source3/auth/auth_sam.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Password and authentication handling
   4    Copyright (C) Andrew Tridgell              1992-2000
   5    Copyright (C) Luke Kenneth Casson Leighton 1996-2000
   6    Copyright (C) Andrew Bartlett              2001
   7    Copyright (C) Gerald Carter                2003
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25
  26 #undef DBGC_CLASS
  27 #define DBGC_CLASS DBGC_AUTH
  28
  29 /****************************************************************************
  30  Core of smb password checking routine.
  31 ****************************************************************************/
  32
  33 static BOOL smb_pwd_check_ntlmv1(const DATA_BLOB *nt_response,
  34                                  const uchar *part_passwd,
  35                                  const DATA_BLOB *sec_blob,
  36                                  uint8 user_sess_key[16])
  37 {
  38         /* Finish the encryption of part_passwd. */
  39         uchar p24[24];
  40
  41         if (part_passwd == NULL) {
  42                 DEBUG(10,("No password set - DISALLOWING access\n"));
  43                 /* No password set - always false ! */
  44                 return False;
  45         }
  46
  47         if (sec_blob->length != 8) {
  48                 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%lu)\n", (unsigned long)sec_blob->length));
  49                 return False;
  50         }
  51
  52         if (nt_response->length != 24) {
  53                 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%lu)\n", (unsigned long)nt_response->length));
  54                 return False;
  55         }
  56
  57         SMBOWFencrypt(part_passwd, sec_blob->data, p24);
  58         if (user_sess_key != NULL) {
  59                 SMBsesskeygen_ntv1(part_passwd, NULL, user_sess_key);
  60         }
  61
  62
  63
  64 #if DEBUG_PASSWORD
  65         DEBUG(100,("Part password (P16) was |\n"));
  66         dump_data(100, part_passwd, 16);
  67         DEBUGADD(100,("Password from client was |\n"));
  68         dump_data(100, nt_response->data, nt_response->length);
  69         DEBUGADD(100,("Given challenge was |\n"));
  70         dump_data(100, sec_blob->data, sec_blob->length);
  71         DEBUGADD(100,("Value from encryption was |\n"));
  72         dump_data(100, p24, 24);
  73 #endif
  74   return (memcmp(p24, nt_response->data, 24) == 0);
  75 }
  76
  77 /****************************************************************************
  78  Core of smb password checking routine. (NTLMv2, LMv2)
  79  Note:  The same code works with both NTLMv2 and LMv2.
  80 ****************************************************************************/
  81
  82 static BOOL smb_pwd_check_ntlmv2(const DATA_BLOB *ntv2_response,
  83                                  const uchar *part_passwd,
  84                                  const DATA_BLOB *sec_blob,
  85                                  const char *user, const char *domain,
  86                                  uint8 user_sess_key[16])
  87 {
  88         /* Finish the encryption of part_passwd. */
  89         uchar kr[16];
  90         uchar value_from_encryption[16];
  91         uchar client_response[16];
  92         DATA_BLOB client_key_data;
  93
  94         if (part_passwd == NULL) {
  95                 DEBUG(10,("No password set - DISALLOWING access\n"));
  96                 /* No password set - always False */
  97                 return False;
  98         }
  99
 100         if (ntv2_response->length < 24) {
 101                 /* We MUST have more than 16 bytes, or the stuff below will go
 102                    crazy.  No known implementation sends less than the 24 bytes
 103                    for LMv2, let alone NTLMv2. */
 104                 DEBUG(0, ("smb_pwd_check_ntlmv2: incorrect password length (%lu)\n",
 105                           (unsigned long)ntv2_response->length));
 106                 return False;
 107         }
 108
 109         client_key_data = data_blob(ntv2_response->data+16, ntv2_response->length-16);
 110         /*
 111            todo:  should we be checking this for anything?  We can't for LMv2,
 112            but for NTLMv2 it is meant to contain the current time etc.
 113         */
 114
 115         memcpy(client_response, ntv2_response->data, sizeof(client_response));
 116
 117         if (!ntv2_owf_gen(part_passwd, user, domain, kr)) {
 118                 return False;
 119         }
 120
 121         SMBOWFencrypt_ntv2(kr, sec_blob, &client_key_data, value_from_encryption);
 122         if (user_sess_key != NULL) {
 123                 SMBsesskeygen_ntv2(kr, value_from_encryption, user_sess_key);
 124         }
 125
 126 #if DEBUG_PASSWORD
 127         DEBUG(100,("Part password (P16) was |\n"));
 128         dump_data(100, part_passwd, 16);
 129         DEBUGADD(100,("Password from client was |\n"));
 130         dump_data(100, ntv2_response->data, ntv2_response->length);
 131         DEBUGADD(100,("Variable data from client was |\n"));
 132         dump_data(100, client_key_data.data, client_key_data.length);
 133         DEBUGADD(100,("Given challenge was |\n"));
 134         dump_data(100, sec_blob->data, sec_blob->length);
 135         DEBUGADD(100,("Value from encryption was |\n"));
 136         dump_data(100, value_from_encryption, 16);
 137 #endif
 138         data_blob_clear_free(&client_key_data);
 139         return (memcmp(value_from_encryption, client_response, 16) == 0);
 140 }
 141
 142 /****************************************************************************
 143  Do a specific test for an smb password being correct, given a smb_password and
 144  the lanman and NT responses.
 145 ****************************************************************************/
 146
 147 static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
 148                                 TALLOC_CTX *mem_ctx,
 149                                 SAM_ACCOUNT *sampass,
 150                                 const auth_usersupplied_info *user_info,
 151                                 uint8 user_sess_key[16])
 152 {
 153         uint16 acct_ctrl;
 154         const uint8 *nt_pw, *lm_pw;
 155         uint32 auth_flags;
 156
 157         acct_ctrl = pdb_get_acct_ctrl(sampass);
 158         if (acct_ctrl & ACB_PWNOTREQ) {
 159                 if (lp_null_passwords()) {
 160                         DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", pdb_get_username(sampass)));
 161                         return(NT_STATUS_OK);
 162                 } else {
 163                         DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", pdb_get_username(sampass)));
 164                         return(NT_STATUS_LOGON_FAILURE);
 165                 }
 166         }
 167
 168         auth_flags = user_info->auth_flags;
 169
 170         if (IS_SAM_DEFAULT(sampass, PDB_NTPASSWD)) {
 171                 DEBUG(3,("sam_password_ok: NO NT password stored for user %s.\n",
 172                          pdb_get_username(sampass)));
 173                 /* No return, we want to check the LM hash below in this case */
 174                 auth_flags &= (~(AUTH_FLAG_NTLMv2_RESP |  AUTH_FLAG_NTLM_RESP));
 175         }
 176
 177         if (auth_flags & AUTH_FLAG_NTLMv2_RESP) {
 178                 nt_pw = pdb_get_nt_passwd(sampass);
 179                 /* We have the NT MD4 hash challenge available - see if we can
 180                    use it (ie. does it exist in the smbpasswd file).
 181                 */
 182                 DEBUG(4,("sam_password_ok: Checking NTLMv2 password with domain [%s]\n", user_info->client_domain.str));
 183                 if (smb_pwd_check_ntlmv2( &user_info->nt_resp,
 184                                           nt_pw, &auth_context->challenge,
 185                                           user_info->smb_name.str,
 186                                           user_info->client_domain.str,
 187                                           user_sess_key)) {
 188                         return NT_STATUS_OK;
 189                 }
 190
 191                 DEBUG(4,("sam_password_ok: Checking NTLMv2 password without a domain\n"));
 192                 if (smb_pwd_check_ntlmv2( &user_info->nt_resp,
 193                                           nt_pw, &auth_context->challenge,
 194                                           user_info->smb_name.str,
 195                                           "",
 196                                           user_sess_key)) {
 197                         return NT_STATUS_OK;
 198                 } else {
 199                         DEBUG(3,("sam_password_ok: NTLMv2 password check failed\n"));
 200                         return NT_STATUS_WRONG_PASSWORD;
 201                 }
 202         } else if (auth_flags & AUTH_FLAG_NTLM_RESP) {
 203                 if (lp_ntlm_auth()) {
 204                         nt_pw = pdb_get_nt_passwd(sampass);
 205                         /* We have the NT MD4 hash challenge available - see if we can
 206                            use it (ie. does it exist in the smbpasswd file).
 207                         */
 208                         DEBUG(4,("sam_password_ok: Checking NT MD4 password\n"));
 209                         if (smb_pwd_check_ntlmv1(&user_info->nt_resp,
 210                                                  nt_pw, &auth_context->challenge,
 211                                                  user_sess_key)) {
 212                                 return NT_STATUS_OK;
 213                         } else {
 214                                 DEBUG(3,("sam_password_ok: NT MD4 password check failed for user %s\n",pdb_get_username(sampass)));
 215                                 return NT_STATUS_WRONG_PASSWORD;
 216                         }
 217                 } else {
 218                         DEBUG(2,("sam_password_ok: NTLMv1 passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass)));
 219                         /* no return, becouse we might pick up LMv2 in the LM field */
 220                 }
 221         }
 222
 223         if (auth_flags & AUTH_FLAG_LM_RESP) {
 224                 if (user_info->lm_resp.length != 24) {
 225                         DEBUG(2,("sam_password_ok: invalid LanMan password length (%lu) for user %s\n",
 226                                  (unsigned long)user_info->nt_resp.length, pdb_get_username(sampass)));
 227                 }
 228
 229                 if (!lp_lanman_auth()) {
 230                         DEBUG(3,("sam_password_ok: Lanman passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass)));
 231                 } else if (IS_SAM_DEFAULT(sampass, PDB_LMPASSWD)) {
 232                         DEBUG(3,("sam_password_ok: NO LanMan password set for user %s (and no NT password supplied)\n",pdb_get_username(sampass)));
 233                 } else {
 234                         lm_pw = pdb_get_lanman_passwd(sampass);
 235
 236                         DEBUG(4,("sam_password_ok: Checking LM password\n"));
 237                         if (smb_pwd_check_ntlmv1(&user_info->lm_resp,
 238                                                  lm_pw, &auth_context->challenge,
 239                                                  user_sess_key)) {
 240                                 return NT_STATUS_OK;
 241                         }
 242                 }
 243
 244                 if (IS_SAM_DEFAULT(sampass, PDB_NTPASSWD)) {
 245                         DEBUG(4,("sam_password_ok: LM password check failed for user, no NT password %s\n",pdb_get_username(sampass)));
 246                         return NT_STATUS_WRONG_PASSWORD;
 247                 }
 248
 249                 nt_pw = pdb_get_nt_passwd(sampass);
 250
 251                 /* This is for 'LMv2' authentication.  almost NTLMv2 but limited to 24 bytes.
 252                    - related to Win9X, legacy NAS pass-though authentication
 253                 */
 254                 DEBUG(4,("sam_password_ok: Checking LMv2 password with domain %s\n", user_info->client_domain.str));
 255                 if (smb_pwd_check_ntlmv2( &user_info->lm_resp,
 256                                           nt_pw, &auth_context->challenge,
 257                                           user_info->smb_name.str,
 258                                           user_info->client_domain.str,
 259                                           user_sess_key)) {
 260                         return NT_STATUS_OK;
 261                 }
 262
 263                 DEBUG(4,("sam_password_ok: Checking LMv2 password without a domain\n"));
 264                 if (smb_pwd_check_ntlmv2( &user_info->lm_resp,
 265                                           nt_pw, &auth_context->challenge,
 266                                           user_info->smb_name.str,
 267                                           "",
 268                                           user_sess_key)) {
 269                         return NT_STATUS_OK;
 270                 }
 271
 272                 /* Apparently NT accepts NT responses in the LM field
 273                    - I think this is related to Win9X pass-though authentication
 274                 */
 275                 DEBUG(4,("sam_password_ok: Checking NT MD4 password in LM field\n"));
 276                 if (lp_ntlm_auth()) {
 277                         if (smb_pwd_check_ntlmv1(&user_info->lm_resp,
 278                                                  nt_pw, &auth_context->challenge,
 279                                                  user_sess_key)) {
 280                                 return NT_STATUS_OK;
 281                         }
 282                         DEBUG(3,("sam_password_ok: LM password, NT MD4 password in LM field and LMv2 failed for user %s\n",pdb_get_username(sampass)));
 283                         return NT_STATUS_WRONG_PASSWORD;
 284                 } else {
 285                         DEBUG(3,("sam_password_ok: LM password and LMv2 failed for user %s, and NT MD4 password in LM field not permitted\n",pdb_get_username(sampass)));
 286                         return NT_STATUS_WRONG_PASSWORD;
 287                 }
 288
 289         }
 290
 291         /* Should not be reached, but if they send nothing... */
 292         DEBUG(3,("sam_password_ok: NEITHER LanMan nor NT password supplied for user %s\n",pdb_get_username(sampass)));
 293         return NT_STATUS_WRONG_PASSWORD;
 294 }
 295
 296 /****************************************************************************
 297  Do a specific test for a SAM_ACCOUNT being vaild for this connection
 298  (ie not disabled, expired and the like).
 299 ****************************************************************************/
 300
 301 static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
 302                                SAM_ACCOUNT *sampass,
 303                                const auth_usersupplied_info *user_info)
 304 {
 305         uint16  acct_ctrl = pdb_get_acct_ctrl(sampass);
 306         char *workstation_list;
 307         time_t kickoff_time;
 308
 309         DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n",pdb_get_username(sampass)));
 310
 311         /* Quit if the account was disabled. */
 312         if (acct_ctrl & ACB_DISABLED) {
 313                 DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", pdb_get_username(sampass)));
 314                 return NT_STATUS_ACCOUNT_DISABLED;
 315         }
 316
 317         /* Quit if the account was locked out. */
 318         if (acct_ctrl & ACB_AUTOLOCK) {
 319                 DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", pdb_get_username(sampass)));
 320                 return NT_STATUS_ACCOUNT_LOCKED_OUT;
 321         }
 322
 323         /* Test account expire time */
 324
 325         kickoff_time = pdb_get_kickoff_time(sampass);
 326         if (kickoff_time != 0 && time(NULL) > kickoff_time) {
 327                 DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", pdb_get_username(sampass)));
 328                 DEBUG(3,("sam_account_ok: Account expired at '%ld' unix time.\n", (long)kickoff_time));
 329                 return NT_STATUS_ACCOUNT_EXPIRED;
 330         }
 331
 332         if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOEXP)) {
 333                 time_t must_change_time = pdb_get_pass_must_change_time(sampass);
 334                 time_t last_set_time = pdb_get_pass_last_set_time(sampass);
 335
 336                 /* check for immediate expiry "must change at next logon" */
 337                 if (must_change_time == 0 && last_set_time != 0) {
 338                         DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", pdb_get_username(sampass)));
 339                         return NT_STATUS_PASSWORD_MUST_CHANGE;
 340                 }
 341
 342                 /* check for expired password */
 343                 if (must_change_time < time(NULL) && must_change_time != 0) {
 344                         DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", pdb_get_username(sampass)));
 345                         DEBUG(1,("sam_account_ok: Password expired at '%s' (%ld) unix time.\n", http_timestring(must_change_time), (long)must_change_time));
 346                         return NT_STATUS_PASSWORD_EXPIRED;
 347                 }
 348         }
 349
 350         /* Test workstation. Workstation list is comma separated. */
 351
 352         workstation_list = talloc_strdup(mem_ctx, pdb_get_workstations(sampass));
 353         if (!workstation_list)
 354                 return NT_STATUS_NO_MEMORY;
 355
 356         if (*workstation_list) {
 357                 BOOL invalid_ws = True;
 358                 const char *s = workstation_list;
 359
 360                 fstring tok;
 361
 362                 while (next_token(&s, tok, ",", sizeof(tok))) {
 363                         DEBUG(10,("sam_account_ok: checking for workstation match %s and %s (len=%d)\n",
 364                                   tok, user_info->wksta_name.str, user_info->wksta_name.len));
 365                         if(strequal(tok, user_info->wksta_name.str)) {
 366                                 invalid_ws = False;
 367                                 break;
 368                         }
 369                 }
 370
 371                 if (invalid_ws)
 372                         return NT_STATUS_INVALID_WORKSTATION;
 373         }
 374
 375         if (acct_ctrl & ACB_DOMTRUST) {
 376                 DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", pdb_get_username(sampass)));
 377                 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
 378         }
 379
 380         if (acct_ctrl & ACB_SVRTRUST) {
 381                 DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", pdb_get_username(sampass)));
 382                 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
 383         }
 384
 385         if (acct_ctrl & ACB_WSTRUST) {
 386                 DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", pdb_get_username(sampass)));
 387                 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
 388         }
 389
 390         return NT_STATUS_OK;
 391 }
 392
 393 /****************************************************************************
 394 check if a username/password is OK assuming the password is a 24 byte
 395 SMB hash supplied in the user_info structure
 396 return an NT_STATUS constant.
 397 ****************************************************************************/
 398
 399 static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 400                                    void *my_private_data,
 401                                    TALLOC_CTX *mem_ctx,
 402                                    const auth_usersupplied_info *user_info,
 403                                    auth_serversupplied_info **server_info)
 404 {
 405         SAM_ACCOUNT *sampass=NULL;
 406         BOOL ret;
 407         NTSTATUS nt_status;
 408         uint8 user_sess_key[16];
 409         const uint8* lm_hash;
 410
 411         if (!user_info || !auth_context) {
 412                 return NT_STATUS_UNSUCCESSFUL;
 413         }
 414
 415         /* Can't use the talloc version here, because the returned struct gets
 416            kept on the server_info */
 417         if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(&sampass))) {
 418                 return nt_status;
 419         }
 420
 421         /* get the account information */
 422
 423         become_root();
 424         ret = pdb_getsampwnam(sampass, user_info->internal_username.str);
 425         unbecome_root();
 426
 427         if (ret == False) {
 428                 DEBUG(3,("check_sam_security: Couldn't find user '%s' in passdb file.\n", user_info->internal_username.str));
 429                 pdb_free_sam(&sampass);
 430                 return NT_STATUS_NO_SUCH_USER;
 431         }
 432
 433         nt_status = sam_password_ok(auth_context, mem_ctx, sampass, user_info, user_sess_key);
 434
 435         if (!NT_STATUS_IS_OK(nt_status)) {
 436                 pdb_free_sam(&sampass);
 437                 return nt_status;
 438         }
 439
 440         nt_status = sam_account_ok(mem_ctx, sampass, user_info);
 441
 442         if (!NT_STATUS_IS_OK(nt_status)) {
 443                 pdb_free_sam(&sampass);
 444                 return nt_status;
 445         }
 446
 447         if (!NT_STATUS_IS_OK(nt_status = make_server_info_sam(server_info, sampass))) {
 448                 DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
 449                 return nt_status;
 450         }
 451
 452         lm_hash = pdb_get_lanman_passwd((*server_info)->sam_account);
 453         if (lm_hash) {
 454                 memcpy((*server_info)->first_8_lm_hash, lm_hash, 8);
 455         }
 456
 457         memcpy((*server_info)->session_key, user_sess_key, sizeof(user_sess_key));
 458
 459         return nt_status;
 460 }
 461
 462 /* module initialisation */
 463 static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
 464 {
 465         if (!make_auth_methods(auth_context, auth_method)) {
 466                 return NT_STATUS_NO_MEMORY;
 467         }
 468
 469         (*auth_method)->auth = check_sam_security;
 470         (*auth_method)->name = "sam_ignoredomain";
 471         return NT_STATUS_OK;
 472 }
 473
 474
 475 /****************************************************************************
 476 Check SAM security (above) but with a few extra checks.
 477 ****************************************************************************/
 478
 479 static NTSTATUS check_samstrict_security(const struct auth_context *auth_context,
 480                                          void *my_private_data,
 481                                          TALLOC_CTX *mem_ctx,
 482                                          const auth_usersupplied_info *user_info,
 483                                          auth_serversupplied_info **server_info)
 484 {
 485         BOOL is_local_name, is_my_domain;
 486
 487         if (!user_info || !auth_context) {
 488                 return NT_STATUS_LOGON_FAILURE;
 489         }
 490
 491         is_local_name = is_myname(user_info->domain.str);
 492         is_my_domain  = strequal(user_info->domain.str, lp_workgroup());
 493
 494         /* check whether or not we service this domain/workgroup name */
 495
 496         switch ( lp_server_role() ) {
 497                 case ROLE_STANDALONE:
 498                 case ROLE_DOMAIN_MEMBER:
 499                         if ( !is_local_name ) {
 500                                 DEBUG(6,("check_samstrict_security: %s is not one of my local names (%s)\n",
 501                                         user_info->domain.str, (lp_server_role() == ROLE_DOMAIN_MEMBER
 502                                         ? "ROLE_DOMAIN_MEMBER" : "ROLE_STANDALONE") ));
 503                                 return NT_STATUS_NOT_IMPLEMENTED;
 504                         }
 505                 case ROLE_DOMAIN_PDC:
 506                 case ROLE_DOMAIN_BDC:
 507                         if ( !is_local_name && !is_my_domain ) {
 508                                 DEBUG(6,("check_samstrict_security: %s is not one of my local names or domain name (DC)\n",
 509                                         user_info->domain.str));
 510                                 return NT_STATUS_NOT_IMPLEMENTED;
 511                         }
 512                 default: /* name is ok */
 513                         break;
 514         }
 515
 516         return check_sam_security(auth_context, my_private_data, mem_ctx, user_info, server_info);
 517 }
 518
 519 /* module initialisation */
 520 static NTSTATUS auth_init_sam(struct auth_context *auth_context, const char *param, auth_methods **auth_method)
 521 {
 522         if (!make_auth_methods(auth_context, auth_method)) {
 523                 return NT_STATUS_NO_MEMORY;
 524         }
 525
 526         (*auth_method)->auth = check_samstrict_security;
 527         (*auth_method)->name = "sam";
 528         return NT_STATUS_OK;
 529 }
 530
 531 NTSTATUS auth_sam_init(void)
 532 {
 533         smb_register_auth(AUTH_INTERFACE_VERSION, "sam", auth_init_sam);
 534         smb_register_auth(AUTH_INTERFACE_VERSION, "sam_ignoredomain", auth_init_sam_ignoredomain);
 535         return NT_STATUS_OK;
 536 }