source3/utils/smbpasswd.c

   1 /*
   2  * Unix SMB/Netbios implementation. Version 1.9. smbpasswd module. Copyright
   3  * (C) Jeremy Allison 1995-1998
   4  *
   5  * This program is free software; you can redistribute it and/or modify it under
   6  * the terms of the GNU General Public License as published by the Free
   7  * Software Foundation; either version 2 of the License, or (at your option)
   8  * any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful, but WITHOUT
  11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  13  * more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along with
  16  * this program; if not, write to the Free Software Foundation, Inc., 675
  17  * Mass Ave, Cambridge, MA 02139, USA.
  18  */
  19
  20 #include "includes.h"
  21
  22 extern pstring myhostname;
  23 extern pstring global_myname;
  24 extern int DEBUGLEVEL;
  25
  26
  27 /*********************************************************
  28 a strdup with exit
  29 **********************************************************/
  30 static char *xstrdup(char *s)
  31 {
  32         s = strdup(s);
  33         if (!s) {
  34                 fprintf(stderr,"out of memory\n");
  35                 exit(1);
  36         }
  37         return s;
  38 }
  39
  40
  41 /*********************************************************
  42  Print command usage on stderr and die.
  43 **********************************************************/
  44 static void usage(void)
  45 {
  46         if (getuid() == 0) {
  47                 printf("smbpasswd [options] [username] [password]\n");
  48         } else {
  49                 printf("smbpasswd [options] [password]\n");
  50         }
  51         printf("options:\n");
  52         printf("  -s                   use stdin for password prompt\n");
  53         printf("  -D LEVEL             debug level\n");
  54         printf("  -U USER              remote username\n");
  55         printf("  -r MACHINE           remote machine\n");
  56
  57         if (getuid() == 0) {
  58                 printf("  -R ORDER             name resolve order\n");
  59                 printf("  -j DOMAIN            join domain name\n");
  60                 printf("  -a                   add user\n");
  61                 printf("  -d                   disable user\n");
  62                 printf("  -e                   enable user\n");
  63                 printf("  -n                   set no password\n");
  64                 printf("  -m                   machine trust account\n");
  65         }
  66         exit(1);
  67 }
  68
  69 /*********************************************************
  70 Join a domain.
  71 **********************************************************/
  72 static int join_domain(char *domain, char *remote)
  73 {
  74         pstring remote_machine;
  75         fstring trust_passwd;
  76         unsigned char orig_trust_passwd_hash[16];
  77         BOOL ret;
  78
  79         pstrcpy(remote_machine, remote ? remote : "");
  80         fstrcpy(trust_passwd, global_myname);
  81         strlower(trust_passwd);
  82         E_md4hash( (uchar *)trust_passwd, orig_trust_passwd_hash);
  83
  84         /* Ensure that we are not trying to join a
  85            domain if we are locally set up as a domain
  86            controller. */
  87
  88         if(strequal(remote, global_myname)) {
  89                 fprintf(stderr, "Cannot join domain %s as the domain controller name is our own. We cannot be a domain controller for a domain and also be a domain member.\n", domain);
  90                 return 1;
  91         }
  92
  93         /*
  94          * Create the machine account password file.
  95          */
  96         if(!trust_password_lock( domain, global_myname, True)) {
  97                 fprintf(stderr, "unable to open the machine account password file for \
  98 machine %s in domain %s.\n", global_myname, domain);
  99                 return 1;
 100         }
 101
 102         /*
 103          * Write the old machine account password.
 104          */
 105
 106         if(!set_trust_account_password( orig_trust_passwd_hash)) {
 107                 fprintf(stderr, "unable to write the machine account password for \
 108 machine %s in domain %s.\n", global_myname, domain);
 109                 trust_password_unlock();
 110                 return 1;
 111         }
 112
 113         /*
 114          * If we are given a remote machine assume this is the PDC.
 115          */
 116
 117         if(remote == NULL) {
 118                 pstrcpy(remote_machine, lp_passwordserver());
 119         }
 120
 121         if(!*remote_machine) {
 122                 fprintf(stderr, "No password server list given in smb.conf - \
 123 unable to join domain.\n");
 124                 trust_password_unlock();
 125                 return 1;
 126         }
 127
 128         ret = change_trust_account_password( domain, remote_machine);
 129         trust_password_unlock();
 130
 131         if(!ret) {
 132                 trust_password_delete( domain, global_myname);
 133                 fprintf(stderr,"Unable to join domain %s.\n",domain);
 134         } else {
 135                 printf("Joined domain %s.\n",domain);
 136         }
 137
 138         return (int)ret;
 139 }
 140
 141
 142 static void set_line_buffering(FILE *f)
 143 {
 144         setvbuf(f, NULL, _IOLBF, 0);
 145 }
 146
 147 /*************************************************************
 148  Utility function to prompt for passwords from stdin. Each
 149  password entered must end with a newline.
 150 *************************************************************/
 151 static char *stdin_new_passwd(void)
 152 {
 153         static fstring new_passwd;
 154         size_t len;
 155
 156         ZERO_ARRAY(new_passwd);
 157
 158         /*
 159          * if no error is reported from fgets() and string at least contains
 160          * the newline that ends the password, then replace the newline with
 161          * a null terminator.
 162          */
 163         if ( fgets(new_passwd, sizeof(new_passwd), stdin) != NULL) {
 164                 if ((len = strlen(new_passwd)) > 0) {
 165                         if(new_passwd[len-1] == '\n')
 166                                 new_passwd[len - 1] = 0;
 167                 }
 168         }
 169         return(new_passwd);
 170 }
 171
 172
 173 /*************************************************************
 174  Utility function to get passwords via tty or stdin
 175  Used if the '-s' option is set to silently get passwords
 176  to enable scripting.
 177 *************************************************************/
 178 static char *get_pass( char *prompt, BOOL stdin_get)
 179 {
 180         char *p;
 181         if (stdin_get) {
 182                 p = stdin_new_passwd();
 183         } else {
 184                 p = getpass(prompt);
 185         }
 186         return xstrdup(p);
 187 }
 188
 189 /*************************************************************
 190  Utility function to prompt for new password.
 191 *************************************************************/
 192 static char *prompt_for_new_password(BOOL stdin_get)
 193 {
 194         char *p;
 195         fstring new_passwd;
 196
 197         ZERO_ARRAY(new_passwd);
 198
 199         p = get_pass("New SMB password:", stdin_get);
 200
 201         fstrcpy(new_passwd, p);
 202
 203         p = get_pass("Retype new SMB password:", stdin_get);
 204
 205         if (strcmp(p, new_passwd)) {
 206                 fprintf(stderr, "Mismatch - password unchanged.\n");
 207                 return NULL;
 208         }
 209
 210         return xstrdup(p);
 211 }
 212
 213
 214 /*************************************************************
 215 change a password either locally or remotely
 216 *************************************************************/
 217 static BOOL password_change(const char *remote_machine, char *user_name,
 218                             char *old_passwd, char *new_passwd,
 219                             BOOL add_user, BOOL enable_user,
 220                             BOOL disable_user, BOOL set_no_password,
 221                             BOOL trust_account)
 222 {
 223         BOOL ret;
 224         pstring err_str;
 225         pstring msg_str;
 226
 227         if (remote_machine != NULL) {
 228                 if (add_user || enable_user || disable_user || set_no_password || trust_account) {
 229                         /* these things can't be done remotely yet */
 230                         return False;
 231                 }
 232                 ret = remote_password_change(remote_machine, user_name,
 233                                                                          old_passwd, new_passwd, err_str, sizeof(err_str));
 234                 if(*err_str)
 235                         fprintf(stderr, err_str);
 236                 return ret;
 237         }
 238
 239         ret = local_password_change(user_name, trust_account, add_user, enable_user,
 240                                      disable_user, set_no_password, new_passwd,
 241                                      err_str, sizeof(err_str), msg_str, sizeof(msg_str));
 242
 243         if(*msg_str)
 244                 printf(msg_str);
 245         if(*err_str)
 246                 fprintf(stderr, err_str);
 247
 248         return ret;
 249 }
 250
 251
 252 /*************************************************************
 253 handle password changing for root
 254 *************************************************************/
 255 static int process_root(int argc, char *argv[])
 256 {
 257         struct passwd  *pwd;
 258         int ch;
 259         BOOL joining_domain = False;
 260         BOOL trust_account = False;
 261         BOOL add_user = False;
 262         BOOL disable_user = False;
 263         BOOL enable_user = False;
 264         BOOL set_no_password = False;
 265         BOOL stdin_passwd_get = False;
 266         char *user_name = NULL;
 267         char *new_domain = NULL;
 268         char *new_passwd = NULL;
 269         char *old_passwd = NULL;
 270         char *remote_machine = NULL;
 271
 272         while ((ch = getopt(argc, argv, "adehmnj:r:sR:D:U:")) != EOF) {
 273                 switch(ch) {
 274                 case 'a':
 275                         add_user = True;
 276                         break;
 277                 case 'd':
 278                         disable_user = True;
 279                         new_passwd = "XXXXXX";
 280                         break;
 281                 case 'e':
 282                         enable_user = True;
 283                         break;
 284                 case 'D':
 285                         DEBUGLEVEL = atoi(optarg);
 286                         break;
 287                 case 'n':
 288                         set_no_password = True;
 289                         new_passwd = "NO PASSWORD";
 290                 case 'r':
 291                         remote_machine = optarg;
 292                         break;
 293                 case 's':
 294                         set_line_buffering(stdin);
 295                         set_line_buffering(stdout);
 296                         set_line_buffering(stderr);
 297                         stdin_passwd_get = True;
 298                         break;
 299                 case 'R':
 300                         lp_set_name_resolve_order(optarg);
 301                         break;
 302                 case 'm':
 303                         trust_account = True;
 304                         break;
 305                 case 'j':
 306                         new_domain = optarg;
 307                         strupper(new_domain);
 308                         joining_domain = True;
 309                         break;
 310                 case 'U':
 311                         user_name = optarg;
 312                         break;
 313                 default:
 314                         usage();
 315                 }
 316         }
 317
 318         argc -= optind;
 319         argv += optind;
 320
 321
 322         /*
 323          * Ensure add_user and either remote machine or join domain are
 324          * not both set.
 325          */
 326         if(add_user && ((remote_machine != NULL) || joining_domain)) {
 327                 usage();
 328         }
 329
 330         if(joining_domain) {
 331                 if (argc != 0) usage();
 332                 return join_domain(new_domain, remote_machine);
 333         }
 334
 335         /*
 336          * Deal with root - can add a user, but only locally.
 337          */
 338
 339         switch(argc) {
 340         case 0:
 341                 break;
 342         case 1:
 343                 user_name = argv[0];
 344                 break;
 345         case 2:
 346                 user_name = argv[0];
 347                 new_passwd = argv[1];
 348                 break;
 349         default:
 350                 usage();
 351         }
 352
 353         if (!user_name && (pwd = getpwuid(0))) {
 354                 user_name = xstrdup(pwd->pw_name);
 355         }
 356
 357         if (!user_name) {
 358                 fprintf(stderr,"You must specify a username\n");
 359                 exit(1);
 360         }
 361
 362         if (!remote_machine && !Get_Pwnam(user_name, True)) {
 363                 fprintf(stderr, "User \"%s\" was not found in system password file.\n",
 364                         user_name);
 365                 exit(1);
 366         }
 367
 368         if (user_name[strlen(user_name)-1] == '$') {
 369                 user_name[strlen(user_name)-1] = 0;
 370         }
 371
 372         if (trust_account) {
 373                 /* add the $ automatically */
 374                 static fstring buf;
 375
 376                 if (add_user) {
 377                         new_passwd = xstrdup(user_name);
 378                         strlower(new_passwd);
 379                 }
 380
 381                 slprintf(buf, sizeof(buf)-1, "%s$", user_name);
 382                 user_name = buf;
 383         }
 384
 385         if (remote_machine != NULL) {
 386                 old_passwd = get_pass("Old SMB password:",stdin_passwd_get);
 387         }
 388
 389         if (!new_passwd) {
 390
 391                 /*
 392                  * If we are trying to enable a user, first we need to find out
 393                  * if they are using a modern version of the smbpasswd file that
 394                  * disables a user by just writing a flag into the file. If so
 395                  * then we can re-enable a user without prompting for a new
 396                  * password. If not (ie. they have a no stored password in the
 397                  * smbpasswd file) then we need to prompt for a new password.
 398                  */
 399
 400                 if(enable_user) {
 401                         struct smb_passwd *smb_pass = getsmbpwnam(user_name);
 402                         if((smb_pass != NULL) && (smb_pass->smb_passwd != NULL)) {
 403                                 new_passwd = "XXXX"; /* Don't care. */
 404                         }
 405                 }
 406
 407                 if(!new_passwd)
 408                         new_passwd = prompt_for_new_password(stdin_passwd_get);
 409         }
 410
 411         if (!password_change(remote_machine, user_name, old_passwd, new_passwd,
 412                              add_user, enable_user, disable_user, set_no_password,
 413                              trust_account)) {
 414                 fprintf(stderr,"Failed to change password entry for %s\n", user_name);
 415                 return 1;
 416         }
 417
 418         if(disable_user) {
 419                 printf("User %s disabled.\n", user_name);
 420         } else if(enable_user) {
 421                 printf("User %s enabled.\n", user_name);
 422         } else if (set_no_password) {
 423                 printf("User %s - set to no password.\n", user_name);
 424         } else {
 425                 printf("Password changed for user %s\n", user_name);
 426         }
 427         return 0;
 428 }
 429
 430
 431 /*************************************************************
 432 handle password changing for non-root
 433 *************************************************************/
 434 static int process_nonroot(int argc, char *argv[])
 435 {
 436         struct passwd  *pwd = NULL;
 437         int ch;
 438         BOOL stdin_passwd_get = False;
 439         char *old_passwd = NULL;
 440         char *remote_machine = NULL;
 441         char *user_name = NULL;
 442         char *new_passwd = NULL;
 443
 444         while ((ch = getopt(argc, argv, "hD:r:sU:")) != EOF) {
 445                 switch(ch) {
 446                 case 'D':
 447                         DEBUGLEVEL = atoi(optarg);
 448                         break;
 449                 case 'r':
 450                         remote_machine = optarg;
 451                         break;
 452                 case 's':
 453                         set_line_buffering(stdin);
 454                         set_line_buffering(stdout);
 455                         set_line_buffering(stderr);
 456                         stdin_passwd_get = True;
 457                         break;
 458                 case 'U':
 459                         user_name = optarg;
 460                         break;
 461                 default:
 462                         usage();
 463                 }
 464         }
 465
 466         argc -= optind;
 467         argv += optind;
 468
 469         if(argc > 1) {
 470                 usage();
 471         }
 472
 473         if (argc == 1) {
 474                 new_passwd = argv[0];
 475         }
 476
 477         if (!user_name) {
 478                 pwd = getpwuid(getuid());
 479                 if (pwd) {
 480                         user_name = xstrdup(pwd->pw_name);
 481                 } else {
 482                         fprintf(stderr,"you don't exist - go away\n");
 483                         exit(1);
 484                 }
 485         }
 486
 487         /*
 488          * A non-root user is always setting a password
 489          * via a remote machine (even if that machine is
 490          * localhost).
 491          */
 492         if (remote_machine == NULL) {
 493                 remote_machine = "127.0.0.1";
 494         }
 495
 496
 497         if (remote_machine != NULL) {
 498                 old_passwd = get_pass("Old SMB password:",stdin_passwd_get);
 499         }
 500
 501         if (!new_passwd) {
 502                 new_passwd = prompt_for_new_password(stdin_passwd_get);
 503         }
 504
 505         if (!new_passwd) {
 506                 printf("unable to get new password\n");
 507                 exit(0);
 508         }
 509
 510         if (!password_change(remote_machine, user_name, old_passwd, new_passwd,
 511                              False, False, False, False, False)) {
 512                 fprintf(stderr,"Failed to change password for %s\n", user_name);
 513                 return 1;
 514         }
 515
 516         printf("Password changed for user %s\n", user_name);
 517         return 0;
 518 }
 519
 520
 521
 522 /*********************************************************
 523  Start here.
 524 **********************************************************/
 525 int main(int argc, char **argv)
 526 {
 527         static pstring servicesf = CONFIGFILE;
 528
 529         TimeInit();
 530
 531         setup_logging("smbpasswd", True);
 532
 533         charset_initialise();
 534
 535         if(!initialize_password_db()) {
 536                 fprintf(stderr, "Can't setup password database vectors.\n");
 537                 exit(1);
 538         }
 539
 540         if (!lp_load(servicesf,True,False,False)) {
 541                 fprintf(stderr, "Can't load %s - run testparm to debug it\n",
 542                         servicesf);
 543                 exit(1);
 544         }
 545
 546         if(!get_myname(myhostname,NULL)) {
 547                 fprintf(stderr, "unable to get my hostname.\n");
 548                 exit(1);
 549         }
 550
 551         /*
 552          * Set the machine NETBIOS name if not already
 553          * set from the config file.
 554          */
 555
 556         if (!*global_myname) {
 557                 char *p;
 558                 fstrcpy(global_myname, myhostname);
 559                 p = strchr(global_myname, '.' );
 560                 if (p) *p = 0;
 561         }
 562         strupper(global_myname);
 563
 564         codepage_initialise(lp_client_code_page());
 565
 566         /* Check the effective uid - make sure we are not setuid */
 567         if ((geteuid() == (uid_t)0) && (getuid() != (uid_t)0)) {
 568                 fprintf(stderr, "smbpasswd must *NOT* be setuid root.\n");
 569                 exit(1);
 570         }
 571
 572         if (getuid() == 0) {
 573                 return process_root(argc, argv);
 574         }
 575
 576         return process_nonroot(argc, argv);
 577 }