/*
- Unix SMB/Netbios implementation.
- Version 1.9.
+ Unix SMB/CIFS implementation.
Password checking
Copyright (C) Andrew Tridgell 1992-1998
#include "includes.h"
-extern int DEBUGLEVEL;
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_AUTH
/* these are kept here to keep the string_combinations function simple */
-static char this_user[100] = "";
-static char this_salt[100] = "";
-static char this_crypted[100] = "";
-
-
-#ifdef WITH_PAM
-/*******************************************************************
-check on PAM authentication
-********************************************************************/
-
-/* We first need some helper functions */
-#include <security/pam_appl.h>
-/* Static variables used to communicate between the conversation function
- * and the server_login function
- */
-static char *PAM_username;
-static char *PAM_password;
-
-/* PAM conversation function
- * Here we assume (for now, at least) that echo on means login name, and
- * echo off means password.
- */
-static int PAM_conv(int num_msg,
- const struct pam_message **msg,
- struct pam_response **resp, void *appdata_ptr)
-{
- int replies = 0;
- struct pam_response *reply = NULL;
-
-#define COPY_STRING(s) (s) ? strdup(s) : NULL
-
- reply = malloc(sizeof(struct pam_response) * num_msg);
- if (!reply)
- return PAM_CONV_ERR;
-
- for (replies = 0; replies < num_msg; replies++)
- {
- switch (msg[replies]->msg_style)
- {
- case PAM_PROMPT_ECHO_ON:
- reply[replies].resp_retcode = PAM_SUCCESS;
- reply[replies].resp =
- COPY_STRING(PAM_username);
- /* PAM frees resp */
- break;
- case PAM_PROMPT_ECHO_OFF:
- reply[replies].resp_retcode = PAM_SUCCESS;
- reply[replies].resp =
- COPY_STRING(PAM_password);
- /* PAM frees resp */
- break;
- case PAM_TEXT_INFO:
- /* fall through */
- case PAM_ERROR_MSG:
- /* ignore it... */
- reply[replies].resp_retcode = PAM_SUCCESS;
- reply[replies].resp = NULL;
- break;
- default:
- /* Must be an error of some sort... */
- free(reply);
- return PAM_CONV_ERR;
- }
- }
- if (reply)
- *resp = reply;
- return PAM_SUCCESS;
-}
-static struct pam_conv PAM_conversation = {
- &PAM_conv,
- NULL
-};
-
-
-static BOOL pam_auth(char *user, char *password)
-{
- pam_handle_t *pamh;
- int pam_error;
-
- /* Now use PAM to do authentication. For now, we won't worry about
- * session logging, only authentication. Bail out if there are any
- * errors. Since this is a limited protocol, and an even more limited
- * function within a server speaking this protocol, we can't be as
- * verbose as would otherwise make sense.
- * Query: should we be using PAM_SILENT to shut PAM up?
- */
-#define PAM_BAIL if (pam_error != PAM_SUCCESS) { \
- pam_end(pamh, 0); return False; \
- }
- PAM_password = password;
- PAM_username = user;
- pam_error = pam_start("samba", user, &PAM_conversation, &pamh);
- PAM_BAIL;
-/* Setting PAM_SILENT stops generation of error messages to syslog
- * to enable debugging on Red Hat Linux set:
- * /etc/pam.d/samba:
- * auth required /lib/security/pam_pwdb.so nullok shadow audit
- * _OR_ change PAM_SILENT to 0 to force detailed reporting (logging)
- */
- pam_error = pam_authenticate(pamh, PAM_SILENT);
- PAM_BAIL;
- /* It is not clear to me that account management is the right thing
- * to do, but it is not clear that it isn't, either. This can be
- * removed if no account management should be done. Alternately,
- * put a pam_allow.so entry in /etc/pam.conf for account handling. */
- pam_error = pam_acct_mgmt(pamh, PAM_SILENT);
- PAM_BAIL;
- pam_end(pamh, PAM_SUCCESS);
- /* If this point is reached, the user has been authenticated. */
- return (True);
-}
+static fstring this_user;
+#if !defined(WITH_PAM)
+static fstring this_salt;
+static fstring this_crypted;
#endif
-
#ifdef WITH_AFS
#include <afs/stds.h>
}
/*
- * NB. I'd like to change these to call something like become_user()
+ * NB. I'd like to change these to call something like change_to_user()
* instead but currently we don't have a connection
* context to become the correct user. This is already
* fairly platform specific code however, so I think
egid = getegid();
- if (set_effective_gid(pw->pw_gid) != 0)
- {
- DEBUG(0, ("Can't set egid to %d (%s)\n",
- pw->pw_gid, strerror(errno)));
- return False;
- }
-
- if (set_effective_uid(pw->pw_uid) != 0)
- {
- set_effective_gid(egid);
- DEBUG(0, ("Can't set euid to %d (%s)\n",
- pw->pw_uid, strerror(errno)));
- return False;
- }
+ set_effective_gid(pw->pw_gid);
+ set_effective_uid(pw->pw_uid);
if (sec_login_setup_identity((unsigned char *)user,
sec_login_no_flags,
}
DEBUG(0, ("DCE login succeeded for principal %s on pid %d\n",
- user, getpid()));
+ user, sys_getpid()));
DEBUG(3, ("DCE principal: %s\n"
" uid: %d\n"
dce_error_inq_text(err, dce_errstr, &err2);
DEBUG(0,
("DCE purge login context failed for server instance %d: %s\n",
- getpid(), dce_errstr));
+ sys_getpid(), dce_errstr));
}
}
#endif
-#ifdef KRB5_AUTH
-
-#include <krb5.h>
-
-/*******************************************************************
-check on Kerberos authentication
-********************************************************************/
-static BOOL krb5_auth(char *user, char *password)
-{
- krb5_data tgtname = {
- 0,
- KRB5_TGS_NAME_SIZE,
- KRB5_TGS_NAME
- };
- krb5_context kcontext;
- krb5_principal kprinc;
- krb5_principal server;
- krb5_creds kcreds;
- int options = 0;
- krb5_address **addrs = (krb5_address **) 0;
- krb5_preauthtype *preauth = NULL;
- krb5_keytab keytab = NULL;
- krb5_timestamp now;
- krb5_ccache ccache = NULL;
- int retval;
- char *name;
-
- if (retval = krb5_init_context(&kcontext))
- {
- return (False);
- }
-
- if (retval = krb5_timeofday(kcontext, &now))
- {
- return (False);
- }
-
- if (retval = krb5_cc_default(kcontext, &ccache))
- {
- return (False);
- }
-
- if (retval = krb5_parse_name(kcontext, user, &kprinc))
- {
- return (False);
- }
-
- ZERO_STRUCT(kcreds);
-
- kcreds.client = kprinc;
-
- if ((retval = krb5_build_principal_ext(kcontext, &server,
- krb5_princ_realm(kcontext,
- kprinc)->
- length,
- krb5_princ_realm(kcontext,
- kprinc)->data,
- tgtname.length, tgtname.data,
- krb5_princ_realm(kcontext,
- kprinc)->
- length,
- krb5_princ_realm(kcontext,
- kprinc)->data,
- 0)))
- {
- return (False);
- }
-
- kcreds.server = server;
-
- retval = krb5_get_in_tkt_with_password(kcontext,
- options,
- addrs,
- NULL,
- preauth,
- password, 0, &kcreds, 0);
-
- if (retval)
- {
- return (False);
- }
-
- return (True);
-}
-#endif /* KRB5_AUTH */
-
-#ifdef KRB4_AUTH
-#include <krb.h>
-
-/*******************************************************************
-check on Kerberos authentication
-********************************************************************/
-static BOOL krb4_auth(char *user, char *password)
-{
- char realm[REALM_SZ];
- char tkfile[MAXPATHLEN];
-
- if (krb_get_lrealm(realm, 1) != KSUCCESS)
- {
- (void)safe_strcpy(realm, KRB_REALM, sizeof(realm) - 1);
- }
-
- (void)slprintf(tkfile, sizeof(tkfile) - 1, "/tmp/samba_tkt_%d",
- (int)getpid());
-
- krb_set_tkt_string(tkfile);
- if (krb_verify_user(user, "", realm, password, 0, "rmcd") == KSUCCESS)
- {
- unlink(tkfile);
- return 1;
- }
- unlink(tkfile);
- return 0;
-}
-#endif /* KRB4_AUTH */
-
#ifdef LINUX_BIGCRYPT
/****************************************************************************
an enhanced crypt for Linux to handle password longer than 8 characters
StrnCpy(salt, salt1, 2);
crypted += 2;
- for (i = strlen(password); i > 0; i -= LINUX_PASSWORD_SEG_CHARS)
- {
+ for (i = strlen(password); i > 0; i -= LINUX_PASSWORD_SEG_CHARS) {
char *p = crypt(password, salt) + 2;
if (strncmp(p, crypted, LINUX_PASSWORD_SEG_CHARS) != 0)
return (0);
int i;
int parts = strlen(password) / AUTH_CLEARTEXT_SEG_CHARS;
if (strlen(password) % AUTH_CLEARTEXT_SEG_CHARS)
- {
parts++;
- }
StrnCpy(salt, salt1, 2);
StrnCpy(result, salt1, 2);
result[2] = '\0';
- for (i = 0; i < parts; i++)
- {
+ for (i = 0; i < parts; i++) {
p1 = crypt(p2, salt);
strncat(result, p1 + 2,
AUTH_MAX_PASSWD_LENGTH - strlen(p1 + 2) - 1);
offset is the first char to try and change (start with 0)
it assumes the string starts lowercased
****************************************************************************/
-static BOOL string_combinations2(char *s, int offset, BOOL (*fn) (char *),
+static NTSTATUS string_combinations2(char *s, int offset, NTSTATUS (*fn) (const char *),
int N)
{
int len = strlen(s);
int i;
+ NTSTATUS nt_status;
#ifdef PASSWORD_LENGTH
len = MIN(len, PASSWORD_LENGTH);
#endif
if (N <= 0 || offset >= len)
- {
return (fn(s));
- }
- for (i = offset; i < (len - (N - 1)); i++)
- {
+ for (i = offset; i < (len - (N - 1)); i++) {
char c = s[i];
if (!islower(c))
continue;
s[i] = toupper(c);
- if (string_combinations2(s, i + 1, fn, N - 1))
- return (True);
+ if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, i + 1, fn, N - 1),NT_STATUS_WRONG_PASSWORD)) {
+ return (nt_status);
+ }
s[i] = c;
}
- return (False);
+ return (NT_STATUS_WRONG_PASSWORD);
}
/****************************************************************************
offset is the first char to try and change (start with 0)
it assumes the string starts lowercased
****************************************************************************/
-static BOOL string_combinations(char *s, BOOL (*fn) (char *), int N)
+static NTSTATUS string_combinations(char *s, NTSTATUS (*fn) (const char *), int N)
{
int n;
+ NTSTATUS nt_status;
for (n = 1; n <= N; n++)
- if (string_combinations2(s, 0, fn, n))
- return (True);
- return (False);
+ if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, 0, fn, n), NT_STATUS_WRONG_PASSWORD))
+ return nt_status;
+ return NT_STATUS_WRONG_PASSWORD;
}
/****************************************************************************
core of password checking routine
****************************************************************************/
-static BOOL password_check(char *password)
+static NTSTATUS password_check(const char *password)
{
-
#ifdef WITH_PAM
- /* This falls through if the password check fails
- - if HAVE_CRYPT is not defined this causes an error msg
- saying Warning - no crypt available
- - if HAVE_CRYPT is defined this is a potential security hole
- as it may authenticate via the crypt call when PAM
- settings say it should fail.
- if (pam_auth(user,password)) return(True);
- Hence we make a direct return to avoid a second chance!!!
- */
- return (pam_auth(this_user, password));
-#endif /* WITH_PAM */
+ return smb_pam_passcheck(this_user, password);
+#else
+
+ BOOL ret;
#ifdef WITH_AFS
if (afs_auth(this_user, password))
- return (True);
+ return NT_STATUS_OK;
#endif /* WITH_AFS */
#ifdef WITH_DFS
if (dfs_auth(this_user, password))
- return (True);
+ return NT_STATUS_OK;
#endif /* WITH_DFS */
-#ifdef KRB5_AUTH
- if (krb5_auth(this_user, password))
- return (True);
-#endif /* KRB5_AUTH */
-
-#ifdef KRB4_AUTH
- if (krb4_auth(this_user, password))
- return (True);
-#endif /* KRB4_AUTH */
-
#ifdef OSF1_ENH_SEC
- {
- BOOL ret =
- (strcmp
- (osf1_bigcrypt(password, this_salt),
- this_crypted) == 0);
- if (!ret)
- {
- DEBUG(2,
- ("OSF1_ENH_SEC failed. Trying normal crypt.\n"));
- ret =
- (strcmp
- ((char *)crypt(password, this_salt),
- this_crypted) == 0);
- }
- return ret;
- }
+
+ ret = (strcmp(osf1_bigcrypt(password, this_salt),
+ this_crypted) == 0);
+ if (!ret) {
+ DEBUG(2,
+ ("OSF1_ENH_SEC failed. Trying normal crypt.\n"));
+ ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+ }
+ if (ret) {
+ return NT_STATUS_OK;
+ } else {
+ return NT_STATUS_WRONG_PASSWORD;
+ }
+
#endif /* OSF1_ENH_SEC */
-
+
#ifdef ULTRIX_AUTH
- return (strcmp((char *)crypt16(password, this_salt), this_crypted) ==
- 0);
+ ret = (strcmp((char *)crypt16(password, this_salt), this_crypted) == 0);
+ if (ret) {
+ return NT_STATUS_OK;
+ } else {
+ return NT_STATUS_WRONG_PASSWORD;
+ }
+
#endif /* ULTRIX_AUTH */
-
+
#ifdef LINUX_BIGCRYPT
- return (linux_bigcrypt(password, this_salt, this_crypted));
+ ret = (linux_bigcrypt(password, this_salt, this_crypted));
+ if (ret) {
+ return NT_STATUS_OK;
+ } else {
+ return NT_STATUS_WRONG_PASSWORD;
+ }
#endif /* LINUX_BIGCRYPT */
-
+
#if defined(HAVE_BIGCRYPT) && defined(HAVE_CRYPT) && defined(USE_BOTH_CRYPT_CALLS)
-
+
/*
* Some systems have bigcrypt in the C library but might not
* actually use it for the password hashes (HPUX 10.20) is
*/
if (strcmp(bigcrypt(password, this_salt), this_crypted) == 0)
- return True;
+ return NT_STATUS_OK;
else
- return (strcmp
- ((char *)crypt(password, this_salt),
- this_crypted) == 0);
+ ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+ if (ret) {
+ return NT_STATUS_OK;
+ } else {
+ return NT_STATUS_WRONG_PASSWORD;
+ }
#else /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
-
+
#ifdef HAVE_BIGCRYPT
- return (strcmp(bigcrypt(password, this_salt), this_crypted) == 0);
+ ret = (strcmp(bigcrypt(password, this_salt), this_crypted) == 0);
+ if (ret) {
+ return NT_STATUS_OK;
+ } else {
+ return NT_STATUS_WRONG_PASSWORD;
+ }
#endif /* HAVE_BIGCRYPT */
-
+
#ifndef HAVE_CRYPT
DEBUG(1, ("Warning - no crypt available\n"));
- return (False);
+ return NT_STATUS_LOGON_FAILURE;
#else /* HAVE_CRYPT */
- return (strcmp((char *)crypt(password, this_salt), this_crypted) ==
- 0);
+ ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+ if (ret) {
+ return NT_STATUS_OK;
+ } else {
+ return NT_STATUS_WRONG_PASSWORD;
+ }
#endif /* HAVE_CRYPT */
#endif /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
+#endif /* WITH_PAM */
}
/****************************************************************************
-check if a username/password is OK
+CHECK if a username/password is OK
the function pointer fn() points to a function to call when a successful
match is found and is used to update the encrypted password file
-return True on correct match, False otherwise
+return NT_STATUS_OK on correct match, appropriate error otherwise
****************************************************************************/
-BOOL pass_check(char *user, char *password, int pwlen, struct passwd *pwd,
- BOOL (*fn) (char *, char *))
+
+NTSTATUS pass_check(const struct passwd *pass, const char *user, const char *password,
+ int pwlen, BOOL (*fn) (const char *, const char *), BOOL run_cracker)
{
pstring pass2;
int level = lp_passwordlevel();
- struct passwd *pass;
- if (password)
- password[pwlen] = 0;
+ NTSTATUS nt_status;
#if DEBUG_PASSWORD
DEBUG(100, ("checking user=[%s] pass=[%s]\n", user, password));
#endif
if (!password)
- {
- return (False);
- }
+ return NT_STATUS_LOGON_FAILURE;
if (((!*password) || (!pwlen)) && !lp_null_passwords())
- {
- return (False);
- }
+ return NT_STATUS_LOGON_FAILURE;
- if (pwd && !user)
- {
- pass = (struct passwd *)pwd;
- user = pass->pw_name;
- }
- else
- {
- pass = Get_Pwnam(user, True);
- }
+#if defined(WITH_PAM)
+ /*
+ * If we're using PAM we want to short-circuit all the
+ * checks below and dive straight into the PAM code.
+ */
- DEBUG(4, ("Checking password for user %s (l=%d)\n", user, pwlen));
+ fstrcpy(this_user, user);
- if (!pass)
- {
+ DEBUG(4, ("pass_check: Checking (PAM) password for user %s (l=%d)\n", user, pwlen));
+
+#else /* Not using PAM */
+
+ DEBUG(4, ("pass_check: Checking password for user %s (l=%d)\n", user, pwlen));
+
+ if (!pass) {
DEBUG(3, ("Couldn't find user %s\n", user));
- return (False);
+ return NT_STATUS_NO_SUCH_USER;
}
+
+ /* Copy into global for the convenience of looping code */
+ /* Also the place to keep the 'password' no matter what
+ crazy struct it started in... */
+ fstrcpy(this_crypted, pass->pw_passwd);
+ fstrcpy(this_salt, pass->pw_passwd);
+
#ifdef HAVE_GETSPNAM
{
struct spwd *spass;
perhaps for IPC password changing requests */
spass = getspnam(pass->pw_name);
- if (spass && spass->sp_pwdp)
- {
- pstrcpy(pass->pw_passwd, spass->sp_pwdp);
+ if (spass && spass->sp_pwdp) {
+ fstrcpy(this_crypted, spass->sp_pwdp);
+ fstrcpy(this_salt, spass->sp_pwdp);
}
}
#elif defined(IA_UINFO)
2.1. (tangent@cyberport.com) */
uinfo_t uinfo;
if (ia_openinfo(pass->pw_name, &uinfo) != -1)
- {
ia_get_logpwd(uinfo, &(pass->pw_passwd));
- }
}
#endif
{
struct pr_passwd *pr_pw = getprpwnam(pass->pw_name);
if (pr_pw && pr_pw->ufld.fd_encrypt)
- pstrcpy(pass->pw_passwd, pr_pw->ufld.fd_encrypt);
+ fstrcpy(this_crypted, pr_pw->ufld.fd_encrypt);
+ }
+#endif
+
+#ifdef HAVE_GETPWANAM
+ {
+ struct passwd_adjunct *pwret;
+ pwret = getpwanam(s);
+ if (pwret && pwret->pwa_passwd)
+ fstrcpy(this_crypted, pwret->pwa_passwd);
}
#endif
DEBUG(5, ("Checking password for user %s in OSF1_ENH_SEC\n",
user));
mypasswd = getprpwnam(user);
- if (mypasswd)
- {
- fstrcpy(pass->pw_name, mypasswd->ufld.fd_name);
- fstrcpy(pass->pw_passwd, mypasswd->ufld.fd_encrypt);
- }
- else
- {
+ if (mypasswd) {
+ fstrcpy(this_user, mypasswd->ufld.fd_name);
+ fstrcpy(this_crypted, mypasswd->ufld.fd_encrypt);
+ } else {
DEBUG(5,
("OSF1_ENH_SEC: No entry for user %s in protected database !\n",
user));
#ifdef ULTRIX_AUTH
{
AUTHORIZATION *ap = getauthuid(pass->pw_uid);
- if (ap)
- {
- fstrcpy(pass->pw_passwd, ap->a_password);
+ if (ap) {
+ fstrcpy(this_crypted, ap->a_password);
endauthent();
}
}
#endif
- /* extract relevant info */
- fstrcpy(this_user, pass->pw_name);
- fstrcpy(this_salt, pass->pw_passwd);
-
#if defined(HAVE_TRUNCATED_SALT)
/* crypt on some platforms (HPUX in particular)
won't work with more than 2 salt characters. */
this_salt[2] = 0;
#endif
- fstrcpy(this_crypted, pass->pw_passwd);
-
- if (!*this_crypted)
- {
- if (!lp_null_passwords())
- {
+ if (!*this_crypted) {
+ if (!lp_null_passwords()) {
DEBUG(2, ("Disallowing %s with null password\n",
this_user));
- return (False);
+ return NT_STATUS_LOGON_FAILURE;
}
- if (!*password)
- {
+ if (!*password) {
DEBUG(3,
("Allowing access to %s with null password\n",
this_user));
- return (True);
+ return NT_STATUS_OK;
}
}
+#endif /* defined(WITH_PAM) */
+
/* try it as it came to us */
- if (password_check(password))
- {
- if (fn)
- fn(user, password);
- return (True);
+ nt_status = password_check(password);
+ if NT_STATUS_IS_OK(nt_status) {
+ if (fn) {
+ fn(user, password);
+ }
+ return (nt_status);
+ } else if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
+ /* No point continuing if its not the password thats to blame (ie PAM disabled). */
+ return (nt_status);
+ }
+
+ if (!run_cracker) {
+ return (nt_status);
}
/* if the password was given to us with mixed case then we don't
- need to proceed as we know it hasn't been case modified by the
- client */
- if (strhasupper(password) && strhaslower(password))
- {
- return (False);
+ * need to proceed as we know it hasn't been case modified by the
+ * client */
+ if (strhasupper(password) && strhaslower(password)) {
+ return nt_status;
}
/* make a copy of it */
- StrnCpy(pass2, password, sizeof(pstring) - 1);
-
- /* try all lowercase */
- strlower(password);
- if (password_check(password))
- {
- if (fn)
- fn(user, password);
- return (True);
+ pstrcpy(pass2, password);
+
+ /* try all lowercase if it's currently all uppercase */
+ if (strhasupper(pass2)) {
+ strlower(pass2);
+ if NT_STATUS_IS_OK(nt_status = password_check(pass2)) {
+ if (fn)
+ fn(user, pass2);
+ return (nt_status);
+ }
}
/* give up? */
- if (level < 1)
- {
-
- /* restore it */
- fstrcpy(password, pass2);
-
- return (False);
+ if (level < 1) {
+ return NT_STATUS_WRONG_PASSWORD;
}
/* last chance - all combinations of up to level chars upper! */
- strlower(password);
+ strlower(pass2);
- if (string_combinations(password, password_check, level))
- {
- if (fn)
- fn(user, password);
- return (True);
+
+ if (NT_STATUS_IS_OK(nt_status = string_combinations(pass2, password_check, level))) {
+ if (fn)
+ fn(user, pass2);
+ return nt_status;
}
-
- /* restore it */
- fstrcpy(password, pass2);
-
- return (False);
+
+ return NT_STATUS_WRONG_PASSWORD;
}
git.samba.org / jra / samba / .git / blobdiff