source3/libsmb/passchange.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB client password change routine
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "../librpc/gen_ndr/ndr_samr.h"
  22 #include "rpc_client/cli_pipe.h"
  23 #include "rpc_client/cli_samr.h"
  24 #include "libsmb/clirap.h"
  25 #include "libsmb/nmblib.h"
  26
  27 /*************************************************************
  28  Change a password on a remote machine using IPC calls.
  29 *************************************************************/
  30
  31 NTSTATUS remote_password_change(const char *remote_machine, const char *user_name,
  32                                 const char *old_passwd, const char *new_passwd,
  33                                 char **err_str)
  34 {
  35         struct nmb_name calling, called;
  36         struct cli_state *cli = NULL;
  37         struct rpc_pipe_client *pipe_hnd = NULL;
  38         struct sockaddr_storage ss;
  39         char *user, *domain, *p;
  40
  41         NTSTATUS result;
  42         bool pass_must_change = False;
  43
  44         user = talloc_strdup(talloc_tos(), user_name);
  45         SMB_ASSERT(user != NULL);
  46         domain = talloc_strdup(talloc_tos(), "");
  47         SMB_ASSERT(domain != NULL);
  48
  49         /* allow usernames of the form domain\\user or domain/user */
  50         if ((p = strchr_m(user,'\\')) || (p = strchr_m(user,'/')) ||
  51             (p = strchr_m(user,*lp_winbind_separator()))) {
  52                 *p = 0;
  53                 domain = user;
  54                 user = p+1;
  55         }
  56
  57         *err_str = NULL;
  58
  59         if(!resolve_name( remote_machine, &ss, 0x20, false)) {
  60                 if (asprintf(err_str, "Unable to find an IP address for machine "
  61                          "%s.\n", remote_machine) == -1) {
  62                         *err_str = NULL;
  63                 }
  64                 return NT_STATUS_UNSUCCESSFUL;
  65         }
  66
  67         cli = cli_initialise();
  68         if (!cli) {
  69                 return NT_STATUS_NO_MEMORY;
  70         }
  71
  72         result = cli_connect(cli, remote_machine, &ss);
  73         if (!NT_STATUS_IS_OK(result)) {
  74                 if (asprintf(err_str, "Unable to connect to SMB server on "
  75                          "machine %s. Error was : %s.\n",
  76                          remote_machine, nt_errstr(result))==-1) {
  77                         *err_str = NULL;
  78                 }
  79                 cli_shutdown(cli);
  80                 return result;
  81         }
  82
  83         make_nmb_name(&calling, global_myname() , 0x0);
  84         make_nmb_name(&called , remote_machine, 0x20);
  85
  86         if (!cli_session_request(cli, &calling, &called)) {
  87                 if (asprintf(err_str, "machine %s rejected the session setup. "
  88                          "Error was : %s.\n",
  89                          remote_machine, cli_errstr(cli)) == -1) {
  90                         *err_str = NULL;
  91                 }
  92                 result = cli_nt_error(cli);
  93                 cli_shutdown(cli);
  94                 return result;
  95         }
  96
  97         cli->protocol = PROTOCOL_NT1;
  98
  99         result = cli_negprot(cli);
 100
 101         if (!NT_STATUS_IS_OK(result)) {
 102                 if (asprintf(err_str, "machine %s rejected the negotiate "
 103                          "protocol. Error was : %s.\n",
 104                          remote_machine, nt_errstr(result)) == -1) {
 105                         *err_str = NULL;
 106                 }
 107                 result = cli_nt_error(cli);
 108                 cli_shutdown(cli);
 109                 return result;
 110         }
 111
 112         /* Given things like SMB signing, restrict anonymous and the like,
 113            try an authenticated connection first */
 114         result = cli_session_setup(cli, user_name,
 115                                    old_passwd, strlen(old_passwd)+1,
 116                                    old_passwd, strlen(old_passwd)+1, "");
 117
 118         if (!NT_STATUS_IS_OK(result)) {
 119
 120                 /* Password must change or Password expired are the only valid
 121                  * error conditions here from where we can proceed, the rest like
 122                  * account locked out or logon failure will lead to errors later
 123                  * anyway */
 124
 125                 if (!NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) &&
 126                     !NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED)) {
 127                         if (asprintf(err_str, "Could not connect to machine %s: "
 128                                  "%s\n", remote_machine, cli_errstr(cli)) == -1) {
 129                                 *err_str = NULL;
 130                         }
 131                         cli_shutdown(cli);
 132                         return result;
 133                 }
 134
 135                 pass_must_change = True;
 136
 137                 /*
 138                  * We should connect as the anonymous user here, in case
 139                  * the server has "must change password" checked...
 140                  * Thanks to <Nicholas.S.Jenkins@cdc.com> for this fix.
 141                  */
 142
 143                 result = cli_session_setup(cli, "", "", 0, "", 0, "");
 144
 145                 if (!NT_STATUS_IS_OK(result)) {
 146                         if (asprintf(err_str, "machine %s rejected the session "
 147                                  "setup. Error was : %s.\n",
 148                                  remote_machine, cli_errstr(cli)) == -1) {
 149                                 *err_str = NULL;
 150                         }
 151                         cli_shutdown(cli);
 152                         return result;
 153                 }
 154
 155                 result = cli_init_creds(cli, "", "", NULL);
 156                 if (!NT_STATUS_IS_OK(result)) {
 157                         cli_shutdown(cli);
 158                         return result;
 159                 }
 160         } else {
 161                 result = cli_init_creds(cli, user, domain, old_passwd);
 162                 if (!NT_STATUS_IS_OK(result)) {
 163                         cli_shutdown(cli);
 164                         return result;
 165                 }
 166         }
 167
 168         result = cli_tcon_andx(cli, "IPC$", "IPC", "", 1);
 169         if (!NT_STATUS_IS_OK(result)) {
 170                 if (asprintf(err_str, "machine %s rejected the tconX on the "
 171                              "IPC$ share. Error was : %s.\n",
 172                              remote_machine, nt_errstr(result))) {
 173                         *err_str = NULL;
 174                 }
 175                 cli_shutdown(cli);
 176                 return result;
 177         }
 178
 179         /* Try not to give the password away too easily */
 180
 181         if (!pass_must_change) {
 182                 result = cli_rpc_pipe_open_ntlmssp(cli,
 183                                                    &ndr_table_samr.syntax_id,
 184                                                    NCACN_NP,
 185                                                    DCERPC_AUTH_LEVEL_PRIVACY,
 186                                                    domain, user,
 187                                                    old_passwd,
 188                                                    &pipe_hnd);
 189         } else {
 190                 /*
 191                  * If the user password must be changed the ntlmssp bind will
 192                  * fail the same way as the session setup above did. The
 193                  * difference ist that with a pipe bind we don't get a good
 194                  * error message, the result will be that the rpc call below
 195                  * will just fail. So we do it anonymously, there's no other
 196                  * way.
 197                  */
 198                 result = cli_rpc_pipe_open_noauth(
 199                         cli, &ndr_table_samr.syntax_id, &pipe_hnd);
 200         }
 201
 202         if (!NT_STATUS_IS_OK(result)) {
 203                 if (lp_client_lanman_auth()) {
 204                         /* Use the old RAP method. */
 205                         if (!cli_oem_change_password(cli, user_name, new_passwd, old_passwd)) {
 206                                 if (asprintf(err_str, "machine %s rejected the "
 207                                          "password change: Error was : %s.\n",
 208                                          remote_machine, cli_errstr(cli)) == -1) {
 209                                         *err_str = NULL;
 210                                 }
 211                                 result = cli_nt_error(cli);
 212                                 cli_shutdown(cli);
 213                                 return result;
 214                         }
 215                 } else {
 216                         if (asprintf(err_str, "SAMR connection to machine %s "
 217                                  "failed. Error was %s, but LANMAN password "
 218                                  "changes are disabled\n",
 219                                  remote_machine, nt_errstr(result)) == -1) {
 220                                 *err_str = NULL;
 221                         }
 222                         result = cli_nt_error(cli);
 223                         cli_shutdown(cli);
 224                         return result;
 225                 }
 226         }
 227
 228         result = rpccli_samr_chgpasswd_user2(pipe_hnd, talloc_tos(),
 229                                              user_name, new_passwd, old_passwd);
 230         if (NT_STATUS_IS_OK(result)) {
 231                 /* Great - it all worked! */
 232                 cli_shutdown(cli);
 233                 return NT_STATUS_OK;
 234
 235         } else if (!(NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)
 236                      || NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL))) {
 237                 /* it failed, but for reasons such as wrong password, too short etc ... */
 238
 239                 if (asprintf(err_str, "machine %s rejected the password change: "
 240                          "Error was : %s.\n",
 241                          remote_machine, get_friendly_nt_error_msg(result)) == -1) {
 242                         *err_str = NULL;
 243                 }
 244                 cli_shutdown(cli);
 245                 return result;
 246         }
 247
 248         /* OK, that failed, so try again... */
 249         TALLOC_FREE(pipe_hnd);
 250
 251         /* Try anonymous NTLMSSP... */
 252         result = cli_init_creds(cli, "", "", NULL);
 253         if (!NT_STATUS_IS_OK(result)) {
 254                 cli_shutdown(cli);
 255                 return result;
 256         }
 257
 258         result = NT_STATUS_UNSUCCESSFUL;
 259
 260         /* OK, this is ugly, but... try an anonymous pipe. */
 261         result = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
 262                                           &pipe_hnd);
 263
 264         if ( NT_STATUS_IS_OK(result) &&
 265                 (NT_STATUS_IS_OK(result = rpccli_samr_chgpasswd_user2(
 266                                          pipe_hnd, talloc_tos(), user_name,
 267                                          new_passwd, old_passwd)))) {
 268                 /* Great - it all worked! */
 269                 cli_shutdown(cli);
 270                 return NT_STATUS_OK;
 271         } else {
 272                 if (!(NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)
 273                       || NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL))) {
 274                         /* it failed, but again it was due to things like new password too short */
 275
 276                         if (asprintf(err_str, "machine %s rejected the "
 277                                  "(anonymous) password change: Error was : "
 278                                  "%s.\n", remote_machine,
 279                                  get_friendly_nt_error_msg(result)) == -1) {
 280                                 *err_str = NULL;
 281                         }
 282                         cli_shutdown(cli);
 283                         return result;
 284                 }
 285
 286                 /* We have failed to change the user's password, and we think the server
 287                    just might not support SAMR password changes, so fall back */
 288
 289                 if (lp_client_lanman_auth()) {
 290                         /* Use the old RAP method. */
 291                         if (cli_oem_change_password(cli, user_name, new_passwd, old_passwd)) {
 292                                 /* SAMR failed, but the old LanMan protocol worked! */
 293
 294                                 cli_shutdown(cli);
 295                                 return NT_STATUS_OK;
 296                         }
 297                         if (asprintf(err_str, "machine %s rejected the password "
 298                                  "change: Error was : %s.\n",
 299                                  remote_machine, cli_errstr(cli)) == -1) {
 300                                 *err_str = NULL;
 301                         }
 302                         result = cli_nt_error(cli);
 303                         cli_shutdown(cli);
 304                         return result;
 305                 } else {
 306                         if (asprintf(err_str, "SAMR connection to machine %s "
 307                                  "failed. Error was %s, but LANMAN password "
 308                                  "changes are disabled\n",
 309                                 nt_errstr(result), remote_machine) == -1) {
 310                                 *err_str = NULL;
 311                         }
 312                         cli_shutdown(cli);
 313                         return NT_STATUS_UNSUCCESSFUL;
 314                 }
 315         }
 316 }