Remove unused and unsubstituted variables from Makefile.settings.in.

[ira/wip.git] / source3 / auth / auth_domain.c

diff --git a/source3/auth/auth_domain.c b/source3/auth/auth_domain.c
index c25e62ab809310a213789954014e674620c62ba4..6aca443fe79198037524f52c276181a0d6cc7624 100644 (file)
--- a/source3/auth/auth_domain.c
+++ b/source3/auth/auth_domain.c
@@ -19,6 +19,7 @@
 */
 
 #include "includes.h"
+#include "../libcli/auth/libcli_auth.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
@@ -26,6 +27,71 @@
 extern bool global_machine_password_needs_changing;
 static struct named_mutex *mutex;
 
+/*
+ * Change machine password (called from main loop
+ * idle timeout. Must be done as root.
+ */
+
+void attempt_machine_password_change(void)
+{
+       unsigned char trust_passwd_hash[16];
+       time_t lct;
+       void *lock;
+
+       if (!global_machine_password_needs_changing) {
+               return;
+       }
+
+       if (lp_security() != SEC_DOMAIN) {
+               return;
+       }
+
+       /*
+        * We're in domain level security, and the code that
+        * read the machine password flagged that the machine
+        * password needs changing.
+        */
+
+       /*
+        * First, open the machine password file with an exclusive lock.
+        */
+
+       lock = secrets_get_trust_account_lock(NULL, lp_workgroup());
+
+       if (lock == NULL) {
+               DEBUG(0,("attempt_machine_password_change: unable to lock "
+                       "the machine account password for machine %s in "
+                       "domain %s.\n",
+                       global_myname(), lp_workgroup() ));
+               return;
+       }
+
+       if(!secrets_fetch_trust_account_password(lp_workgroup(),
+                       trust_passwd_hash, &lct, NULL)) {
+               DEBUG(0,("attempt_machine_password_change: unable to read the "
+                       "machine account password for %s in domain %s.\n",
+                       global_myname(), lp_workgroup()));
+               TALLOC_FREE(lock);
+               return;
+       }
+
+       /*
+        * Make sure someone else hasn't already done this.
+        */
+
+       if(time(NULL) < lct + lp_machine_password_timeout()) {
+               global_machine_password_needs_changing = false;
+               TALLOC_FREE(lock);
+               return;
+       }
+
+       /* always just contact the PDC here */
+
+       change_trust_account_password( lp_workgroup(), NULL);
+       global_machine_password_needs_changing = false;
+       TALLOC_FREE(lock);
+}
+
 /**
  * Connect to a remote server for (inter)domain security authenticaion.
  *