2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Jeremy Allison 1996-2001
5 Copyright (C) Luke Kenneth Casson Leighton 1996-1998
6 Copyright (C) Gerald (Jerry) Carter 2000-2001
7 Copyright (C) Andrew Bartlett 2001-2002
8 Copyright (C) Simo Sorce 2003
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 #define DBGC_CLASS DBGC_PASSDB
30 /******************************************************************
31 get the default domain/netbios name to be used when
32 testing authentication. For example, if you connect
33 to a Windows member server using a bogus domain name, the
34 Windows box will map the BOGUS\user to DOMAIN\user. A
35 standalone box will map to WKS\user.
36 ******************************************************************/
38 const char *get_default_sam_name(void)
40 /* standalone servers can only use the local netbios name */
41 if ( lp_server_role() == ROLE_STANDALONE )
42 return global_myname();
44 /* Windows domain members default to the DOMAIN
45 name when not specified */
46 return lp_workgroup();
49 /************************************************************
50 Fill the SAM_ACCOUNT with default values.
51 ***********************************************************/
53 void pdb_fill_default_sam(SAM_ACCOUNT *user)
55 ZERO_STRUCT(user->private); /* Don't touch the talloc context */
57 /* no initial methods */
60 /* Don't change these timestamp settings without a good reason.
61 They are important for NT member server compatibility. */
63 user->private.logon_time = (time_t)0;
64 user->private.pass_last_set_time = (time_t)0;
65 user->private.pass_can_change_time = (time_t)0;
66 user->private.logoff_time =
67 user->private.kickoff_time =
68 user->private.pass_must_change_time = get_time_t_max();
69 user->private.fields_present = 0x00ffffff;
70 user->private.logon_divs = 168; /* hours per week */
71 user->private.hours_len = 21; /* 21 times 8 bits = 168 */
72 memset(user->private.hours, 0xff, user->private.hours_len); /* available at all hours */
73 user->private.bad_password_count = 0;
74 user->private.logon_count = 0;
75 user->private.unknown_6 = 0x000004ec; /* don't know */
77 /* Some parts of samba strlen their pdb_get...() returns,
78 so this keeps the interface unchanged for now. */
80 user->private.username = "";
81 user->private.domain = "";
82 user->private.nt_username = "";
83 user->private.full_name = "";
84 user->private.home_dir = "";
85 user->private.logon_script = "";
86 user->private.profile_path = "";
87 user->private.acct_desc = "";
88 user->private.workstations = "";
89 user->private.unknown_str = "";
90 user->private.munged_dial = "";
92 user->private.plaintext_pw = NULL;
95 Unless we know otherwise have a Account Control Bit
96 value of 'normal user'. This helps User Manager, which
97 asks for a filtered list of users.
100 user->private.acct_ctrl = ACB_NORMAL;
103 static void destroy_pdb_talloc(SAM_ACCOUNT **user)
106 data_blob_clear_free(&((*user)->private.lm_pw));
107 data_blob_clear_free(&((*user)->private.nt_pw));
109 if((*user)->private.plaintext_pw!=NULL)
110 memset((*user)->private.plaintext_pw,'\0',strlen((*user)->private.plaintext_pw));
111 talloc_destroy((*user)->mem_ctx);
117 /**********************************************************************
118 Allocates memory and initialises a struct sam_passwd on supplied mem_ctx.
119 ***********************************************************************/
121 NTSTATUS pdb_init_sam_talloc(TALLOC_CTX *mem_ctx, SAM_ACCOUNT **user)
124 DEBUG(0,("pdb_init_sam_talloc: SAM_ACCOUNT was non NULL\n"));
126 smb_panic("non-NULL pointer passed to pdb_init_sam\n");
128 return NT_STATUS_UNSUCCESSFUL;
132 DEBUG(0,("pdb_init_sam_talloc: mem_ctx was NULL!\n"));
133 return NT_STATUS_UNSUCCESSFUL;
136 *user=TALLOC_P(mem_ctx, SAM_ACCOUNT);
139 DEBUG(0,("pdb_init_sam_talloc: error while allocating memory\n"));
140 return NT_STATUS_NO_MEMORY;
143 (*user)->mem_ctx = mem_ctx;
145 (*user)->free_fn = NULL;
147 pdb_fill_default_sam(*user);
153 /*************************************************************
154 Allocates memory and initialises a struct sam_passwd.
155 ************************************************************/
157 NTSTATUS pdb_init_sam(SAM_ACCOUNT **user)
162 mem_ctx = talloc_init("passdb internal SAM_ACCOUNT allocation");
165 DEBUG(0,("pdb_init_sam: error while doing talloc_init()\n"));
166 return NT_STATUS_NO_MEMORY;
169 if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_talloc(mem_ctx, user))) {
170 talloc_destroy(mem_ctx);
174 (*user)->free_fn = destroy_pdb_talloc;
179 /**************************************************************************
180 * This function will take care of all the steps needed to correctly
181 * allocate and set the user SID, please do use this function to create new
182 * users, messing with SIDs is not good.
184 * account_data must be provided initialized, pwd may be null.
186 ***************************************************************************/
188 static NTSTATUS pdb_set_sam_sids(SAM_ACCOUNT *account_data, const struct passwd *pwd)
190 const char *guest_account = lp_guestaccount();
194 if (!account_data || !pwd) {
195 return NT_STATUS_INVALID_PARAMETER;
198 /* this is a hack this thing should not be set
200 if (!(guest_account && *guest_account)) {
201 DEBUG(1, ("NULL guest account!?!?\n"));
202 return NT_STATUS_UNSUCCESSFUL;
204 /* Ensure this *must* be set right */
205 if (strcmp(pwd->pw_name, guest_account) == 0) {
206 if (!pdb_set_user_sid_from_rid(account_data, DOMAIN_USER_RID_GUEST, PDB_DEFAULT)) {
207 return NT_STATUS_UNSUCCESSFUL;
209 if (!pdb_set_group_sid_from_rid(account_data, DOMAIN_GROUP_RID_GUESTS, PDB_DEFAULT)) {
210 return NT_STATUS_UNSUCCESSFUL;
216 if (!pdb_set_user_sid_from_rid(account_data, algorithmic_pdb_uid_to_user_rid(pwd->pw_uid), PDB_SET)) {
217 DEBUG(0,("Can't set User SID from RID!\n"));
218 return NT_STATUS_INVALID_PARAMETER;
221 /* call the mapping code here */
223 ret = pdb_getgrgid(&map, pwd->pw_gid);
227 if (!pdb_set_group_sid(account_data, &map.sid, PDB_SET)){
228 DEBUG(0,("Can't set Group SID!\n"));
229 return NT_STATUS_INVALID_PARAMETER;
233 if (!pdb_set_group_sid_from_rid(account_data, pdb_gid_to_group_rid(pwd->pw_gid), PDB_SET)) {
234 DEBUG(0,("Can't set Group SID\n"));
235 return NT_STATUS_INVALID_PARAMETER;
242 /*************************************************************
243 Initialises a struct sam_passwd with sane values.
244 ************************************************************/
246 NTSTATUS pdb_fill_sam_pw(SAM_ACCOUNT *sam_account, const struct passwd *pwd)
251 return NT_STATUS_UNSUCCESSFUL;
254 pdb_fill_default_sam(sam_account);
256 pdb_set_username(sam_account, pwd->pw_name, PDB_SET);
257 pdb_set_fullname(sam_account, pwd->pw_gecos, PDB_SET);
259 pdb_set_unix_homedir(sam_account, pwd->pw_dir, PDB_SET);
261 pdb_set_domain (sam_account, get_global_sam_name(), PDB_DEFAULT);
263 /* When we get a proper uid -> SID and SID -> uid allocation
264 mechinism, we should call it here.
266 We can't just set this to 0 or allow it only to be filled
267 in when added to the backend, because the user's SID
268 may already be in security descriptors etc.
270 -- abartlet 11-May-02
273 ret = pdb_set_sam_sids(sam_account, pwd);
274 if (!NT_STATUS_IS_OK(ret)) return ret;
276 /* check if this is a user account or a machine account */
277 if (pwd->pw_name[strlen(pwd->pw_name)-1] != '$')
279 pdb_set_profile_path(sam_account,
280 talloc_sub_specified((sam_account)->mem_ctx,
282 pwd->pw_name, global_myname(),
283 pwd->pw_uid, pwd->pw_gid),
286 pdb_set_homedir(sam_account,
287 talloc_sub_specified((sam_account)->mem_ctx,
289 pwd->pw_name, global_myname(),
290 pwd->pw_uid, pwd->pw_gid),
293 pdb_set_dir_drive(sam_account,
294 talloc_sub_specified((sam_account)->mem_ctx,
296 pwd->pw_name, global_myname(),
297 pwd->pw_uid, pwd->pw_gid),
300 pdb_set_logon_script(sam_account,
301 talloc_sub_specified((sam_account)->mem_ctx,
303 pwd->pw_name, global_myname(),
304 pwd->pw_uid, pwd->pw_gid),
306 if (!pdb_set_acct_ctrl(sam_account, ACB_NORMAL, PDB_DEFAULT)) {
307 DEBUG(1, ("Failed to set 'normal account' flags for user %s.\n", pwd->pw_name));
308 return NT_STATUS_UNSUCCESSFUL;
311 if (!pdb_set_acct_ctrl(sam_account, ACB_WSTRUST, PDB_DEFAULT)) {
312 DEBUG(1, ("Failed to set 'trusted workstation account' flags for user %s.\n", pwd->pw_name));
313 return NT_STATUS_UNSUCCESSFUL;
320 /*************************************************************
321 Initialises a struct sam_passwd with sane values.
322 ************************************************************/
324 NTSTATUS pdb_init_sam_pw(SAM_ACCOUNT **new_sam_acct, const struct passwd *pwd)
330 return NT_STATUS_INVALID_PARAMETER;
333 if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(new_sam_acct))) {
338 if (!NT_STATUS_IS_OK(nt_status = pdb_fill_sam_pw(*new_sam_acct, pwd))) {
339 pdb_free_sam(new_sam_acct);
348 /*************************************************************
349 Initialises a SAM_ACCOUNT ready to add a new account, based
350 on the UNIX user. Pass in a RID if you have one
351 ************************************************************/
353 NTSTATUS pdb_init_sam_new(SAM_ACCOUNT **new_sam_acct, const char *username,
356 NTSTATUS nt_status = NT_STATUS_NO_MEMORY;
360 pwd = Get_Pwnam(username);
363 return NT_STATUS_NO_SUCH_USER;
365 if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_pw(new_sam_acct, pwd))) {
366 *new_sam_acct = NULL;
370 /* see if we need to generate a new rid using the 2.2 algorithm */
371 if ( rid == 0 && lp_enable_rid_algorithm() ) {
372 DEBUG(10,("pdb_init_sam_new: no RID specified. Generating one via old algorithm\n"));
373 rid = algorithmic_pdb_uid_to_user_rid(pwd->pw_uid);
376 /* set the new SID */
378 ret = pdb_set_user_sid_from_rid( *new_sam_acct, rid, PDB_SET );
380 return (ret ? NT_STATUS_OK : NT_STATUS_NO_SUCH_USER);
385 * Free the contets of the SAM_ACCOUNT, but not the structure.
387 * Also wipes the LM and NT hashes and plaintext password from
390 * @param user SAM_ACCOUNT to free members of.
393 static void pdb_free_sam_contents(SAM_ACCOUNT *user)
396 /* Kill off sensitive data. Free()ed by the
399 data_blob_clear_free(&(user->private.lm_pw));
400 data_blob_clear_free(&(user->private.nt_pw));
401 if (user->private.plaintext_pw!=NULL)
402 memset(user->private.plaintext_pw,'\0',strlen(user->private.plaintext_pw));
404 if (user->private.backend_private_data && user->private.backend_private_data_free_fn) {
405 user->private.backend_private_data_free_fn(&user->private.backend_private_data);
410 /************************************************************
411 Reset the SAM_ACCOUNT and free the NT/LM hashes.
412 ***********************************************************/
414 NTSTATUS pdb_reset_sam(SAM_ACCOUNT *user)
417 DEBUG(0,("pdb_reset_sam: SAM_ACCOUNT was NULL\n"));
419 smb_panic("NULL pointer passed to pdb_free_sam\n");
421 return NT_STATUS_UNSUCCESSFUL;
424 pdb_free_sam_contents(user);
426 pdb_fill_default_sam(user);
432 /************************************************************
433 Free the SAM_ACCOUNT and the member pointers.
434 ***********************************************************/
436 NTSTATUS pdb_free_sam(SAM_ACCOUNT **user)
439 DEBUG(0,("pdb_free_sam: SAM_ACCOUNT was NULL\n"));
441 smb_panic("NULL pointer passed to pdb_free_sam\n");
443 return NT_STATUS_UNSUCCESSFUL;
446 pdb_free_sam_contents(*user);
448 if ((*user)->free_fn) {
449 (*user)->free_fn(user);
455 /**********************************************************
456 Encode the account control bits into a string.
457 length = length of string to encode into (including terminating
458 null). length *MUST BE MORE THAN 2* !
459 **********************************************************/
461 char *pdb_encode_acct_ctrl(uint16 acct_ctrl, size_t length)
463 static fstring acct_str;
467 SMB_ASSERT(length <= sizeof(acct_str));
471 if (acct_ctrl & ACB_PWNOTREQ ) acct_str[i++] = 'N';
472 if (acct_ctrl & ACB_DISABLED ) acct_str[i++] = 'D';
473 if (acct_ctrl & ACB_HOMDIRREQ) acct_str[i++] = 'H';
474 if (acct_ctrl & ACB_TEMPDUP ) acct_str[i++] = 'T';
475 if (acct_ctrl & ACB_NORMAL ) acct_str[i++] = 'U';
476 if (acct_ctrl & ACB_MNS ) acct_str[i++] = 'M';
477 if (acct_ctrl & ACB_WSTRUST ) acct_str[i++] = 'W';
478 if (acct_ctrl & ACB_SVRTRUST ) acct_str[i++] = 'S';
479 if (acct_ctrl & ACB_AUTOLOCK ) acct_str[i++] = 'L';
480 if (acct_ctrl & ACB_PWNOEXP ) acct_str[i++] = 'X';
481 if (acct_ctrl & ACB_DOMTRUST ) acct_str[i++] = 'I';
483 for ( ; i < length - 2 ; i++ )
488 acct_str[i++] = '\0';
493 /**********************************************************
494 Decode the account control bits from a string.
495 **********************************************************/
497 uint16 pdb_decode_acct_ctrl(const char *p)
499 uint16 acct_ctrl = 0;
500 BOOL finished = False;
503 * Check if the account type bits have been encoded after the
504 * NT password (in the form [NDHTUWSLXI]).
510 for (p++; *p && !finished; p++) {
512 case 'N': { acct_ctrl |= ACB_PWNOTREQ ; break; /* 'N'o password. */ }
513 case 'D': { acct_ctrl |= ACB_DISABLED ; break; /* 'D'isabled. */ }
514 case 'H': { acct_ctrl |= ACB_HOMDIRREQ; break; /* 'H'omedir required. */ }
515 case 'T': { acct_ctrl |= ACB_TEMPDUP ; break; /* 'T'emp account. */ }
516 case 'U': { acct_ctrl |= ACB_NORMAL ; break; /* 'U'ser account (normal). */ }
517 case 'M': { acct_ctrl |= ACB_MNS ; break; /* 'M'NS logon user account. What is this ? */ }
518 case 'W': { acct_ctrl |= ACB_WSTRUST ; break; /* 'W'orkstation account. */ }
519 case 'S': { acct_ctrl |= ACB_SVRTRUST ; break; /* 'S'erver account. */ }
520 case 'L': { acct_ctrl |= ACB_AUTOLOCK ; break; /* 'L'ocked account. */ }
521 case 'X': { acct_ctrl |= ACB_PWNOEXP ; break; /* No 'X'piry on password */ }
522 case 'I': { acct_ctrl |= ACB_DOMTRUST ; break; /* 'I'nterdomain trust account. */ }
528 default: { finished = True; }
535 /*************************************************************
536 Routine to set 32 hex password characters from a 16 byte array.
537 **************************************************************/
539 void pdb_sethexpwd(char *p, const unsigned char *pwd, uint16 acct_ctrl)
543 for (i = 0; i < 16; i++)
544 slprintf(&p[i*2], 3, "%02X", pwd[i]);
546 if (acct_ctrl & ACB_PWNOTREQ)
547 safe_strcpy(p, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX", 33);
549 safe_strcpy(p, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 33);
553 /*************************************************************
554 Routine to get the 32 hex characters and turn them
555 into a 16 byte array.
556 **************************************************************/
558 BOOL pdb_gethexpwd(const char *p, unsigned char *pwd)
561 unsigned char lonybble, hinybble;
562 const char *hexchars = "0123456789ABCDEF";
568 for (i = 0; i < 32; i += 2) {
569 hinybble = toupper(p[i]);
570 lonybble = toupper(p[i + 1]);
572 p1 = strchr(hexchars, hinybble);
573 p2 = strchr(hexchars, lonybble);
578 hinybble = PTR_DIFF(p1, hexchars);
579 lonybble = PTR_DIFF(p2, hexchars);
581 pwd[i / 2] = (hinybble << 4) | lonybble;
586 /*************************************************************
587 Routine to set 42 hex hours characters from a 21 byte array.
588 **************************************************************/
590 void pdb_sethexhours(char *p, const unsigned char *hours)
594 for (i = 0; i < 21; i++) {
595 slprintf(&p[i*2], 3, "%02X", hours[i]);
598 safe_strcpy(p, "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", 43);
602 /*************************************************************
603 Routine to get the 42 hex characters and turn them
604 into a 21 byte array.
605 **************************************************************/
607 BOOL pdb_gethexhours(const char *p, unsigned char *hours)
610 unsigned char lonybble, hinybble;
611 const char *hexchars = "0123456789ABCDEF";
618 for (i = 0; i < 42; i += 2) {
619 hinybble = toupper(p[i]);
620 lonybble = toupper(p[i + 1]);
622 p1 = strchr(hexchars, hinybble);
623 p2 = strchr(hexchars, lonybble);
629 hinybble = PTR_DIFF(p1, hexchars);
630 lonybble = PTR_DIFF(p2, hexchars);
632 hours[i / 2] = (hinybble << 4) | lonybble;
637 int algorithmic_rid_base(void)
639 static int rid_offset = 0;
644 rid_offset = lp_algorithmic_rid_base();
646 if (rid_offset < BASE_RID) {
647 /* Try to prevent admin foot-shooting, we can't put algorithmic
648 rids below 1000, that's the 'well known RIDs' on NT */
649 DEBUG(0, ("'algorithmic rid base' must be equal to or above %ld\n", BASE_RID));
650 rid_offset = BASE_RID;
652 if (rid_offset & 1) {
653 DEBUG(0, ("algorithmic rid base must be even\n"));
659 /*******************************************************************
660 Converts NT user RID to a UNIX uid.
661 ********************************************************************/
663 uid_t algorithmic_pdb_user_rid_to_uid(uint32 user_rid)
665 int rid_offset = algorithmic_rid_base();
666 return (uid_t)(((user_rid & (~USER_RID_TYPE)) - rid_offset)/RID_MULTIPLIER);
669 /*******************************************************************
670 converts UNIX uid to an NT User RID.
671 ********************************************************************/
673 uint32 algorithmic_pdb_uid_to_user_rid(uid_t uid)
675 int rid_offset = algorithmic_rid_base();
676 return (((((uint32)uid)*RID_MULTIPLIER) + rid_offset) | USER_RID_TYPE);
679 /*******************************************************************
680 Converts NT group RID to a UNIX gid.
681 ********************************************************************/
683 gid_t pdb_group_rid_to_gid(uint32 group_rid)
685 int rid_offset = algorithmic_rid_base();
686 return (gid_t)(((group_rid & (~GROUP_RID_TYPE))- rid_offset)/RID_MULTIPLIER);
689 /*******************************************************************
690 converts NT Group RID to a UNIX uid.
692 warning: you must not call that function only
693 you must do a call to the group mapping first.
694 there is not anymore a direct link between the gid and the rid.
695 ********************************************************************/
697 uint32 pdb_gid_to_group_rid(gid_t gid)
699 int rid_offset = algorithmic_rid_base();
700 return (((((uint32)gid)*RID_MULTIPLIER) + rid_offset) | GROUP_RID_TYPE);
703 /*******************************************************************
704 Decides if a RID is a well known RID.
705 ********************************************************************/
707 static BOOL pdb_rid_is_well_known(uint32 rid)
709 /* Not using rid_offset here, because this is the actual
710 NT fixed value (1000) */
712 return (rid < BASE_RID);
715 /*******************************************************************
716 Decides if a RID is a user or group RID.
717 ********************************************************************/
719 BOOL algorithmic_pdb_rid_is_user(uint32 rid)
721 if(pdb_rid_is_well_known(rid)) {
723 * The only well known user RIDs are DOMAIN_USER_RID_ADMIN
724 * and DOMAIN_USER_RID_GUEST.
726 if(rid == DOMAIN_USER_RID_ADMIN || rid == DOMAIN_USER_RID_GUEST)
728 } else if((rid & RID_TYPE_MASK) == USER_RID_TYPE) {
734 /*******************************************************************
735 Convert a rid into a name. Used in the lookup SID rpc.
736 ********************************************************************/
738 BOOL local_lookup_sid(const DOM_SID *sid, char *name, enum SID_NAME_USE *psid_name_use)
741 SAM_ACCOUNT *sam_account = NULL;
745 if (sid_equal(get_global_sam_sid(), sid)) {
746 *psid_name_use = SID_NAME_DOMAIN;
748 DEBUG(5,("local_lookup_sid: SID is our own domain-sid: %s.\n",
749 sid_string_static(sid)));
753 if (!sid_peek_check_rid(get_global_sam_sid(), sid, &rid)){
754 DEBUG(0,("local_lookup_sid: sid_peek_check_rid return False! SID: %s\n",
755 sid_string_static(&map.sid)));
758 *psid_name_use = SID_NAME_UNKNOWN;
760 DEBUG(5,("local_lookup_sid: looking up RID %u.\n", (unsigned int)rid));
762 if (rid == DOMAIN_USER_RID_ADMIN) {
763 const char **admin_list = lp_admin_users(-1);
764 *psid_name_use = SID_NAME_USER;
766 const char *p = *admin_list;
767 if(!next_token(&p, name, NULL, sizeof(fstring)))
768 fstrcpy(name, "Administrator");
770 fstrcpy(name, "Administrator");
775 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_account))) {
779 /* see if the passdb can help us with the name of the user */
781 /* BEING ROOT BLLOCK */
783 if (pdb_getsampwsid(sam_account, sid)) {
784 unbecome_root(); /* -----> EXIT BECOME_ROOT() */
785 fstrcpy(name, pdb_get_username(sam_account));
786 *psid_name_use = SID_NAME_USER;
788 pdb_free_sam(&sam_account);
792 pdb_free_sam(&sam_account);
794 ret = pdb_getgrsid(&map, *sid);
796 /* END BECOME_ROOT BLOCK */
799 if (map.gid!=(gid_t)-1) {
800 DEBUG(5,("local_lookup_sid: mapped group %s to gid %u\n", map.nt_name, (unsigned int)map.gid));
802 DEBUG(5,("local_lookup_sid: mapped group %s to no unix gid. Returning name.\n", map.nt_name));
805 fstrcpy(name, map.nt_name);
806 *psid_name_use = map.sid_name_use;
810 if (algorithmic_pdb_rid_is_user(rid)) {
812 struct passwd *pw = NULL;
814 DEBUG(5, ("assuming RID %u is a user\n", (unsigned)rid));
816 uid = algorithmic_pdb_user_rid_to_uid(rid);
817 pw = sys_getpwuid( uid );
819 DEBUG(5,("local_lookup_sid: looking up uid %u %s\n", (unsigned int)uid,
820 pw ? "succeeded" : "failed" ));
823 fstr_sprintf(name, "unix_user.%u", (unsigned int)uid);
825 fstrcpy( name, pw->pw_name );
827 DEBUG(5,("local_lookup_sid: found user %s for rid %u\n", name,
828 (unsigned int)rid ));
830 *psid_name_use = SID_NAME_USER;
832 return ( pw != NULL );
837 DEBUG(5, ("assuming RID %u is a group\n", (unsigned)rid));
839 gid = pdb_group_rid_to_gid(rid);
842 *psid_name_use = SID_NAME_ALIAS;
844 DEBUG(5,("local_lookup_sid: looking up gid %u %s\n", (unsigned int)gid,
845 gr ? "succeeded" : "failed" ));
848 fstr_sprintf(name, "unix_group.%u", (unsigned int)gid);
850 fstrcpy( name, gr->gr_name);
852 DEBUG(5,("local_lookup_sid: found group %s for rid %u\n", name,
853 (unsigned int)rid ));
855 /* assume algorithmic groups are domain global groups */
857 *psid_name_use = SID_NAME_DOM_GRP;
859 return ( gr != NULL );
863 /*******************************************************************
864 Convert a name into a SID. Used in the lookup name rpc.
865 ********************************************************************/
867 BOOL local_lookup_name(const char *c_user, DOM_SID *psid, enum SID_NAME_USE *psid_name_use)
872 SAM_ACCOUNT *sam_account = NULL;
876 *psid_name_use = SID_NAME_UNKNOWN;
879 * user may be quoted a const string, and map_username and
880 * friends can modify it. Make a modifiable copy. JRA.
883 fstrcpy(user, c_user);
885 sid_copy(&local_sid, get_global_sam_sid());
887 if (map_name_to_wellknown_sid(&sid, psid_name_use, user)){
889 sid_copy( psid, &sid);
890 sid_to_string(sid_str, &sid);
891 DEBUG(10,("lookup_name: name %s = SID %s, type = %u\n", user, sid_str,
892 (unsigned int)*psid_name_use ));
896 (void)map_username(user);
898 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_account))) {
902 /* BEGIN ROOT BLOCK */
905 if (pdb_getsampwnam(sam_account, user)) {
907 sid_copy(psid, pdb_get_user_sid(sam_account));
908 *psid_name_use = SID_NAME_USER;
910 pdb_free_sam(&sam_account);
914 pdb_free_sam(&sam_account);
917 * Maybe it was a group ?
920 /* check if it's a mapped group */
921 if (pdb_getgrnam(&map, user)) {
922 /* yes it's a mapped group */
923 sid_copy(&local_sid, &map.sid);
924 *psid_name_use = map.sid_name_use;
926 /* it's not a mapped group */
927 grp = getgrnam(user);
929 unbecome_root(); /* ---> exit form block */
934 *check if it's mapped, if it is reply it doesn't exist
936 * that's to prevent this case:
938 * unix group ug is mapped to nt group ng
939 * someone does a lookup on ug
940 * we must not reply as it doesn't "exist" anymore
941 * for NT. For NT only ng exists.
945 if (pdb_getgrgid(&map, grp->gr_gid)){
946 unbecome_root(); /* ---> exit form block */
950 sid_append_rid( &local_sid, pdb_gid_to_group_rid(grp->gr_gid));
951 *psid_name_use = SID_NAME_ALIAS;
956 sid_copy( psid, &local_sid);
961 /*************************************************************
962 Change a password entry in the local smbpasswd file.
963 *************************************************************/
965 BOOL local_password_change(const char *user_name, int local_flags,
966 const char *new_passwd,
967 char *err_str, size_t err_str_len,
968 char *msg_str, size_t msg_str_len)
970 SAM_ACCOUNT *sam_pass=NULL;
976 /* Get the smb passwd entry for this user */
977 pdb_init_sam(&sam_pass);
980 if(!pdb_getsampwnam(sam_pass, user_name)) {
982 pdb_free_sam(&sam_pass);
984 if ((local_flags & LOCAL_ADD_USER) || (local_flags & LOCAL_DELETE_USER)) {
985 /* Might not exist in /etc/passwd. Use rid algorithm here */
986 if (!NT_STATUS_IS_OK(pdb_init_sam_new(&sam_pass, user_name, 0))) {
987 slprintf(err_str, err_str_len-1, "Failed to initialise SAM_ACCOUNT for user %s. Does this user exist in the UNIX password database ?\n", user_name);
991 slprintf(err_str, err_str_len-1,"Failed to find entry for user %s.\n", user_name);
996 /* the entry already existed */
997 local_flags &= ~LOCAL_ADD_USER;
1000 /* the 'other' acb bits not being changed here */
1001 other_acb = (pdb_get_acct_ctrl(sam_pass) & (!(ACB_WSTRUST|ACB_DOMTRUST|ACB_SVRTRUST|ACB_NORMAL)));
1002 if (local_flags & LOCAL_TRUST_ACCOUNT) {
1003 if (!pdb_set_acct_ctrl(sam_pass, ACB_WSTRUST | other_acb, PDB_CHANGED) ) {
1004 slprintf(err_str, err_str_len - 1, "Failed to set 'trusted workstation account' flags for user %s.\n", user_name);
1005 pdb_free_sam(&sam_pass);
1008 } else if (local_flags & LOCAL_INTERDOM_ACCOUNT) {
1009 if (!pdb_set_acct_ctrl(sam_pass, ACB_DOMTRUST | other_acb, PDB_CHANGED)) {
1010 slprintf(err_str, err_str_len - 1, "Failed to set 'domain trust account' flags for user %s.\n", user_name);
1011 pdb_free_sam(&sam_pass);
1015 if (!pdb_set_acct_ctrl(sam_pass, ACB_NORMAL | other_acb, PDB_CHANGED)) {
1016 slprintf(err_str, err_str_len - 1, "Failed to set 'normal account' flags for user %s.\n", user_name);
1017 pdb_free_sam(&sam_pass);
1023 * We are root - just write the new password
1024 * and the valid last change time.
1027 if (local_flags & LOCAL_DISABLE_USER) {
1028 if (!pdb_set_acct_ctrl (sam_pass, pdb_get_acct_ctrl(sam_pass)|ACB_DISABLED, PDB_CHANGED)) {
1029 slprintf(err_str, err_str_len-1, "Failed to set 'disabled' flag for user %s.\n", user_name);
1030 pdb_free_sam(&sam_pass);
1033 } else if (local_flags & LOCAL_ENABLE_USER) {
1034 if (!pdb_set_acct_ctrl (sam_pass, pdb_get_acct_ctrl(sam_pass)&(~ACB_DISABLED), PDB_CHANGED)) {
1035 slprintf(err_str, err_str_len-1, "Failed to unset 'disabled' flag for user %s.\n", user_name);
1036 pdb_free_sam(&sam_pass);
1041 if (local_flags & LOCAL_SET_NO_PASSWORD) {
1042 if (!pdb_set_acct_ctrl (sam_pass, pdb_get_acct_ctrl(sam_pass)|ACB_PWNOTREQ, PDB_CHANGED)) {
1043 slprintf(err_str, err_str_len-1, "Failed to set 'no password required' flag for user %s.\n", user_name);
1044 pdb_free_sam(&sam_pass);
1047 } else if (local_flags & LOCAL_SET_PASSWORD) {
1049 * If we're dealing with setting a completely empty user account
1050 * ie. One with a password of 'XXXX', but not set disabled (like
1051 * an account created from scratch) then if the old password was
1052 * 'XX's then getsmbpwent will have set the ACB_DISABLED flag.
1053 * We remove that as we're giving this user their first password
1054 * and the decision hasn't really been made to disable them (ie.
1055 * don't create them disabled). JRA.
1057 if ((pdb_get_lanman_passwd(sam_pass)==NULL) && (pdb_get_acct_ctrl(sam_pass)&ACB_DISABLED)) {
1058 if (!pdb_set_acct_ctrl (sam_pass, pdb_get_acct_ctrl(sam_pass)&(~ACB_DISABLED), PDB_CHANGED)) {
1059 slprintf(err_str, err_str_len-1, "Failed to unset 'disabled' flag for user %s.\n", user_name);
1060 pdb_free_sam(&sam_pass);
1064 if (!pdb_set_acct_ctrl (sam_pass, pdb_get_acct_ctrl(sam_pass)&(~ACB_PWNOTREQ), PDB_CHANGED)) {
1065 slprintf(err_str, err_str_len-1, "Failed to unset 'no password required' flag for user %s.\n", user_name);
1066 pdb_free_sam(&sam_pass);
1070 if (!pdb_set_plaintext_passwd (sam_pass, new_passwd)) {
1071 slprintf(err_str, err_str_len-1, "Failed to set password for user %s.\n", user_name);
1072 pdb_free_sam(&sam_pass);
1077 if (local_flags & LOCAL_ADD_USER) {
1078 if (pdb_add_sam_account(sam_pass)) {
1079 slprintf(msg_str, msg_str_len-1, "Added user %s.\n", user_name);
1080 pdb_free_sam(&sam_pass);
1083 slprintf(err_str, err_str_len-1, "Failed to add entry for user %s.\n", user_name);
1084 pdb_free_sam(&sam_pass);
1087 } else if (local_flags & LOCAL_DELETE_USER) {
1088 if (!pdb_delete_sam_account(sam_pass)) {
1089 slprintf(err_str,err_str_len-1, "Failed to delete entry for user %s.\n", user_name);
1090 pdb_free_sam(&sam_pass);
1093 slprintf(msg_str, msg_str_len-1, "Deleted user %s.\n", user_name);
1095 if(!pdb_update_sam_account(sam_pass)) {
1096 slprintf(err_str, err_str_len-1, "Failed to modify entry for user %s.\n", user_name);
1097 pdb_free_sam(&sam_pass);
1100 if(local_flags & LOCAL_DISABLE_USER)
1101 slprintf(msg_str, msg_str_len-1, "Disabled user %s.\n", user_name);
1102 else if (local_flags & LOCAL_ENABLE_USER)
1103 slprintf(msg_str, msg_str_len-1, "Enabled user %s.\n", user_name);
1104 else if (local_flags & LOCAL_SET_NO_PASSWORD)
1105 slprintf(msg_str, msg_str_len-1, "User %s password set to none.\n", user_name);
1108 pdb_free_sam(&sam_pass);
1112 /****************************************************************************
1113 Convert a uid to SID - algorithmic.
1114 ****************************************************************************/
1116 DOM_SID *algorithmic_uid_to_sid(DOM_SID *psid, uid_t uid)
1118 if ( !lp_enable_rid_algorithm() )
1121 DEBUG(8,("algorithmic_uid_to_sid: falling back to RID algorithm\n"));
1122 sid_copy( psid, get_global_sam_sid() );
1123 sid_append_rid( psid, algorithmic_pdb_uid_to_user_rid(uid) );
1124 DEBUG(10,("algorithmic_uid_to_sid: uid (%d) -> SID %s.\n",
1125 (unsigned int)uid, sid_string_static(psid) ));
1130 /****************************************************************************
1131 Convert a uid to SID - locally.
1132 ****************************************************************************/
1134 DOM_SID *local_uid_to_sid(DOM_SID *psid, uid_t uid)
1136 SAM_ACCOUNT *sampw = NULL;
1137 struct passwd *unix_pw;
1140 unix_pw = sys_getpwuid( uid );
1143 DEBUG(4,("local_uid_to_sid: host has no idea of uid %lu\n", (unsigned long)uid));
1144 return algorithmic_uid_to_sid( psid, uid);
1147 if ( !NT_STATUS_IS_OK(pdb_init_sam(&sampw)) ) {
1148 DEBUG(0,("local_uid_to_sid: failed to allocate SAM_ACCOUNT object\n"));
1153 ret = pdb_getsampwnam( sampw, unix_pw->pw_name );
1157 sid_copy( psid, pdb_get_user_sid(sampw) );
1159 DEBUG(4,("local_uid_to_sid: User %s [uid == %lu] has no samba account\n",
1160 unix_pw->pw_name, (unsigned long)uid));
1162 return algorithmic_uid_to_sid( psid, uid);
1165 DEBUG(10,("local_uid_to_sid: uid (%d) -> SID %s (%s).\n",
1166 (unsigned int)uid, sid_string_static(psid), unix_pw->pw_name));
1171 /****************************************************************************
1172 Convert a SID to uid - locally.
1173 ****************************************************************************/
1175 BOOL local_sid_to_uid(uid_t *puid, const DOM_SID *psid, enum SID_NAME_USE *name_type)
1177 SAM_ACCOUNT *sampw = NULL;
1178 struct passwd *unix_pw;
1179 const char *user_name;
1181 *name_type = SID_NAME_UNKNOWN;
1184 * We can only convert to a uid if this is our local
1185 * Domain SID (ie. we are the controling authority).
1187 if (!sid_check_is_in_our_domain(psid) ) {
1188 DEBUG(5,("local_sid_to_uid: this SID (%s) is not from our domain\n", sid_string_static(psid)));
1192 /* lookup the user account */
1194 if ( !NT_STATUS_IS_OK(pdb_init_sam(&sampw)) ) {
1195 DEBUG(0,("local_sid_to_uid: Failed to allocate memory for SAM_ACCOUNT object\n"));
1200 if ( !pdb_getsampwsid(sampw, psid) ) {
1202 DEBUG(8,("local_sid_to_uid: Could not find SID %s in passdb\n",
1203 sid_string_static(psid)));
1208 user_name = pdb_get_username(sampw);
1210 unix_pw = sys_getpwnam( user_name );
1213 DEBUG(0,("local_sid_to_uid: %s found in passdb but getpwnam() return NULL!\n",
1215 pdb_free_sam( &sampw );
1219 *puid = unix_pw->pw_uid;
1221 DEBUG(10,("local_sid_to_uid: SID %s -> uid (%u) (%s).\n", sid_string_static(psid),
1222 (unsigned int)*puid, user_name ));
1224 *name_type = SID_NAME_USER;
1229 /****************************************************************************
1230 Convert a gid to SID - algorithmic.
1231 ****************************************************************************/
1233 DOM_SID *algorithmic_gid_to_sid(DOM_SID *psid, uid_t gid)
1235 if ( !lp_enable_rid_algorithm() )
1238 DEBUG(8,("algorithmic_gid_to_sid: falling back to RID algorithm\n"));
1239 sid_copy( psid, get_global_sam_sid() );
1240 sid_append_rid( psid, pdb_gid_to_group_rid(gid) );
1241 DEBUG(10,("algorithmic_gid_to_sid: gid (%d) -> SID %s.\n",
1242 (unsigned int)gid, sid_string_static(psid) ));
1247 /****************************************************************************
1248 Convert a gid to SID - locally.
1249 ****************************************************************************/
1251 DOM_SID *local_gid_to_sid(DOM_SID *psid, gid_t gid)
1256 /* we don't need to disable winbindd since the gid is stored in
1257 the GROUP_MAP object */
1259 /* done as root since ldap backend requires root to open a connection */
1262 ret = pdb_getgrgid( &group, gid );
1267 /* algorithmic to rid mapping if enabled */
1269 if ( lp_enable_rid_algorithm() ) {
1271 DEBUG(10,("local_gid_to_sid: Fall back to algorithmic mapping: %u -> %s\n",
1272 (unsigned int)gid, sid_string_static(psid)));
1274 return algorithmic_gid_to_sid(psid, gid);
1280 sid_copy( psid, &group.sid );
1282 DEBUG(10,("local_gid_to_sid: gid (%d) -> SID %s.\n",
1283 (unsigned int)gid, sid_string_static(psid)));
1288 /****************************************************************************
1289 Convert a SID to gid - locally.
1290 ****************************************************************************/
1292 BOOL local_sid_to_gid(gid_t *pgid, const DOM_SID *psid, enum SID_NAME_USE *name_type)
1298 *name_type = SID_NAME_UNKNOWN;
1300 /* This call can enumerate group mappings for foreign sids as well.
1301 So don't check for a match against our domain SID */
1303 /* we don't need to disable winbindd since the gid is stored in
1304 the GROUP_MAP object */
1307 ret = pdb_getgrsid(&group, *psid);
1312 /* Fallback to algorithmic rid mapping if enabled */
1314 if ( lp_enable_rid_algorithm() ) {
1316 if (!sid_check_is_in_our_domain(psid) ) {
1317 DEBUG(5,("local_sid_to_gid: RID algorithm only supported for our domain (%s is not)\n", sid_string_static(psid)));
1321 if (!sid_peek_rid(psid, &rid)) {
1322 DEBUG(10,("local_sid_to_gid: invalid SID!\n"));
1326 DEBUG(10,("local_sid_to_gid: Fall back to algorithmic mapping\n"));
1328 if (algorithmic_pdb_rid_is_user(rid)) {
1329 DEBUG(3, ("local_sid_to_gid: SID %s is *NOT* a group\n", sid_string_static(psid)));
1332 *pgid = pdb_group_rid_to_gid(rid);
1333 DEBUG(10,("local_sid_to_gid: mapping: %s -> %u\n", sid_string_static(psid), (unsigned int)(*pgid)));
1342 *name_type = group.sid_name_use;
1344 DEBUG(10,("local_sid_to_gid: SID %s -> gid (%u)\n", sid_string_static(psid),
1345 (unsigned int)*pgid));
1350 /**********************************************************************
1351 Marshall/unmarshall SAM_ACCOUNT structs.
1352 *********************************************************************/
1354 #define TDB_FORMAT_STRING_V0 "ddddddBBBBBBBBBBBBddBBwdwdBwwd"
1355 #define TDB_FORMAT_STRING_V1 "dddddddBBBBBBBBBBBBddBBwdwdBwwd"
1356 #define TDB_FORMAT_STRING_V2 "dddddddBBBBBBBBBBBBddBBBwwdBwwd"
1358 /**********************************************************************
1359 Intialize a SAM_ACCOUNT struct from a BYTE buffer of size len
1360 *********************************************************************/
1362 BOOL init_sam_from_buffer(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen)
1364 return(init_sam_from_buffer_v2(sampass, buf, buflen));
1367 /**********************************************************************
1368 Intialize a BYTE buffer from a SAM_ACCOUNT struct
1369 *********************************************************************/
1371 uint32 init_buffer_from_sam (uint8 **buf, const SAM_ACCOUNT *sampass, BOOL size_only)
1373 return(init_buffer_from_sam_v2(buf, sampass, size_only));
1377 BOOL init_sam_from_buffer_v0(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen)
1380 /* times are stored as 32bit integer
1381 take care on system with 64bit wide time_t
1387 pass_can_change_time,
1388 pass_must_change_time;
1401 uint32 username_len, domain_len, nt_username_len,
1402 dir_drive_len, unknown_str_len, munged_dial_len,
1403 fullname_len, homedir_len, logon_script_len,
1404 profile_path_len, acct_desc_len, workstations_len;
1406 uint32 user_rid, group_rid, remove_me, hours_len, unknown_6;
1407 uint16 acct_ctrl, logon_divs;
1408 uint16 bad_password_count, logon_count;
1410 uint8 *lm_pw_ptr, *nt_pw_ptr;
1412 uint32 lm_pw_len, nt_pw_len, hourslen;
1415 if(sampass == NULL || buf == NULL) {
1416 DEBUG(0, ("init_sam_from_buffer_v0: NULL parameters found!\n"));
1420 /* TDB_FORMAT_STRING_V0 "ddddddBBBBBBBBBBBBddBBwdwdBwwd" */
1422 /* unpack the buffer into variables */
1423 len = tdb_unpack ((char *)buf, buflen, TDB_FORMAT_STRING_V0,
1424 &logon_time, /* d */
1425 &logoff_time, /* d */
1426 &kickoff_time, /* d */
1427 &pass_last_set_time, /* d */
1428 &pass_can_change_time, /* d */
1429 &pass_must_change_time, /* d */
1430 &username_len, &username, /* B */
1431 &domain_len, &domain, /* B */
1432 &nt_username_len, &nt_username, /* B */
1433 &fullname_len, &fullname, /* B */
1434 &homedir_len, &homedir, /* B */
1435 &dir_drive_len, &dir_drive, /* B */
1436 &logon_script_len, &logon_script, /* B */
1437 &profile_path_len, &profile_path, /* B */
1438 &acct_desc_len, &acct_desc, /* B */
1439 &workstations_len, &workstations, /* B */
1440 &unknown_str_len, &unknown_str, /* B */
1441 &munged_dial_len, &munged_dial, /* B */
1444 &lm_pw_len, &lm_pw_ptr, /* B */
1445 &nt_pw_len, &nt_pw_ptr, /* B */
1447 &remove_me, /* remove on the next TDB_FORMAT upgarde */ /* d */
1448 &logon_divs, /* w */
1450 &hourslen, &hours, /* B */
1451 &bad_password_count, /* w */
1452 &logon_count, /* w */
1453 &unknown_6); /* d */
1455 if (len == (uint32) -1) {
1460 pdb_set_logon_time(sampass, logon_time, PDB_SET);
1461 pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
1462 pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
1463 pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
1464 pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
1465 pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
1467 pdb_set_username(sampass, username, PDB_SET);
1468 pdb_set_domain(sampass, domain, PDB_SET);
1469 pdb_set_nt_username(sampass, nt_username, PDB_SET);
1470 pdb_set_fullname(sampass, fullname, PDB_SET);
1473 pdb_set_homedir(sampass, homedir, PDB_SET);
1476 pdb_set_homedir(sampass,
1477 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_home()),
1482 pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
1484 pdb_set_dir_drive(sampass,
1485 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_drive()),
1490 pdb_set_logon_script(sampass, logon_script, PDB_SET);
1492 pdb_set_logon_script(sampass,
1493 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_script()),
1498 pdb_set_profile_path(sampass, profile_path, PDB_SET);
1500 pdb_set_profile_path(sampass,
1501 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_path()),
1505 pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
1506 pdb_set_workstations(sampass, workstations, PDB_SET);
1507 pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
1509 if (lm_pw_ptr && lm_pw_len == LM_HASH_LEN) {
1510 if (!pdb_set_lanman_passwd(sampass, lm_pw_ptr, PDB_SET)) {
1516 if (nt_pw_ptr && nt_pw_len == NT_HASH_LEN) {
1517 if (!pdb_set_nt_passwd(sampass, nt_pw_ptr, PDB_SET)) {
1523 pdb_set_pw_history(sampass, NULL, 0, PDB_SET);
1524 pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
1525 pdb_set_group_sid_from_rid(sampass, group_rid, PDB_SET);
1526 pdb_set_hours_len(sampass, hours_len, PDB_SET);
1527 pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET);
1528 pdb_set_logon_count(sampass, logon_count, PDB_SET);
1529 pdb_set_unknown_6(sampass, unknown_6, PDB_SET);
1530 pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
1531 pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
1532 pdb_set_hours(sampass, hours, PDB_SET);
1536 SAFE_FREE(username);
1538 SAFE_FREE(nt_username);
1539 SAFE_FREE(fullname);
1541 SAFE_FREE(dir_drive);
1542 SAFE_FREE(logon_script);
1543 SAFE_FREE(profile_path);
1544 SAFE_FREE(acct_desc);
1545 SAFE_FREE(workstations);
1546 SAFE_FREE(munged_dial);
1547 SAFE_FREE(unknown_str);
1548 SAFE_FREE(lm_pw_ptr);
1549 SAFE_FREE(nt_pw_ptr);
1555 BOOL init_sam_from_buffer_v1(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen)
1558 /* times are stored as 32bit integer
1559 take care on system with 64bit wide time_t
1566 pass_can_change_time,
1567 pass_must_change_time;
1580 uint32 username_len, domain_len, nt_username_len,
1581 dir_drive_len, unknown_str_len, munged_dial_len,
1582 fullname_len, homedir_len, logon_script_len,
1583 profile_path_len, acct_desc_len, workstations_len;
1585 uint32 user_rid, group_rid, remove_me, hours_len, unknown_6;
1586 uint16 acct_ctrl, logon_divs;
1587 uint16 bad_password_count, logon_count;
1589 uint8 *lm_pw_ptr, *nt_pw_ptr;
1591 uint32 lm_pw_len, nt_pw_len, hourslen;
1594 if(sampass == NULL || buf == NULL) {
1595 DEBUG(0, ("init_sam_from_buffer_v1: NULL parameters found!\n"));
1599 /* TDB_FORMAT_STRING_V1 "dddddddBBBBBBBBBBBBddBBwdwdBwwd" */
1601 /* unpack the buffer into variables */
1602 len = tdb_unpack ((char *)buf, buflen, TDB_FORMAT_STRING_V1,
1603 &logon_time, /* d */
1604 &logoff_time, /* d */
1605 &kickoff_time, /* d */
1606 /* Change from V0 is addition of bad_password_time field. */
1607 &bad_password_time, /* d */
1608 &pass_last_set_time, /* d */
1609 &pass_can_change_time, /* d */
1610 &pass_must_change_time, /* d */
1611 &username_len, &username, /* B */
1612 &domain_len, &domain, /* B */
1613 &nt_username_len, &nt_username, /* B */
1614 &fullname_len, &fullname, /* B */
1615 &homedir_len, &homedir, /* B */
1616 &dir_drive_len, &dir_drive, /* B */
1617 &logon_script_len, &logon_script, /* B */
1618 &profile_path_len, &profile_path, /* B */
1619 &acct_desc_len, &acct_desc, /* B */
1620 &workstations_len, &workstations, /* B */
1621 &unknown_str_len, &unknown_str, /* B */
1622 &munged_dial_len, &munged_dial, /* B */
1625 &lm_pw_len, &lm_pw_ptr, /* B */
1626 &nt_pw_len, &nt_pw_ptr, /* B */
1629 &logon_divs, /* w */
1631 &hourslen, &hours, /* B */
1632 &bad_password_count, /* w */
1633 &logon_count, /* w */
1634 &unknown_6); /* d */
1636 if (len == (uint32) -1) {
1641 pdb_set_logon_time(sampass, logon_time, PDB_SET);
1642 pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
1643 pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
1645 /* Change from V0 is addition of bad_password_time field. */
1646 pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
1647 pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
1648 pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
1649 pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
1651 pdb_set_username(sampass, username, PDB_SET);
1652 pdb_set_domain(sampass, domain, PDB_SET);
1653 pdb_set_nt_username(sampass, nt_username, PDB_SET);
1654 pdb_set_fullname(sampass, fullname, PDB_SET);
1657 pdb_set_homedir(sampass, homedir, PDB_SET);
1660 pdb_set_homedir(sampass,
1661 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_home()),
1666 pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
1668 pdb_set_dir_drive(sampass,
1669 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_drive()),
1674 pdb_set_logon_script(sampass, logon_script, PDB_SET);
1676 pdb_set_logon_script(sampass,
1677 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_script()),
1682 pdb_set_profile_path(sampass, profile_path, PDB_SET);
1684 pdb_set_profile_path(sampass,
1685 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_path()),
1689 pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
1690 pdb_set_workstations(sampass, workstations, PDB_SET);
1691 pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
1693 if (lm_pw_ptr && lm_pw_len == LM_HASH_LEN) {
1694 if (!pdb_set_lanman_passwd(sampass, lm_pw_ptr, PDB_SET)) {
1700 if (nt_pw_ptr && nt_pw_len == NT_HASH_LEN) {
1701 if (!pdb_set_nt_passwd(sampass, nt_pw_ptr, PDB_SET)) {
1707 pdb_set_pw_history(sampass, NULL, 0, PDB_SET);
1709 pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
1710 pdb_set_group_sid_from_rid(sampass, group_rid, PDB_SET);
1711 pdb_set_hours_len(sampass, hours_len, PDB_SET);
1712 pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET);
1713 pdb_set_logon_count(sampass, logon_count, PDB_SET);
1714 pdb_set_unknown_6(sampass, unknown_6, PDB_SET);
1715 pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
1716 pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
1717 pdb_set_hours(sampass, hours, PDB_SET);
1721 SAFE_FREE(username);
1723 SAFE_FREE(nt_username);
1724 SAFE_FREE(fullname);
1726 SAFE_FREE(dir_drive);
1727 SAFE_FREE(logon_script);
1728 SAFE_FREE(profile_path);
1729 SAFE_FREE(acct_desc);
1730 SAFE_FREE(workstations);
1731 SAFE_FREE(munged_dial);
1732 SAFE_FREE(unknown_str);
1733 SAFE_FREE(lm_pw_ptr);
1734 SAFE_FREE(nt_pw_ptr);
1741 BOOL init_sam_from_buffer_v2(SAM_ACCOUNT *sampass, uint8 *buf, uint32 buflen)
1744 /* times are stored as 32bit integer
1745 take care on system with 64bit wide time_t
1752 pass_can_change_time,
1753 pass_must_change_time;
1766 uint32 username_len, domain_len, nt_username_len,
1767 dir_drive_len, unknown_str_len, munged_dial_len,
1768 fullname_len, homedir_len, logon_script_len,
1769 profile_path_len, acct_desc_len, workstations_len;
1771 uint32 user_rid, group_rid, hours_len, unknown_6;
1772 uint16 acct_ctrl, logon_divs;
1773 uint16 bad_password_count, logon_count;
1775 uint8 *lm_pw_ptr, *nt_pw_ptr, *nt_pw_hist_ptr;
1777 uint32 lm_pw_len, nt_pw_len, nt_pw_hist_len, hourslen;
1778 uint32 pwHistLen = 0;
1782 if(sampass == NULL || buf == NULL) {
1783 DEBUG(0, ("init_sam_from_buffer_v2: NULL parameters found!\n"));
1787 /* TDB_FORMAT_STRING_V2 "dddddddBBBBBBBBBBBBddBBBwwdBwwd" */
1789 /* unpack the buffer into variables */
1790 len = tdb_unpack ((char *)buf, buflen, TDB_FORMAT_STRING_V2,
1791 &logon_time, /* d */
1792 &logoff_time, /* d */
1793 &kickoff_time, /* d */
1794 &bad_password_time, /* d */
1795 &pass_last_set_time, /* d */
1796 &pass_can_change_time, /* d */
1797 &pass_must_change_time, /* d */
1798 &username_len, &username, /* B */
1799 &domain_len, &domain, /* B */
1800 &nt_username_len, &nt_username, /* B */
1801 &fullname_len, &fullname, /* B */
1802 &homedir_len, &homedir, /* B */
1803 &dir_drive_len, &dir_drive, /* B */
1804 &logon_script_len, &logon_script, /* B */
1805 &profile_path_len, &profile_path, /* B */
1806 &acct_desc_len, &acct_desc, /* B */
1807 &workstations_len, &workstations, /* B */
1808 &unknown_str_len, &unknown_str, /* B */
1809 &munged_dial_len, &munged_dial, /* B */
1812 &lm_pw_len, &lm_pw_ptr, /* B */
1813 &nt_pw_len, &nt_pw_ptr, /* B */
1814 /* Change from V1 is addition of password history field. */
1815 &nt_pw_hist_len, &nt_pw_hist_ptr, /* B */
1817 /* Also "remove_me" field was removed. */
1818 &logon_divs, /* w */
1820 &hourslen, &hours, /* B */
1821 &bad_password_count, /* w */
1822 &logon_count, /* w */
1823 &unknown_6); /* d */
1825 if (len == (uint32) -1) {
1830 pdb_set_logon_time(sampass, logon_time, PDB_SET);
1831 pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
1832 pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
1833 pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
1834 pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
1835 pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
1836 pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
1838 pdb_set_username(sampass, username, PDB_SET);
1839 pdb_set_domain(sampass, domain, PDB_SET);
1840 pdb_set_nt_username(sampass, nt_username, PDB_SET);
1841 pdb_set_fullname(sampass, fullname, PDB_SET);
1844 fstrcpy( tmpstring, homedir );
1845 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
1846 pdb_set_homedir(sampass, tmpstring, PDB_SET);
1849 pdb_set_homedir(sampass,
1850 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_home()),
1855 pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
1857 pdb_set_dir_drive(sampass, lp_logon_drive(), PDB_DEFAULT );
1860 fstrcpy( tmpstring, logon_script );
1861 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
1862 pdb_set_logon_script(sampass, tmpstring, PDB_SET);
1865 pdb_set_logon_script(sampass,
1866 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_script()),
1871 fstrcpy( tmpstring, profile_path );
1872 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
1873 pdb_set_profile_path(sampass, tmpstring, PDB_SET);
1876 pdb_set_profile_path(sampass,
1877 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_path()),
1881 pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
1882 pdb_set_workstations(sampass, workstations, PDB_SET);
1883 pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
1885 if (lm_pw_ptr && lm_pw_len == LM_HASH_LEN) {
1886 if (!pdb_set_lanman_passwd(sampass, lm_pw_ptr, PDB_SET)) {
1892 if (nt_pw_ptr && nt_pw_len == NT_HASH_LEN) {
1893 if (!pdb_set_nt_passwd(sampass, nt_pw_ptr, PDB_SET)) {
1899 /* Change from V1 is addition of password history field. */
1900 account_policy_get(AP_PASSWORD_HISTORY, &pwHistLen);
1902 char *pw_hist = SMB_MALLOC(pwHistLen * PW_HISTORY_ENTRY_LEN);
1907 memset(pw_hist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
1908 if (nt_pw_hist_ptr && nt_pw_hist_len) {
1910 SMB_ASSERT((nt_pw_hist_len % PW_HISTORY_ENTRY_LEN) == 0);
1911 nt_pw_hist_len /= PW_HISTORY_ENTRY_LEN;
1912 for (i = 0; (i < pwHistLen) && (i < nt_pw_hist_len); i++) {
1913 memcpy(&pw_hist[i*PW_HISTORY_ENTRY_LEN],
1914 &nt_pw_hist_ptr[i*PW_HISTORY_ENTRY_LEN],
1915 PW_HISTORY_ENTRY_LEN);
1918 if (!pdb_set_pw_history(sampass, pw_hist, pwHistLen, PDB_SET)) {
1925 pdb_set_pw_history(sampass, NULL, 0, PDB_SET);
1928 pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
1929 pdb_set_group_sid_from_rid(sampass, group_rid, PDB_SET);
1930 pdb_set_hours_len(sampass, hours_len, PDB_SET);
1931 pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET);
1932 pdb_set_logon_count(sampass, logon_count, PDB_SET);
1933 pdb_set_unknown_6(sampass, unknown_6, PDB_SET);
1934 pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
1935 pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
1936 pdb_set_hours(sampass, hours, PDB_SET);
1940 SAFE_FREE(username);
1942 SAFE_FREE(nt_username);
1943 SAFE_FREE(fullname);
1945 SAFE_FREE(dir_drive);
1946 SAFE_FREE(logon_script);
1947 SAFE_FREE(profile_path);
1948 SAFE_FREE(acct_desc);
1949 SAFE_FREE(workstations);
1950 SAFE_FREE(munged_dial);
1951 SAFE_FREE(unknown_str);
1952 SAFE_FREE(lm_pw_ptr);
1953 SAFE_FREE(nt_pw_ptr);
1954 SAFE_FREE(nt_pw_hist_ptr);
1960 uint32 init_buffer_from_sam_v2 (uint8 **buf, const SAM_ACCOUNT *sampass, BOOL size_only)
1964 /* times are stored as 32bit integer
1965 take care on system with 64bit wide time_t
1972 pass_can_change_time,
1973 pass_must_change_time;
1975 uint32 user_rid, group_rid;
1977 const char *username;
1979 const char *nt_username;
1980 const char *dir_drive;
1981 const char *unknown_str;
1982 const char *munged_dial;
1983 const char *fullname;
1984 const char *homedir;
1985 const char *logon_script;
1986 const char *profile_path;
1987 const char *acct_desc;
1988 const char *workstations;
1989 uint32 username_len, domain_len, nt_username_len,
1990 dir_drive_len, unknown_str_len, munged_dial_len,
1991 fullname_len, homedir_len, logon_script_len,
1992 profile_path_len, acct_desc_len, workstations_len;
1996 const uint8 *nt_pw_hist;
1997 uint32 lm_pw_len = 16;
1998 uint32 nt_pw_len = 16;
1999 uint32 nt_pw_hist_len;
2000 uint32 pwHistLen = 0;
2002 /* do we have a valid SAM_ACCOUNT pointer? */
2003 if (sampass == NULL) {
2004 DEBUG(0, ("init_buffer_from_sam: SAM_ACCOUNT is NULL!\n"));
2011 logon_time = (uint32)pdb_get_logon_time(sampass);
2012 logoff_time = (uint32)pdb_get_logoff_time(sampass);
2013 kickoff_time = (uint32)pdb_get_kickoff_time(sampass);
2014 bad_password_time = (uint32)pdb_get_bad_password_time(sampass);
2015 pass_can_change_time = (uint32)pdb_get_pass_can_change_time(sampass);
2016 pass_must_change_time = (uint32)pdb_get_pass_must_change_time(sampass);
2017 pass_last_set_time = (uint32)pdb_get_pass_last_set_time(sampass);
2019 user_rid = pdb_get_user_rid(sampass);
2020 group_rid = pdb_get_group_rid(sampass);
2022 username = pdb_get_username(sampass);
2024 username_len = strlen(username) +1;
2029 domain = pdb_get_domain(sampass);
2031 domain_len = strlen(domain) +1;
2036 nt_username = pdb_get_nt_username(sampass);
2038 nt_username_len = strlen(nt_username) +1;
2040 nt_username_len = 0;
2043 fullname = pdb_get_fullname(sampass);
2045 fullname_len = strlen(fullname) +1;
2051 * Only updates fields which have been set (not defaults from smb.conf)
2054 if (!IS_SAM_DEFAULT(sampass, PDB_DRIVE)) {
2055 dir_drive = pdb_get_dir_drive(sampass);
2060 dir_drive_len = strlen(dir_drive) +1;
2065 if (!IS_SAM_DEFAULT(sampass, PDB_SMBHOME)) {
2066 homedir = pdb_get_homedir(sampass);
2071 homedir_len = strlen(homedir) +1;
2076 if (!IS_SAM_DEFAULT(sampass, PDB_LOGONSCRIPT)) {
2077 logon_script = pdb_get_logon_script(sampass);
2079 logon_script = NULL;
2082 logon_script_len = strlen(logon_script) +1;
2084 logon_script_len = 0;
2087 if (!IS_SAM_DEFAULT(sampass, PDB_PROFILE)) {
2088 profile_path = pdb_get_profile_path(sampass);
2090 profile_path = NULL;
2093 profile_path_len = strlen(profile_path) +1;
2095 profile_path_len = 0;
2098 lm_pw = pdb_get_lanman_passwd(sampass);
2103 nt_pw = pdb_get_nt_passwd(sampass);
2108 account_policy_get(AP_PASSWORD_HISTORY, &pwHistLen);
2109 nt_pw_hist = pdb_get_pw_history(sampass, &nt_pw_hist_len);
2110 if (pwHistLen && nt_pw_hist && nt_pw_hist_len) {
2111 nt_pw_hist_len *= PW_HISTORY_ENTRY_LEN;
2116 acct_desc = pdb_get_acct_desc(sampass);
2118 acct_desc_len = strlen(acct_desc) +1;
2123 workstations = pdb_get_workstations(sampass);
2125 workstations_len = strlen(workstations) +1;
2127 workstations_len = 0;
2131 unknown_str_len = 0;
2133 munged_dial = pdb_get_munged_dial(sampass);
2135 munged_dial_len = strlen(munged_dial) +1;
2137 munged_dial_len = 0;
2140 /* TDB_FORMAT_STRING_V2 "dddddddBBBBBBBBBBBBddBBBwwdBwwd" */
2142 /* one time to get the size needed */
2143 len = tdb_pack(NULL, 0, TDB_FORMAT_STRING_V2,
2145 logoff_time, /* d */
2146 kickoff_time, /* d */
2147 bad_password_time, /* d */
2148 pass_last_set_time, /* d */
2149 pass_can_change_time, /* d */
2150 pass_must_change_time, /* d */
2151 username_len, username, /* B */
2152 domain_len, domain, /* B */
2153 nt_username_len, nt_username, /* B */
2154 fullname_len, fullname, /* B */
2155 homedir_len, homedir, /* B */
2156 dir_drive_len, dir_drive, /* B */
2157 logon_script_len, logon_script, /* B */
2158 profile_path_len, profile_path, /* B */
2159 acct_desc_len, acct_desc, /* B */
2160 workstations_len, workstations, /* B */
2161 unknown_str_len, unknown_str, /* B */
2162 munged_dial_len, munged_dial, /* B */
2165 lm_pw_len, lm_pw, /* B */
2166 nt_pw_len, nt_pw, /* B */
2167 nt_pw_hist_len, nt_pw_hist, /* B */
2168 pdb_get_acct_ctrl(sampass), /* w */
2169 pdb_get_logon_divs(sampass), /* w */
2170 pdb_get_hours_len(sampass), /* d */
2171 MAX_HOURS_LEN, pdb_get_hours(sampass), /* B */
2172 pdb_get_bad_password_count(sampass), /* w */
2173 pdb_get_logon_count(sampass), /* w */
2174 pdb_get_unknown_6(sampass)); /* d */
2180 /* malloc the space needed */
2181 if ( (*buf=(uint8*)SMB_MALLOC(len)) == NULL) {
2182 DEBUG(0,("init_buffer_from_sam_v2: Unable to malloc() memory for buffer!\n"));
2186 /* now for the real call to tdb_pack() */
2187 buflen = tdb_pack((char *)*buf, len, TDB_FORMAT_STRING_V2,
2189 logoff_time, /* d */
2190 kickoff_time, /* d */
2191 bad_password_time, /* d */
2192 pass_last_set_time, /* d */
2193 pass_can_change_time, /* d */
2194 pass_must_change_time, /* d */
2195 username_len, username, /* B */
2196 domain_len, domain, /* B */
2197 nt_username_len, nt_username, /* B */
2198 fullname_len, fullname, /* B */
2199 homedir_len, homedir, /* B */
2200 dir_drive_len, dir_drive, /* B */
2201 logon_script_len, logon_script, /* B */
2202 profile_path_len, profile_path, /* B */
2203 acct_desc_len, acct_desc, /* B */
2204 workstations_len, workstations, /* B */
2205 unknown_str_len, unknown_str, /* B */
2206 munged_dial_len, munged_dial, /* B */
2209 lm_pw_len, lm_pw, /* B */
2210 nt_pw_len, nt_pw, /* B */
2211 nt_pw_hist_len, nt_pw_hist, /* B */
2212 pdb_get_acct_ctrl(sampass), /* w */
2213 pdb_get_logon_divs(sampass), /* w */
2214 pdb_get_hours_len(sampass), /* d */
2215 MAX_HOURS_LEN, pdb_get_hours(sampass), /* B */
2216 pdb_get_bad_password_count(sampass), /* w */
2217 pdb_get_logon_count(sampass), /* w */
2218 pdb_get_unknown_6(sampass)); /* d */
2220 /* check to make sure we got it correct */
2221 if (buflen != len) {
2222 DEBUG(0, ("init_buffer_from_sam_v2: somthing odd is going on here: bufflen (%lu) != len (%lu) in tdb_pack operations!\n",
2223 (unsigned long)buflen, (unsigned long)len));
2232 BOOL pdb_copy_sam_account(const SAM_ACCOUNT *src, SAM_ACCOUNT **dst)
2238 if ((*dst == NULL) && (!NT_STATUS_IS_OK(pdb_init_sam(dst))))
2241 len = init_buffer_from_sam_v2(&buf, src, False);
2246 result = init_sam_from_buffer_v2(*dst, buf, len);
2247 (*dst)->methods = src->methods;
2254 /**********************************************************************
2255 **********************************************************************/
2257 static BOOL get_free_ugid_range(uint32 *low, uint32 *high)
2259 uid_t u_low, u_high;
2260 gid_t g_low, g_high;
2262 if (!lp_idmap_uid(&u_low, &u_high) || !lp_idmap_gid(&g_low, &g_high)) {
2266 *low = (u_low < g_low) ? u_low : g_low;
2267 *high = (u_high < g_high) ? u_high : g_high;
2272 /******************************************************************
2273 Get the the non-algorithmic RID range if idmap range are defined
2274 ******************************************************************/
2276 BOOL get_free_rid_range(uint32 *low, uint32 *high)
2278 uint32 id_low, id_high;
2280 if (!lp_enable_rid_algorithm()) {
2285 if (!get_free_ugid_range(&id_low, &id_high)) {
2289 *low = algorithmic_pdb_uid_to_user_rid(id_low);
2290 if (algorithmic_pdb_user_rid_to_uid((uint32)-1) < id_high) {
2293 *high = algorithmic_pdb_uid_to_user_rid(id_high);
2299 /*********************************************************************
2300 Update the bad password count checking the AP_RESET_COUNT_TIME
2301 *********************************************************************/
2303 BOOL pdb_update_bad_password_count(SAM_ACCOUNT *sampass, BOOL *updated)
2305 time_t LastBadPassword;
2306 uint16 BadPasswordCount;
2309 if (!sampass) return False;
2311 BadPasswordCount = pdb_get_bad_password_count(sampass);
2312 if (!BadPasswordCount) {
2313 DEBUG(9, ("No bad password attempts.\n"));
2317 if (!account_policy_get(AP_RESET_COUNT_TIME, &resettime)) {
2318 DEBUG(0, ("pdb_update_bad_password_count: account_policy_get failed.\n"));
2322 /* First, check if there is a reset time to compare */
2323 if ((resettime == (uint32) -1) || (resettime == 0)) {
2324 DEBUG(9, ("No reset time, can't reset bad pw count\n"));
2328 LastBadPassword = pdb_get_bad_password_time(sampass);
2329 DEBUG(7, ("LastBadPassword=%d, resettime=%d, current time=%d.\n",
2330 (uint32) LastBadPassword, resettime, (uint32)time(NULL)));
2331 if (time(NULL) > (LastBadPassword + (time_t)resettime*60)){
2332 pdb_set_bad_password_count(sampass, 0, PDB_CHANGED);
2333 pdb_set_bad_password_time(sampass, 0, PDB_CHANGED);
2342 /*********************************************************************
2343 Update the ACB_AUTOLOCK flag checking the AP_LOCK_ACCOUNT_DURATION
2344 *********************************************************************/
2346 BOOL pdb_update_autolock_flag(SAM_ACCOUNT *sampass, BOOL *updated)
2349 time_t LastBadPassword;
2351 if (!sampass) return False;
2353 if (!(pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK)) {
2354 DEBUG(9, ("pdb_update_autolock_flag: Account %s not autolocked, no check needed\n",
2355 pdb_get_username(sampass)));
2359 if (!account_policy_get(AP_LOCK_ACCOUNT_DURATION, &duration)) {
2360 DEBUG(0, ("pdb_update_autolock_flag: account_policy_get failed.\n"));
2364 /* First, check if there is a duration to compare */
2365 if ((duration == (uint32) -1) || (duration == 0)) {
2366 DEBUG(9, ("pdb_update_autolock_flag: No reset duration, can't reset autolock\n"));
2370 LastBadPassword = pdb_get_bad_password_time(sampass);
2371 DEBUG(7, ("pdb_update_autolock_flag: Account %s, LastBadPassword=%d, duration=%d, current time =%d.\n",
2372 pdb_get_username(sampass), (uint32)LastBadPassword, duration*60, (uint32)time(NULL)));
2374 if (LastBadPassword == (time_t)0) {
2375 DEBUG(1,("pdb_update_autolock_flag: Account %s administratively locked out with no \
2376 bad password time. Leaving locked out.\n",
2377 pdb_get_username(sampass) ));
2381 if ((time(NULL) > (LastBadPassword + (time_t) duration * 60))) {
2382 pdb_set_acct_ctrl(sampass,
2383 pdb_get_acct_ctrl(sampass) & ~ACB_AUTOLOCK,
2385 pdb_set_bad_password_count(sampass, 0, PDB_CHANGED);
2386 pdb_set_bad_password_time(sampass, 0, PDB_CHANGED);
2395 /*********************************************************************
2396 Increment the bad_password_count
2397 *********************************************************************/
2399 BOOL pdb_increment_bad_password_count(SAM_ACCOUNT *sampass)
2401 uint32 account_policy_lockout;
2402 BOOL autolock_updated = False, badpw_updated = False;
2407 /* Retrieve the account lockout policy */
2408 if (!account_policy_get(AP_BAD_ATTEMPT_LOCKOUT,
2409 &account_policy_lockout)) {
2410 DEBUG(0, ("pdb_increment_bad_password_count: account_policy_get failed.\n"));
2414 /* If there is no policy, we don't need to continue checking */
2415 if (!account_policy_lockout) {
2416 DEBUG(9, ("No lockout policy, don't track bad passwords\n"));
2420 /* Check if the autolock needs to be cleared */
2421 if (!pdb_update_autolock_flag(sampass, &autolock_updated))
2424 /* Check if the badpw count needs to be reset */
2425 if (!pdb_update_bad_password_count(sampass, &badpw_updated))
2429 Ok, now we can assume that any resetting that needs to be
2430 done has been done, and just get on with incrementing
2431 and autolocking if necessary
2434 pdb_set_bad_password_count(sampass,
2435 pdb_get_bad_password_count(sampass)+1,
2437 pdb_set_bad_password_time(sampass, time(NULL), PDB_CHANGED);
2440 if (pdb_get_bad_password_count(sampass) < account_policy_lockout)
2443 if (!pdb_set_acct_ctrl(sampass,
2444 pdb_get_acct_ctrl(sampass) | ACB_AUTOLOCK,
2446 DEBUG(1, ("pdb_increment_bad_password_count:failed to set 'autolock' flag. \n"));