source3/utils/smbpasswd.c

   1 /*
   2  * Unix SMB/Netbios implementation. Version 1.9. smbpasswd module. Copyright
   3  * (C) Jeremy Allison 1995-1998
   4  *
   5  * This program is free software; you can redistribute it and/or modify it under
   6  * the terms of the GNU General Public License as published by the Free
   7  * Software Foundation; either version 2 of the License, or (at your option)
   8  * any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful, but WITHOUT
  11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  13  * more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along with
  16  * this program; if not, write to the Free Software Foundation, Inc., 675
  17  * Mass Ave, Cambridge, MA 02139, USA.
  18  */
  19
  20 #include "includes.h"
  21
  22 extern pstring global_myname;
  23 extern int DEBUGLEVEL;
  24
  25 /*
  26  * Next two lines needed for SunOS and don't
  27  * hurt anything else...
  28  */
  29 extern char *optarg;
  30 extern int optind;
  31
  32 /*********************************************************
  33 a strdup with exit
  34 **********************************************************/
  35 static char *xstrdup(char *s)
  36 {
  37         s = strdup(s);
  38         if (!s) {
  39                 fprintf(stderr,"out of memory\n");
  40                 exit(1);
  41         }
  42         return s;
  43 }
  44
  45
  46 /*********************************************************
  47  Print command usage on stderr and die.
  48 **********************************************************/
  49 static void usage(void)
  50 {
  51         if (getuid() == 0) {
  52                 printf("smbpasswd [options] [username] [password]\n");
  53         } else {
  54                 printf("smbpasswd [options] [password]\n");
  55         }
  56         printf("options:\n");
  57         printf("  -s                   use stdin for password prompt\n");
  58         printf("  -D LEVEL             debug level\n");
  59         printf("  -U USER              remote username\n");
  60         printf("  -r MACHINE           remote machine\n");
  61
  62         if (getuid() == 0) {
  63                 printf("  -R ORDER             name resolve order\n");
  64                 printf("  -j DOMAIN            join domain name\n");
  65                 printf("  -a                   add user\n");
  66                 printf("  -x                   delete user\n");
  67                 printf("  -d                   disable user\n");
  68                 printf("  -e                   enable user\n");
  69                 printf("  -n                   set no password\n");
  70                 printf("  -m                   machine trust account\n");
  71         }
  72         exit(1);
  73 }
  74
  75 /*********************************************************
  76 Join a domain.
  77 **********************************************************/
  78 static int join_domain(char *domain, char *remote)
  79 {
  80         pstring remote_machine;
  81         fstring trust_passwd;
  82         unsigned char orig_trust_passwd_hash[16];
  83         BOOL ret;
  84
  85         pstrcpy(remote_machine, remote ? remote : "");
  86         fstrcpy(trust_passwd, global_myname);
  87         strlower(trust_passwd);
  88         E_md4hash( (uchar *)trust_passwd, orig_trust_passwd_hash);
  89
  90         /* Ensure that we are not trying to join a
  91            domain if we are locally set up as a domain
  92            controller. */
  93
  94         if(strequal(remote, global_myname)) {
  95                 fprintf(stderr, "Cannot join domain %s as the domain controller name is our own. We cannot be a domain controller for a domain and also be a domain member.\n", domain);
  96                 return 1;
  97         }
  98
  99         /*
 100          * Create the machine account password file.
 101          */
 102         if(!trust_password_lock( domain, global_myname, True)) {
 103                 fprintf(stderr, "Unable to open the machine account password file for \
 104 machine %s in domain %s.\n", global_myname, domain);
 105                 return 1;
 106         }
 107
 108         /*
 109          * Write the old machine account password.
 110          */
 111
 112         if(!set_trust_account_password( orig_trust_passwd_hash)) {
 113                 fprintf(stderr, "Unable to write the machine account password for \
 114 machine %s in domain %s.\n", global_myname, domain);
 115                 trust_password_unlock();
 116                 return 1;
 117         }
 118
 119         /*
 120          * If we are given a remote machine assume this is the PDC.
 121          */
 122
 123         if(remote == NULL) {
 124                 pstrcpy(remote_machine, lp_passwordserver());
 125         }
 126
 127         if(!*remote_machine) {
 128                 fprintf(stderr, "No password server list given in smb.conf - \
 129 unable to join domain.\n");
 130                 trust_password_unlock();
 131                 return 1;
 132         }
 133
 134         ret = change_trust_account_password( domain, remote_machine);
 135         trust_password_unlock();
 136
 137         if(!ret) {
 138                 trust_password_delete( domain, global_myname);
 139                 fprintf(stderr,"Unable to join domain %s.\n",domain);
 140         } else {
 141                 printf("Joined domain %s.\n",domain);
 142         }
 143
 144         return (int)ret;
 145 }
 146
 147
 148 static void set_line_buffering(FILE *f)
 149 {
 150         setvbuf(f, NULL, _IOLBF, 0);
 151 }
 152
 153 /*************************************************************
 154  Utility function to prompt for passwords from stdin. Each
 155  password entered must end with a newline.
 156 *************************************************************/
 157 static char *stdin_new_passwd(void)
 158 {
 159         static fstring new_passwd;
 160         size_t len;
 161
 162         ZERO_ARRAY(new_passwd);
 163
 164         /*
 165          * if no error is reported from fgets() and string at least contains
 166          * the newline that ends the password, then replace the newline with
 167          * a null terminator.
 168          */
 169         if ( fgets(new_passwd, sizeof(new_passwd), stdin) != NULL) {
 170                 if ((len = strlen(new_passwd)) > 0) {
 171                         if(new_passwd[len-1] == '\n')
 172                                 new_passwd[len - 1] = 0;
 173                 }
 174         }
 175         return(new_passwd);
 176 }
 177
 178
 179 /*************************************************************
 180  Utility function to get passwords via tty or stdin
 181  Used if the '-s' option is set to silently get passwords
 182  to enable scripting.
 183 *************************************************************/
 184 static char *get_pass( char *prompt, BOOL stdin_get)
 185 {
 186         char *p;
 187         if (stdin_get) {
 188                 p = stdin_new_passwd();
 189         } else {
 190                 p = getpass(prompt);
 191         }
 192         return xstrdup(p);
 193 }
 194
 195 /*************************************************************
 196  Utility function to prompt for new password.
 197 *************************************************************/
 198 static char *prompt_for_new_password(BOOL stdin_get)
 199 {
 200         char *p;
 201         fstring new_passwd;
 202
 203         ZERO_ARRAY(new_passwd);
 204
 205         p = get_pass("New SMB password:", stdin_get);
 206
 207         fstrcpy(new_passwd, p);
 208
 209         p = get_pass("Retype new SMB password:", stdin_get);
 210
 211         if (strcmp(p, new_passwd)) {
 212                 fprintf(stderr, "Mismatch - password unchanged.\n");
 213                 ZERO_ARRAY(new_passwd);
 214                 return NULL;
 215         }
 216
 217         return xstrdup(p);
 218 }
 219
 220
 221 /*************************************************************
 222  Change a password either locally or remotely.
 223 *************************************************************/
 224
 225 static BOOL password_change(const char *remote_machine, char *user_name,
 226                             char *old_passwd, char *new_passwd, int local_flags)
 227 {
 228         BOOL ret;
 229         pstring err_str;
 230         pstring msg_str;
 231
 232         if (remote_machine != NULL) {
 233                 if (local_flags & (LOCAL_ADD_USER|LOCAL_DELETE_USER|LOCAL_DISABLE_USER|LOCAL_ENABLE_USER|
 234                                                         LOCAL_TRUST_ACCOUNT|LOCAL_SET_NO_PASSWORD)) {
 235                         /* these things can't be done remotely yet */
 236                         return False;
 237                 }
 238                 ret = remote_password_change(remote_machine, user_name,
 239                                                                          old_passwd, new_passwd, err_str, sizeof(err_str));
 240                 if(*err_str)
 241                         fprintf(stderr, err_str);
 242                 return ret;
 243         }
 244
 245         ret = local_password_change(user_name, local_flags, new_passwd,
 246                                      err_str, sizeof(err_str), msg_str, sizeof(msg_str));
 247
 248         if(*msg_str)
 249                 printf(msg_str);
 250         if(*err_str)
 251                 fprintf(stderr, err_str);
 252
 253         return ret;
 254 }
 255
 256
 257 /*************************************************************
 258  Handle password changing for root.
 259 *************************************************************/
 260
 261 static int process_root(int argc, char *argv[])
 262 {
 263         struct passwd  *pwd;
 264         int ch;
 265         BOOL joining_domain = False;
 266         int local_flags = 0;
 267         BOOL stdin_passwd_get = False;
 268         char *user_name = NULL;
 269         char *new_domain = NULL;
 270         char *new_passwd = NULL;
 271         char *old_passwd = NULL;
 272         char *remote_machine = NULL;
 273
 274         while ((ch = getopt(argc, argv, "ax:d:e:mnj:r:sR:D:U:")) != EOF) {
 275                 switch(ch) {
 276                 case 'a':
 277                         local_flags |= LOCAL_ADD_USER;
 278                         break;
 279                 case 'x':
 280                         local_flags |= LOCAL_DELETE_USER;
 281                         user_name = optarg;
 282                         new_passwd = "XXXXXX";
 283                         break;
 284                 case 'd':
 285                         local_flags |= LOCAL_DISABLE_USER;
 286                         user_name = optarg;
 287                         new_passwd = "XXXXXX";
 288                         break;
 289                 case 'e':
 290                         local_flags |= LOCAL_ENABLE_USER;
 291                         user_name = optarg;
 292                         break;
 293                 case 'm':
 294                         local_flags |= LOCAL_TRUST_ACCOUNT;
 295                         break;
 296                 case 'n':
 297                         local_flags |= LOCAL_SET_NO_PASSWORD;
 298                         new_passwd = "NO PASSWORD";
 299                         break;
 300                 case 'j':
 301                         new_domain = optarg;
 302                         strupper(new_domain);
 303                         joining_domain = True;
 304                         break;
 305                 case 'r':
 306                         remote_machine = optarg;
 307                         break;
 308                 case 's':
 309                         set_line_buffering(stdin);
 310                         set_line_buffering(stdout);
 311                         set_line_buffering(stderr);
 312                         stdin_passwd_get = True;
 313                         break;
 314                 case 'R':
 315                         lp_set_name_resolve_order(optarg);
 316                         break;
 317                 case 'D':
 318                         DEBUGLEVEL = atoi(optarg);
 319                         break;
 320                 case 'U':
 321                         user_name = optarg;
 322                         break;
 323                 default:
 324                         usage();
 325                 }
 326         }
 327
 328         argc -= optind;
 329         argv += optind;
 330
 331         /*
 332          * Ensure add/delete user and either remote machine or join domain are
 333          * not both set.
 334          */
 335         if((local_flags & (LOCAL_ADD_USER|LOCAL_DELETE_USER)) && ((remote_machine != NULL) || joining_domain)) {
 336                 usage();
 337         }
 338
 339         if(joining_domain) {
 340                 if (argc != 0)
 341                         usage();
 342                 return join_domain(new_domain, remote_machine);
 343         }
 344
 345         /*
 346          * Deal with root - can add a user, but only locally.
 347          */
 348
 349         switch(argc) {
 350         case 0:
 351                 break;
 352         case 1:
 353                 user_name = argv[0];
 354                 break;
 355         case 2:
 356                 user_name = argv[0];
 357                 new_passwd = argv[1];
 358                 break;
 359         default:
 360                 usage();
 361         }
 362
 363         if (!user_name && (pwd = sys_getpwuid(0))) {
 364                 user_name = xstrdup(pwd->pw_name);
 365         }
 366
 367         if (!user_name) {
 368                 fprintf(stderr,"You must specify a username\n");
 369                 exit(1);
 370         }
 371
 372         if (local_flags & LOCAL_TRUST_ACCOUNT) {
 373                 /* add the $ automatically */
 374                 static fstring buf;
 375
 376                 /*
 377                  * Remove any trailing '$' before we
 378                  * generate the initial machine password.
 379                  */
 380
 381                 if (user_name[strlen(user_name)-1] == '$') {
 382                         user_name[strlen(user_name)-1] = 0;
 383                 }
 384
 385                 if (local_flags & LOCAL_ADD_USER) {
 386                         new_passwd = xstrdup(user_name);
 387                         strlower(new_passwd);
 388                 }
 389
 390                 /*
 391                  * Now ensure the username ends in '$' for
 392                  * the machine add.
 393                  */
 394
 395                 slprintf(buf, sizeof(buf)-1, "%s$", user_name);
 396                 user_name = buf;
 397         }
 398
 399         if (remote_machine != NULL) {
 400                 old_passwd = get_pass("Old SMB password:",stdin_passwd_get);
 401         }
 402
 403         if (!new_passwd) {
 404
 405                 /*
 406                  * If we are trying to enable a user, first we need to find out
 407                  * if they are using a modern version of the smbpasswd file that
 408                  * disables a user by just writing a flag into the file. If so
 409                  * then we can re-enable a user without prompting for a new
 410                  * password. If not (ie. they have a no stored password in the
 411                  * smbpasswd file) then we need to prompt for a new password.
 412                  */
 413
 414                 if(local_flags & LOCAL_ENABLE_USER) {
 415                         struct smb_passwd *smb_pass = getsmbpwnam(user_name);
 416                         if((smb_pass != NULL) && (smb_pass->smb_passwd != NULL)) {
 417                                 new_passwd = "XXXX"; /* Don't care. */
 418                         }
 419                 }
 420
 421                 if(!new_passwd)
 422                         new_passwd = prompt_for_new_password(stdin_passwd_get);
 423
 424                 if(!new_passwd) {
 425                         fprintf(stderr, "Unable to get new password.\n");
 426                         exit(1);
 427                 }
 428         }
 429
 430         if (!password_change(remote_machine, user_name, old_passwd, new_passwd, local_flags)) {
 431                 fprintf(stderr,"Failed to modify password entry for user %s\n", user_name);
 432                 return 1;
 433         }
 434
 435         if(!(local_flags & (LOCAL_ADD_USER|LOCAL_DISABLE_USER|LOCAL_ENABLE_USER|LOCAL_DELETE_USER|LOCAL_SET_NO_PASSWORD))) {
 436                 struct smb_passwd *smb_pass = getsmbpwnam(user_name);
 437                 printf("Password changed for user %s.", user_name );
 438                 if((smb_pass != NULL) && (smb_pass->acct_ctrl & ACB_DISABLED ))
 439                         printf(" User has disabled flag set.");
 440                 if((smb_pass != NULL) && (smb_pass->acct_ctrl & ACB_PWNOTREQ))
 441                         printf(" User has no password flag set.");
 442                 printf("\n");
 443         }
 444         return 0;
 445 }
 446
 447
 448 /*************************************************************
 449 handle password changing for non-root
 450 *************************************************************/
 451 static int process_nonroot(int argc, char *argv[])
 452 {
 453         struct passwd  *pwd = NULL;
 454         int ch;
 455         BOOL stdin_passwd_get = False;
 456         char *old_passwd = NULL;
 457         char *remote_machine = NULL;
 458         char *user_name = NULL;
 459         char *new_passwd = NULL;
 460
 461         while ((ch = getopt(argc, argv, "hD:r:sU:")) != EOF) {
 462                 switch(ch) {
 463                 case 'D':
 464                         DEBUGLEVEL = atoi(optarg);
 465                         break;
 466                 case 'r':
 467                         remote_machine = optarg;
 468                         break;
 469                 case 's':
 470                         set_line_buffering(stdin);
 471                         set_line_buffering(stdout);
 472                         set_line_buffering(stderr);
 473                         stdin_passwd_get = True;
 474                         break;
 475                 case 'U':
 476                         user_name = optarg;
 477                         break;
 478                 default:
 479                         usage();
 480                 }
 481         }
 482
 483         argc -= optind;
 484         argv += optind;
 485
 486         if(argc > 1) {
 487                 usage();
 488         }
 489
 490         if (argc == 1) {
 491                 new_passwd = argv[0];
 492         }
 493
 494         if (!user_name) {
 495                 pwd = sys_getpwuid(getuid());
 496                 if (pwd) {
 497                         user_name = xstrdup(pwd->pw_name);
 498                 } else {
 499                         fprintf(stderr,"you don't exist - go away\n");
 500                         exit(1);
 501                 }
 502         }
 503
 504         /*
 505          * A non-root user is always setting a password
 506          * via a remote machine (even if that machine is
 507          * localhost).
 508          */
 509         if (remote_machine == NULL) {
 510                 remote_machine = "127.0.0.1";
 511         }
 512
 513
 514         if (remote_machine != NULL) {
 515                 old_passwd = get_pass("Old SMB password:",stdin_passwd_get);
 516         }
 517
 518         if (!new_passwd) {
 519                 new_passwd = prompt_for_new_password(stdin_passwd_get);
 520         }
 521
 522         if (!new_passwd) {
 523                 fprintf(stderr, "Unable to get new password.\n");
 524                 exit(1);
 525         }
 526
 527         if (!password_change(remote_machine, user_name, old_passwd, new_passwd, 0)) {
 528                 fprintf(stderr,"Failed to change password for %s\n", user_name);
 529                 return 1;
 530         }
 531
 532         printf("Password changed for user %s\n", user_name);
 533         return 0;
 534 }
 535
 536
 537
 538 /*********************************************************
 539  Start here.
 540 **********************************************************/
 541 int main(int argc, char **argv)
 542 {
 543         static pstring servicesf = CONFIGFILE;
 544
 545 #if defined(HAVE_SET_AUTH_PARAMETERS)
 546         set_auth_parameters(argc, argv);
 547 #endif /* HAVE_SET_AUTH_PARAMETERS */
 548
 549         TimeInit();
 550
 551         setup_logging("smbpasswd", True);
 552
 553         charset_initialise();
 554
 555         if(!initialize_password_db()) {
 556                 fprintf(stderr, "Can't setup password database vectors.\n");
 557                 exit(1);
 558         }
 559
 560         if (!lp_load(servicesf,True,False,False)) {
 561                 fprintf(stderr, "Can't load %s - run testparm to debug it\n",
 562                         servicesf);
 563                 exit(1);
 564         }
 565
 566         /*
 567          * Set the machine NETBIOS name if not already
 568          * set from the config file.
 569          */
 570
 571         if (!*global_myname) {
 572                 char *p;
 573                 fstrcpy(global_myname, myhostname());
 574                 p = strchr(global_myname, '.' );
 575                 if (p) *p = 0;
 576         }
 577         strupper(global_myname);
 578
 579         codepage_initialise(lp_client_code_page());
 580
 581         load_interfaces();
 582
 583         /* Check the effective uid - make sure we are not setuid */
 584         if ((geteuid() == (uid_t)0) && (getuid() != (uid_t)0)) {
 585                 fprintf(stderr, "smbpasswd must *NOT* be setuid root.\n");
 586                 exit(1);
 587         }
 588
 589         if (getuid() == 0) {
 590                 return process_root(argc, argv);
 591         }
 592
 593         return process_nonroot(argc, argv);
 594 }