source3/smbd/auth_smbpasswd.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    Password and authentication handling
   5    Copyright (C) Andrew Tridgell              1992-2000
   6    Copyright (C) Luke Kenneth Casson Leighton 1996-2000
   7    Copyright (C) Andrew Bartlett              2001
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25
  26 extern int DEBUGLEVEL;
  27
  28 /****************************************************************************
  29 core of smb password checking routine.
  30 ****************************************************************************/
  31 static BOOL smb_pwd_check_ntlmv1(const uchar *password,
  32                                 const uchar *part_passwd,
  33                                 const uchar *c8,
  34                                 char user_sess_key[16])
  35 {
  36   /* Finish the encryption of part_passwd. */
  37   uchar p24[24];
  38
  39   if (part_passwd == NULL) {
  40           DEBUG(10,("No password set - DISALLOWING access\n"));
  41           /* No password set - always false ! */
  42           return False;
  43   }
  44
  45   SMBOWFencrypt(part_passwd, c8, p24);
  46         if (user_sess_key != NULL)
  47         {
  48                 SMBsesskeygen_ntv1(part_passwd, NULL, user_sess_key);
  49         }
  50
  51
  52
  53 #if DEBUG_PASSWORD
  54         DEBUG(100,("Part password (P16) was |"));
  55         dump_data(100, part_passwd, 16);
  56         DEBUG(100,("Password from client was |"));
  57         dump_data(100, password, 24);
  58         DEBUG(100,("Given challenge was |"));
  59         dump_data(100, c8, 8);
  60         DEBUG(100,("Value from encryption was |"));
  61         dump_data(100, p24, 24);
  62 #endif
  63   return (memcmp(p24, password, 24) == 0);
  64 }
  65
  66 /****************************************************************************
  67 core of smb password checking routine.
  68 ****************************************************************************/
  69 static BOOL smb_pwd_check_ntlmv2(const uchar *password, size_t pwd_len,
  70                                 uchar *part_passwd,
  71                                 uchar const *c8,
  72                                 const char *user, const char *domain,
  73                                 char user_sess_key[16])
  74 {
  75         /* Finish the encryption of part_passwd. */
  76         uchar kr[16];
  77         uchar resp[16];
  78
  79         if (part_passwd == NULL)
  80         {
  81                 DEBUG(10,("No password set - DISALLOWING access\n"));
  82                 /* No password set - always False */
  83                 return False;
  84         }
  85
  86         ntv2_owf_gen(part_passwd, user, domain, kr);
  87         SMBOWFencrypt_ntv2(kr, c8, 8, password+16, pwd_len-16, (char *)resp);
  88         if (user_sess_key != NULL)
  89         {
  90                 SMBsesskeygen_ntv2(kr, resp, user_sess_key);
  91         }
  92
  93 #if DEBUG_PASSWORD
  94         DEBUG(100,("Part password (P16) was |"));
  95         dump_data(100, part_passwd, 16);
  96         DEBUG(100,("Password from client was |"));
  97         dump_data(100, password, pwd_len);
  98         DEBUG(100,("Given challenge was |"));
  99         dump_data(100, c8, 8);
 100         DEBUG(100,("Value from encryption was |"));
 101         dump_data(100, resp, 16);
 102 #endif
 103
 104         return (memcmp(resp, password, 16) == 0);
 105 }
 106
 107
 108 /****************************************************************************
 109  Do a specific test for an smb password being correct, given a smb_password and
 110  the lanman and NT responses.
 111 ****************************************************************************/
 112 NTSTATUS sam_password_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *user_info, char user_sess_key[16])
 113 {
 114         uint8 *nt_pw, *lm_pw;
 115         uint16  acct_ctrl = pdb_get_acct_ctrl(sampass);
 116
 117         if (!user_info || !sampass)
 118                 return NT_STATUS_LOGON_FAILURE;
 119
 120         if (acct_ctrl & ACB_PWNOTREQ)
 121         {
 122                 if (lp_null_passwords())
 123                 {
 124                         DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", sampass->username));
 125                         return(NT_STATUS_OK);
 126                 }
 127                 else
 128                 {
 129                         DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", sampass->username));
 130                         return(NT_STATUS_LOGON_FAILURE);
 131                 }
 132         } else {
 133                 nt_pw = pdb_get_nt_passwd(sampass);
 134                 lm_pw = pdb_get_lanman_passwd(sampass);
 135
 136                 if (nt_pw != NULL && user_info->nt_resp.len > 0) {
 137                         if ((user_info->nt_resp.len > 24 )) {
 138                                 /* We have the NT MD4 hash challenge available - see if we can
 139                                    use it (ie. does it exist in the smbpasswd file).
 140                                 */
 141                                 DEBUG(4,("smb_password_ok: Checking NTLMv2 password\n"));
 142                                 if (smb_pwd_check_ntlmv2( user_info->nt_resp.buffer,
 143                                                            user_info->nt_resp.len,
 144                                                            nt_pw,
 145                                                            user_info->chal, user_info->smb_username.str,
 146                                                            user_info->requested_domain.str,
 147                                                            user_sess_key))
 148                                 {
 149                                         return NT_STATUS_OK;
 150                                 } else {
 151                                         DEBUG(4,("smb_password_ok: NTLMv2 password check failed\n"));
 152                                         return NT_STATUS_WRONG_PASSWORD;
 153                                 }
 154
 155                         } else if (lp_ntlm_auth() && (user_info->nt_resp.len == 24)) {
 156                                 /* We have the NT MD4 hash challenge available - see if we can
 157                                    use it (ie. does it exist in the smbpasswd file).
 158                                 */
 159                                 DEBUG(4,("smb_password_ok: Checking NT MD4 password\n"));
 160                                 if (smb_pwd_check_ntlmv1(user_info->nt_resp.buffer,
 161                                                           nt_pw, user_info->chal,
 162                                                           user_sess_key))
 163                                 {
 164                                         return NT_STATUS_OK;
 165                                 } else {
 166                                         DEBUG(4,("smb_password_ok: NT MD4 password check failed\n"));
 167                                         return NT_STATUS_WRONG_PASSWORD;
 168                                 }
 169                         } else {
 170                                 return NT_STATUS_LOGON_FAILURE;
 171                         }
 172                 } else if (lm_pw != NULL && user_info->lm_resp.len == 24) {
 173                         if (lp_lanman_auth()) {
 174                                 DEBUG(4,("smb_password_ok: Checking LM password\n"));
 175                                 if (smb_pwd_check_ntlmv1(user_info->lm_resp.buffer,
 176                                                          lm_pw, user_info->chal,
 177                                                          user_sess_key))
 178                                 {
 179                                         return NT_STATUS_OK;
 180                                 } else {
 181                                         DEBUG(4,("smb_password_ok: LM password check failed\n"));
 182                                         return NT_STATUS_WRONG_PASSWORD;
 183                                 }
 184                         }
 185                 }
 186         }
 187         /* Should not be reached */
 188         return NT_STATUS_LOGON_FAILURE;
 189 }
 190
 191 /****************************************************************************
 192  Do a specific test for a SAM_ACCOUNT being vaild for this connection
 193  (ie not disabled, expired and the like).
 194 ****************************************************************************/
 195 NTSTATUS sam_account_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *user_info)
 196 {
 197         uint16  acct_ctrl = pdb_get_acct_ctrl(sampass);
 198         char *workstation_list;
 199         time_t kickoff_time;
 200
 201         if (!user_info || !sampass)
 202                 return NT_STATUS_LOGON_FAILURE;
 203
 204         DEBUG(4,("smb_password_ok: Checking SMB password for user %s\n",sampass->username));
 205
 206         /* Quit if the account was disabled. */
 207         if (acct_ctrl & ACB_DISABLED) {
 208                 DEBUG(1,("Account for user '%s' was disabled.\n", sampass->username));
 209                 return NT_STATUS_ACCOUNT_DISABLED;
 210         }
 211
 212         /* Test account expire time */
 213
 214         kickoff_time = pdb_get_kickoff_time(sampass);
 215         if (kickoff_time != 0 && time(NULL) > kickoff_time) {
 216                 DEBUG(1,("Account for user '%s' has expried.\n", sampass->username));
 217                 DEBUG(3,("Account expired at '%ld' unix time.\n", (long)kickoff_time));
 218                 return NT_STATUS_ACCOUNT_EXPIRED;
 219         }
 220
 221         /* Test workstation. Workstation list is comma separated. */
 222
 223         workstation_list = strdup(pdb_get_workstations(sampass));
 224
 225         if (!workstation_list) return NT_STATUS_NO_MEMORY;
 226
 227         if (*workstation_list) {
 228                 BOOL invalid_ws = True;
 229                 char *s = workstation_list;
 230
 231                 fstring tok;
 232
 233                 while (next_token(&s, tok, ",", sizeof(tok))) {
 234                         DEBUG(10,("checking for workstation match %s and %s (len=%d)\n",
 235                                   tok, user_info->wksta_name.str, user_info->wksta_name.len));
 236                         if(strequal(tok, user_info->wksta_name.str)) {
 237                                 invalid_ws = False;
 238                                 break;
 239                         }
 240                 }
 241
 242                 SAFE_FREE(workstation_list);
 243                 if (invalid_ws)
 244                         return NT_STATUS_INVALID_WORKSTATION;
 245         } else {
 246                 SAFE_FREE(workstation_list);
 247         }
 248
 249
 250         {
 251                 time_t must_change_time = pdb_get_pass_must_change_time(sampass);
 252                 time_t last_set_time = pdb_get_pass_last_set_time(sampass);
 253
 254                 /* check for immediate expiry "must change at next logon" */
 255                 if (must_change_time == 0 && last_set_time != 0) {
 256                         DEBUG(1,("Account for user '%s' password must change!.\n", sampass->username));
 257                         return NT_STATUS_PASSWORD_MUST_CHANGE;
 258                 }
 259
 260                 /* check for expired password */
 261                 if (must_change_time < time(NULL) && must_change_time != 0) {
 262                         DEBUG(1,("Account for user '%s' password expired!.\n", sampass->username));
 263                         DEBUG(1,("Password expired at '%ld' unix time.\n", (long)must_change_time));
 264                         return NT_STATUS_PASSWORD_EXPIRED;
 265                 }
 266         }
 267
 268         if (acct_ctrl & ACB_DOMTRUST) {
 269                 DEBUG(2,("session_trust_account: Domain trust account %s denied by server\n", sampass->username));
 270                 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
 271         }
 272
 273         if (acct_ctrl & ACB_SVRTRUST) {
 274                 DEBUG(2,("session_trust_account: Server trust account %s denied by server\n", sampass->username));
 275                 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
 276         }
 277
 278         if (acct_ctrl & ACB_WSTRUST) {
 279                 DEBUG(4,("session_trust_account: Wksta trust account %s denied by server\n", sampass->username));
 280                 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
 281         }
 282
 283         return NT_STATUS_OK;
 284 }
 285
 286
 287 /****************************************************************************
 288 check if a username/password is OK assuming the password is a 24 byte
 289 SMB hash supplied in the user_info structure
 290 return an NT_STATUS constant.
 291 ****************************************************************************/
 292
 293 NTSTATUS check_smbpasswd_security(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info)
 294 {
 295         SAM_ACCOUNT *sampass=NULL;
 296         BOOL ret;
 297         NTSTATUS nt_status;
 298
 299         pdb_init_sam(&sampass);
 300
 301         /* get the account information */
 302
 303         become_root();
 304         ret = pdb_getsampwnam(sampass, user_info->unix_username.str);
 305         unbecome_root();
 306
 307         if (ret == False)
 308         {
 309                 DEBUG(1,("Couldn't find user '%s' in passdb file.\n", user_info->unix_username.str));
 310                 pdb_free_sam(&sampass);
 311                 return NT_STATUS_NO_SUCH_USER;
 312         }
 313
 314         nt_status = sam_password_ok(sampass, user_info, server_info->session_key);
 315
 316         if NT_STATUS_IS_OK(nt_status) {
 317                 nt_status = sam_account_ok(sampass, user_info);
 318         }
 319
 320         pdb_free_sam(&sampass);
 321         return nt_status;
 322 }
 323
 324
 325