}
-/****************************************************************************
-Setup the groups a user belongs to.
-****************************************************************************/
-int setup_groups(char *user, uid_t uid, gid_t gid, int *p_ngroups, gid_t **p_groups)
-{
- int i,ngroups;
- gid_t grp = 0;
- gid_t *groups = NULL;
-
- if (-1 == initgroups(user,gid))
- {
- if (getuid() == 0)
- {
- DEBUG(0,("Unable to initgroups!\n"));
- if (gid < 0 || gid > 16000 || uid < 0 || uid > 16000)
- {
- DEBUG(0,("This is probably a problem with the account %s\n", user));
- }
- }
- return -1;
- }
-
- ngroups = sys_getgroups(0,&grp);
- if (ngroups <= 0)
- {
- ngroups = 32;
- }
-
- if((groups = (gid_t *)malloc(sizeof(gid_t)*ngroups)) == NULL)
- {
- DEBUG(0,("setup_groups malloc fail !\n"));
- return -1;
- }
-
- ngroups = sys_getgroups(ngroups,groups);
-
- (*p_ngroups) = ngroups;
- (*p_groups) = groups;
-
- DEBUG( 3, ( "%s is in %d groups: ", user, ngroups ) );
- for (i = 0; i < ngroups; i++ )
- {
- DEBUG( 3, ( "%s%d", (i ? ", " : ""), (int)groups[i] ) );
- }
- DEBUG( 3, ( "\n" ) );
-
- return 0;
-}
-
/****************************************************************************
register a uid/name pair as being valid and that a valid password
/* Find all the groups this uid is in and store them.
Used by become_user() */
- setup_groups(unix_name,uid,gid,
+ get_unixgroups(unix_name,uid,gid,
&vuser->n_groups,
&vuser->groups);
if (!lm_pass || !smb_pass) return(False);
DEBUG(4,("Checking SMB password for user %s\n",
- smb_pass->smb_name));
+ smb_pass->unix_name));
if(smb_pass->acct_ctrl & ACB_DISABLED) {
DEBUG(3,("account for user %s was disabled.\n",
- smb_pass->smb_name));
+ smb_pass->unix_name));
return(False);
}
if((smb_pass->smb_passwd == NULL) &&
(smb_pass->acct_ctrl & ACB_PWNOTREQ)) {
DEBUG(4,("no password required for user %s\n",
- smb_pass->smb_name));
+ smb_pass->unix_name));
return True;
}
}
/* Ensure the uid's match */
- if (smb_pass->smb_userid != pass->pw_uid)
+ if (smb_pass->unix_uid != pass->pw_uid)
{
DEBUG(3,("Error : UNIX and SMB uids in password files do not match !\n"));
return(False);
if (lm_pwd[0] == '\0' && IS_BITS_SET_ALL(smb_pass->acct_ctrl, ACB_PWNOTREQ) && lp_null_passwords())
{
- DEBUG(3,("account for user %s has no password and null passwords are allowed.\n", smb_pass->smb_name));
+ DEBUG(3,("account for user %s has no password and null passwords are allowed.\n", smb_pass->unix_name));
return(True);
}
****************************************************************************/
static char *validate_group(char *group,char *password,int pwlen,int snum)
{
-#ifdef HAVE_NETGROUP
+#if defined(HAVE_NETGROUP) && defined(HAVE_GETNETGRENT) && defined(HAVE_SETNETGRENT) && defined(HAVE_ENDNETGRENT)
{
char *host, *user, *domain;
setnetgrent(group);
int plus_allowed = 1;
char *file_host;
char *file_user;
- FILE *fp = fopen(equiv_file, "r");
+ FILE *fp = sys_fopen(equiv_file, "r");
DEBUG(5, ("check_user_equiv %s %s %s\n", user, remote, equiv_file));
if (! fp) return False;
while(fgets(buf, sizeof(buf), fp))
****************************************************************************/
struct cli_state *server_cryptkey(void)
{
- struct cli_state *cli;
- fstring desthost;
- struct in_addr dest_ip;
- extern fstring local_machine;
- char *p;
- BOOL connected_ok = False;
- struct nmb_name calling, called;
-
- cli = server_client();
-
- if (!cli_initialise(cli))
- return NULL;
-
- p = lp_passwordserver();
- while(p && next_token( &p, desthost, LIST_SEP, sizeof(desthost))) {
- standard_sub_basic(desthost);
- strupper(desthost);
-
- if(!resolve_name( desthost, &dest_ip, 0x20)) {
- DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost));
- continue;
- }
-
- if (ismyip(dest_ip)) {
- DEBUG(1,("Password server loop - disabling password server %s\n",desthost));
- continue;
- }
-
- if (cli_connect(cli, desthost, &dest_ip)) {
- DEBUG(3,("connected to password server %s\n",desthost));
- connected_ok = True;
- break;
- }
- }
-
- if (!connected_ok) {
- DEBUG(0,("password server not available\n"));
- cli_shutdown(cli);
- return NULL;
- }
-
- make_nmb_name(&calling, local_machine, 0x0 , scope);
- make_nmb_name(&called , desthost , 0x20, scope);
-
- if (!cli_session_request(cli, &calling, &called))
+ if (cli_connect_serverlist(server_client(), lp_passwordserver()))
{
- DEBUG(1,("%s rejected the session\n",desthost));
- cli_shutdown(cli);
- return NULL;
- }
-
- DEBUG(3,("got session\n"));
-
- if (!cli_negprot(cli)) {
- DEBUG(1,("%s rejected the negprot\n",desthost));
- cli_shutdown(cli);
- return NULL;
+ return server_client();
}
-
- if (cli->protocol < PROTOCOL_LANMAN2 ||
- !(cli->sec_mode & 1)) {
- DEBUG(1,("%s isn't in user level security mode\n",desthost));
- cli_shutdown(cli);
- return NULL;
- }
-
- DEBUG(3,("password server OK\n"));
-
- return cli;
+ return NULL;
}
/****************************************************************************
char *smb_apasswd, int smb_apasslen,
char *smb_ntpasswd, int smb_ntpasslen)
{
+ uint16 nt_pipe_fnum;
unsigned char local_challenge[8];
unsigned char local_lm_response[24];
unsigned char local_nt_reponse[24];
unsigned char trust_passwd[16];
- fstring remote_machine;
- char *p;
- struct in_addr dest_ip;
NET_ID_INFO_CTR ctr;
NET_USER_INFO_3 info3;
struct cli_state cli;
uint32 smb_uid_low;
- BOOL connected_ok = False;
- struct nmb_name calling, called;
/*
* Check that the requested domain is not our own machine name.
* see if they were valid.
*/
- ZERO_STRUCT(cli);
-
- if(cli_initialise(&cli) == False) {
- DEBUG(0,("domain_client_validate: unable to initialize client connection.\n"));
- return False;
- }
-
- /*
- * Treat each name in the 'password server =' line as a potential
- * PDC/BDC. Contact each in turn and try and authenticate.
- */
-
- p = lp_passwordserver();
- while(p && next_token(&p,remote_machine,LIST_SEP,sizeof(remote_machine))) {
-
- standard_sub_basic(remote_machine);
- strupper(remote_machine);
-
- if(!resolve_name( remote_machine, &dest_ip, 0x20)) {
- DEBUG(1,("domain_client_validate: Can't resolve address for %s\n", remote_machine));
- continue;
- }
-
- if (ismyip(dest_ip)) {
- DEBUG(1,("domain_client_validate: Password server loop - not using password server %s\n",remote_machine));
- continue;
- }
-
- if (!cli_connect(&cli, remote_machine, &dest_ip)) {
- DEBUG(0,("domain_client_validate: unable to connect to SMB server on \
-machine %s. Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- continue;
- }
-
- make_nmb_name(&calling, global_myname , 0x0 , scope);
- make_nmb_name(&called , remote_machine, 0x20, scope);
-
- if (!cli_session_request(&cli, &calling, &called))
+ if (!cli_connect_serverlist(&cli, lp_passwordserver()))
{
- DEBUG(0,("domain_client_validate: machine %s rejected the session setup. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- cli.protocol = PROTOCOL_NT1;
-
- if (!cli_negprot(&cli)) {
- DEBUG(0,("domain_client_validate: machine %s rejected the negotiate protocol. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- if (cli.protocol != PROTOCOL_NT1) {
- DEBUG(0,("domain_client_validate: machine %s didn't negotiate NT protocol.\n",
- remote_machine));
- cli_shutdown(&cli);
- continue;
- }
-
- /*
- * Do an anonymous session setup.
- */
-
- if (!cli_session_setup(&cli, "", "", 0, "", 0, "")) {
- DEBUG(0,("domain_client_validate: machine %s rejected the session setup. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- if (!(cli.sec_mode & 1)) {
- DEBUG(1,("domain_client_validate: machine %s isn't in user level security mode\n",
- remote_machine));
- cli_shutdown(&cli);
- continue;
- }
-
- if (!cli_send_tconX(&cli, "IPC$", "IPC", "", 1)) {
- DEBUG(0,("domain_client_validate: machine %s rejected the tconX on the IPC$ share. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- /*
- * We have an anonymous connection to IPC$.
- */
- connected_ok = True;
- break;
- }
-
- if (!connected_ok) {
DEBUG(0,("domain_client_validate: Domain password server not available.\n"));
- cli_shutdown(&cli);
return False;
}
* Now start the NT Domain stuff :-).
*/
- if(cli_nt_session_open(&cli, PIPE_NETLOGON) == False) {
+ if(cli_nt_session_open(&cli, PIPE_NETLOGON, &nt_pipe_fnum) == False) {
DEBUG(0,("domain_client_validate: unable to open the domain client session to \
-machine %s. Error was : %s.\n", remote_machine, cli_errstr(&cli)));
- cli_nt_session_close(&cli);
+machine %s. Error was : %s.\n", cli.desthost, cli_errstr(&cli)));
+ cli_nt_session_close(&cli, nt_pipe_fnum);
cli_ulogoff(&cli);
cli_shutdown(&cli);
return False;
}
- if(cli_nt_setup_creds(&cli, trust_passwd) == False) {
+ if(cli_nt_setup_creds(&cli, nt_pipe_fnum,
+ cli.mach_acct, trust_passwd, SEC_CHAN_WKSTA) == False)
+ {
DEBUG(0,("domain_client_validate: unable to setup the PDC credentials to machine \
-%s. Error was : %s.\n", remote_machine, cli_errstr(&cli)));
- cli_nt_session_close(&cli);
+%s. Error was : %s.\n", cli.desthost, cli_errstr(&cli)));
+ cli_nt_session_close(&cli, nt_pipe_fnum);
cli_ulogoff(&cli);
cli_shutdown(&cli);
return False;
/* We really don't care what LUID we give the user. */
generate_random_buffer( (unsigned char *)&smb_uid_low, 4, False);
- if(cli_nt_login_network(&cli, domain, user, smb_uid_low, (char *)local_challenge,
+ if(cli_nt_login_network(&cli, nt_pipe_fnum, domain, user, smb_uid_low, (char *)local_challenge,
((smb_apasslen != 0) ? smb_apasswd : NULL),
((smb_ntpasslen != 0) ? smb_ntpasswd : NULL),
&ctr, &info3) == False) {
DEBUG(0,("domain_client_validate: unable to validate password for user %s in domain \
-%s to Domain controller %s. Error was %s.\n", user, domain, remote_machine, cli_errstr(&cli)));
- cli_nt_session_close(&cli);
+%s to Domain controller %s. Error was %s.\n", user, domain, cli.desthost, cli_errstr(&cli)));
+ cli_nt_session_close(&cli, nt_pipe_fnum);
cli_ulogoff(&cli);
cli_shutdown(&cli);
return False;
* send here. JRA.
*/
- if(cli_nt_logoff(&cli, &ctr) == False) {
+ if(cli_nt_logoff(&cli, nt_pipe_fnum, &ctr) == False) {
DEBUG(0,("domain_client_validate: unable to log off user %s in domain \
-%s to Domain controller %s. Error was %s.\n", user, domain, remote_machine, cli_errstr(&cli)));
- cli_nt_session_close(&cli);
+%s to Domain controller %s. Error was %s.\n", user, domain, cli.desthost, cli_errstr(&cli)));
+ cli_nt_session_close(&cli, nt_pipe_fnum);
cli_ulogoff(&cli);
cli_shutdown(&cli);
return False;
}
#endif /* 0 */
- cli_nt_session_close(&cli);
+ cli_nt_session_close(&cli, nt_pipe_fnum);
cli_ulogoff(&cli);
cli_shutdown(&cli);
return True;
git.samba.org / samba.git / blobdiff