2 Unix SMB/Netbios implementation.
4 Password and authentication handling
5 Copyright (C) Andrew Tridgell 1992-2000
6 Copyright (C) Luke Kenneth Casson Leighton 1996-2000
7 Copyright (C) Andrew Bartlett 2001
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 /****************************************************************************
27 core of smb password checking routine.
28 ****************************************************************************/
29 static BOOL smb_pwd_check_ntlmv1(DATA_BLOB nt_response,
30 const uchar *part_passwd,
32 uint8 user_sess_key[16])
34 /* Finish the encryption of part_passwd. */
37 if (part_passwd == NULL) {
38 DEBUG(10,("No password set - DISALLOWING access\n"));
39 /* No password set - always false ! */
43 if (sec_blob.length != 8) {
44 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%d)\n", sec_blob.length));
48 if (nt_response.length != 24) {
49 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%d)\n", nt_response.length));
53 SMBOWFencrypt(part_passwd, sec_blob.data, p24);
54 if (user_sess_key != NULL)
56 SMBsesskeygen_ntv1(part_passwd, NULL, user_sess_key);
62 DEBUG(100,("Part password (P16) was |"));
63 dump_data(100, part_passwd, 16);
64 DEBUG(100,("Password from client was |"));
65 dump_data(100, nt_response.data, nt_response.length);
66 DEBUG(100,("Given challenge was |"));
67 dump_data(100, sec_blob.data, sec_blob.length);
68 DEBUG(100,("Value from encryption was |"));
69 dump_data(100, p24, 24);
71 return (memcmp(p24, nt_response.data, 24) == 0);
74 /****************************************************************************
75 core of smb password checking routine.
76 ****************************************************************************/
77 static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB ntv2_response,
78 const uchar *part_passwd,
79 const DATA_BLOB sec_blob,
80 const char *user, const char *domain,
81 uint8 user_sess_key[16])
83 /* Finish the encryption of part_passwd. */
85 uchar value_from_encryption[16];
86 uchar client_response[16];
87 DATA_BLOB client_key_data;
89 if (part_passwd == NULL)
91 DEBUG(10,("No password set - DISALLOWING access\n"));
92 /* No password set - always False */
96 if (ntv2_response.length < 16) {
97 /* We MUST have more than 16 bytes, or the stuff below will go
99 DEBUG(0, ("smb_pwd_check_ntlmv2: incorrect password length (%d)\n",
100 ntv2_response.length));
104 client_key_data = data_blob(ntv2_response.data+16, ntv2_response.length-16);
105 memcpy(client_response, ntv2_response.data, sizeof(client_response));
107 ntv2_owf_gen(part_passwd, user, domain, kr);
108 SMBOWFencrypt_ntv2(kr, sec_blob, client_key_data, (char *)value_from_encryption);
109 if (user_sess_key != NULL)
111 SMBsesskeygen_ntv2(kr, value_from_encryption, user_sess_key);
115 DEBUG(100,("Part password (P16) was |"));
116 dump_data(100, part_passwd, 16);
117 DEBUG(100,("Password from client was |"));
118 dump_data(100, ntv2_response.data, ntv2_response.length);
119 DEBUG(100,("Variable data from client was |"));
120 dump_data(100, client_key_data.data, client_key_data.length);
121 DEBUG(100,("Given challenge was |"));
122 dump_data(100, sec_blob.data, sec_blob.length);
123 DEBUG(100,("Value from encryption was |"));
124 dump_data(100, value_from_encryption, 16);
126 data_blob_clear_free(&client_key_data);
127 return (memcmp(value_from_encryption, client_response, 16) == 0);
131 /****************************************************************************
132 Do a specific test for an smb password being correct, given a smb_password and
133 the lanman and NT responses.
134 ****************************************************************************/
135 static NTSTATUS sam_password_ok(SAM_ACCOUNT *sampass,
136 const auth_usersupplied_info *user_info,
137 const auth_authsupplied_info *auth_info,
138 uint8 user_sess_key[16])
141 const uint8 *nt_pw, *lm_pw;
142 uint32 ntlmssp_flags;
144 acct_ctrl = pdb_get_acct_ctrl(sampass);
145 if (acct_ctrl & ACB_PWNOTREQ)
147 if (lp_null_passwords())
149 DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", pdb_get_username(sampass)));
150 return(NT_STATUS_OK);
154 DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", pdb_get_username(sampass)));
155 return(NT_STATUS_LOGON_FAILURE);
159 nt_pw = pdb_get_nt_passwd(sampass);
160 lm_pw = pdb_get_lanman_passwd(sampass);
162 ntlmssp_flags = user_info->ntlmssp_flags;
165 DEBUG(3,("smb_password_ok: NO NT password stored for user %s.\n",
166 pdb_get_username(sampass)));
167 /* No return, we want to check the LM hash below in this case */
168 ntlmssp_flags &= (~(NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_NTLM2));
171 if (ntlmssp_flags & NTLMSSP_NEGOTIATE_NTLM2) {
172 /* We have the NT MD4 hash challenge available - see if we can
173 use it (ie. does it exist in the smbpasswd file).
175 DEBUG(4,("smb_password_ok: Checking NTLMv2 password\n"));
176 if (smb_pwd_check_ntlmv2( user_info->nt_resp,
177 nt_pw, auth_info->challenge,
178 user_info->smb_name.str,
179 user_info->client_domain.str,
184 DEBUG(3,("smb_password_ok: NTLMv2 password check failed\n"));
185 return NT_STATUS_WRONG_PASSWORD;
187 } else if (ntlmssp_flags & NTLMSSP_NEGOTIATE_NTLM) {
188 if (lp_ntlm_auth()) {
189 /* We have the NT MD4 hash challenge available - see if we can
190 use it (ie. does it exist in the smbpasswd file).
192 DEBUG(4,("smb_password_ok: Checking NT MD4 password\n"));
193 if (smb_pwd_check_ntlmv1(user_info->nt_resp,
194 nt_pw, auth_info->challenge,
199 DEBUG(3,("smb_password_ok: NT MD4 password check failed for user %s\n",pdb_get_username(sampass)));
200 return NT_STATUS_WRONG_PASSWORD;
203 DEBUG(2,("smb_password_ok: NTLMv1 passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass)));
204 /* No return, we want to check the LM hash below in this case */
209 DEBUG(3,("smb_password_ok: NO LanMan password set for user %s (and no NT password supplied)\n",pdb_get_username(sampass)));
210 ntlmssp_flags &= (~NTLMSSP_NEGOTIATE_OEM);
213 if (ntlmssp_flags & NTLMSSP_NEGOTIATE_OEM) {
215 if (user_info->lm_resp.length != 24) {
216 DEBUG(2,("smb_password_ok: invalid LanMan password length (%d) for user %s\n",
217 user_info->nt_resp.length, pdb_get_username(sampass)));
220 if (!lp_lanman_auth()) {
221 DEBUG(3,("smb_password_ok: Lanman passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass)));
222 return NT_STATUS_LOGON_FAILURE;
225 DEBUG(4,("smb_password_ok: Checking LM password\n"));
226 if (smb_pwd_check_ntlmv1(user_info->lm_resp,
227 lm_pw, auth_info->challenge,
232 DEBUG(4,("smb_password_ok: LM password check failed for user %s\n",pdb_get_username(sampass)));
233 return NT_STATUS_WRONG_PASSWORD;
237 /* Should not be reached, but if they send nothing... */
238 DEBUG(3,("smb_password_ok: NEITHER LanMan nor NT password supplied for user %s\n",pdb_get_username(sampass)));
239 return NT_STATUS_WRONG_PASSWORD;
242 /****************************************************************************
243 Do a specific test for a SAM_ACCOUNT being vaild for this connection
244 (ie not disabled, expired and the like).
245 ****************************************************************************/
246 static NTSTATUS sam_account_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *user_info)
248 uint16 acct_ctrl = pdb_get_acct_ctrl(sampass);
249 char *workstation_list;
252 DEBUG(4,("smb_password_ok: Checking SMB password for user %s\n",pdb_get_username(sampass)));
254 /* Quit if the account was disabled. */
255 if (acct_ctrl & ACB_DISABLED) {
256 DEBUG(1,("Account for user '%s' was disabled.\n", pdb_get_username(sampass)));
257 return NT_STATUS_ACCOUNT_DISABLED;
260 /* Test account expire time */
262 kickoff_time = pdb_get_kickoff_time(sampass);
263 if (kickoff_time != 0 && time(NULL) > kickoff_time) {
264 DEBUG(1,("Account for user '%s' has expried.\n", pdb_get_username(sampass)));
265 DEBUG(3,("Account expired at '%ld' unix time.\n", (long)kickoff_time));
266 return NT_STATUS_ACCOUNT_EXPIRED;
269 if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOEXP)) {
270 time_t must_change_time = pdb_get_pass_must_change_time(sampass);
271 time_t last_set_time = pdb_get_pass_last_set_time(sampass);
273 /* check for immediate expiry "must change at next logon" */
274 if (must_change_time == 0 && last_set_time != 0) {
275 DEBUG(1,("Account for user '%s' password must change!.\n", pdb_get_username(sampass)));
276 return NT_STATUS_PASSWORD_MUST_CHANGE;
279 /* check for expired password */
280 if (must_change_time < time(NULL) && must_change_time != 0) {
281 DEBUG(1,("Account for user '%s' password expired!.\n", pdb_get_username(sampass)));
282 DEBUG(1,("Password expired at '%s' (%ld) unix time.\n", http_timestring(must_change_time), (long)must_change_time));
283 return NT_STATUS_PASSWORD_EXPIRED;
287 /* Test workstation. Workstation list is comma separated. */
289 workstation_list = strdup(pdb_get_workstations(sampass));
291 if (!workstation_list) return NT_STATUS_NO_MEMORY;
293 if (*workstation_list) {
294 BOOL invalid_ws = True;
295 char *s = workstation_list;
299 while (next_token(&s, tok, ",", sizeof(tok))) {
300 DEBUG(10,("checking for workstation match %s and %s (len=%d)\n",
301 tok, user_info->wksta_name.str, user_info->wksta_name.len));
302 if(strequal(tok, user_info->wksta_name.str)) {
308 SAFE_FREE(workstation_list);
310 return NT_STATUS_INVALID_WORKSTATION;
312 SAFE_FREE(workstation_list);
315 if (acct_ctrl & ACB_DOMTRUST) {
316 DEBUG(2,("session_trust_account: Domain trust account %s denied by server\n", pdb_get_username(sampass)));
317 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
320 if (acct_ctrl & ACB_SVRTRUST) {
321 DEBUG(2,("session_trust_account: Server trust account %s denied by server\n", pdb_get_username(sampass)));
322 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
325 if (acct_ctrl & ACB_WSTRUST) {
326 DEBUG(4,("session_trust_account: Wksta trust account %s denied by server\n", pdb_get_username(sampass)));
327 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
334 /****************************************************************************
335 check if a username/password is OK assuming the password is a 24 byte
336 SMB hash supplied in the user_info structure
337 return an NT_STATUS constant.
338 ****************************************************************************/
340 static NTSTATUS check_sam_security(void *my_private_data,
341 const auth_usersupplied_info *user_info,
342 const auth_authsupplied_info *auth_info,
343 auth_serversupplied_info **server_info)
345 SAM_ACCOUNT *sampass=NULL;
348 uint8 user_sess_key[16];
349 const uint8* lm_hash;
351 if (!user_info || !auth_info) {
352 return NT_STATUS_LOGON_FAILURE;
355 if (!pdb_init_sam(&sampass)) {
356 return NT_STATUS_NO_MEMORY;
359 /* get the account information */
362 ret = pdb_getsampwnam(sampass, user_info->internal_username.str);
367 DEBUG(1,("Couldn't find user '%s' in passdb file.\n", user_info->internal_username.str));
368 pdb_free_sam(&sampass);
369 return NT_STATUS_NO_SUCH_USER;
372 nt_status = sam_password_ok(sampass, user_info, auth_info, user_sess_key);
374 if (!NT_STATUS_IS_OK(nt_status)) {
375 pdb_free_sam(&sampass);
379 nt_status = sam_account_ok(sampass, user_info);
381 if (!NT_STATUS_IS_OK(nt_status)) {
382 pdb_free_sam(&sampass);
386 if (!make_server_info_sam(server_info, sampass)) {
387 DEBUG(0,("failed to malloc memory for server_info\n"));
388 return NT_STATUS_NO_MEMORY;
391 lm_hash = pdb_get_lanman_passwd((*server_info)->sam_account);
393 memcpy((*server_info)->first_8_lm_hash, lm_hash, 8);
396 memcpy((*server_info)->session_key, user_sess_key, sizeof(user_sess_key));
401 BOOL auth_init_sam(auth_methods **auth_method)
403 if (!make_auth_methods(auth_method)) {
407 (*auth_method)->auth = check_sam_security;
411 /****************************************************************************
412 check if a username/password is OK assuming the password is a 24 byte
413 SMB hash supplied in the user_info structure
414 return an NT_STATUS constant.
415 ****************************************************************************/
417 static NTSTATUS check_samstrict_security(void *my_private_data,
418 const auth_usersupplied_info *user_info,
419 const auth_authsupplied_info *auth_info,
420 auth_serversupplied_info **server_info)
423 if (!user_info || !auth_info) {
424 return NT_STATUS_LOGON_FAILURE;
427 /* If we are a domain member, we must not
428 attempt to check the password locally,
429 unless it is one of our aliases. */
431 if (!is_netbios_alias_or_name(user_info->domain.str)) {
432 return NT_STATUS_NO_SUCH_USER;
435 return check_sam_security(my_private_data, user_info, auth_info, server_info);
438 BOOL auth_init_samstrict(auth_methods **auth_method)
440 if (!make_auth_methods(auth_method)) {
444 (*auth_method)->auth = check_samstrict_security;