source3/passdb/machine_account_secrets.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Copyright (C) Andrew Tridgell 1992-2001
   4    Copyright (C) Andrew Bartlett      2002
   5    Copyright (C) Rafal Szczesniak     2002
   6    Copyright (C) Tim Potter           2001
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /* the Samba secrets database stores any generated, private information
  23    such as the local SID and machine trust password */
  24
  25 #include "includes.h"
  26 #include "passdb.h"
  27 #include "../libcli/auth/libcli_auth.h"
  28 #include "secrets.h"
  29 #include "dbwrap/dbwrap.h"
  30 #include "../librpc/ndr/libndr.h"
  31 #include "util_tdb.h"
  32 #include "libcli/security/security.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_PASSDB
  36
  37 static char *des_salt_key(const char *realm);
  38
  39 /**
  40  * Form a key for fetching the domain sid
  41  *
  42  * @param domain domain name
  43  *
  44  * @return keystring
  45  **/
  46 static const char *domain_sid_keystr(const char *domain)
  47 {
  48         char *keystr;
  49
  50         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
  51                                             SECRETS_DOMAIN_SID, domain);
  52         SMB_ASSERT(keystr != NULL);
  53         return keystr;
  54 }
  55
  56 static const char *domain_guid_keystr(const char *domain)
  57 {
  58         char *keystr;
  59
  60         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
  61                                             SECRETS_DOMAIN_GUID, domain);
  62         SMB_ASSERT(keystr != NULL);
  63         return keystr;
  64 }
  65
  66 static const char *protect_ids_keystr(const char *domain)
  67 {
  68         char *keystr;
  69
  70         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
  71                                             SECRETS_PROTECT_IDS, domain);
  72         SMB_ASSERT(keystr != NULL);
  73         return keystr;
  74 }
  75
  76 /* N O T E: never use this outside of passdb modules that store the SID on their own */
  77 bool secrets_mark_domain_protected(const char *domain)
  78 {
  79         bool ret;
  80
  81         ret = secrets_store(protect_ids_keystr(domain), "TRUE", 5);
  82         if (!ret) {
  83                 DEBUG(0, ("Failed to protect the Domain IDs\n"));
  84         }
  85         return ret;
  86 }
  87
  88 bool secrets_clear_domain_protection(const char *domain)
  89 {
  90         bool ret;
  91         void *protection = secrets_fetch(protect_ids_keystr(domain), NULL);
  92
  93         if (protection) {
  94                 SAFE_FREE(protection);
  95                 ret = secrets_delete_entry(protect_ids_keystr(domain));
  96                 if (!ret) {
  97                         DEBUG(0, ("Failed to remove Domain IDs protection\n"));
  98                 }
  99                 return ret;
 100         }
 101         return true;
 102 }
 103
 104 bool secrets_store_domain_sid(const char *domain, const struct dom_sid  *sid)
 105 {
 106         char *protect_ids;
 107         bool ret;
 108
 109         protect_ids = secrets_fetch(protect_ids_keystr(domain), NULL);
 110         if (protect_ids) {
 111                 if (strncmp(protect_ids, "TRUE", 4)) {
 112                         DEBUG(0, ("Refusing to store a Domain SID, "
 113                                   "it has been marked as protected!\n"));
 114                         SAFE_FREE(protect_ids);
 115                         return false;
 116                 }
 117         }
 118         SAFE_FREE(protect_ids);
 119
 120         ret = secrets_store(domain_sid_keystr(domain), sid, sizeof(struct dom_sid ));
 121
 122         /* Force a re-query, in the case where we modified our domain */
 123         if (ret) {
 124                 if (dom_sid_equal(get_global_sam_sid(), sid) == false) {
 125                         reset_global_sam_sid();
 126                 }
 127         }
 128         return ret;
 129 }
 130
 131 bool secrets_fetch_domain_sid(const char *domain, struct dom_sid  *sid)
 132 {
 133         struct dom_sid  *dyn_sid;
 134         size_t size = 0;
 135
 136         dyn_sid = (struct dom_sid  *)secrets_fetch(domain_sid_keystr(domain), &size);
 137
 138         if (dyn_sid == NULL)
 139                 return False;
 140
 141         if (size != sizeof(struct dom_sid)) {
 142                 SAFE_FREE(dyn_sid);
 143                 return False;
 144         }
 145
 146         *sid = *dyn_sid;
 147         SAFE_FREE(dyn_sid);
 148         return True;
 149 }
 150
 151 bool secrets_store_domain_guid(const char *domain, const struct GUID *guid)
 152 {
 153         char *protect_ids;
 154         const char *key;
 155
 156         protect_ids = secrets_fetch(protect_ids_keystr(domain), NULL);
 157         if (protect_ids) {
 158                 if (strncmp(protect_ids, "TRUE", 4)) {
 159                         DEBUG(0, ("Refusing to store a Domain SID, "
 160                                   "it has been marked as protected!\n"));
 161                         SAFE_FREE(protect_ids);
 162                         return false;
 163                 }
 164         }
 165         SAFE_FREE(protect_ids);
 166
 167         key = domain_guid_keystr(domain);
 168         return secrets_store(key, guid, sizeof(struct GUID));
 169 }
 170
 171 bool secrets_fetch_domain_guid(const char *domain, struct GUID *guid)
 172 {
 173         struct GUID *dyn_guid;
 174         const char *key;
 175         size_t size = 0;
 176         struct GUID new_guid;
 177
 178         key = domain_guid_keystr(domain);
 179         dyn_guid = (struct GUID *)secrets_fetch(key, &size);
 180
 181         if (!dyn_guid) {
 182                 if (lp_server_role() == ROLE_DOMAIN_PDC) {
 183                         new_guid = GUID_random();
 184                         if (!secrets_store_domain_guid(domain, &new_guid))
 185                                 return False;
 186                         dyn_guid = (struct GUID *)secrets_fetch(key, &size);
 187                 }
 188                 if (dyn_guid == NULL) {
 189                         return False;
 190                 }
 191         }
 192
 193         if (size != sizeof(struct GUID)) {
 194                 DEBUG(1,("UUID size %d is wrong!\n", (int)size));
 195                 SAFE_FREE(dyn_guid);
 196                 return False;
 197         }
 198
 199         *guid = *dyn_guid;
 200         SAFE_FREE(dyn_guid);
 201         return True;
 202 }
 203
 204 /**
 205  * Form a key for fetching the machine trust account sec channel type
 206  *
 207  * @param domain domain name
 208  *
 209  * @return keystring
 210  **/
 211 static const char *machine_sec_channel_type_keystr(const char *domain)
 212 {
 213         char *keystr;
 214
 215         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 216                                             SECRETS_MACHINE_SEC_CHANNEL_TYPE,
 217                                             domain);
 218         SMB_ASSERT(keystr != NULL);
 219         return keystr;
 220 }
 221
 222 /**
 223  * Form a key for fetching the machine trust account last change time
 224  *
 225  * @param domain domain name
 226  *
 227  * @return keystring
 228  **/
 229 static const char *machine_last_change_time_keystr(const char *domain)
 230 {
 231         char *keystr;
 232
 233         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 234                                             SECRETS_MACHINE_LAST_CHANGE_TIME,
 235                                             domain);
 236         SMB_ASSERT(keystr != NULL);
 237         return keystr;
 238 }
 239
 240
 241 /**
 242  * Form a key for fetching the machine previous trust account password
 243  *
 244  * @param domain domain name
 245  *
 246  * @return keystring
 247  **/
 248 static const char *machine_prev_password_keystr(const char *domain)
 249 {
 250         char *keystr;
 251
 252         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 253                                             SECRETS_MACHINE_PASSWORD_PREV, domain);
 254         SMB_ASSERT(keystr != NULL);
 255         return keystr;
 256 }
 257
 258 /**
 259  * Form a key for fetching the machine trust account password
 260  *
 261  * @param domain domain name
 262  *
 263  * @return keystring
 264  **/
 265 static const char *machine_password_keystr(const char *domain)
 266 {
 267         char *keystr;
 268
 269         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 270                                             SECRETS_MACHINE_PASSWORD, domain);
 271         SMB_ASSERT(keystr != NULL);
 272         return keystr;
 273 }
 274
 275 /**
 276  * Form a key for fetching the machine trust account password
 277  *
 278  * @param domain domain name
 279  *
 280  * @return stored password's key
 281  **/
 282 static const char *trust_keystr(const char *domain)
 283 {
 284         char *keystr;
 285
 286         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/%s",
 287                                             SECRETS_MACHINE_ACCT_PASS, domain);
 288         SMB_ASSERT(keystr != NULL);
 289         return keystr;
 290 }
 291
 292 /************************************************************************
 293  Routine to get the default secure channel type for trust accounts
 294 ************************************************************************/
 295
 296 enum netr_SchannelType get_default_sec_channel(void)
 297 {
 298         if (lp_server_role() == ROLE_DOMAIN_BDC ||
 299             lp_server_role() == ROLE_DOMAIN_PDC ||
 300             lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC) {
 301                 return SEC_CHAN_BDC;
 302         } else {
 303                 return SEC_CHAN_WKSTA;
 304         }
 305 }
 306
 307 /************************************************************************
 308  Routine to get the trust account password for a domain.
 309  This only tries to get the legacy hashed version of the password.
 310  The user of this function must have locked the trust password file using
 311  the above secrets_lock_trust_account_password().
 312 ************************************************************************/
 313
 314 bool secrets_fetch_trust_account_password_legacy(const char *domain,
 315                                                  uint8_t ret_pwd[16],
 316                                                  time_t *pass_last_set_time,
 317                                                  enum netr_SchannelType *channel)
 318 {
 319         struct machine_acct_pass *pass;
 320         size_t size = 0;
 321
 322         if (!(pass = (struct machine_acct_pass *)secrets_fetch(
 323                       trust_keystr(domain), &size))) {
 324                 DEBUG(5, ("secrets_fetch failed!\n"));
 325                 return False;
 326         }
 327
 328         if (size != sizeof(*pass)) {
 329                 DEBUG(0, ("secrets were of incorrect size!\n"));
 330                 SAFE_FREE(pass);
 331                 return False;
 332         }
 333
 334         if (pass_last_set_time) {
 335                 *pass_last_set_time = pass->mod_time;
 336         }
 337         memcpy(ret_pwd, pass->hash, 16);
 338
 339         if (channel) {
 340                 *channel = get_default_sec_channel();
 341         }
 342
 343         SAFE_FREE(pass);
 344         return True;
 345 }
 346
 347 /************************************************************************
 348  Routine to get the trust account password for a domain.
 349  The user of this function must have locked the trust password file using
 350  the above secrets_lock_trust_account_password().
 351 ************************************************************************/
 352
 353 bool secrets_fetch_trust_account_password(const char *domain, uint8_t ret_pwd[16],
 354                                           time_t *pass_last_set_time,
 355                                           enum netr_SchannelType *channel)
 356 {
 357         char *plaintext;
 358
 359         plaintext = secrets_fetch_machine_password(domain, pass_last_set_time,
 360                                                    channel);
 361         if (plaintext) {
 362                 DEBUG(4,("Using cleartext machine password\n"));
 363                 E_md4hash(plaintext, ret_pwd);
 364                 SAFE_FREE(plaintext);
 365                 return True;
 366         }
 367
 368         return secrets_fetch_trust_account_password_legacy(domain, ret_pwd,
 369                                                            pass_last_set_time,
 370                                                            channel);
 371 }
 372
 373 /************************************************************************
 374  Routine to delete the plaintext machine account password, old password,
 375  sec channel type and last change time from secrets database
 376 ************************************************************************/
 377
 378 bool secrets_delete_machine_password_ex(const char *domain)
 379 {
 380         if (!secrets_delete(machine_prev_password_keystr(domain))) {
 381                 return false;
 382         }
 383         if (!secrets_delete_entry(machine_password_keystr(domain))) {
 384                 return false;
 385         }
 386         if (!secrets_delete_entry(machine_sec_channel_type_keystr(domain))) {
 387                 return false;
 388         }
 389         return secrets_delete_entry(machine_last_change_time_keystr(domain));
 390 }
 391
 392 /************************************************************************
 393  Routine to delete the domain sid
 394 ************************************************************************/
 395
 396 bool secrets_delete_domain_sid(const char *domain)
 397 {
 398         return secrets_delete_entry(domain_sid_keystr(domain));
 399 }
 400
 401 /************************************************************************
 402  Routine to store the previous machine password (by storing the current password
 403  as the old)
 404 ************************************************************************/
 405
 406 static bool secrets_store_prev_machine_password(const char *domain)
 407 {
 408         char *oldpass;
 409         bool ret;
 410
 411         oldpass = (char *)secrets_fetch(machine_password_keystr(domain), NULL);
 412         if (oldpass == NULL) {
 413                 return true;
 414         }
 415         ret = secrets_store(machine_prev_password_keystr(domain), oldpass, strlen(oldpass)+1);
 416         SAFE_FREE(oldpass);
 417         return ret;
 418 }
 419
 420 /************************************************************************
 421  Routine to set the plaintext machine account password for a realm
 422  the password is assumed to be a null terminated ascii string.
 423  Before storing
 424 ************************************************************************/
 425
 426 bool secrets_store_machine_password(const char *pass, const char *domain,
 427                                     enum netr_SchannelType sec_channel)
 428 {
 429         bool ret;
 430         uint32_t last_change_time;
 431         uint32_t sec_channel_type;
 432
 433         if (!secrets_store_prev_machine_password(domain)) {
 434                 return false;
 435         }
 436
 437         ret = secrets_store(machine_password_keystr(domain), pass, strlen(pass)+1);
 438         if (!ret)
 439                 return ret;
 440
 441         SIVAL(&last_change_time, 0, time(NULL));
 442         ret = secrets_store(machine_last_change_time_keystr(domain), &last_change_time, sizeof(last_change_time));
 443
 444         SIVAL(&sec_channel_type, 0, sec_channel);
 445         ret = secrets_store(machine_sec_channel_type_keystr(domain), &sec_channel_type, sizeof(sec_channel_type));
 446
 447         return ret;
 448 }
 449
 450 /************************************************************************
 451  Set the machine trust account password, the old pw and last change
 452  time, domain SID and salting principals based on values passed in
 453  (added to supprt the secrets_tdb_sync module on secrets.ldb)
 454 ************************************************************************/
 455
 456 bool secrets_store_machine_pw_sync(const char *pass, const char *oldpass, const char *domain,
 457                                    const char *realm,
 458                                    const char *salting_principal, uint32_t supported_enc_types,
 459                                    const struct dom_sid *domain_sid, uint32_t last_change_time,
 460                                    uint32_t secure_channel_type,
 461                                    bool delete_join)
 462 {
 463         bool ret;
 464         uint8_t last_change_time_store[4];
 465         TALLOC_CTX *frame = talloc_stackframe();
 466         uint8_t sec_channel_bytes[4];
 467
 468         if (delete_join) {
 469                 secrets_delete_machine_password_ex(domain);
 470                 secrets_delete_domain_sid(domain);
 471                 TALLOC_FREE(frame);
 472                 return true;
 473         }
 474
 475         ret = secrets_store(machine_password_keystr(domain), pass, strlen(pass)+1);
 476         if (!ret) {
 477                 TALLOC_FREE(frame);
 478                 return ret;
 479         }
 480
 481         if (oldpass) {
 482                 ret = secrets_store(machine_prev_password_keystr(domain), oldpass, strlen(oldpass)+1);
 483         } else {
 484                 ret = secrets_delete(machine_prev_password_keystr(domain));
 485         }
 486         if (!ret) {
 487                 TALLOC_FREE(frame);
 488                 return ret;
 489         }
 490
 491         if (secure_channel_type == 0) {
 492                 /* We delete this and instead have the read code fall back to
 493                  * a default based on server role, as our caller can't specify
 494                  * this with any more certainty */
 495                 ret = secrets_delete(machine_sec_channel_type_keystr(domain));
 496                 if (!ret) {
 497                         TALLOC_FREE(frame);
 498                         return ret;
 499                 }
 500         } else {
 501                 SIVAL(&sec_channel_bytes, 0, secure_channel_type);
 502                 ret = secrets_store(machine_sec_channel_type_keystr(domain),
 503                                     &sec_channel_bytes, sizeof(sec_channel_bytes));
 504                 if (!ret) {
 505                         TALLOC_FREE(frame);
 506                         return ret;
 507                 }
 508         }
 509
 510         SIVAL(&last_change_time_store, 0, last_change_time);
 511         ret = secrets_store(machine_last_change_time_keystr(domain),
 512                             &last_change_time_store, sizeof(last_change_time));
 513
 514         if (!ret) {
 515                 TALLOC_FREE(frame);
 516                 return ret;
 517         }
 518
 519         ret = secrets_store_domain_sid(domain, domain_sid);
 520
 521         if (!ret) {
 522                 TALLOC_FREE(frame);
 523                 return ret;
 524         }
 525
 526         if (realm != NULL) {
 527                 char *key = des_salt_key(realm);
 528
 529                 if (salting_principal != NULL) {
 530                         ret = secrets_store(key,
 531                                             salting_principal,
 532                                             strlen(salting_principal)+1);
 533                 } else {
 534                         ret = secrets_delete(key);
 535                 }
 536         }
 537
 538         TALLOC_FREE(frame);
 539         return ret;
 540 }
 541
 542 /************************************************************************
 543  Return the standard DES salt key
 544 ************************************************************************/
 545
 546 char* kerberos_standard_des_salt( void )
 547 {
 548         fstring salt;
 549
 550         fstr_sprintf( salt, "host/%s.%s@", lp_netbios_name(), lp_realm() );
 551         (void)strlower_m( salt );
 552         fstrcat( salt, lp_realm() );
 553
 554         return SMB_STRDUP( salt );
 555 }
 556
 557 /************************************************************************
 558 ************************************************************************/
 559
 560 static char *des_salt_key(const char *realm)
 561 {
 562         char *keystr;
 563
 564         keystr = talloc_asprintf_strupper_m(talloc_tos(), "%s/DES/%s",
 565                                             SECRETS_SALTING_PRINCIPAL,
 566                                             realm);
 567         SMB_ASSERT(keystr != NULL);
 568         return keystr;
 569 }
 570
 571 /************************************************************************
 572 ************************************************************************/
 573
 574 bool kerberos_secrets_store_des_salt( const char* salt )
 575 {
 576         char* key;
 577         bool ret;
 578
 579         key = des_salt_key(lp_realm());
 580         if (key == NULL) {
 581                 DEBUG(0,("kerberos_secrets_store_des_salt: failed to generate key!\n"));
 582                 return False;
 583         }
 584
 585         if ( !salt ) {
 586                 DEBUG(8,("kerberos_secrets_store_des_salt: deleting salt\n"));
 587                 secrets_delete_entry( key );
 588                 return True;
 589         }
 590
 591         DEBUG(3,("kerberos_secrets_store_des_salt: Storing salt \"%s\"\n", salt));
 592
 593         ret = secrets_store( key, salt, strlen(salt)+1 );
 594
 595         TALLOC_FREE(key);
 596
 597         return ret;
 598 }
 599
 600 /************************************************************************
 601 ************************************************************************/
 602
 603 static
 604 char* kerberos_secrets_fetch_des_salt( void )
 605 {
 606         char *salt, *key;
 607
 608         key = des_salt_key(lp_realm());
 609         if (key == NULL) {
 610                 DEBUG(0,("kerberos_secrets_fetch_des_salt: failed to generate key!\n"));
 611                 return NULL;
 612         }
 613
 614         salt = (char*)secrets_fetch( key, NULL );
 615
 616         TALLOC_FREE(key);
 617
 618         return salt;
 619 }
 620
 621 /************************************************************************
 622  Routine to get the salting principal for this service.
 623  Caller must free if return is not null.
 624  ************************************************************************/
 625
 626 char *kerberos_secrets_fetch_salt_princ(void)
 627 {
 628         char *salt_princ_s;
 629         /* lookup new key first */
 630
 631         salt_princ_s = kerberos_secrets_fetch_des_salt();
 632         if (salt_princ_s == NULL) {
 633                 /* fall back to host/machine.realm@REALM */
 634                 salt_princ_s = kerberos_standard_des_salt();
 635         }
 636
 637         return salt_princ_s;
 638 }
 639
 640 /************************************************************************
 641  Routine to fetch the previous plaintext machine account password for a realm
 642  the password is assumed to be a null terminated ascii string.
 643 ************************************************************************/
 644
 645 char *secrets_fetch_prev_machine_password(const char *domain)
 646 {
 647         return (char *)secrets_fetch(machine_prev_password_keystr(domain), NULL);
 648 }
 649
 650 /************************************************************************
 651  Routine to fetch the last change time of the machine account password
 652   for a realm
 653 ************************************************************************/
 654
 655 time_t secrets_fetch_pass_last_set_time(const char *domain)
 656 {
 657         uint32_t *last_set_time;
 658         time_t pass_last_set_time;
 659
 660         last_set_time = secrets_fetch(machine_last_change_time_keystr(domain),
 661                                       NULL);
 662         if (last_set_time) {
 663                 pass_last_set_time = IVAL(last_set_time,0);
 664                 SAFE_FREE(last_set_time);
 665         } else {
 666                 pass_last_set_time = 0;
 667         }
 668
 669         return pass_last_set_time;
 670 }
 671
 672 /************************************************************************
 673  Routine to fetch the plaintext machine account password for a realm
 674  the password is assumed to be a null terminated ascii string.
 675 ************************************************************************/
 676
 677 char *secrets_fetch_machine_password(const char *domain,
 678                                      time_t *pass_last_set_time,
 679                                      enum netr_SchannelType *channel)
 680 {
 681         char *ret;
 682         ret = (char *)secrets_fetch(machine_password_keystr(domain), NULL);
 683
 684         if (pass_last_set_time) {
 685                 *pass_last_set_time = secrets_fetch_pass_last_set_time(domain);
 686         }
 687
 688         if (channel) {
 689                 size_t size;
 690                 uint32_t *channel_type;
 691                 channel_type = (unsigned int *)secrets_fetch(machine_sec_channel_type_keystr(domain), &size);
 692                 if (channel_type) {
 693                         *channel = IVAL(channel_type,0);
 694                         SAFE_FREE(channel_type);
 695                 } else {
 696                         *channel = get_default_sec_channel();
 697                 }
 698         }
 699
 700         return ret;
 701 }