {
+ if (lp_map_untrusted_to_domain())
+ domain = my_sam_name();
+ else
+ domain = get_global_sam_name();
+ DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
+ "workstation [%s]\n",
+ client_domain, domain, smb_name, wksta_name));
+ }
+
+ /* We know that the given domain is trusted (and we are allowing them),
+ * it is our global SAM name, or for legacy behavior it is our
+ * primary domain name */
+
+ result = make_user_info(user_info, smb_name, internal_username,
+ client_domain, domain, wksta_name,
lm_pwd, nt_pwd,
lm_interactive_pwd, nt_interactive_pwd,
plaintext, encrypted);
unsigned char local_nt_response[24];
unsigned char key[16];
- ZERO_STRUCT(key);
- memcpy(key, dc_sess_key, 8);
+ memcpy(key, dc_sess_key, 16);
if (lm_interactive_pwd)
memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
#endif
if (lm_interactive_pwd)
- SamOEMhash(lm_pwd, key, sizeof(lm_pwd));
+ arcfour_crypt(lm_pwd, key, sizeof(lm_pwd));
if (nt_interactive_pwd)
- SamOEMhash(nt_pwd, key, sizeof(nt_pwd));
+ arcfour_crypt(nt_pwd, key, sizeof(nt_pwd));
#ifdef DEBUG_PASSWORD
DEBUG(100,("decrypt of lm owf password:"));
struct passwd *pwd;
gid_t *gids;
auth_serversupplied_info *result;
- int i;
- size_t num_gids;
- DOM_SID unix_group_sid;
const char *username = pdb_get_username(sampass);
NTSTATUS status;
}
result->sam_account = sampass;
- /* Ensure thaat the sampass will be freed with the result */
- talloc_steal(result, sampass);
result->unix_name = pwd->pw_name;
/* Ensure that we keep pwd->pw_name, because we will free pwd below */
talloc_steal(result, pwd->pw_name);
* a PDC. JRA.
*/
- winbind_off();
+ (void)winbind_off();
DEBUG(10, ("make_server_info_sam: our machine account %s "
"setting supplementary group list empty and "
}
}
- /* Add the "Unix Group" SID for each gid to catch mapped groups
- and their Unix equivalent. This is to solve the backwards
- compatibility problem of 'valid users = +ntadmin' where
- ntadmin has been paired with "Domain Admins" in the group
- mapping table. Otherwise smb.conf would need to be changed
- to 'valid user = "Domain Admins"'. --jerry */
-
- num_gids = result->num_sids;
- for ( i=0; i<num_gids; i++ ) {
- if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
- DEBUG(1,("make_server_info_sam: Failed to create SID "
- "for gid %d!\n", gids[i]));
- continue;
- }
- status = add_sid_to_array_unique(result, &unix_group_sid,
- &result->sids,
- &result->num_sids);
- if (!NT_STATUS_IS_OK(status)) {
- result->sam_account = NULL; /* Don't free on error exit. */
- TALLOC_FREE(result);
- return status;
- }
- }
-
/* For now we throw away the gids and convert via sid_to_gid
* later. This needs fixing, but I'd like to get the code straight and
* simple first. */
pdb_get_username(sampass), result->unix_name));
*server_info = result;
+ /* Ensure that the sampass will be freed with the result */
+ talloc_steal(result, sampass);
return NT_STATUS_OK;
}
-static NTSTATUS log_nt_token(TALLOC_CTX *tmp_ctx, NT_USER_TOKEN *token)
+static NTSTATUS log_nt_token(NT_USER_TOKEN *token)
{
+ TALLOC_CTX *frame = talloc_stackframe();
char *command;
char *group_sidstr;
size_t i;
if ((lp_log_nt_token_command() == NULL) ||
(strlen(lp_log_nt_token_command()) == 0)) {
+ TALLOC_FREE(frame);
return NT_STATUS_OK;
}
- group_sidstr = talloc_strdup(tmp_ctx, "");
+ group_sidstr = talloc_strdup(frame, "");
for (i=1; i<token->num_sids; i++) {
group_sidstr = talloc_asprintf(
- tmp_ctx, "%s %s", group_sidstr,
- sid_string_talloc(tmp_ctx, &token->user_sids[i]));
+ frame, "%s %s", group_sidstr,
+ sid_string_talloc(frame, &token->user_sids[i]));
}
command = talloc_string_sub(
- tmp_ctx, lp_log_nt_token_command(),
- "%s", sid_string_talloc(tmp_ctx, &token->user_sids[0]));
- command = talloc_string_sub(tmp_ctx, command, "%t", group_sidstr);
+ frame, lp_log_nt_token_command(),
+ "%s", sid_string_talloc(frame, &token->user_sids[0]));
+ command = talloc_string_sub(frame, command, "%t", group_sidstr);
if (command == NULL) {
+ TALLOC_FREE(frame);
return NT_STATUS_NO_MEMORY;
}
DEBUG(8, ("running command: [%s]\n", command));
if (smbrun(command, NULL) != 0) {
DEBUG(0, ("Could not log NT token\n"));
+ TALLOC_FREE(frame);
return NT_STATUS_ACCESS_DENIED;
}
+ TALLOC_FREE(frame);
return NT_STATUS_OK;
}
NTSTATUS create_local_token(auth_serversupplied_info *server_info)
{
- TALLOC_CTX *mem_ctx;
NTSTATUS status;
size_t i;
-
-
- mem_ctx = talloc_new(NULL);
- if (mem_ctx == NULL) {
- DEBUG(0, ("talloc_new failed\n"));
- return NT_STATUS_NO_MEMORY;
- }
+ struct dom_sid tmp_sid;
/*
* If winbind is not around, we can not make much use of the SIDs the
&server_info->utok.gid,
&server_info->unix_name,
&server_info->ptok);
-
+
} else {
server_info->ptok = create_local_nt_token(
server_info,
}
if (!NT_STATUS_IS_OK(status)) {
- TALLOC_FREE(mem_ctx);
return status;
}
-
+
/* Convert the SIDs to gids. */
server_info->utok.ngroups = 0;
&server_info->utok.groups,
&server_info->utok.ngroups);
}
-
- debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
- status = log_nt_token(mem_ctx, server_info->ptok);
+ /*
+ * Add the "Unix Group" SID for each gid to catch mapped groups
+ * and their Unix equivalent. This is to solve the backwards
+ * compatibility problem of 'valid users = +ntadmin' where
+ * ntadmin has been paired with "Domain Admins" in the group
+ * mapping table. Otherwise smb.conf would need to be changed
+ * to 'valid user = "Domain Admins"'. --jerry
+ *
+ * For consistency we also add the "Unix User" SID,
+ * so that the complete unix token is represented within
+ * the nt token.
+ */
- TALLOC_FREE(mem_ctx);
+ if (!uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid)) {
+ DEBUG(1,("create_local_token: Failed to create SID "
+ "for uid %u!\n", (unsigned int)server_info->utok.uid));
+ }
+ add_sid_to_array_unique(server_info->ptok, &tmp_sid,
+ &server_info->ptok->user_sids,
+ &server_info->ptok->num_sids);
+
+ for ( i=0; i<server_info->utok.ngroups; i++ ) {
+ if (!gid_to_unix_groups_sid( server_info->utok.groups[i], &tmp_sid ) ) {
+ DEBUG(1,("create_local_token: Failed to create SID "
+ "for gid %u!\n", (unsigned int)server_info->utok.groups[i]));
+ continue;
+ }
+ add_sid_to_array_unique(server_info->ptok, &tmp_sid,
+ &server_info->ptok->user_sids,
+ &server_info->ptok->num_sids);
+ }
+
+ debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
+ debug_unix_user_token(DBGC_AUTH, 10,
+ server_info->utok.uid,
+ server_info->utok.gid,
+ server_info->utok.ngroups,
+ server_info->utok.groups);
+
+ status = log_nt_token(server_info->ptok);
return status;
}
/*
- * Create an artificial NT token given just a username. (Initially indended
+ * Create an artificial NT token given just a username. (Initially intended
* for force user)
*
* We go through lookup_name() to avoid problems we had with 'winbind use
goto done;
}
- if (!sid_to_uid(&user_sid, uid)) {
- DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
- username, sid_string_dbg(&user_sid)));
- goto done;
- }
-
if (sid_check_is_in_our_domain(&user_sid)) {
bool ret;
&group_sids, &gids,
&num_group_sids);
if (!NT_STATUS_IS_OK(result)) {
- DEBUG(10, ("enum_group_memberships failed for %s\n",
- username));
+ DEBUG(1, ("enum_group_memberships failed for %s (%s): "
+ "%s\n", username, sid_string_dbg(&user_sid),
+ nt_errstr(result)));
DEBUGADD(1, ("Fall back to unix user %s\n", username));
goto unix_user;
}
*found_username = talloc_strdup(mem_ctx,
pdb_get_username(sam_acct));
+ /*
+ * If the SID from lookup_name() was the guest sid, passdb knows
+ * about the mapping of guest sid to lp_guestaccount()
+ * username and will return the unix_pw info for a guest
+ * user. Use it if it's there, else lookup the *uid details
+ * using getpwnam_alloc(). See bug #6291 for details. JRA.
+ */
+
+ /* We must always assign the *uid. */
+ if (sam_acct->unix_pw == NULL) {
+ struct passwd *pwd = getpwnam_alloc(sam_acct, *found_username );
+ if (!pwd) {
+ DEBUG(10, ("getpwnam_alloc failed for %s\n",
+ *found_username));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+ result = samu_set_unix(sam_acct, pwd );
+ if (!NT_STATUS_IS_OK(result)) {
+ DEBUG(10, ("samu_set_unix failed for %s\n",
+ *found_username));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+ }
+ *uid = sam_acct->unix_pw->pw_uid;
+
} else if (sid_check_is_in_unix_users(&user_sid)) {
/* This is a unix user not in passdb. We need to ask nss
unix_user:
+ if (!sid_to_uid(&user_sid, uid)) {
+ DEBUG(1, ("unix_user case, sid_to_uid for %s (%s) failed\n",
+ username, sid_string_dbg(&user_sid)));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+
uid_to_unix_users_sid(*uid, &user_sid);
pass = getpwuid_alloc(tmp_ctx, *uid);
if (pass == NULL) {
- DEBUG(1, ("getpwuid(%d) for user %s failed\n",
- *uid, username));
+ DEBUG(1, ("getpwuid(%u) for user %s failed\n",
+ (unsigned int)*uid, username));
goto done;
}
uint32 dummy;
+ /* We must always assign the *uid. */
+ if (!sid_to_uid(&user_sid, uid)) {
+ DEBUG(1, ("winbindd case, sid_to_uid for %s (%s) failed\n",
+ username, sid_string_dbg(&user_sid)));
+ result = NT_STATUS_NO_SUCH_USER;
+ goto done;
+ }
+
num_group_sids = 1;
group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
if (group_sids == NULL) {
if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
DEBUG(1,("create_token_from_username: Failed to create SID "
- "for gid %d!\n", gids[i]));
+ "for gid %u!\n", (unsigned int)gids[i]));
continue;
}
result = add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
- auth_serversupplied_info *src)
+ const auth_serversupplied_info *src)
{
auth_serversupplied_info *dst;
return dst;
}
+/*
+ * Set a new session key. Used in the rpc server where we have to override the
+ * SMB level session key with SystemLibraryDTC
+ */
+
+bool server_info_set_session_key(struct auth_serversupplied_info *info,
+ DATA_BLOB session_key)
+{
+ TALLOC_FREE(info->user_session_key.data);
+
+ info->user_session_key = data_blob_talloc(
+ info, session_key.data, session_key.length);
+
+ return (info->user_session_key.data != NULL);
+}
+
static auth_serversupplied_info *guest_info = NULL;
bool init_guest_info(void)
struct samu *account,
bool *username_was_mapped)
{
+ struct smbd_server_connection *sconn = smbd_server_conn;
NTSTATUS nt_status;
fstring dom_user, lower_username;
fstring real_username;
/* Get the passwd struct. Try to create the account is necessary. */
- *username_was_mapped = map_username( dom_user );
+ *username_was_mapped = map_username(sconn, dom_user);
if ( !(passwd = smb_getpwnam( NULL, dom_user, real_username, True )) )
return NT_STATUS_NO_SUCH_USER;
if (username[strlen(username)-1] == '$')
return NULL;
- smb_create_user(NULL, username, NULL);
+ _smb_create_user(NULL, username, NULL);
pw = Get_Pwnam_alloc(mem_ctx, username);
}
return nt_status;
}
+ /* Ensure the primary group sid is at position 0. */
+ sort_sid_array_for_smbd(result, &group_sid);
+
result->login_server = talloc_strdup(result,
info3->base.logon_server.string);
memcpy(&result->sids[i], &info->sids[i+2].sid, sizeof(result->sids[i]));
}
+ /* Ensure the primary group sid is at position 0. */
+ sort_sid_array_for_smbd(result, &group_sid);
+
/* ensure we are never given NULL session keys */
ZERO_STRUCT(zeros);
* Verify whether or not given domain is trusted.
*
* @param domain_name name of the domain to be verified
- * @return true if domain is one of the trusted once or
+ * @return true if domain is one of the trusted ones or
* false if otherwise
**/
if ( lp_server_role() == ROLE_STANDALONE )
return False;
+ if (dom_name == NULL || dom_name[0] == '\0') {
+ return false;
+ }
+
+ if (strequal(dom_name, get_global_sam_name())) {
+ return false;
+ }
+
/* if we are a DC, then check for a direct trust relationships */
if ( IS_DC ) {