source3/auth/auth_domain.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authenticate against a remote domain
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "../libcli/auth/libcli_auth.h"
  23 #include "../librpc/gen_ndr/ndr_netlogon.h"
  24 #include "rpc_client/cli_netlogon.h"
  25 #include "secrets.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_AUTH
  29
  30 extern bool global_machine_password_needs_changing;
  31 static struct named_mutex *mutex;
  32
  33 /*
  34  * Change machine password (called from main loop
  35  * idle timeout. Must be done as root.
  36  */
  37
  38 void attempt_machine_password_change(void)
  39 {
  40         unsigned char trust_passwd_hash[16];
  41         time_t lct;
  42         void *lock;
  43
  44         if (!global_machine_password_needs_changing) {
  45                 return;
  46         }
  47
  48         if (lp_security() != SEC_DOMAIN) {
  49                 return;
  50         }
  51
  52         /*
  53          * We're in domain level security, and the code that
  54          * read the machine password flagged that the machine
  55          * password needs changing.
  56          */
  57
  58         /*
  59          * First, open the machine password file with an exclusive lock.
  60          */
  61
  62         lock = secrets_get_trust_account_lock(NULL, lp_workgroup());
  63
  64         if (lock == NULL) {
  65                 DEBUG(0,("attempt_machine_password_change: unable to lock "
  66                         "the machine account password for machine %s in "
  67                         "domain %s.\n",
  68                         global_myname(), lp_workgroup() ));
  69                 return;
  70         }
  71
  72         if(!secrets_fetch_trust_account_password(lp_workgroup(),
  73                         trust_passwd_hash, &lct, NULL)) {
  74                 DEBUG(0,("attempt_machine_password_change: unable to read the "
  75                         "machine account password for %s in domain %s.\n",
  76                         global_myname(), lp_workgroup()));
  77                 TALLOC_FREE(lock);
  78                 return;
  79         }
  80
  81         /*
  82          * Make sure someone else hasn't already done this.
  83          */
  84
  85         if(time(NULL) < lct + lp_machine_password_timeout()) {
  86                 global_machine_password_needs_changing = false;
  87                 TALLOC_FREE(lock);
  88                 return;
  89         }
  90
  91         /* always just contact the PDC here */
  92
  93         change_trust_account_password( lp_workgroup(), NULL);
  94         global_machine_password_needs_changing = false;
  95         TALLOC_FREE(lock);
  96 }
  97
  98 /**
  99  * Connect to a remote server for (inter)domain security authenticaion.
 100  *
 101  * @param cli the cli to return containing the active connection
 102  * @param server either a machine name or text IP address to
 103  *               connect to.
 104  * @param setup_creds_as domain account to setup credentials as
 105  * @param sec_chan a switch value to distinguish between domain
 106  *                 member and interdomain authentication
 107  * @param trust_passwd the trust password to establish the
 108  *                     credentials with.
 109  *
 110  **/
 111
 112 static NTSTATUS connect_to_domain_password_server(struct cli_state **cli,
 113                                                 const char *domain,
 114                                                 const char *dc_name,
 115                                                 struct sockaddr_storage *dc_ss,
 116                                                 struct rpc_pipe_client **pipe_ret)
 117 {
 118         NTSTATUS result;
 119         struct rpc_pipe_client *netlogon_pipe = NULL;
 120
 121         *cli = NULL;
 122
 123         *pipe_ret = NULL;
 124
 125         /* TODO: Send a SAMLOGON request to determine whether this is a valid
 126            logonserver.  We can avoid a 30-second timeout if the DC is down
 127            if the SAMLOGON request fails as it is only over UDP. */
 128
 129         /* we use a mutex to prevent two connections at once - when a
 130            Win2k PDC get two connections where one hasn't completed a
 131            session setup yet it will send a TCP reset to the first
 132            connection (tridge) */
 133
 134         /*
 135          * With NT4.x DC's *all* authentication must be serialized to avoid
 136          * ACCESS_DENIED errors if 2 auths are done from the same machine. JRA.
 137          */
 138
 139         mutex = grab_named_mutex(NULL, dc_name, 10);
 140         if (mutex == NULL) {
 141                 return NT_STATUS_NO_LOGON_SERVERS;
 142         }
 143
 144         /* Attempt connection */
 145         result = cli_full_connection(cli, global_myname(), dc_name, dc_ss, 0,
 146                 "IPC$", "IPC", "", "", "", 0, Undefined);
 147
 148         if (!NT_STATUS_IS_OK(result)) {
 149                 /* map to something more useful */
 150                 if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) {
 151                         result = NT_STATUS_NO_LOGON_SERVERS;
 152                 }
 153
 154                 if (*cli) {
 155                         cli_shutdown(*cli);
 156                         *cli = NULL;
 157                 }
 158
 159                 TALLOC_FREE(mutex);
 160                 return result;
 161         }
 162
 163         /*
 164          * We now have an anonymous connection to IPC$ on the domain password server.
 165          */
 166
 167         /*
 168          * Even if the connect succeeds we need to setup the netlogon
 169          * pipe here. We do this as we may just have changed the domain
 170          * account password on the PDC and yet we may be talking to
 171          * a BDC that doesn't have this replicated yet. In this case
 172          * a successful connect to a DC needs to take the netlogon connect
 173          * into account also. This patch from "Bjart Kvarme" <bjart.kvarme@usit.uio.no>.
 174          */
 175
 176         /* open the netlogon pipe. */
 177         if (lp_client_schannel()) {
 178                 /* We also setup the creds chain in the open_schannel call. */
 179                 result = cli_rpc_pipe_open_schannel(
 180                         *cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
 181                         DCERPC_AUTH_LEVEL_PRIVACY, domain, &netlogon_pipe);
 182         } else {
 183                 result = cli_rpc_pipe_open_noauth(
 184                         *cli, &ndr_table_netlogon.syntax_id, &netlogon_pipe);
 185         }
 186
 187         if (!NT_STATUS_IS_OK(result)) {
 188                 DEBUG(0,("connect_to_domain_password_server: unable to open the domain client session to \
 189 machine %s. Error was : %s.\n", dc_name, nt_errstr(result)));
 190                 cli_shutdown(*cli);
 191                 *cli = NULL;
 192                 TALLOC_FREE(mutex);
 193                 return result;
 194         }
 195
 196         if (!lp_client_schannel()) {
 197                 /* We need to set up a creds chain on an unauthenticated netlogon pipe. */
 198                 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
 199                 enum netr_SchannelType sec_chan_type = 0;
 200                 unsigned char machine_pwd[16];
 201                 const char *account_name;
 202
 203                 if (!get_trust_pw_hash(domain, machine_pwd, &account_name,
 204                                        &sec_chan_type))
 205                 {
 206                         DEBUG(0, ("connect_to_domain_password_server: could not fetch "
 207                         "trust account password for domain '%s'\n",
 208                                 domain));
 209                         cli_shutdown(*cli);
 210                         *cli = NULL;
 211                         TALLOC_FREE(mutex);
 212                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 213                 }
 214
 215                 result = rpccli_netlogon_setup_creds(netlogon_pipe,
 216                                         dc_name, /* server name */
 217                                         domain, /* domain */
 218                                         global_myname(), /* client name */
 219                                         account_name, /* machine account name */
 220                                         machine_pwd,
 221                                         sec_chan_type,
 222                                         &neg_flags);
 223
 224                 if (!NT_STATUS_IS_OK(result)) {
 225                         cli_shutdown(*cli);
 226                         *cli = NULL;
 227                         TALLOC_FREE(mutex);
 228                         return result;
 229                 }
 230         }
 231
 232         if(!netlogon_pipe) {
 233                 DEBUG(0,("connect_to_domain_password_server: unable to open the domain client session to \
 234 machine %s. Error was : %s.\n", dc_name, cli_errstr(*cli)));
 235                 cli_shutdown(*cli);
 236                 *cli = NULL;
 237                 TALLOC_FREE(mutex);
 238                 return NT_STATUS_NO_LOGON_SERVERS;
 239         }
 240
 241         /* We exit here with the mutex *locked*. JRA */
 242
 243         *pipe_ret = netlogon_pipe;
 244
 245         return NT_STATUS_OK;
 246 }
 247
 248 /***********************************************************************
 249  Do the same as security=server, but using NT Domain calls and a session
 250  key from the machine password.  If the server parameter is specified
 251  use it, otherwise figure out a server from the 'password server' param.
 252 ************************************************************************/
 253
 254 static NTSTATUS domain_client_validate(TALLOC_CTX *mem_ctx,
 255                                         const struct auth_usersupplied_info *user_info,
 256                                         const char *domain,
 257                                         uchar chal[8],
 258                                         struct auth_serversupplied_info **server_info,
 259                                         const char *dc_name,
 260                                         struct sockaddr_storage *dc_ss)
 261
 262 {
 263         struct netr_SamInfo3 *info3 = NULL;
 264         struct cli_state *cli = NULL;
 265         struct rpc_pipe_client *netlogon_pipe = NULL;
 266         NTSTATUS nt_status = NT_STATUS_NO_LOGON_SERVERS;
 267         int i;
 268
 269         /*
 270          * At this point, smb_apasswd points to the lanman response to
 271          * the challenge in local_challenge, and smb_ntpasswd points to
 272          * the NT response to the challenge in local_challenge. Ship
 273          * these over the secure channel to a domain controller and
 274          * see if they were valid.
 275          */
 276
 277         /* rety loop for robustness */
 278
 279         for (i = 0; !NT_STATUS_IS_OK(nt_status) && (i < 3); i++) {
 280                 nt_status = connect_to_domain_password_server(&cli,
 281                                                         domain,
 282                                                         dc_name,
 283                                                         dc_ss,
 284                                                         &netlogon_pipe);
 285         }
 286
 287         if ( !NT_STATUS_IS_OK(nt_status) ) {
 288                 DEBUG(0,("domain_client_validate: Domain password server not available.\n"));
 289                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_ACCESS_DENIED)) {
 290                         return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
 291                 }
 292                 return nt_status;
 293         }
 294
 295         /* store a successful connection */
 296
 297         saf_store( domain, cli->desthost );
 298
 299         /*
 300          * If this call succeeds, we now have lots of info about the user
 301          * in the info3 structure.
 302          */
 303
 304         nt_status = rpccli_netlogon_sam_network_logon(netlogon_pipe,
 305                                                       mem_ctx,
 306                                                       user_info->logon_parameters,         /* flags such as 'allow workstation logon' */
 307                                                       dc_name,                             /* server name */
 308                                                       user_info->client.account_name,      /* user name logging on. */
 309                                                       user_info->client.domain_name,       /* domain name */
 310                                                       user_info->workstation_name,         /* workstation name */
 311                                                       chal,                                /* 8 byte challenge. */
 312                                                       user_info->password.response.lanman, /* lanman 24 byte response */
 313                                                       user_info->password.response.nt,     /* nt 24 byte response */
 314                                                       &info3);                             /* info3 out */
 315
 316         /* Let go as soon as possible so we avoid any potential deadlocks
 317            with winbind lookup up users or groups. */
 318
 319         TALLOC_FREE(mutex);
 320
 321         if (!NT_STATUS_IS_OK(nt_status)) {
 322                 DEBUG(0,("domain_client_validate: unable to validate password "
 323                          "for user %s in domain %s to Domain controller %s. "
 324                          "Error was %s.\n", user_info->client.account_name,
 325                          user_info->client.domain_name, dc_name,
 326                          nt_errstr(nt_status)));
 327
 328                 /* map to something more useful */
 329                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_UNSUCCESSFUL)) {
 330                         nt_status = NT_STATUS_NO_LOGON_SERVERS;
 331                 }
 332         } else {
 333                 nt_status = make_server_info_info3(mem_ctx,
 334                                                    user_info->client.account_name,
 335                                                    domain,
 336                                                    server_info,
 337                                                    info3);
 338
 339                 if (NT_STATUS_IS_OK(nt_status)) {
 340                         (*server_info)->nss_token |= user_info->was_mapped;
 341                         netsamlogon_cache_store(user_info->client.account_name, info3);
 342                         TALLOC_FREE(info3);
 343                 }
 344         }
 345
 346         /* Note - once the cli stream is shutdown the mem_ctx used
 347            to allocate the other_sids and gids structures has been deleted - so
 348            these pointers are no longer valid..... */
 349
 350         cli_shutdown(cli);
 351         return nt_status;
 352 }
 353
 354 /****************************************************************************
 355  Check for a valid username and password in security=domain mode.
 356 ****************************************************************************/
 357
 358 static NTSTATUS check_ntdomain_security(const struct auth_context *auth_context,
 359                                         void *my_private_data,
 360                                         TALLOC_CTX *mem_ctx,
 361                                         const struct auth_usersupplied_info *user_info,
 362                                         struct auth_serversupplied_info **server_info)
 363 {
 364         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
 365         const char *domain = lp_workgroup();
 366         fstring dc_name;
 367         struct sockaddr_storage dc_ss;
 368
 369         if ( lp_server_role() != ROLE_DOMAIN_MEMBER ) {
 370                 DEBUG(0,("check_ntdomain_security: Configuration error!  Cannot use "
 371                         "ntdomain auth method when not a member of a domain.\n"));
 372                 return NT_STATUS_NOT_IMPLEMENTED;
 373         }
 374
 375         if (!user_info || !server_info || !auth_context) {
 376                 DEBUG(1,("check_ntdomain_security: Critical variables not present.  Failing.\n"));
 377                 return NT_STATUS_INVALID_PARAMETER;
 378         }
 379
 380         DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
 381
 382         /*
 383          * Check that the requested domain is not our own machine name.
 384          * If it is, we should never check the PDC here, we use our own local
 385          * password file.
 386          */
 387
 388         if(strequal(get_global_sam_name(), user_info->mapped.domain_name)) {
 389                 DEBUG(3,("check_ntdomain_security: Requested domain was for this machine.\n"));
 390                 return NT_STATUS_NOT_IMPLEMENTED;
 391         }
 392
 393         /* we need our DC to send the net_sam_logon() request to */
 394
 395         if ( !get_dc_name(domain, NULL, dc_name, &dc_ss) ) {
 396                 DEBUG(5,("check_ntdomain_security: unable to locate a DC for domain %s\n",
 397                         user_info->mapped.domain_name));
 398                 return NT_STATUS_NO_LOGON_SERVERS;
 399         }
 400
 401         nt_status = domain_client_validate(mem_ctx,
 402                                         user_info,
 403                                         domain,
 404                                         (uchar *)auth_context->challenge.data,
 405                                         server_info,
 406                                         dc_name,
 407                                         &dc_ss);
 408
 409         return nt_status;
 410 }
 411
 412 /* module initialisation */
 413 static NTSTATUS auth_init_ntdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method)
 414 {
 415         struct auth_methods *result;
 416
 417         result = TALLOC_ZERO_P(auth_context, struct auth_methods);
 418         if (result == NULL) {
 419                 return NT_STATUS_NO_MEMORY;
 420         }
 421         result->name = "ntdomain";
 422         result->auth = check_ntdomain_security;
 423
 424         *auth_method = result;
 425         return NT_STATUS_OK;
 426 }
 427
 428
 429 /****************************************************************************
 430  Check for a valid username and password in a trusted domain
 431 ****************************************************************************/
 432
 433 static NTSTATUS check_trustdomain_security(const struct auth_context *auth_context,
 434                                            void *my_private_data,
 435                                            TALLOC_CTX *mem_ctx,
 436                                            const struct auth_usersupplied_info *user_info,
 437                                            struct auth_serversupplied_info **server_info)
 438 {
 439         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
 440         unsigned char trust_md4_password[16];
 441         char *trust_password;
 442         fstring dc_name;
 443         struct sockaddr_storage dc_ss;
 444
 445         if (!user_info || !server_info || !auth_context) {
 446                 DEBUG(1,("check_trustdomain_security: Critical variables not present.  Failing.\n"));
 447                 return NT_STATUS_INVALID_PARAMETER;
 448         }
 449
 450         DEBUG(10, ("Check auth for: [%s]\n", user_info->mapped.account_name));
 451
 452         /*
 453          * Check that the requested domain is not our own machine name or domain name.
 454          */
 455
 456         if( strequal(get_global_sam_name(), user_info->mapped.domain_name)) {
 457                 DEBUG(3,("check_trustdomain_security: Requested domain [%s] was for this machine.\n",
 458                         user_info->mapped.domain_name));
 459                 return NT_STATUS_NOT_IMPLEMENTED;
 460         }
 461
 462         /* No point is bothering if this is not a trusted domain.
 463            This return makes "map to guest = bad user" work again.
 464            The logic is that if we know nothing about the domain, that
 465            user is not known to us and does not exist */
 466
 467         if ( !is_trusted_domain( user_info->mapped.domain_name ) )
 468                 return NT_STATUS_NOT_IMPLEMENTED;
 469
 470         /*
 471          * Get the trusted account password for the trusted domain
 472          * No need to become_root() as secrets_init() is done at startup.
 473          */
 474
 475         if (!pdb_get_trusteddom_pw(user_info->mapped.domain_name, &trust_password,
 476                                    NULL, NULL)) {
 477                 DEBUG(0, ("check_trustdomain_security: could not fetch trust "
 478                           "account password for domain %s\n",
 479                           user_info->mapped.domain_name));
 480                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 481         }
 482
 483 #ifdef DEBUG_PASSWORD
 484         DEBUG(100, ("Trust password for domain %s is %s\n", user_info->mapped.domain_name,
 485                     trust_password));
 486 #endif
 487         E_md4hash(trust_password, trust_md4_password);
 488         SAFE_FREE(trust_password);
 489
 490 #if 0
 491         /* Test if machine password is expired and need to be changed */
 492         if (time(NULL) > last_change_time + (time_t)lp_machine_password_timeout())
 493         {
 494                 global_machine_password_needs_changing = True;
 495         }
 496 #endif
 497
 498         /* use get_dc_name() for consistency even through we know that it will be
 499            a netbios name */
 500
 501         if ( !get_dc_name(user_info->mapped.domain_name, NULL, dc_name, &dc_ss) ) {
 502                 DEBUG(5,("check_trustdomain_security: unable to locate a DC for domain %s\n",
 503                         user_info->mapped.domain_name));
 504                 return NT_STATUS_NO_LOGON_SERVERS;
 505         }
 506
 507         nt_status = domain_client_validate(mem_ctx,
 508                                            user_info,
 509                                            user_info->mapped.domain_name,
 510                                            (uchar *)auth_context->challenge.data,
 511                                            server_info,
 512                                            dc_name,
 513                                            &dc_ss);
 514
 515         return nt_status;
 516 }
 517
 518 /* module initialisation */
 519 static NTSTATUS auth_init_trustdomain(struct auth_context *auth_context, const char* param, auth_methods **auth_method)
 520 {
 521         struct auth_methods *result;
 522
 523         result = TALLOC_ZERO_P(auth_context, struct auth_methods);
 524         if (result == NULL) {
 525                 return NT_STATUS_NO_MEMORY;
 526         }
 527         result->name = "trustdomain";
 528         result->auth = check_trustdomain_security;
 529
 530         *auth_method = result;
 531         return NT_STATUS_OK;
 532 }
 533
 534 NTSTATUS auth_domain_init(void)
 535 {
 536         smb_register_auth(AUTH_INTERFACE_VERSION, "trustdomain", auth_init_trustdomain);
 537         smb_register_auth(AUTH_INTERFACE_VERSION, "ntdomain", auth_init_ntdomain);
 538         return NT_STATUS_OK;
 539 }