change_trust_account_password() must always use the PDC for rpc

password changes.

jerry
(This used to be commit 974822526f90aee9b43e75fc7fd5d48fe91add99)

diff --git a/source3/smbd/change_trust_pw.c b/source3/smbd/change_trust_pw.c
index 28a004eba8806c8dc8b6e9004814cc129985de9a..a14097873304b25f30d06bca1e4054805f9e5992 100644 (file)
--- a/source3/smbd/change_trust_pw.c
+++ b/source3/smbd/change_trust_pw.c
@@ -31,106 +31,98 @@
 static NTSTATUS modify_trust_password( const char *domain, const char *remote_machine, 
                                   unsigned char orig_trust_passwd_hash[16])
 {
-  struct cli_state *cli;
-  DOM_SID domain_sid;
-  NTSTATUS nt_status;
+       struct cli_state *cli;
+       DOM_SID domain_sid;
+       NTSTATUS nt_status;
 
-  /*
-   * Ensure we have the domain SID for this domain.
-   */
+       /*
+        * Ensure we have the domain SID for this domain.
+        */
 
-  if (!secrets_fetch_domain_sid(domain, &domain_sid)) {
-    DEBUG(0, ("modify_trust_password: unable to fetch domain sid.\n"));
-    return NT_STATUS_UNSUCCESSFUL;
-  }
+       if (!secrets_fetch_domain_sid(domain, &domain_sid)) {
+               DEBUG(0, ("modify_trust_password: unable to fetch domain sid.\n"));
+               return NT_STATUS_UNSUCCESSFUL;
+       }
 
-  if (!NT_STATUS_IS_OK(cli_full_connection(&cli, global_myname(), remote_machine, 
+       if (!NT_STATUS_IS_OK(cli_full_connection(&cli, global_myname(), remote_machine, 
                                           NULL, 0,
                                           "IPC$", "IPC",  
                                           "", "",
-                                          "", 0, NULL))) {
-         DEBUG(0,("modify_trust_password: Connection to %s failed!\n", remote_machine));
-         return NT_STATUS_UNSUCCESSFUL;
-  }
+                                          "", 0, NULL))) 
+       {
+               DEBUG(0,("modify_trust_password: Connection to %s failed!\n", remote_machine));
+               return NT_STATUS_UNSUCCESSFUL;
+       }
       
-  /*
-   * Ok - we have an anonymous connection to the IPC$ share.
-   * Now start the NT Domain stuff :-).
-   */
-
-  if(cli_nt_session_open(cli, PI_NETLOGON) == False) {
-    DEBUG(0,("modify_trust_password: unable to open the domain client session to \
-machine %s. Error was : %s.\n", remote_machine, cli_errstr(cli)));
-    cli_nt_session_close(cli);
-    cli_ulogoff(cli);
-    cli_shutdown(cli);
-    return NT_STATUS_UNSUCCESSFUL;
-  } 
-
-  nt_status = trust_pw_change_and_store_it(cli, cli->mem_ctx,
+       /*
+        * Ok - we have an anonymous connection to the IPC$ share.
+        * Now start the NT Domain stuff :-).
+        */
+
+       if(cli_nt_session_open(cli, PI_NETLOGON) == False) {
+               DEBUG(0,("modify_trust_password: unable to open the domain client session to machine %s. Error was : %s.\n", 
+                       remote_machine, cli_errstr(cli)));
+               cli_nt_session_close(cli);
+               cli_ulogoff(cli);
+               cli_shutdown(cli);
+               return NT_STATUS_UNSUCCESSFUL;
+       }
+
+       nt_status = trust_pw_change_and_store_it(cli, cli->mem_ctx,
                                           orig_trust_passwd_hash);
   
-  cli_nt_session_close(cli);
-  cli_ulogoff(cli);
-  cli_shutdown(cli);
-  return nt_status;
+       cli_nt_session_close(cli);
+       cli_ulogoff(cli);
+       cli_shutdown(cli);
+       
+       return nt_status;
 }
 
 /************************************************************************
  Change the trust account password for a domain.
 ************************************************************************/
 
-NTSTATUS change_trust_account_password( const char *domain, const char *remote_machine_list)
+NTSTATUS change_trust_account_password( const char *domain, const char *remote_machine)
 {
-  fstring remote_machine;
-  unsigned char old_trust_passwd_hash[16];
-  time_t lct;
-  NTSTATUS res = NT_STATUS_UNSUCCESSFUL;
-
-  if(!secrets_fetch_trust_account_password(domain, old_trust_passwd_hash, &lct)) {
-    DEBUG(0,("change_trust_account_password: unable to read the machine \
-account password for domain %s.\n", domain));
-    return NT_STATUS_UNSUCCESSFUL;
-  }
-
-  while(remote_machine_list && 
-       next_token(&remote_machine_list, remote_machine, 
-                  LIST_SEP, sizeof(remote_machine))) {
-    strupper(remote_machine);
-    if(strequal(remote_machine, "*")) {
-
-      /*
-       * We have been asked to dynamcially determine the IP addresses of the PDC.
-       */
-
-      struct in_addr pdc_ip;
-      fstring dc_name;
-
-      /* Use the PDC *only* for this. */
-      if(!get_pdc_ip(domain, &pdc_ip))
-        continue;
-
-      /*
-       * Try and connect to the PDC/BDC list in turn as an IP
-       * address used as a string.
-       */
-
-        if(!lookup_dc_name(global_myname(), domain, &pdc_ip, dc_name))
-          continue;
-        if(NT_STATUS_IS_OK(res = modify_trust_password( domain, dc_name,
-                                         old_trust_passwd_hash)))
-          break;
-    } else {
-           res = modify_trust_password( domain, remote_machine,
-                                        old_trust_passwd_hash);
-    }
-
-  }
-
-  if (!NT_STATUS_IS_OK(res)) {
-         DEBUG(0,("%s : change_trust_account_password: Failed to change password for \
-domain %s.\n", timestring(False), domain));
-  }
+       unsigned char old_trust_passwd_hash[16];
+       time_t lct;
+       NTSTATUS res = NT_STATUS_UNSUCCESSFUL;
+       struct in_addr pdc_ip;
+       fstring dc_name;
+
+
+       if(!secrets_fetch_trust_account_password(domain, old_trust_passwd_hash, &lct)) {
+               DEBUG(0,("change_trust_account_password: unable to read the machine account password for domain %s.\n", 
+                       domain));
+               return NT_STATUS_UNSUCCESSFUL;
+       }
+
+       if (remote_machine == NULL || !strcmp(remote_machine, "*")) {
+               /* Use the PDC *only* for this */
+       
+               if ( !get_pdc_ip(domain, &pdc_ip) ) {
+                       DEBUG(0,("Can't get IP for PDC for domain %s\n", domain));
+                       goto failed;
+               }
+
+               if ( !lookup_dc_name(global_myname(), domain, &pdc_ip, dc_name) ) 
+                       goto failed;
+       }
+       /* supoport old deprecated "smbpasswd -j DOMAIN -r MACHINE" behavior */
+       else {
+               fstrcpy( dc_name, remote_machine );
+       }
+       
+       /* if this next call fails, then give up.  We can't do
+          password changes on BDC's  --jerry */
+          
+       res = modify_trust_password(domain, dc_name, old_trust_passwd_hash);    
+       
+failed:
+       if (!NT_STATUS_IS_OK(res)) {
+               DEBUG(0,("%s : change_trust_account_password: Failed to change password for domain %s.\n", 
+                       timestring(False), domain));
+       }
   
-  return res;
+       return res;
 }

diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index c46c4c5509c92b2ffd313b0a679b14af47c9ba44..3b0619b7d0e4407457cf52cb63a12471894010c5 100644 (file)
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -1175,9 +1175,9 @@ machine %s in domain %s.\n", global_myname(), lp_workgroup() ));
       return True;
     }
 
-    pstrcpy(remote_machine_list, lp_passwordserver());
-
-    change_trust_account_password( lp_workgroup(), remote_machine_list);
+    /* always just contact the PDC here */
+    
+    change_trust_account_password( lp_workgroup(), NULL);
     global_machine_password_needs_changing = False;
     secrets_lock_trust_account_password(lp_workgroup(), False);
   }