source/auth/auth_server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authenticate to a remote server
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 #undef DBGC_CLASS
  25 #define DBGC_CLASS DBGC_AUTH
  26
  27 /****************************************************************************
  28  Support for server level security.
  29 ****************************************************************************/
  30
  31 static struct smbcli_state *server_cryptkey(TALLOC_CTX *mem_ctx)
  32 {
  33         struct smbcli_state *cli = NULL;
  34         fstring desthost;
  35         struct ipv4_addr dest_ip;
  36         const char *p;
  37         char *pserver;
  38         BOOL connected_ok = False;
  39
  40         if (!(cli = smbcli_initialise(cli)))
  41                 return NULL;
  42
  43         /* security = server just can't function with spnego */
  44         cli->use_spnego = False;
  45
  46         pserver = talloc_strdup(mem_ctx, lp_passwordserver());
  47         p = pserver;
  48
  49         while(next_token( &p, desthost, LIST_SEP, sizeof(desthost))) {
  50                 strupper(desthost);
  51
  52                 if(!resolve_name( desthost, &dest_ip, 0x20)) {
  53                         DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost));
  54                         continue;
  55                 }
  56
  57                 if (ismyip(dest_ip)) {
  58                         DEBUG(1,("Password server loop - disabling password server %s\n",desthost));
  59                         continue;
  60                 }
  61
  62                 /* we use a mutex to prevent two connections at once - when a
  63                    Win2k PDC get two connections where one hasn't completed a
  64                    session setup yet it will send a TCP reset to the first
  65                    connection (tridge) */
  66
  67                 if (!grab_server_mutex(desthost)) {
  68                         return NULL;
  69                 }
  70
  71                 if (smbcli_connect(cli, desthost, &dest_ip)) {
  72                         DEBUG(3,("connected to password server %s\n",desthost));
  73                         connected_ok = True;
  74                         break;
  75                 }
  76         }
  77
  78         if (!connected_ok) {
  79                 release_server_mutex();
  80                 DEBUG(0,("password server not available\n"));
  81                 smbcli_shutdown(cli);
  82                 return NULL;
  83         }
  84
  85         if (!attempt_netbios_session_request(cli, lp_netbios_name(),
  86                                              desthost, &dest_ip)) {
  87                 release_server_mutex();
  88                 DEBUG(1,("password server fails session request\n"));
  89                 smbcli_shutdown(cli);
  90                 return NULL;
  91         }
  92
  93         if (strequal(desthost,myhostname(mem_ctx))) {
  94                 exit_server("Password server loop!");
  95         }
  96
  97         DEBUG(3,("got session\n"));
  98
  99         if (!smbcli_negprot(cli)) {
 100                 DEBUG(1,("%s rejected the negprot\n",desthost));
 101                 release_server_mutex();
 102                 smbcli_shutdown(cli);
 103                 return NULL;
 104         }
 105
 106         if (cli->protocol < PROTOCOL_LANMAN2 ||
 107             !(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
 108                 DEBUG(1,("%s isn't in user level security mode\n",desthost));
 109                 release_server_mutex();
 110                 smbcli_shutdown(cli);
 111                 return NULL;
 112         }
 113
 114         /* Get the first session setup done quickly, to avoid silly
 115            Win2k bugs.  (The next connection to the server will kill
 116            this one...
 117         */
 118
 119         if (!smbcli_session_setup(cli, "", "", 0, "", 0,
 120                                "")) {
 121                 DEBUG(0,("%s rejected the initial session setup (%s)\n",
 122                          desthost, smbcli_errstr(cli)));
 123                 release_server_mutex();
 124                 smbcli_shutdown(cli);
 125                 return NULL;
 126         }
 127
 128         release_server_mutex();
 129
 130         DEBUG(3,("password server OK\n"));
 131
 132         return cli;
 133 }
 134
 135 /****************************************************************************
 136  Clean up our allocated cli.
 137 ****************************************************************************/
 138
 139 static void free_server_private_data(void **private_data_pointer)
 140 {
 141         struct smbcli_state **cli = (struct smbcli_state **)private_data_pointer;
 142         if (*cli && (*cli)->initialised) {
 143                 smbcli_shutdown(*cli);
 144         }
 145 }
 146
 147 /****************************************************************************
 148  Get the challenge out of a password server.
 149 ****************************************************************************/
 150
 151 static DATA_BLOB auth_get_challenge_server(const struct auth_context *auth_context,
 152                                            void **my_private_data,
 153                                            TALLOC_CTX *mem_ctx)
 154 {
 155         struct smbcli_state *cli = server_cryptkey(mem_ctx);
 156
 157         if (cli) {
 158                 DEBUG(3,("using password server validation\n"));
 159
 160                 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
 161                         /* We can't work with unencrypted password servers
 162                            unless 'encrypt passwords = no' */
 163                         DEBUG(5,("make_auth_info_server: Server is unencrypted, no challenge available..\n"));
 164
 165                         /* However, it is still a perfectly fine connection
 166                            to pass that unencrypted password over */
 167                         *my_private_data = (void *)cli;
 168                         return data_blob(NULL, 0);
 169
 170                 } else if (cli->secblob.length < 8) {
 171                         /* We can't do much if we don't get a full challenge */
 172                         DEBUG(2,("make_auth_info_server: Didn't receive a full challenge from server\n"));
 173                         smbcli_shutdown(cli);
 174                         return data_blob(NULL, 0);
 175                 }
 176
 177                 *my_private_data = (void *)cli;
 178
 179                 /* The return must be allocated on the caller's mem_ctx, as our own will be
 180                    destoyed just after the call. */
 181                 return data_blob_talloc(auth_context->mem_ctx, cli->secblob.data,8);
 182         } else {
 183                 return data_blob(NULL, 0);
 184         }
 185 }
 186
 187
 188 /****************************************************************************
 189  Check for a valid username and password in security=server mode.
 190   - Validate a password with the password server.
 191 ****************************************************************************/
 192
 193 static NTSTATUS check_smbserver_security(const struct auth_context *auth_context,
 194                                          void *my_private_data,
 195                                          TALLOC_CTX *mem_ctx,
 196                                          const auth_usersupplied_info *user_info,
 197                                          auth_serversupplied_info **server_info)
 198 {
 199         struct smbcli_state *cli;
 200         static uint8_t badpass[24];
 201         static fstring baduser;
 202         static BOOL tested_password_server = False;
 203         static BOOL bad_password_server = False;
 204         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
 205         BOOL locally_made_cli = False;
 206
 207         /*
 208          * Check that the requested domain is not our own machine name.
 209          * If it is, we should never check the PDC here, we use our own local
 210          * password file.
 211          */
 212
 213         if(is_myname(user_info->domain.str)) {
 214                 DEBUG(3,("check_smbserver_security: Requested domain was for this machine.\n"));
 215                 return NT_STATUS_LOGON_FAILURE;
 216         }
 217
 218         cli = my_private_data;
 219
 220         if (cli) {
 221         } else {
 222                 cli = server_cryptkey(mem_ctx);
 223                 locally_made_cli = True;
 224         }
 225
 226         if (!cli || !cli->initialised) {
 227                 DEBUG(1,("password server is not connected (cli not initilised)\n"));
 228                 return NT_STATUS_LOGON_FAILURE;
 229         }
 230
 231         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
 232                 if (user_info->encrypted) {
 233                         DEBUG(1,("password server %s is plaintext, but we are encrypted. This just can't work :-(\n", cli->desthost));
 234                         return NT_STATUS_LOGON_FAILURE;
 235                 }
 236         } else {
 237                 if (memcmp(cli->secblob.data, auth_context->challenge.data, 8) != 0) {
 238                         DEBUG(1,("the challenge that the password server (%s) supplied us is not the one we gave our client. This just can't work :-(\n", cli->desthost));
 239                         return NT_STATUS_LOGON_FAILURE;
 240                 }
 241         }
 242
 243         if(badpass[0] == 0)
 244                 memset(badpass, 0x1f, sizeof(badpass));
 245
 246         if((user_info->nt_resp.length == sizeof(badpass)) &&
 247            !memcmp(badpass, user_info->nt_resp.data, sizeof(badpass))) {
 248                 /*
 249                  * Very unlikely, our random bad password is the same as the users
 250                  * password.
 251                  */
 252                 memset(badpass, badpass[0]+1, sizeof(badpass));
 253         }
 254
 255         if(baduser[0] == 0) {
 256                 fstrcpy(baduser, INVALID_USER_PREFIX);
 257                 fstrcat(baduser, lp_netbios_name());
 258         }
 259
 260         /*
 261          * Attempt a session setup with a totally incorrect password.
 262          * If this succeeds with the guest bit *NOT* set then the password
 263          * server is broken and is not correctly setting the guest bit. We
 264          * need to detect this as some versions of NT4.x are broken. JRA.
 265          */
 266
 267         /* I sure as hell hope that there aren't servers out there that take
 268          * NTLMv2 and have this bug, as we don't test for that...
 269          *  - abartlet@samba.org
 270          */
 271
 272         if ((!tested_password_server) && (lp_paranoid_server_security())) {
 273                 if (smbcli_session_setup(cli, baduser, (char *)badpass, sizeof(badpass),
 274                                         (char *)badpass, sizeof(badpass), user_info->domain.str)) {
 275
 276                         /*
 277                          * We connected to the password server so we
 278                          * can say we've tested it.
 279                          */
 280                         tested_password_server = True;
 281
 282                         if ((SVAL(cli->inbuf,smb_vwv2) & 1) == 0) {
 283                                 DEBUG(0,("server_validate: password server %s allows users as non-guest \
 284 with a bad password.\n", cli->desthost));
 285                                 DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
 286 use this machine as the password server.\n"));
 287                                 smbcli_ulogoff(cli);
 288
 289                                 /*
 290                                  * Password server has the bug.
 291                                  */
 292                                 bad_password_server = True;
 293                                 return NT_STATUS_LOGON_FAILURE;
 294                         }
 295                         smbcli_ulogoff(cli);
 296                 }
 297         } else {
 298
 299                 /*
 300                  * We have already tested the password server.
 301                  * Fail immediately if it has the bug.
 302                  */
 303
 304                 if(bad_password_server) {
 305                         DEBUG(0,("server_validate: [1] password server %s allows users as non-guest \
 306 with a bad password.\n", cli->desthost));
 307                         DEBUG(0,("server_validate: [1] This is broken (and insecure) behaviour. Please do not \
 308 use this machine as the password server.\n"));
 309                         return NT_STATUS_LOGON_FAILURE;
 310                 }
 311         }
 312
 313         /*
 314          * Now we know the password server will correctly set the guest bit, or is
 315          * not guest enabled, we can try with the real password.
 316          */
 317
 318         if (!user_info->encrypted) {
 319                 /* Plaintext available */
 320                 if (!smbcli_session_setup(cli, user_info->smb_name.str,
 321                                        (char *)user_info->plaintext_password.data,
 322                                        user_info->plaintext_password.length,
 323                                        NULL, 0,
 324                                        user_info->domain.str)) {
 325                         DEBUG(1,("password server %s rejected the password\n", cli->desthost));
 326                         /* Make this smbcli_nt_error() when the conversion is in */
 327                         nt_status = smbcli_nt_error(cli);
 328                 } else {
 329                         nt_status = NT_STATUS_OK;
 330                 }
 331         } else {
 332                 if (!smbcli_session_setup(cli, user_info->smb_name.str,
 333                                        (char *)user_info->lm_resp.data,
 334                                        user_info->lm_resp.length,
 335                                        (char *)user_info->nt_resp.data,
 336                                        user_info->nt_resp.length,
 337                                        user_info->domain.str)) {
 338                         DEBUG(1,("password server %s rejected the password\n", cli->desthost));
 339                         /* Make this smbcli_nt_error() when the conversion is in */
 340                         nt_status = smbcli_nt_error(cli);
 341                 } else {
 342                         nt_status = NT_STATUS_OK;
 343                 }
 344         }
 345
 346         /* if logged in as guest then reject */
 347         if ((SVAL(cli->inbuf,smb_vwv2) & 1) != 0) {
 348                 DEBUG(1,("password server %s gave us guest only\n", cli->desthost));
 349                 nt_status = NT_STATUS_LOGON_FAILURE;
 350         }
 351
 352         smbcli_ulogoff(cli);
 353
 354         if NT_STATUS_IS_OK(nt_status) {
 355                 struct passwd *pass = Get_Pwnam(user_info->internal_username.str);
 356                 if (pass) {
 357                         nt_status = make_server_info_pw(auth_context, server_info, pass);
 358                 } else {
 359                         nt_status = NT_STATUS_NO_SUCH_USER;
 360                 }
 361         }
 362
 363         if (locally_made_cli) {
 364                 smbcli_shutdown(cli);
 365         }
 366
 367         return(nt_status);
 368 }
 369
 370 NTSTATUS auth_init_smbserver(struct auth_context *auth_context, const char* param, auth_methods **auth_method)
 371 {
 372         if (!make_auth_methods(auth_context, auth_method)) {
 373                 return NT_STATUS_NO_MEMORY;
 374         }
 375         (*auth_method)->name = "smbserver";
 376         (*auth_method)->auth = check_smbserver_security;
 377         (*auth_method)->get_chal = auth_get_challenge_server;
 378         (*auth_method)->send_keepalive = send_server_keepalive;
 379         (*auth_method)->free_private_data = free_server_private_data;
 380         return NT_STATUS_OK;
 381 }