2 Unix SMB/Netbios implementation.
4 Authentication utility functions
5 Copyright (C) Andrew Tridgell 1992-1998
6 Copyright (C) Andrew Bartlett 2001
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 /* Data to do lanman1/2 password challenge. */
26 static unsigned char saved_challenge[8];
27 static BOOL challenge_sent=False;
28 extern fstring remote_machine;
29 extern pstring global_myname;
31 /*******************************************************************
32 Get the next challenge value - no repeats.
33 ********************************************************************/
34 void generate_next_challenge(char *challenge)
38 generate_random_buffer(buf,8,False);
39 memcpy(saved_challenge, buf, 8);
40 memcpy(challenge,buf,8);
41 challenge_sent = True;
44 /*******************************************************************
45 set the last challenge sent, usually from a password server
46 ********************************************************************/
47 BOOL set_challenge(unsigned char *challenge)
49 memcpy(saved_challenge,challenge,8);
50 challenge_sent = True;
54 /*******************************************************************
55 get the last challenge sent
56 ********************************************************************/
57 BOOL last_challenge(unsigned char *challenge)
59 if (!challenge_sent) return(False);
60 memcpy(challenge,saved_challenge,8);
65 /****************************************************************************
66 Create a UNIX user on demand.
67 ****************************************************************************/
69 static int smb_create_user(const char *unix_user, const char *homedir)
74 pstrcpy(add_script, lp_adduser_script());
75 if (! *add_script) return -1;
76 all_string_sub(add_script, "%u", unix_user, sizeof(pstring));
78 all_string_sub(add_script, "%H", homedir, sizeof(pstring));
79 ret = smbrun(add_script,NULL);
80 DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
84 /****************************************************************************
85 Delete a UNIX user on demand.
86 ****************************************************************************/
88 static int smb_delete_user(char *unix_user)
93 pstrcpy(del_script, lp_deluser_script());
94 if (! *del_script) return -1;
95 all_string_sub(del_script, "%u", unix_user, sizeof(pstring));
96 ret = smbrun(del_script,NULL);
97 DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
101 /****************************************************************************
102 Add and Delete UNIX users on demand, based on NTSTATUS codes.
103 ****************************************************************************/
105 void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status)
107 struct passwd *pwd=NULL;
109 if (NT_STATUS_IS_OK(nt_status)) {
111 if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) {
114 * User validated ok against Domain controller.
115 * If the admin wants us to try and create a UNIX
116 * user on the fly, do so.
119 if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) {
120 smb_create_user(user_info->internal_username.str, NULL);
123 if(lp_adduser_script()) {
125 const char *home_dir = pdb_get_homedir(server_info->sam_account);
127 * Also call smb_create_user if the users home directory
128 * doesn't exist. Used with winbindd to allow the script to
129 * create the home directory for a user mapped with winbindd.
133 (sys_stat(home_dir, &st) == -1) && (errno == ENOENT)) {
134 smb_create_user(user_info->internal_username.str, home_dir);
138 } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) {
140 * User failed to validate ok against Domain controller.
141 * If the failure was "user doesn't exist" and admin
142 * wants us to try and delete that UNIX user on the fly,
145 if (lp_deluser_script()) {
146 smb_delete_user(user_info->internal_username.str);
151 /****************************************************************************
152 Create an auth_usersupplied_data structure
153 ****************************************************************************/
155 BOOL make_user_info(auth_usersupplied_info **user_info,
156 char *smb_name, char *internal_username,
157 char *client_domain, char *domain,
158 char *wksta_name, DATA_BLOB sec_blob,
159 DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
161 uint32 ntlmssp_flags, BOOL encrypted)
164 DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
166 *user_info = malloc(sizeof(**user_info));
168 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info)));
172 ZERO_STRUCTP(*user_info);
174 DEBUG(5,("makeing strings for %s's user_info struct\n", internal_username));
176 (*user_info)->smb_name.str = strdup(smb_name);
177 if ((*user_info)->smb_name.str) {
178 (*user_info)->smb_name.len = strlen(smb_name);
180 free_user_info(user_info);
184 (*user_info)->internal_username.str = strdup(internal_username);
185 if ((*user_info)->internal_username.str) {
186 (*user_info)->internal_username.len = strlen(internal_username);
188 free_user_info(user_info);
192 (*user_info)->domain.str = strdup(domain);
193 if ((*user_info)->domain.str) {
194 (*user_info)->domain.len = strlen(domain);
196 free_user_info(user_info);
200 (*user_info)->client_domain.str = strdup(client_domain);
201 if ((*user_info)->client_domain.str) {
202 (*user_info)->client_domain.len = strlen(client_domain);
204 free_user_info(user_info);
208 (*user_info)->wksta_name.str = strdup(wksta_name);
209 if ((*user_info)->wksta_name.str) {
210 (*user_info)->wksta_name.len = strlen(wksta_name);
212 free_user_info(user_info);
216 DEBUG(5,("makeing blobs for %s's user_info struct\n", internal_username));
218 (*user_info)->sec_blob = data_blob(sec_blob.data, sec_blob.length);
219 (*user_info)->lm_resp = data_blob(lm_pwd.data, lm_pwd.length);
220 (*user_info)->nt_resp = data_blob(nt_pwd.data, nt_pwd.length);
221 (*user_info)->plaintext_password = data_blob(plaintext.data, plaintext.length);
223 (*user_info)->encrypted = encrypted;
224 (*user_info)->ntlmssp_flags = ntlmssp_flags;
226 DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
231 /****************************************************************************
232 Create an auth_usersupplied_data structure after appropriate mapping.
233 ****************************************************************************/
235 BOOL make_user_info_map(auth_usersupplied_info **user_info,
238 char *wksta_name, DATA_BLOB sec_blob,
239 DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
241 uint32 ntlmssp_flags, BOOL encrypted)
244 fstring internal_username;
245 fstrcpy(internal_username, smb_name);
246 map_username(internal_username);
248 if (lp_allow_trusted_domains()) {
249 domain = client_domain;
251 domain = lp_workgroup();
254 return make_user_info(user_info,
255 smb_name, internal_username,
256 client_domain, domain,
257 wksta_name, sec_blob,
260 ntlmssp_flags, encrypted);
264 /****************************************************************************
265 Create an auth_usersupplied_data, making the DATA_BLOBs here.
266 Decrupt and encrypt the passwords.
267 ****************************************************************************/
269 BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
272 char *wksta_name, uchar chal[8],
273 uchar *lm_network_pwd, int lm_pwd_len,
274 uchar *nt_network_pwd, int nt_pwd_len)
277 DATA_BLOB sec_blob = data_blob(chal, sizeof(chal));
278 DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
279 DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
280 DATA_BLOB plaintext_blob = data_blob(NULL, 0);
281 uint32 ntlmssp_flags = 0;
284 ntlmssp_flags |= NTLMSSP_NEGOTIATE_OEM;
286 ntlmssp_flags |= NTLMSSP_NEGOTIATE_NTLM;
288 ret = make_user_info_map(user_info,
289 smb_name, client_domain,
290 wksta_name, sec_blob,
293 ntlmssp_flags, True);
295 data_blob_free(&lm_blob);
296 data_blob_free(&nt_blob);
300 /****************************************************************************
301 Create an auth_usersupplied_data, making the DATA_BLOBs here.
302 Decrupt and encrypt the passwords.
303 ****************************************************************************/
305 BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
309 uchar *lm_interactive_pwd, int lm_pwd_len,
310 uchar *nt_interactive_pwd, int nt_pwd_len,
315 unsigned char local_lm_response[24];
316 unsigned char local_nt_response[24];
317 unsigned char key[16];
319 uint32 ntlmssp_flags = 0;
321 generate_random_buffer(chal, 8, False);
324 memcpy(key, dc_sess_key, 8);
326 memcpy(lm_pwd, lm_interactive_pwd, 16);
327 memcpy(nt_pwd, nt_interactive_pwd, 16);
329 #ifdef DEBUG_PASSWORD
331 dump_data(100, (char *)key, 16);
333 DEBUG(100,("lm owf password:"));
334 dump_data(100, lm_pwd, 16);
336 DEBUG(100,("nt owf password:"));
337 dump_data(100, nt_pwd, 16);
340 SamOEMhash((uchar *)lm_pwd, key, 16);
341 SamOEMhash((uchar *)nt_pwd, key, 16);
343 #ifdef DEBUG_PASSWORD
344 DEBUG(100,("decrypt of lm owf password:"));
345 dump_data(100, lm_pwd, 16);
347 DEBUG(100,("decrypt of nt owf password:"));
348 dump_data(100, nt_pwd, 16);
351 generate_random_buffer(chal, 8, False);
352 SMBOWFencrypt((const unsigned char *)lm_pwd, chal, local_lm_response);
353 SMBOWFencrypt((const unsigned char *)nt_pwd, chal, local_nt_response);
355 /* Password info parinoia */
362 DATA_BLOB sec_blob = data_blob(chal, sizeof(chal));
363 DATA_BLOB local_lm_blob = data_blob(local_lm_response, sizeof(local_lm_response));
364 DATA_BLOB local_nt_blob = data_blob(local_nt_response, sizeof(local_nt_response));
365 DATA_BLOB plaintext_blob = data_blob(NULL, 0);
367 ntlmssp_flags = NTLMSSP_NEGOTIATE_OEM | NTLMSSP_NEGOTIATE_NTLM;
368 ret = make_user_info_map(user_info,
369 smb_name, client_domain,
370 wksta_name, sec_blob,
374 ntlmssp_flags, True);
376 data_blob_free(&local_lm_blob);
377 data_blob_free(&local_nt_blob);
382 /****************************************************************************
383 Create an auth_usersupplied_data structure
384 ****************************************************************************/
386 BOOL make_user_info_for_winbind(auth_usersupplied_info **user_info,
391 unsigned char local_lm_response[24];
392 unsigned char local_nt_response[24];
394 DATA_BLOB local_lm_blob;
395 DATA_BLOB local_nt_blob;
396 DATA_BLOB plaintext_blob;
397 uint32 ntlmssp_flags = 0;
400 * Not encrypted - do so.
403 DEBUG(5,("pass_check_smb: User passwords not in encrypted format.\n"));
405 generate_random_buffer(chal, 8, False);
408 SMBencrypt( (uchar *)password, chal, local_lm_response);
410 /* This encrypts the lm_pwd feild, which actualy contains the password
411 rather than the nt_pwd field becouse that contains nothing */
413 /* WATCH OUT. This doesn't work if the incoming password is incorrectly cased.
414 We might want to add a check here and only do an LM in that case */
416 SMBNTencrypt((uchar *)password, chal, local_nt_response);
418 local_lm_blob = data_blob(local_lm_response, sizeof(local_lm_response));
419 local_nt_blob = data_blob(local_nt_response, sizeof(local_nt_response));
420 plaintext_blob = data_blob(password, strlen(password)+1);
421 if ((!local_lm_blob.data) || (!local_nt_blob.data)|| (!plaintext_blob.data)) {
422 data_blob_free(&local_lm_blob);
423 data_blob_free(&local_nt_blob);
424 data_blob_clear_free(&plaintext_blob);
427 ntlmssp_flags = NTLMSSP_NEGOTIATE_OEM | NTLMSSP_NEGOTIATE_NTLM;
429 local_lm_blob = data_blob(NULL, 0);
430 local_nt_blob = data_blob(NULL, 0);
431 plaintext_blob = data_blob(NULL, 0);
436 DATA_BLOB sec_blob = data_blob(chal, sizeof(chal));
438 if (!sec_blob.data) {
442 ret = make_user_info(user_info,
445 global_myname, sec_blob,
449 ntlmssp_flags, False);
451 data_blob_free(&local_lm_blob);
452 data_blob_free(&local_nt_blob);
453 data_blob_clear_free(&plaintext_blob);
458 /****************************************************************************
459 Create an auth_usersupplied_data, making the DATA_BLOBs here.
460 Decrupt and encrypt the passwords.
461 ****************************************************************************/
463 BOOL make_user_info_winbind_crap(auth_usersupplied_info **user_info,
467 uchar *lm_network_pwd, int lm_pwd_len,
468 uchar *nt_network_pwd, int nt_pwd_len)
471 DATA_BLOB sec_blob = data_blob(chal, sizeof(chal));
472 DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
473 DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
474 DATA_BLOB plaintext_blob = data_blob(NULL, 0);
475 uint32 ntlmssp_flags = 0;
478 ntlmssp_flags |= NTLMSSP_NEGOTIATE_OEM;
480 ntlmssp_flags |= NTLMSSP_NEGOTIATE_NTLM;
482 ret = make_user_info(user_info,
484 client_domain, client_domain,
485 global_myname, sec_blob,
488 ntlmssp_flags, True);
490 data_blob_free(&lm_blob);
491 data_blob_free(&nt_blob);
495 /****************************************************************************
496 Create an auth_usersupplied_data structure
497 ****************************************************************************/
499 BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
502 DATA_BLOB lm_resp, DATA_BLOB nt_resp,
503 DATA_BLOB plaintext_password,
508 DATA_BLOB local_lm_blob;
509 DATA_BLOB local_nt_blob;
512 uint32 ntlmssp_flags = 0;
515 DATA_BLOB no_plaintext_blob = data_blob(NULL, 0);
516 if (!last_challenge(chal)) {
517 DEBUG(0,("Encrypted login but no challange set!\n"));
520 sec_blob = data_blob(chal, 8);
522 if (lm_resp.length == 24) {
523 ntlmssp_flags |= NTLMSSP_NEGOTIATE_OEM;
525 if (nt_resp.length == 0) {
526 } else if (nt_resp.length == 24) {
527 ntlmssp_flags |= NTLMSSP_NEGOTIATE_NTLM;
529 ntlmssp_flags |= NTLMSSP_NEGOTIATE_NTLM2;
532 return make_user_info_map(user_info, smb_name,
534 remote_machine, sec_blob,
538 ntlmssp_flags, encrypted);
541 generate_random_buffer(chal, 8, False);
543 sec_blob = data_blob(chal, 8);
546 * Not encrypted - do so.
549 DEBUG(5,("pass_check_smb: User passwords not in encrypted format.\n"));
551 if (plaintext_password.data) {
552 unsigned char local_lm_response[24];
554 SMBencrypt( (uchar *)plaintext_password.data, chal, local_lm_response);
555 local_lm_blob = data_blob(local_lm_response, 24);
557 /* We can't do an NT hash here, as the password needs to be case insensitive */
558 local_nt_blob = data_blob(NULL, 0);
560 ntlmssp_flags = NTLMSSP_NEGOTIATE_OEM;
562 local_lm_blob = data_blob(NULL, 0);
563 local_nt_blob = data_blob(NULL, 0);
566 ret = make_user_info_map(user_info, smb_name,
573 ntlmssp_flags, encrypted);
575 data_blob_free(&local_lm_blob);
579 BOOL make_server_info(auth_serversupplied_info **server_info)
581 *server_info = malloc(sizeof(**server_info));
583 DEBUG(0,("make_server_info_sam: malloc failed!\n"));
586 ZERO_STRUCTP(*server_info);
590 BOOL make_server_info_sam(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass)
592 if (!make_server_info(server_info)) {
596 (*server_info)->sam_fill_level = SAM_FILL_ALL;
597 (*server_info)->sam_account = sampass;
599 DEBUG(5,("make_server_info_sam: made sever info for user %s\n",
600 pdb_get_username((*server_info)->sam_account)));
604 BOOL make_server_info_pw(auth_serversupplied_info **server_info, struct passwd *pwd)
606 SAM_ACCOUNT *sampass = NULL;
607 if (!pdb_init_sam_pw(&sampass, pwd)) {
610 return make_server_info_sam(server_info, sampass);
613 void free_user_info(auth_usersupplied_info **user_info)
615 DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
616 if (*user_info != NULL) {
617 if ((*user_info)->smb_name.str) {
618 DEBUG(10,("structure was created for %s\n", (*user_info)->smb_name.str));
620 SAFE_FREE((*user_info)->smb_name.str);
621 SAFE_FREE((*user_info)->internal_username.str);
622 SAFE_FREE((*user_info)->client_domain.str);
623 SAFE_FREE((*user_info)->domain.str);
624 data_blob_free(&(*user_info)->sec_blob);
625 data_blob_free(&(*user_info)->lm_resp);
626 data_blob_free(&(*user_info)->nt_resp);
627 SAFE_FREE((*user_info)->interactive_password);
628 data_blob_clear_free(&(*user_info)->plaintext_password);
629 ZERO_STRUCT(**user_info);
631 SAFE_FREE(*user_info);
634 /***************************************************************************
635 Clear out a server_info struct that has been allocated
636 ***************************************************************************/
637 void free_server_info(auth_serversupplied_info **server_info)
639 if (*server_info != NULL) {
640 pdb_free_sam(&(*server_info)->sam_account);
642 /* call pam_end here, unless we know we are keeping it */
643 SAFE_FREE((*server_info)->group_rids);
645 ZERO_STRUCT(**server_info);
647 SAFE_FREE(*server_info);
650 /***************************************************************************
651 Make a server_info struct for a guest user
652 ***************************************************************************/
653 void make_server_info_guest(auth_serversupplied_info **server_info)
655 struct passwd *pass = sys_getpwnam(lp_guestaccount(-1));
658 make_server_info_pw(server_info, pass);