2 Unix SMB/CIFS implementation.
4 Copyright (C) Andrew Tridgell 1992-2001
5 Copyright (C) John H Terpsta 1999-2001
6 Copyright (C) Andrew Bartlett 2001
7 Copyright (C) Jeremy Allison 2001
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * This module provides PAM based functions for validation of
25 * username/password pairs, account managment, session and access control.
26 * Note: SMB password checking is done in smbpass.c
30 #include "../libcli/auth/pam_errors.h"
33 #define DBGC_CLASS DBGC_AUTH
37 /*******************************************************************
38 * Handle PAM authentication
39 * - Access, Authentication, Session, Password
40 * Note: See PAM Documentation and refer to local system PAM implementation
41 * which determines what actions/limitations/allowances become affected.
42 *********************************************************************/
44 #if defined(HAVE_SECURITY_PAM_APPL_H)
45 #include <security/pam_appl.h>
46 #elif defined(HAVE_PAM_PAM_APPL_H)
47 #include <pam/pam_appl.h>
51 * Structure used to communicate between the conversation function
52 * and the server_login/change password functions.
55 struct smb_pam_userdata {
56 const char *PAM_username;
57 const char *PAM_password;
58 const char *PAM_newpassword;
61 typedef int (*smb_pam_conv_fn)(int, const struct pam_message **, struct pam_response **, void *appdata_ptr);
63 static char *smb_pam_copy_string(const char *s)
71 static char *smb_pam_copy_fstring(const char *s)
79 /*******************************************************************
81 *********************************************************************/
83 static bool smb_pam_error_handler(pam_handle_t *pamh, int pam_error, const char *msg, int dbglvl)
86 if( pam_error != PAM_SUCCESS) {
87 DEBUG(dbglvl, ("smb_pam_error_handler: PAM: %s : %s\n",
88 msg, pam_strerror(pamh, pam_error)));
94 /*******************************************************************
95 This function is a sanity check, to make sure that we NEVER report
97 *********************************************************************/
99 static bool smb_pam_nt_status_error_handler(pam_handle_t *pamh, int pam_error,
100 const char *msg, int dbglvl,
103 *nt_status = pam_to_nt_status(pam_error);
105 if (smb_pam_error_handler(pamh, pam_error, msg, dbglvl))
108 if (NT_STATUS_IS_OK(*nt_status)) {
109 /* Complain LOUDLY */
110 DEBUG(0, ("smb_pam_nt_status_error_handler: PAM: BUG: PAM and NT_STATUS \
111 error MISMATCH, forcing to NT_STATUS_LOGON_FAILURE"));
112 *nt_status = NT_STATUS_LOGON_FAILURE;
118 * PAM conversation function
119 * Here we assume (for now, at least) that echo on means login name, and
120 * echo off means password.
123 static int smb_pam_conv(int num_msg,
124 const struct pam_message **msg,
125 struct pam_response **resp,
129 struct pam_response *reply = NULL;
130 struct smb_pam_userdata *udp = (struct smb_pam_userdata *)appdata_ptr;
138 * Apparantly HPUX has a buggy PAM that doesn't support the
139 * appdata_ptr. Fail if this is the case. JRA.
143 DEBUG(0,("smb_pam_conv: PAM on this system is broken - appdata_ptr == NULL !\n"));
147 reply = SMB_MALLOC_ARRAY(struct pam_response, num_msg);
151 memset(reply, '\0', sizeof(struct pam_response) * num_msg);
153 for (replies = 0; replies < num_msg; replies++) {
154 switch (msg[replies]->msg_style) {
155 case PAM_PROMPT_ECHO_ON:
156 reply[replies].resp_retcode = PAM_SUCCESS;
157 reply[replies].resp = smb_pam_copy_string(
162 case PAM_PROMPT_ECHO_OFF:
163 reply[replies].resp_retcode = PAM_SUCCESS;
164 reply[replies].resp = smb_pam_copy_string(
174 reply[replies].resp_retcode = PAM_SUCCESS;
175 reply[replies].resp = NULL;
179 /* Must be an error of some sort... */
190 * PAM password change conversation function
191 * Here we assume (for now, at least) that echo on means login name, and
192 * echo off means password.
195 static void special_char_sub(char *buf)
197 all_string_sub(buf, "\\n", "", 0);
198 all_string_sub(buf, "\\r", "", 0);
199 all_string_sub(buf, "\\s", " ", 0);
200 all_string_sub(buf, "\\t", "\t", 0);
203 static void pwd_sub(char *buf, const char *username, const char *oldpass, const char *newpass)
205 fstring_sub(buf, "%u", username);
206 all_string_sub(buf, "%o", oldpass, sizeof(fstring));
207 all_string_sub(buf, "%n", newpass, sizeof(fstring));
212 struct chat_struct *next, *prev;
217 /**************************************************************
218 Create a linked list containing chat data.
219 ***************************************************************/
221 static struct chat_struct *make_pw_chat(const char *p)
225 struct chat_struct *list = NULL;
226 struct chat_struct *t;
227 TALLOC_CTX *frame = talloc_stackframe();
230 t = SMB_MALLOC_P(struct chat_struct);
232 DEBUG(0,("make_pw_chat: malloc failed!\n"));
239 DLIST_ADD_END(list, t, struct chat_struct*);
241 if (!next_token_talloc(frame, &p, &prompt, NULL)) {
245 if (strequal(prompt,".")) {
249 special_char_sub(prompt);
250 fstrcpy(t->prompt, prompt);
251 strlower_m(t->prompt);
252 trim_char(t->prompt, ' ', ' ');
254 if (!next_token_talloc(frame, &p, &reply, NULL)) {
258 if (strequal(reply,".")) {
262 special_char_sub(reply);
263 fstrcpy(t->reply, reply);
264 strlower_m(t->reply);
265 trim_char(t->reply, ' ', ' ');
272 static void free_pw_chat(struct chat_struct *list)
275 struct chat_struct *old_head = list;
276 DLIST_REMOVE(list, list);
281 static int smb_pam_passchange_conv(int num_msg,
282 const struct pam_message **msg,
283 struct pam_response **resp,
287 struct pam_response *reply = NULL;
288 fstring current_prompt;
289 fstring current_reply;
290 struct smb_pam_userdata *udp = (struct smb_pam_userdata *)appdata_ptr;
291 struct chat_struct *pw_chat;
292 struct chat_struct *t;
296 DEBUG(10,("smb_pam_passchange_conv: starting converstation for %d messages\n", num_msg));
301 if ((pw_chat = make_pw_chat(lp_passwd_chat())) == NULL)
305 * Apparantly HPUX has a buggy PAM that doesn't support the
306 * appdata_ptr. Fail if this is the case. JRA.
310 DEBUG(0,("smb_pam_passchange_conv: PAM on this system is broken - appdata_ptr == NULL !\n"));
311 free_pw_chat(pw_chat);
315 reply = SMB_MALLOC_ARRAY(struct pam_response, num_msg);
317 DEBUG(0,("smb_pam_passchange_conv: malloc for reply failed!\n"));
318 free_pw_chat(pw_chat);
322 for (replies = 0; replies < num_msg; replies++) {
324 DEBUG(10,("smb_pam_passchange_conv: Processing message %d\n", replies));
325 switch (msg[replies]->msg_style) {
326 case PAM_PROMPT_ECHO_ON:
327 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: PAM said: %s\n", msg[replies]->msg));
328 fstrcpy(current_prompt, msg[replies]->msg);
329 trim_char(current_prompt, ' ', ' ');
330 for (t=pw_chat; t; t=t->next) {
332 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: trying to match |%s| to |%s|\n",
333 t->prompt, current_prompt ));
335 if (unix_wild_match(t->prompt, current_prompt)) {
336 fstrcpy(current_reply, t->reply);
337 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We sent: %s\n", current_reply));
338 pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
339 #ifdef DEBUG_PASSWORD
340 DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We actually sent: %s\n", current_reply));
342 reply[replies].resp_retcode = PAM_SUCCESS;
343 reply[replies].resp = smb_pam_copy_fstring(
351 DEBUG(3,("smb_pam_passchange_conv: Could not find reply for PAM prompt: %s\n",msg[replies]->msg));
352 free_pw_chat(pw_chat);
358 case PAM_PROMPT_ECHO_OFF:
359 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: PAM said: %s\n", msg[replies]->msg));
360 fstrcpy(current_prompt, msg[replies]->msg);
361 trim_char(current_prompt, ' ', ' ');
362 for (t=pw_chat; t; t=t->next) {
364 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: trying to match |%s| to |%s|\n",
365 t->prompt, current_prompt ));
367 if (unix_wild_match(t->prompt, current_prompt)) {
368 fstrcpy(current_reply, t->reply);
369 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We sent: %s\n", current_reply));
370 pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
371 reply[replies].resp_retcode = PAM_SUCCESS;
372 reply[replies].resp = smb_pam_copy_fstring(
374 #ifdef DEBUG_PASSWORD
375 DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We actually sent: %s\n", current_reply));
384 DEBUG(3,("smb_pam_passchange_conv: Could not find reply for PAM prompt: %s\n",msg[replies]->msg));
385 free_pw_chat(pw_chat);
396 reply[replies].resp_retcode = PAM_SUCCESS;
397 reply[replies].resp = NULL;
401 /* Must be an error of some sort... */
402 free_pw_chat(pw_chat);
408 free_pw_chat(pw_chat);
414 /***************************************************************************
415 Free up a malloced pam_conv struct.
416 ****************************************************************************/
418 static void smb_free_pam_conv(struct pam_conv *pconv)
421 SAFE_FREE(pconv->appdata_ptr);
426 /***************************************************************************
427 Allocate a pam_conv struct.
428 ****************************************************************************/
430 static struct pam_conv *smb_setup_pam_conv(smb_pam_conv_fn smb_pam_conv_fnptr, const char *user,
431 const char *passwd, const char *newpass)
433 struct pam_conv *pconv = SMB_MALLOC_P(struct pam_conv);
434 struct smb_pam_userdata *udp = SMB_MALLOC_P(struct smb_pam_userdata);
436 if (pconv == NULL || udp == NULL) {
442 udp->PAM_username = user;
443 udp->PAM_password = passwd;
444 udp->PAM_newpassword = newpass;
446 pconv->conv = smb_pam_conv_fnptr;
447 pconv->appdata_ptr = (void *)udp;
452 * PAM Closing out cleanup handler
455 static bool smb_pam_end(pam_handle_t *pamh, struct pam_conv *smb_pam_conv_ptr)
459 smb_free_pam_conv(smb_pam_conv_ptr);
462 pam_error = pam_end(pamh, 0);
463 if(smb_pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
464 DEBUG(4, ("smb_pam_end: PAM: PAM_END OK.\n"));
468 DEBUG(2,("smb_pam_end: PAM: not initialised"));
473 * Start PAM authentication for specified account
476 static bool smb_pam_start(pam_handle_t **pamh, const char *user, const char *rhost, struct pam_conv *pconv)
480 *pamh = (pam_handle_t *)NULL;
482 DEBUG(4,("smb_pam_start: PAM: Init user: %s\n", user));
484 pam_error = pam_start("samba", user, pconv, pamh);
485 if( !smb_pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
486 *pamh = (pam_handle_t *)NULL;
491 DEBUG(4,("smb_pam_start: PAM: setting rhost to: %s\n", rhost));
492 pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
493 if(!smb_pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
494 smb_pam_end(*pamh, pconv);
495 *pamh = (pam_handle_t *)NULL;
500 DEBUG(4,("smb_pam_start: PAM: setting tty\n"));
501 pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
502 if (!smb_pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
503 smb_pam_end(*pamh, pconv);
504 *pamh = (pam_handle_t *)NULL;
508 DEBUG(4,("smb_pam_start: PAM: Init passed for user: %s\n", user));
513 * PAM Authentication Handler
515 static NTSTATUS smb_pam_auth(pam_handle_t *pamh, const char *user)
518 NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
521 * To enable debugging set in /etc/pam.d/samba:
522 * auth required /lib/security/pam_pwdb.so nullok shadow audit
525 DEBUG(4,("smb_pam_auth: PAM: Authenticate User: %s\n", user));
526 pam_error = pam_authenticate(pamh, PAM_SILENT | lp_null_passwords() ? 0 : PAM_DISALLOW_NULL_AUTHTOK);
529 DEBUG(2, ("smb_pam_auth: PAM: Authentication Error for user %s\n", user));
531 case PAM_CRED_INSUFFICIENT:
532 DEBUG(2, ("smb_pam_auth: PAM: Insufficient Credentials for user %s\n", user));
534 case PAM_AUTHINFO_UNAVAIL:
535 DEBUG(2, ("smb_pam_auth: PAM: Authentication Information Unavailable for user %s\n", user));
537 case PAM_USER_UNKNOWN:
538 DEBUG(2, ("smb_pam_auth: PAM: Username %s NOT known to Authentication system\n", user));
541 DEBUG(2, ("smb_pam_auth: PAM: One or more authentication modules reports user limit for user %s exceeeded\n", user));
544 DEBUG(0, ("smb_pam_auth: PAM: One or more PAM modules failed to load for user %s\n", user));
547 DEBUG(4, ("smb_pam_auth: PAM: User %s Authenticated OK\n", user));
550 DEBUG(0, ("smb_pam_auth: PAM: UNKNOWN ERROR while authenticating user %s\n", user));
554 smb_pam_nt_status_error_handler(pamh, pam_error, "Authentication Failure", 2, &nt_status);
559 * PAM Account Handler
561 static NTSTATUS smb_pam_account(pam_handle_t *pamh, const char * user)
564 NTSTATUS nt_status = NT_STATUS_ACCOUNT_DISABLED;
566 DEBUG(4,("smb_pam_account: PAM: Account Management for User: %s\n", user));
567 pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
568 switch( pam_error ) {
569 case PAM_AUTHTOK_EXPIRED:
570 DEBUG(2, ("smb_pam_account: PAM: User %s is valid but password is expired\n", user));
572 case PAM_ACCT_EXPIRED:
573 DEBUG(2, ("smb_pam_account: PAM: User %s no longer permitted to access system\n", user));
576 DEBUG(2, ("smb_pam_account: PAM: There was an authentication error for user %s\n", user));
578 case PAM_PERM_DENIED:
579 DEBUG(0, ("smb_pam_account: PAM: User %s is NOT permitted to access system at this time\n", user));
581 case PAM_USER_UNKNOWN:
582 DEBUG(0, ("smb_pam_account: PAM: User \"%s\" is NOT known to account management\n", user));
585 DEBUG(4, ("smb_pam_account: PAM: Account OK for User: %s\n", user));
588 DEBUG(0, ("smb_pam_account: PAM: UNKNOWN PAM ERROR (%d) during Account Management for User: %s\n", pam_error, user));
592 smb_pam_nt_status_error_handler(pamh, pam_error, "Account Check Failed", 2, &nt_status);
597 * PAM Credential Setting
600 static NTSTATUS smb_pam_setcred(pam_handle_t *pamh, const char * user)
603 NTSTATUS nt_status = NT_STATUS_NO_TOKEN;
606 * This will allow samba to aquire a kerberos token. And, when
607 * exporting an AFS cell, be able to /write/ to this cell.
610 DEBUG(4,("PAM: Account Management SetCredentials for User: %s\n", user));
611 pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED|PAM_SILENT));
612 switch( pam_error ) {
613 case PAM_CRED_UNAVAIL:
614 DEBUG(0, ("smb_pam_setcred: PAM: Credentials not found for user:%s\n", user ));
616 case PAM_CRED_EXPIRED:
617 DEBUG(0, ("smb_pam_setcred: PAM: Credentials for user: \"%s\" EXPIRED!\n", user ));
619 case PAM_USER_UNKNOWN:
620 DEBUG(0, ("smb_pam_setcred: PAM: User: \"%s\" is NOT known so can not set credentials!\n", user ));
623 DEBUG(0, ("smb_pam_setcred: PAM: Unknown setcredentials error - unable to set credentials for %s\n", user ));
626 DEBUG(4, ("smb_pam_setcred: PAM: SetCredentials OK for User: %s\n", user));
629 DEBUG(0, ("smb_pam_setcred: PAM: UNKNOWN PAM ERROR (%d) during SetCredentials for User: %s\n", pam_error, user));
633 smb_pam_nt_status_error_handler(pamh, pam_error, "Set Credential Failure", 2, &nt_status);
638 * PAM Internal Session Handler
640 static bool smb_internal_pam_session(pam_handle_t *pamh, const char *user, const char *tty, bool flag)
645 DEBUG(4,("smb_internal_pam_session: PAM: tty set to: %s\n", tty));
646 pam_error = pam_set_item(pamh, PAM_TTY, tty);
647 if (!smb_pam_error_handler(pamh, pam_error, "set tty failed", 0))
652 pam_error = pam_open_session(pamh, PAM_SILENT);
653 if (!smb_pam_error_handler(pamh, pam_error, "session setup failed", 0))
656 pam_setcred(pamh, (PAM_DELETE_CRED|PAM_SILENT)); /* We don't care if this fails */
657 pam_error = pam_close_session(pamh, PAM_SILENT); /* This will probably pick up the error anyway */
658 if (!smb_pam_error_handler(pamh, pam_error, "session close failed", 0))
665 * Internal PAM Password Changer.
668 static bool smb_pam_chauthtok(pam_handle_t *pamh, const char * user)
672 DEBUG(4,("smb_pam_chauthtok: PAM: Password Change for User: %s\n", user));
674 pam_error = pam_chauthtok(pamh, PAM_SILENT); /* Change Password */
676 switch( pam_error ) {
677 case PAM_AUTHTOK_ERR:
678 DEBUG(2, ("PAM: unable to obtain the new authentication token - is password to weak?\n"));
681 /* This doesn't seem to be defined on Solaris. JRA */
682 #ifdef PAM_AUTHTOK_RECOVER_ERR
683 case PAM_AUTHTOK_RECOVER_ERR:
684 DEBUG(2, ("PAM: unable to obtain the old authentication token - was the old password wrong?.\n"));
688 case PAM_AUTHTOK_LOCK_BUSY:
689 DEBUG(2, ("PAM: unable to change the authentication token since it is currently locked.\n"));
691 case PAM_AUTHTOK_DISABLE_AGING:
692 DEBUG(2, ("PAM: Authentication token aging has been disabled.\n"));
694 case PAM_PERM_DENIED:
695 DEBUG(0, ("PAM: Permission denied.\n"));
698 DEBUG(0, ("PAM: Could not update all authentication token(s). No authentication tokens were updated.\n"));
700 case PAM_USER_UNKNOWN:
701 DEBUG(0, ("PAM: User not known to PAM\n"));
704 DEBUG(4, ("PAM: Account OK for User: %s\n", user));
707 DEBUG(0, ("PAM: UNKNOWN PAM ERROR (%d) for User: %s\n", pam_error, user));
710 if(!smb_pam_error_handler(pamh, pam_error, "Password Change Failed", 2)) {
714 /* If this point is reached, the password has changed. */
719 * PAM Externally accessible Session handler
722 bool smb_pam_claim_session(char *user, char *tty, char *rhost)
724 pam_handle_t *pamh = NULL;
725 struct pam_conv *pconv = NULL;
727 /* Ignore PAM if told to. */
729 if (!lp_obey_pam_restrictions())
732 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
735 if (!smb_pam_start(&pamh, user, rhost, pconv))
738 if (!smb_internal_pam_session(pamh, user, tty, True)) {
739 smb_pam_end(pamh, pconv);
743 return smb_pam_end(pamh, pconv);
747 * PAM Externally accessible Session handler
750 bool smb_pam_close_session(char *user, char *tty, char *rhost)
752 pam_handle_t *pamh = NULL;
753 struct pam_conv *pconv = NULL;
755 /* Ignore PAM if told to. */
757 if (!lp_obey_pam_restrictions())
760 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
763 if (!smb_pam_start(&pamh, user, rhost, pconv))
766 if (!smb_internal_pam_session(pamh, user, tty, False)) {
767 smb_pam_end(pamh, pconv);
771 return smb_pam_end(pamh, pconv);
775 * PAM Externally accessible Account handler
778 NTSTATUS smb_pam_accountcheck(const char *user, const char *rhost)
780 NTSTATUS nt_status = NT_STATUS_ACCOUNT_DISABLED;
781 pam_handle_t *pamh = NULL;
782 struct pam_conv *pconv = NULL;
784 /* Ignore PAM if told to. */
786 if (!lp_obey_pam_restrictions())
789 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
790 return NT_STATUS_NO_MEMORY;
792 if (!smb_pam_start(&pamh, user, rhost, pconv))
793 return NT_STATUS_ACCOUNT_DISABLED;
795 if (!NT_STATUS_IS_OK(nt_status = smb_pam_account(pamh, user)))
796 DEBUG(0, ("smb_pam_accountcheck: PAM: Account Validation Failed - Rejecting User %s!\n", user));
798 smb_pam_end(pamh, pconv);
803 * PAM Password Validation Suite
806 NTSTATUS smb_pam_passcheck(const char * user, const char * rhost,
807 const char * password)
809 pam_handle_t *pamh = NULL;
810 NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
811 struct pam_conv *pconv = NULL;
814 * Note we can't ignore PAM here as this is the only
815 * way of doing auths on plaintext passwords when
816 * compiled --with-pam.
819 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, password, NULL)) == NULL)
820 return NT_STATUS_LOGON_FAILURE;
822 if (!smb_pam_start(&pamh, user, rhost, pconv))
823 return NT_STATUS_LOGON_FAILURE;
825 if (!NT_STATUS_IS_OK(nt_status = smb_pam_auth(pamh, user))) {
826 DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_auth failed - Rejecting User %s !\n", user));
827 smb_pam_end(pamh, pconv);
831 if (!NT_STATUS_IS_OK(nt_status = smb_pam_account(pamh, user))) {
832 DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_account failed - Rejecting User %s !\n", user));
833 smb_pam_end(pamh, pconv);
837 if (!NT_STATUS_IS_OK(nt_status = smb_pam_setcred(pamh, user))) {
838 DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_setcred failed - Rejecting User %s !\n", user));
839 smb_pam_end(pamh, pconv);
843 smb_pam_end(pamh, pconv);
848 * PAM Password Change Suite
851 bool smb_pam_passchange(const char *user, const char *rhost,
852 const char *oldpassword, const char *newpassword)
854 /* Appropriate quantities of root should be obtained BEFORE calling this function */
855 struct pam_conv *pconv = NULL;
856 pam_handle_t *pamh = NULL;
858 if ((pconv = smb_setup_pam_conv(smb_pam_passchange_conv, user, oldpassword, newpassword)) == NULL)
861 if(!smb_pam_start(&pamh, user, rhost, pconv))
864 if (!smb_pam_chauthtok(pamh, user)) {
865 DEBUG(0, ("smb_pam_passchange: PAM: Password Change Failed for user %s!\n", user));
866 smb_pam_end(pamh, pconv);
870 return smb_pam_end(pamh, pconv);
875 /* If PAM not used, no PAM restrictions on accounts. */
876 NTSTATUS smb_pam_accountcheck(const char *user, const char *rhost)
881 /* If PAM not used, also no PAM restrictions on sessions. */
882 bool smb_pam_claim_session(char *user, char *tty, char *rhost)
887 /* If PAM not used, also no PAM restrictions on sessions. */
888 bool smb_pam_close_session(char *in_user, char *tty, char *rhost)
892 #endif /* WITH_PAM */