/****************************************************************************
Setup the groups a user belongs to.
****************************************************************************/
-int setup_groups(char *user, uid_t uid, gid_t gid, int *p_ngroups, gid_t **p_groups)
+int get_unixgroups(char *user, uid_t uid, gid_t gid, int *p_ngroups, gid_t **p_groups)
{
int i,ngroups;
gid_t grp = 0;
if((groups = (gid_t *)malloc(sizeof(gid_t)*ngroups)) == NULL)
{
- DEBUG(0,("setup_groups malloc fail !\n"));
+ DEBUG(0,("get_unixgroups malloc fail !\n"));
return -1;
}
/* Find all the groups this uid is in and store them.
Used by become_user() */
- setup_groups(unix_name,uid,gid,
+ get_unixgroups(unix_name,uid,gid,
&vuser->n_groups,
&vuser->groups);
Do a specific test for an smb password being correct, given a smb_password and
the lanman and NT responses.
****************************************************************************/
-
-BOOL smb_password_ok(struct smb_passwd *smb_pass,
+BOOL smb_password_ok(struct smb_passwd *smb_pass, uchar chal[8],
uchar lm_pass[24], uchar nt_pass[24])
{
uchar challenge[8];
return(False);
}
- if (!last_challenge(challenge)) {
- DEBUG(1,("no challenge done - password failed\n"));
- return False;
+ if (chal == NULL)
+ {
+ DEBUG(5,("use last SMBnegprot challenge\n"));
+ if (!last_challenge(challenge))
+ {
+ DEBUG(1,("no challenge done - password failed\n"));
+ return False;
+ }
+ }
+ else
+ {
+ DEBUG(5,("challenge received\n"));
+ memcpy(challenge, chal, 8);
}
if ((Protocol >= PROTOCOL_NT1) && (smb_pass->smb_nt_passwd != NULL)) {
SMB hash
return True if the password is correct, False otherwise
****************************************************************************/
-static BOOL pass_check_smb(char *user,char *password, struct passwd *pwd)
+
+BOOL pass_check_smb(char *user, char *domain,
+ uchar *chal, uchar *lm_pwd, uchar *nt_pwd,
+ struct passwd *pwd)
{
struct passwd *pass;
- uchar challenge[8];
struct smb_passwd *smb_pass;
- BOOL challenge_done;
- if (!password) {
+ if (!lm_pwd || !nt_pwd)
+ {
return(False);
}
- challenge_done = last_challenge(challenge);
-
- if (!challenge_done) {
- DEBUG(0,("Error: challenge not done for user=%s\n", user));
- return False;
- }
-
- if (pwd && !user) {
+ if (pwd != NULL && user == NULL)
+ {
pass = (struct passwd *) pwd;
user = pass->pw_name;
- } else {
+ }
+ else
+ {
pass = Get_Pwnam(user,True);
}
- if (!pass) {
+ if (pass == NULL)
+ {
DEBUG(3,("Couldn't find user %s\n",user));
return(False);
}
smb_pass = getsmbpwnam(user);
- if (!smb_pass) {
+ if (smb_pass == NULL)
+ {
DEBUG(3,("Couldn't find user %s in smb_passwd file.\n", user));
return(False);
}
}
/* Ensure the uid's match */
- if (smb_pass->smb_userid != pass->pw_uid) {
+ if (smb_pass->smb_userid != pass->pw_uid)
+ {
DEBUG(3,("Error : UNIX and SMB uids in password files do not match !\n"));
return(False);
}
- if(password[0] == '\0' && smb_pass->acct_ctrl & ACB_PWNOTREQ && lp_null_passwords()) {
+ if (lm_pwd[0] == '\0' && IS_BITS_SET_ALL(smb_pass->acct_ctrl, ACB_PWNOTREQ) && lp_null_passwords())
+ {
DEBUG(3,("account for user %s has no password and null passwords are allowed.\n", smb_pass->smb_name));
return(True);
}
- if (smb_password_ok(smb_pass,
- (unsigned char *)password,
- (uchar *)password)) {
+ if (smb_password_ok(smb_pass, chal, lm_pwd, nt_pwd))
+ {
return(True);
}
database or the encrypted SMB password database
return True if the password is correct, False otherwise
****************************************************************************/
-BOOL password_ok(char *user,char *password, int pwlen, struct passwd *pwd)
+BOOL password_ok(char *user, char *password, int pwlen, struct passwd *pwd)
{
- if (pwlen == 24 || (lp_encrypted_passwords() && (pwlen == 0) && lp_null_passwords())) {
- /* if it is 24 bytes long then assume it is an encrypted
- password */
- return pass_check_smb(user, password, pwd);
+ if (pwlen == 24 || (lp_encrypted_passwords() && (pwlen == 0) && lp_null_passwords()))
+ {
+ /* if 24 bytes long assume it is an encrypted password */
+ uchar challenge[8];
+
+ if (!last_challenge(challenge))
+ {
+ DEBUG(0,("Error: challenge not done for user=%s\n", user));
+ return False;
+ }
+
+ return pass_check_smb(user, global_myworkgroup,
+ challenge, (uchar *)password, (uchar *)password, pwd);
}
return pass_check(user, password, pwlen, pwd,
int plus_allowed = 1;
char *file_host;
char *file_user;
- FILE *fp = fopen(equiv_file, "r");
+ FILE *fp = sys_fopen(equiv_file, "r");
DEBUG(5, ("check_user_equiv %s %s %s\n", user, remote, equiv_file));
if (! fp) return False;
while(fgets(buf, sizeof(buf), fp))
make_nmb_name(&calling, local_machine, 0x0 , scope);
make_nmb_name(&called , desthost , 0x20, scope);
- if (!cli_session_request(cli, &calling, &called))
- {
- DEBUG(1,("%s rejected the session\n",desthost));
+ if (!cli_session_request(cli, &calling, &called)) {
+ /* try with *SMBSERVER if the first name fails */
cli_shutdown(cli);
- return NULL;
+ make_nmb_name(&called , "*SMBSERVER", 0x20, scope);
+ if (!cli_initialise(cli) ||
+ !cli_connect(cli, desthost, &dest_ip) ||
+ !cli_session_request(cli, &calling, &called)) {
+ DEBUG(1,("%s rejected the session\n",desthost));
+ cli_shutdown(cli);
+ return NULL;
+ }
}
DEBUG(3,("got session\n"));
char *pass, int passlen,
char *ntpass, int ntpasslen)
{
- struct cli_state *cli;
- extern fstring local_machine;
- static unsigned char badpass[24];
- cli = server_client();
+ struct cli_state *cli;
+ static unsigned char badpass[24];
+ static BOOL tested_password_server = False;
+ static BOOL bad_password_server = False;
- if (!cli->initialised) {
- DEBUG(1,("password server %s is not connected\n", cli->desthost));
- return(False);
- }
+ cli = server_client();
- if(badpass[0] == 0) {
- memset(badpass, 0x1f, sizeof(badpass));
- }
+ if (!cli->initialised) {
+ DEBUG(1,("password server %s is not connected\n", cli->desthost));
+ return(False);
+ }
- if((passlen == sizeof(badpass)) && !memcmp(badpass, pass, passlen)) {
- /* Very unlikely, our random bad password is the same as the users
- password. */
- memset(badpass, badpass[0]+1, sizeof(badpass));
- }
+ if(badpass[0] == 0)
+ memset(badpass, 0x1f, sizeof(badpass));
- /*
- * Attempt a session setup with a totally incorrect password.
- * If this succeeds with the guest bit *NOT* set then the password
- * server is broken and is not correctly setting the guest bit. We
- * need to detect this as some versions of NT4.x are broken. JRA.
- */
+ if((passlen == sizeof(badpass)) && !memcmp(badpass, pass, passlen)) {
+ /*
+ * Very unlikely, our random bad password is the same as the users
+ * password. */
+ memset(badpass, badpass[0]+1, sizeof(badpass));
+ }
- if (cli_session_setup(cli, user, (char *)badpass, sizeof(badpass),
- (char *)badpass, sizeof(badpass), domain)) {
- if ((SVAL(cli->inbuf,smb_vwv2) & 1) == 0) {
- DEBUG(0,("server_validate: password server %s allows users as non-guest \
-with a bad password.\n", cli->desthost));
- DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
-use this machine as the password server.\n"));
- cli_ulogoff(cli);
- return False;
- }
- cli_ulogoff(cli);
- }
+ /*
+ * Attempt a session setup with a totally incorrect password.
+ * If this succeeds with the guest bit *NOT* set then the password
+ * server is broken and is not correctly setting the guest bit. We
+ * need to detect this as some versions of NT4.x are broken. JRA.
+ */
- /*
- * Now we know the password server will correctly set the guest bit, or is
- * not guest enabled, we can try with the real password.
- */
+ if(!tested_password_server) {
+ if (cli_session_setup(cli, user, (char *)badpass, sizeof(badpass),
+ (char *)badpass, sizeof(badpass), domain)) {
- if (!cli_session_setup(cli, user, pass, passlen, ntpass, ntpasslen, domain)) {
- DEBUG(1,("password server %s rejected the password\n", cli->desthost));
- return False;
- }
+ /*
+ * We connected to the password server so we
+ * can say we've tested it.
+ */
+ tested_password_server = True;
- /* if logged in as guest then reject */
- if ((SVAL(cli->inbuf,smb_vwv2) & 1) != 0) {
- DEBUG(1,("password server %s gave us guest only\n", cli->desthost));
- cli_ulogoff(cli);
- return(False);
- }
+ if ((SVAL(cli->inbuf,smb_vwv2) & 1) == 0) {
+ DEBUG(0,("server_validate: password server %s allows users as non-guest \
+with a bad password.\n", cli->desthost));
+ DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
+use this machine as the password server.\n"));
+ cli_ulogoff(cli);
/*
- * This patch from Rob Nielsen <ran@adc.com> makes doing
- * the NetWksaUserLogon a dynamic, rather than compile-time
- * parameter, defaulting to on. This is somewhat dangerous
- * as it allows people to turn off this neccessary check,
- * but so many people have had problems with this that I
- * think it is a neccessary change. JRA.
+ * Password server has the bug.
*/
+ bad_password_server = True;
+ return False;
+ }
+ cli_ulogoff(cli);
+ }
+ } else {
- if (lp_net_wksta_user_logon()) {
- DEBUG(3,("trying NetWkstaUserLogon with password server %s\n", cli->desthost));
+ /*
+ * We have already tested the password server.
+ * Fail immediately if it has the bug.
+ */
- if (!cli_send_tconX(cli, "IPC$", "IPC", "", 1)) {
- DEBUG(0,("password server %s refused IPC$ connect\n", cli->desthost));
- cli_ulogoff(cli);
- return False;
- }
+ if(bad_password_server) {
+ DEBUG(0,("server_validate: [1] password server %s allows users as non-guest \
+with a bad password.\n", cli->desthost));
+ DEBUG(0,("server_validate: [1] This is broken (and insecure) behaviour. Please do not \
+use this machine as the password server.\n"));
+ return False;
+ }
+ }
- if (!cli_NetWkstaUserLogon(cli,user,local_machine)) {
- DEBUG(0,("password server %s failed NetWkstaUserLogon\n", cli->desthost));
- cli_tdis(cli);
- cli_ulogoff(cli);
- return False;
- }
+ /*
+ * Now we know the password server will correctly set the guest bit, or is
+ * not guest enabled, we can try with the real password.
+ */
- if (cli->privilages == 0) {
- DEBUG(0,("password server %s gave guest privilages\n", cli->desthost));
- cli_tdis(cli);
- cli_ulogoff(cli);
- return False;
- }
+ if (!cli_session_setup(cli, user, pass, passlen, ntpass, ntpasslen, domain)) {
+ DEBUG(1,("password server %s rejected the password\n", cli->desthost));
+ return False;
+ }
- if (!strequal(cli->eff_name, user)) {
- DEBUG(0,("password server %s gave different username %s\n",
- cli->desthost,
- cli->eff_name));
- cli_tdis(cli);
- cli_ulogoff(cli);
- return False;
- }
- cli_tdis(cli);
- }
- else {
- DEBUG(3,("skipping NetWkstaUserLogon with password server %s\n", cli->desthost));
- }
+ /* if logged in as guest then reject */
+ if ((SVAL(cli->inbuf,smb_vwv2) & 1) != 0) {
+ DEBUG(1,("password server %s gave us guest only\n", cli->desthost));
+ cli_ulogoff(cli);
+ return(False);
+ }
- DEBUG(3,("password server %s accepted the password\n", cli->desthost));
- cli_ulogoff(cli);
+ cli_ulogoff(cli);
- return(True);
+ return(True);
}
/***********************************************************************
unsigned char local_lm_response[24];
unsigned char local_nt_reponse[24];
unsigned char trust_passwd[16];
- fstring remote_machine;
- char *p;
- struct in_addr dest_ip;
NET_ID_INFO_CTR ctr;
NET_USER_INFO_3 info3;
struct cli_state cli;
uint32 smb_uid_low;
- BOOL connected_ok = False;
- struct nmb_name calling, called;
/*
* Check that the requested domain is not our own machine name.
* see if they were valid.
*/
- ZERO_STRUCT(cli);
-
- if(cli_initialise(&cli) == False) {
- DEBUG(0,("domain_client_validate: unable to initialize client connection.\n"));
- return False;
- }
-
- /*
- * Treat each name in the 'password server =' line as a potential
- * PDC/BDC. Contact each in turn and try and authenticate.
- */
-
- p = lp_passwordserver();
- while(p && next_token(&p,remote_machine,LIST_SEP,sizeof(remote_machine))) {
-
- standard_sub_basic(remote_machine);
- strupper(remote_machine);
-
- if(!resolve_name( remote_machine, &dest_ip, 0x20)) {
- DEBUG(1,("domain_client_validate: Can't resolve address for %s\n", remote_machine));
- continue;
- }
-
- if (ismyip(dest_ip)) {
- DEBUG(1,("domain_client_validate: Password server loop - not using password server %s\n",remote_machine));
- continue;
- }
-
- if (!cli_connect(&cli, remote_machine, &dest_ip)) {
- DEBUG(0,("domain_client_validate: unable to connect to SMB server on \
-machine %s. Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- continue;
- }
-
- make_nmb_name(&calling, global_myname , 0x0 , scope);
- make_nmb_name(&called , remote_machine, 0x20, scope);
-
- if (!cli_session_request(&cli, &calling, &called))
+ if (!cli_connect_serverlist(&cli, lp_passwordserver()))
{
- DEBUG(0,("domain_client_validate: machine %s rejected the session setup. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- cli.protocol = PROTOCOL_NT1;
-
- if (!cli_negprot(&cli)) {
- DEBUG(0,("domain_client_validate: machine %s rejected the negotiate protocol. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- if (cli.protocol != PROTOCOL_NT1) {
- DEBUG(0,("domain_client_validate: machine %s didn't negotiate NT protocol.\n",
- remote_machine));
- cli_shutdown(&cli);
- continue;
- }
-
- /*
- * Do an anonymous session setup.
- */
-
- if (!cli_session_setup(&cli, "", "", 0, "", 0, "")) {
- DEBUG(0,("domain_client_validate: machine %s rejected the session setup. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- if (!(cli.sec_mode & 1)) {
- DEBUG(1,("domain_client_validate: machine %s isn't in user level security mode\n",
- remote_machine));
- cli_shutdown(&cli);
- continue;
- }
-
- if (!cli_send_tconX(&cli, "IPC$", "IPC", "", 1)) {
- DEBUG(0,("domain_client_validate: machine %s rejected the tconX on the IPC$ share. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- /*
- * We have an anonymous connection to IPC$.
- */
- connected_ok = True;
- break;
- }
-
- if (!connected_ok) {
DEBUG(0,("domain_client_validate: Domain password server not available.\n"));
- cli_shutdown(&cli);
return False;
}
* Now start the NT Domain stuff :-).
*/
- if(cli_nt_session_open(&cli, PIPE_NETLOGON, False) == False) {
+ if(cli_nt_session_open(&cli, PIPE_NETLOGON) == False) {
DEBUG(0,("domain_client_validate: unable to open the domain client session to \
-machine %s. Error was : %s.\n", remote_machine, cli_errstr(&cli)));
+machine %s. Error was : %s.\n", cli.desthost, cli_errstr(&cli)));
cli_nt_session_close(&cli);
cli_ulogoff(&cli);
cli_shutdown(&cli);
if(cli_nt_setup_creds(&cli, trust_passwd) == False) {
DEBUG(0,("domain_client_validate: unable to setup the PDC credentials to machine \
-%s. Error was : %s.\n", remote_machine, cli_errstr(&cli)));
+%s. Error was : %s.\n", cli.desthost, cli_errstr(&cli)));
cli_nt_session_close(&cli);
cli_ulogoff(&cli);
cli_shutdown(&cli);
((smb_ntpasslen != 0) ? smb_ntpasswd : NULL),
&ctr, &info3) == False) {
DEBUG(0,("domain_client_validate: unable to validate password for user %s in domain \
-%s to Domain controller %s. Error was %s.\n", user, domain, remote_machine, cli_errstr(&cli)));
+%s to Domain controller %s. Error was %s.\n", user, domain, cli.desthost, cli_errstr(&cli)));
cli_nt_session_close(&cli);
cli_ulogoff(&cli);
cli_shutdown(&cli);
if(cli_nt_logoff(&cli, &ctr) == False) {
DEBUG(0,("domain_client_validate: unable to log off user %s in domain \
-%s to Domain controller %s. Error was %s.\n", user, domain, remote_machine, cli_errstr(&cli)));
+%s to Domain controller %s. Error was %s.\n", user, domain, cli.desthost, cli_errstr(&cli)));
cli_nt_session_close(&cli);
cli_ulogoff(&cli);
cli_shutdown(&cli);
git.samba.org / samba.git / blobdiff