source/smbd/chgpasswd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Samba utility functions
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001-2004
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 /* These comments regard the code to change the user's unix password: */
  23
  24 /* fork a child process to exec passwd and write to its
  25  * tty to change a users password. This is running as the
  26  * user who is attempting to change the password.
  27  */
  28
  29 /*
  30  * This code was copied/borrowed and stolen from various sources.
  31  * The primary source was the poppasswd.c from the authors of POPMail. This software
  32  * was included as a client to change passwords using the 'passwd' program
  33  * on the remote machine.
  34  *
  35  * This code has been hacked by Bob Nance (nance@niehs.nih.gov) and Evan Patterson
  36  * (patters2@niehs.nih.gov) at the National Institute of Environmental Health Sciences
  37  * and rights to modify, distribute or incorporate this change to the CAP suite or
  38  * using it for any other reason are granted, so long as this disclaimer is left intact.
  39  */
  40
  41 /*
  42    This code was hacked considerably for inclusion in Samba, primarily
  43    by Andrew.Tridgell@anu.edu.au. The biggest change was the addition
  44    of the "password chat" option, which allows the easy runtime
  45    specification of the expected sequence of events to change a
  46    password.
  47    */
  48
  49 #include "includes.h"
  50
  51 extern struct passdb_ops pdb_ops;
  52
  53 static NTSTATUS check_oem_password(const char *user,
  54                                    uchar password_encrypted_with_lm_hash[516],
  55                                    const uchar old_lm_hash_encrypted[16],
  56                                    uchar password_encrypted_with_nt_hash[516],
  57                                    const uchar old_nt_hash_encrypted[16],
  58                                    SAM_ACCOUNT **hnd, char *new_passwd,
  59                                    int new_passwd_size);
  60
  61 #if ALLOW_CHANGE_PASSWORD
  62
  63 static int findpty(char **slave)
  64 {
  65         int master;
  66         static fstring line;
  67         SMB_STRUCT_DIR *dirp;
  68         const char *dpname;
  69
  70 #if defined(HAVE_GRANTPT)
  71         /* Try to open /dev/ptmx. If that fails, fall through to old method. */
  72         if ((master = sys_open("/dev/ptmx", O_RDWR, 0)) >= 0)
  73         {
  74                 grantpt(master);
  75                 unlockpt(master);
  76                 *slave = (char *)ptsname(master);
  77                 if (*slave == NULL)
  78                 {
  79                         DEBUG(0,
  80                               ("findpty: Unable to create master/slave pty pair.\n"));
  81                         /* Stop fd leak on error. */
  82                         close(master);
  83                         return -1;
  84                 }
  85                 else
  86                 {
  87                         DEBUG(10,
  88                               ("findpty: Allocated slave pty %s\n", *slave));
  89                         return (master);
  90                 }
  91         }
  92 #endif /* HAVE_GRANTPT */
  93
  94         fstrcpy(line, "/dev/ptyXX");
  95
  96         dirp = sys_opendir("/dev");
  97         if (!dirp)
  98                 return (-1);
  99         while ((dpname = readdirname(dirp)) != NULL)
 100         {
 101                 if (strncmp(dpname, "pty", 3) == 0 && strlen(dpname) == 5)
 102                 {
 103                         DEBUG(3,
 104                               ("pty: try to open %s, line was %s\n", dpname,
 105                                line));
 106                         line[8] = dpname[3];
 107                         line[9] = dpname[4];
 108                         if ((master = sys_open(line, O_RDWR, 0)) >= 0)
 109                         {
 110                                 DEBUG(3, ("pty: opened %s\n", line));
 111                                 line[5] = 't';
 112                                 *slave = line;
 113                                 sys_closedir(dirp);
 114                                 return (master);
 115                         }
 116                 }
 117         }
 118         sys_closedir(dirp);
 119         return (-1);
 120 }
 121
 122 static int dochild(int master, const char *slavedev, const struct passwd *pass,
 123                    const char *passwordprogram, BOOL as_root)
 124 {
 125         int slave;
 126         struct termios stermios;
 127         gid_t gid;
 128         uid_t uid;
 129
 130         if (pass == NULL)
 131         {
 132                 DEBUG(0,
 133                       ("dochild: user doesn't exist in the UNIX password database.\n"));
 134                 return False;
 135         }
 136
 137         gid = pass->pw_gid;
 138         uid = pass->pw_uid;
 139
 140         gain_root_privilege();
 141
 142         /* Start new session - gets rid of controlling terminal. */
 143         if (setsid() < 0)
 144         {
 145                 DEBUG(3,
 146                       ("Weirdness, couldn't let go of controlling terminal\n"));
 147                 return (False);
 148         }
 149
 150         /* Open slave pty and acquire as new controlling terminal. */
 151         if ((slave = sys_open(slavedev, O_RDWR, 0)) < 0)
 152         {
 153                 DEBUG(3, ("More weirdness, could not open %s\n", slavedev));
 154                 return (False);
 155         }
 156 #if defined(I_PUSH) && defined(I_FIND)
 157         if (ioctl(slave, I_FIND, "ptem") == 0) {
 158                 ioctl(slave, I_PUSH, "ptem");
 159         }
 160         if (ioctl(slave, I_FIND, "ldterm") == 0) {
 161                 ioctl(slave, I_PUSH, "ldterm");
 162         }
 163 #elif defined(TIOCSCTTY)
 164         if (ioctl(slave, TIOCSCTTY, 0) < 0)
 165         {
 166                 DEBUG(3, ("Error in ioctl call for slave pty\n"));
 167                 /* return(False); */
 168         }
 169 #endif
 170
 171         /* Close master. */
 172         close(master);
 173
 174         /* Make slave stdin/out/err of child. */
 175
 176         if (sys_dup2(slave, STDIN_FILENO) != STDIN_FILENO)
 177         {
 178                 DEBUG(3, ("Could not re-direct stdin\n"));
 179                 return (False);
 180         }
 181         if (sys_dup2(slave, STDOUT_FILENO) != STDOUT_FILENO)
 182         {
 183                 DEBUG(3, ("Could not re-direct stdout\n"));
 184                 return (False);
 185         }
 186         if (sys_dup2(slave, STDERR_FILENO) != STDERR_FILENO)
 187         {
 188                 DEBUG(3, ("Could not re-direct stderr\n"));
 189                 return (False);
 190         }
 191         if (slave > 2)
 192                 close(slave);
 193
 194         /* Set proper terminal attributes - no echo, canonical input processing,
 195            no map NL to CR/NL on output. */
 196
 197         if (tcgetattr(0, &stermios) < 0)
 198         {
 199                 DEBUG(3,
 200                       ("could not read default terminal attributes on pty\n"));
 201                 return (False);
 202         }
 203         stermios.c_lflag &= ~(ECHO | ECHOE | ECHOK | ECHONL);
 204         stermios.c_lflag |= ICANON;
 205 #ifdef ONLCR
 206         stermios.c_oflag &= ~(ONLCR);
 207 #endif
 208         if (tcsetattr(0, TCSANOW, &stermios) < 0)
 209         {
 210                 DEBUG(3, ("could not set attributes of pty\n"));
 211                 return (False);
 212         }
 213
 214         /* make us completely into the right uid */
 215         if (!as_root)
 216         {
 217                 become_user_permanently(uid, gid);
 218         }
 219
 220         DEBUG(10,
 221               ("Invoking '%s' as password change program.\n",
 222                passwordprogram));
 223
 224         /* execl() password-change application */
 225         if (execl("/bin/sh", "sh", "-c", passwordprogram, NULL) < 0)
 226         {
 227                 DEBUG(3, ("Bad status returned from %s\n", passwordprogram));
 228                 return (False);
 229         }
 230         return (True);
 231 }
 232
 233 static int expect(int master, char *issue, char *expected)
 234 {
 235         pstring buffer;
 236         int attempts, timeout, nread, len;
 237         BOOL match = False;
 238
 239         for (attempts = 0; attempts < 2; attempts++) {
 240                 if (!strequal(issue, ".")) {
 241                         if (lp_passwd_chat_debug())
 242                                 DEBUG(100, ("expect: sending [%s]\n", issue));
 243
 244                         if ((len = write(master, issue, strlen(issue))) != strlen(issue)) {
 245                                 DEBUG(2,("expect: (short) write returned %d\n", len ));
 246                                 return False;
 247                         }
 248                 }
 249
 250                 if (strequal(expected, "."))
 251                         return True;
 252
 253                 /* Initial timeout. */
 254                 timeout = lp_passwd_chat_timeout() * 1000;
 255                 nread = 0;
 256                 buffer[nread] = 0;
 257
 258                 while ((len = read_socket_with_timeout(master, buffer + nread, 1,
 259                                                        sizeof(buffer) - nread - 1,
 260                                                        timeout)) > 0) {
 261                         nread += len;
 262                         buffer[nread] = 0;
 263
 264                         {
 265                                 /* Eat leading/trailing whitespace before match. */
 266                                 pstring str;
 267                                 pstrcpy( str, buffer);
 268                                 trim_char( str, ' ', ' ');
 269
 270                                 if ((match = unix_wild_match(expected, str)) == True) {
 271                                         /* Now data has started to return, lower timeout. */
 272                                         timeout = lp_passwd_chat_timeout() * 100;
 273                                 }
 274                         }
 275                 }
 276
 277                 if (lp_passwd_chat_debug())
 278                         DEBUG(100, ("expect: expected [%s] received [%s] match %s\n",
 279                                     expected, buffer, match ? "yes" : "no" ));
 280
 281                 if (match)
 282                         break;
 283
 284                 if (len < 0) {
 285                         DEBUG(2, ("expect: %s\n", strerror(errno)));
 286                         return False;
 287                 }
 288         }
 289
 290         DEBUG(10,("expect: returning %s\n", match ? "True" : "False" ));
 291         return match;
 292 }
 293
 294 static void pwd_sub(char *buf)
 295 {
 296         all_string_sub(buf, "\\n", "\n", 0);
 297         all_string_sub(buf, "\\r", "\r", 0);
 298         all_string_sub(buf, "\\s", " ", 0);
 299         all_string_sub(buf, "\\t", "\t", 0);
 300 }
 301
 302 static int talktochild(int master, const char *seq)
 303 {
 304         int count = 0;
 305         fstring issue, expected;
 306
 307         fstrcpy(issue, ".");
 308
 309         while (next_token(&seq, expected, NULL, sizeof(expected)))
 310         {
 311                 pwd_sub(expected);
 312                 count++;
 313
 314                 if (!expect(master, issue, expected))
 315                 {
 316                         DEBUG(3, ("Response %d incorrect\n", count));
 317                         return False;
 318                 }
 319
 320                 if (!next_token(&seq, issue, NULL, sizeof(issue)))
 321                         fstrcpy(issue, ".");
 322
 323                 pwd_sub(issue);
 324         }
 325         if (!strequal(issue, ".")) {
 326                 /* we have one final issue to send */
 327                 fstrcpy(expected, ".");
 328                 if (!expect(master, issue, expected))
 329                         return False;
 330         }
 331
 332         return (count > 0);
 333 }
 334
 335 static BOOL chat_with_program(char *passwordprogram, const struct passwd *pass,
 336                               char *chatsequence, BOOL as_root)
 337 {
 338         char *slavedev;
 339         int master;
 340         pid_t pid, wpid;
 341         int wstat;
 342         BOOL chstat = False;
 343
 344         if (pass == NULL) {
 345                 DEBUG(0, ("chat_with_program: user doesn't exist in the UNIX password database.\n"));
 346                 return False;
 347         }
 348
 349         /* allocate a pseudo-terminal device */
 350         if ((master = findpty(&slavedev)) < 0) {
 351                 DEBUG(3, ("chat_with_program: Cannot Allocate pty for password change: %s\n", pass->pw_name));
 352                 return (False);
 353         }
 354
 355         /*
 356          * We need to temporarily stop CatchChild from eating
 357          * SIGCLD signals as it also eats the exit status code. JRA.
 358          */
 359
 360         CatchChildLeaveStatus();
 361
 362         if ((pid = sys_fork()) < 0) {
 363                 DEBUG(3, ("chat_with_program: Cannot fork() child for password change: %s\n", pass->pw_name));
 364                 close(master);
 365                 CatchChild();
 366                 return (False);
 367         }
 368
 369         /* we now have a pty */
 370         if (pid > 0) {                  /* This is the parent process */
 371                 if ((chstat = talktochild(master, chatsequence)) == False) {
 372                         DEBUG(3, ("chat_with_program: Child failed to change password: %s\n", pass->pw_name));
 373                         kill(pid, SIGKILL);     /* be sure to end this process */
 374                 }
 375
 376                 while ((wpid = sys_waitpid(pid, &wstat, 0)) < 0) {
 377                         if (errno == EINTR) {
 378                                 errno = 0;
 379                                 continue;
 380                         }
 381                         break;
 382                 }
 383
 384                 if (wpid < 0) {
 385                         DEBUG(3, ("chat_with_program: The process is no longer waiting!\n\n"));
 386                         close(master);
 387                         CatchChild();
 388                         return (False);
 389                 }
 390
 391                 /*
 392                  * Go back to ignoring children.
 393                  */
 394                 CatchChild();
 395
 396                 close(master);
 397
 398                 if (pid != wpid) {
 399                         DEBUG(3, ("chat_with_program: We were waiting for the wrong process ID\n"));
 400                         return (False);
 401                 }
 402                 if (WIFEXITED(wstat) && (WEXITSTATUS(wstat) != 0)) {
 403                         DEBUG(3, ("chat_with_program: The process exited with status %d \
 404 while we were waiting\n", WEXITSTATUS(wstat)));
 405                         return (False);
 406                 }
 407 #if defined(WIFSIGNALLED) && defined(WTERMSIG)
 408                 else if (WIFSIGNALLED(wstat)) {
 409                         DEBUG(3, ("chat_with_program: The process was killed by signal %d \
 410 while we were waiting\n", WTERMSIG(wstat)));
 411                         return (False);
 412                 }
 413 #endif
 414         } else {
 415                 /* CHILD */
 416
 417                 /*
 418                  * Lose any oplock capabilities.
 419                  */
 420                 oplock_set_capability(False, False);
 421
 422                 /* make sure it doesn't freeze */
 423                 alarm(20);
 424
 425                 if (as_root)
 426                         become_root();
 427
 428                 DEBUG(3, ("chat_with_program: Dochild for user %s (uid=%d,gid=%d) (as_root = %s)\n", pass->pw_name,
 429                        (int)getuid(), (int)getgid(), BOOLSTR(as_root) ));
 430                 chstat = dochild(master, slavedev, pass, passwordprogram, as_root);
 431
 432                 if (as_root)
 433                         unbecome_root();
 434
 435                 /*
 436                  * The child should never return from dochild() ....
 437                  */
 438
 439                 DEBUG(0, ("chat_with_program: Error: dochild() returned %d\n", chstat));
 440                 exit(1);
 441         }
 442
 443         if (chstat)
 444                 DEBUG(3, ("chat_with_program: Password change %ssuccessful for user %s\n",
 445                        (chstat ? "" : "un"), pass->pw_name));
 446         return (chstat);
 447 }
 448
 449 BOOL chgpasswd(const char *name, const struct passwd *pass,
 450                const char *oldpass, const char *newpass, BOOL as_root)
 451 {
 452         pstring passwordprogram;
 453         pstring chatsequence;
 454         size_t i;
 455         size_t len;
 456
 457         if (!oldpass) {
 458                 oldpass = "";
 459         }
 460
 461         DEBUG(3, ("chgpasswd: Password change (as_root=%s) for user: %s\n", BOOLSTR(as_root), name));
 462
 463 #ifdef DEBUG_PASSWORD
 464         DEBUG(100, ("chgpasswd: Passwords: old=%s new=%s\n", oldpass, newpass));
 465 #endif
 466
 467         /* Take the passed information and test it for minimum criteria */
 468
 469         /* Password is same as old password */
 470         if (strcmp(oldpass, newpass) == 0) {
 471                 /* don't allow same password */
 472                 DEBUG(2, ("chgpasswd: Password Change: %s, New password is same as old\n", name));      /* log the attempt */
 473                 return (False); /* inform the user */
 474         }
 475
 476         /*
 477          * Check the old and new passwords don't contain any control
 478          * characters.
 479          */
 480
 481         len = strlen(oldpass);
 482         for (i = 0; i < len; i++) {
 483                 if (iscntrl((int)oldpass[i])) {
 484                         DEBUG(0, ("chgpasswd: oldpass contains control characters (disallowed).\n"));
 485                         return False;
 486                 }
 487         }
 488
 489         len = strlen(newpass);
 490         for (i = 0; i < len; i++) {
 491                 if (iscntrl((int)newpass[i])) {
 492                         DEBUG(0, ("chgpasswd: newpass contains control characters (disallowed).\n"));
 493                         return False;
 494                 }
 495         }
 496
 497 #ifdef WITH_PAM
 498         if (lp_pam_password_change()) {
 499                 BOOL ret;
 500
 501                 if (as_root)
 502                         become_root();
 503
 504                 if (pass) {
 505                         ret = smb_pam_passchange(pass->pw_name, oldpass, newpass);
 506                 } else {
 507                         ret = smb_pam_passchange(name, oldpass, newpass);
 508                 }
 509
 510                 if (as_root)
 511                         unbecome_root();
 512
 513                 return ret;
 514         }
 515 #endif
 516
 517         /* A non-PAM password change just doen't make sense without a valid local user */
 518
 519         if (pass == NULL) {
 520                 DEBUG(0, ("chgpasswd: user %s doesn't exist in the UNIX password database.\n", name));
 521                 return False;
 522         }
 523
 524         pstrcpy(passwordprogram, lp_passwd_program());
 525         pstrcpy(chatsequence, lp_passwd_chat());
 526
 527         if (!*chatsequence) {
 528                 DEBUG(2, ("chgpasswd: Null chat sequence - no password changing\n"));
 529                 return (False);
 530         }
 531
 532         if (!*passwordprogram) {
 533                 DEBUG(2, ("chgpasswd: Null password program - no password changing\n"));
 534                 return (False);
 535         }
 536
 537         if (as_root) {
 538                 /* The password program *must* contain the user name to work. Fail if not. */
 539                 if (strstr_m(passwordprogram, "%u") == NULL) {
 540                         DEBUG(0,("chgpasswd: Running as root the 'passwd program' parameter *MUST* contain \
 541 the string %%u, and the given string %s does not.\n", passwordprogram ));
 542                         return False;
 543                 }
 544         }
 545
 546         pstring_sub(passwordprogram, "%u", name);
 547         /* note that we do NOT substitute the %o and %n in the password program
 548            as this would open up a security hole where the user could use
 549            a new password containing shell escape characters */
 550
 551         pstring_sub(chatsequence, "%u", name);
 552         all_string_sub(chatsequence, "%o", oldpass, sizeof(pstring));
 553         all_string_sub(chatsequence, "%n", newpass, sizeof(pstring));
 554         return (chat_with_program
 555                 (passwordprogram, pass, chatsequence, as_root));
 556 }
 557
 558 #else /* ALLOW_CHANGE_PASSWORD */
 559
 560 BOOL chgpasswd(const char *name, const struct passwd *pass,
 561                const char *oldpass, const char *newpass, BOOL as_root)
 562 {
 563         DEBUG(0, ("chgpasswd: Unix Password changing not compiled in (user=%s)\n", name));
 564         return (False);
 565 }
 566 #endif /* ALLOW_CHANGE_PASSWORD */
 567
 568 /***********************************************************
 569  Code to check the lanman hashed password.
 570 ************************************************************/
 571
 572 BOOL check_lanman_password(char *user, uchar * pass1,
 573                            uchar * pass2, SAM_ACCOUNT **hnd)
 574 {
 575         uchar unenc_new_pw[16];
 576         uchar unenc_old_pw[16];
 577         SAM_ACCOUNT *sampass = NULL;
 578         uint16 acct_ctrl;
 579         const uint8 *lanman_pw;
 580         BOOL ret;
 581
 582         become_root();
 583         ret = pdb_getsampwnam(sampass, user);
 584         unbecome_root();
 585
 586         if (ret == False) {
 587                 DEBUG(0,("check_lanman_password: getsampwnam returned NULL\n"));
 588                 pdb_free_sam(&sampass);
 589                 return False;
 590         }
 591
 592         acct_ctrl = pdb_get_acct_ctrl     (sampass);
 593         lanman_pw = pdb_get_lanman_passwd (sampass);
 594
 595         if (acct_ctrl & ACB_DISABLED) {
 596                 DEBUG(0,("check_lanman_password: account %s disabled.\n", user));
 597                 pdb_free_sam(&sampass);
 598                 return False;
 599         }
 600
 601         if (lanman_pw == NULL) {
 602                 if (acct_ctrl & ACB_PWNOTREQ) {
 603                         /* this saves the pointer for the caller */
 604                         *hnd = sampass;
 605                         return True;
 606                 } else {
 607                         DEBUG(0, ("check_lanman_password: no lanman password !\n"));
 608                         pdb_free_sam(&sampass);
 609                         return False;
 610                 }
 611         }
 612
 613         /* Get the new lanman hash. */
 614         D_P16(lanman_pw, pass2, unenc_new_pw);
 615
 616         /* Use this to get the old lanman hash. */
 617         D_P16(unenc_new_pw, pass1, unenc_old_pw);
 618
 619         /* Check that the two old passwords match. */
 620         if (memcmp(lanman_pw, unenc_old_pw, 16)) {
 621                 DEBUG(0,("check_lanman_password: old password doesn't match.\n"));
 622                 pdb_free_sam(&sampass);
 623                 return False;
 624         }
 625
 626         /* this saves the pointer for the caller */
 627         *hnd = sampass;
 628         return True;
 629 }
 630
 631 /***********************************************************
 632  Code to change the lanman hashed password.
 633  It nulls out the NT hashed password as it will
 634  no longer be valid.
 635  NOTE this function is designed to be called as root. Check the old password
 636  is correct before calling. JRA.
 637 ************************************************************/
 638
 639 BOOL change_lanman_password(SAM_ACCOUNT *sampass, uchar *pass2)
 640 {
 641         static uchar null_pw[16];
 642         uchar unenc_new_pw[16];
 643         BOOL ret;
 644         uint16 acct_ctrl;
 645         const uint8 *pwd;
 646
 647         if (sampass == NULL) {
 648                 DEBUG(0,("change_lanman_password: no smb password entry.\n"));
 649                 return False;
 650         }
 651
 652         acct_ctrl = pdb_get_acct_ctrl(sampass);
 653         pwd = pdb_get_lanman_passwd(sampass);
 654
 655         if (acct_ctrl & ACB_DISABLED) {
 656                 DEBUG(0,("change_lanman_password: account %s disabled.\n",
 657                        pdb_get_username(sampass)));
 658                 return False;
 659         }
 660
 661         if (pwd == NULL) {
 662                 if (acct_ctrl & ACB_PWNOTREQ) {
 663                         uchar no_pw[14];
 664                         memset(no_pw, '\0', 14);
 665                         E_P16(no_pw, null_pw);
 666
 667                         /* Get the new lanman hash. */
 668                         D_P16(null_pw, pass2, unenc_new_pw);
 669                 } else {
 670                         DEBUG(0,("change_lanman_password: no lanman password !\n"));
 671                         return False;
 672                 }
 673         } else {
 674                 /* Get the new lanman hash. */
 675                 D_P16(pwd, pass2, unenc_new_pw);
 676         }
 677
 678         if (!pdb_set_lanman_passwd(sampass, unenc_new_pw, PDB_CHANGED)) {
 679                 return False;
 680         }
 681
 682         if (!pdb_set_nt_passwd    (sampass, NULL, PDB_CHANGED)) {
 683                 return False;   /* We lose the NT hash. Sorry. */
 684         }
 685
 686         if (!pdb_set_pass_changed_now  (sampass)) {
 687                 pdb_free_sam(&sampass);
 688                 /* Not quite sure what this one qualifies as, but this will do */
 689                 return False;
 690         }
 691
 692         /* Now flush the sam_passwd struct to persistent storage */
 693         ret = pdb_update_sam_account (sampass);
 694
 695         return ret;
 696 }
 697
 698 /***********************************************************
 699  Code to check and change the OEM hashed password.
 700 ************************************************************/
 701
 702 NTSTATUS pass_oem_change(char *user,
 703                          uchar password_encrypted_with_lm_hash[516],
 704                          const uchar old_lm_hash_encrypted[16],
 705                          uchar password_encrypted_with_nt_hash[516],
 706                          const uchar old_nt_hash_encrypted[16])
 707 {
 708         pstring new_passwd;
 709         SAM_ACCOUNT *sampass = NULL;
 710         NTSTATUS nt_status = check_oem_password(user, password_encrypted_with_lm_hash,
 711                                                 old_lm_hash_encrypted,
 712                                                 password_encrypted_with_nt_hash,
 713                                                 old_nt_hash_encrypted,
 714                                                 &sampass, new_passwd, sizeof(new_passwd));
 715
 716         if (!NT_STATUS_IS_OK(nt_status))
 717                 return nt_status;
 718
 719         /* We've already checked the old password here.... */
 720         become_root();
 721         nt_status = change_oem_password(sampass, NULL, new_passwd, True);
 722         unbecome_root();
 723
 724         memset(new_passwd, 0, sizeof(new_passwd));
 725
 726         pdb_free_sam(&sampass);
 727
 728         return nt_status;
 729 }
 730
 731 /***********************************************************
 732  Decrypt and verify a user password change.
 733
 734  The 516 byte long buffers are encrypted with the old NT and
 735  old LM passwords, and if the NT passwords are present, both
 736  buffers contain a unicode string.
 737
 738  After decrypting the buffers, check the password is correct by
 739  matching the old hashed passwords with the passwords in the passdb.
 740
 741 ************************************************************/
 742
 743 static NTSTATUS check_oem_password(const char *user,
 744                                    uchar password_encrypted_with_lm_hash[516],
 745                                    const uchar old_lm_hash_encrypted[16],
 746                                    uchar password_encrypted_with_nt_hash[516],
 747                                    const uchar old_nt_hash_encrypted[16],
 748                                    SAM_ACCOUNT **hnd, char *new_passwd,
 749                                    int new_passwd_size)
 750 {
 751         static uchar null_pw[16];
 752         static uchar null_ntpw[16];
 753         SAM_ACCOUNT *sampass = NULL;
 754         uint8 *password_encrypted;
 755         const uint8 *encryption_key;
 756         const uint8 *lanman_pw, *nt_pw;
 757         uint16 acct_ctrl;
 758         uint32 new_pw_len;
 759         uchar new_nt_hash[16];
 760         uchar new_lm_hash[16];
 761         uchar verifier[16];
 762         char no_pw[2];
 763         BOOL ret;
 764
 765         BOOL nt_pass_set = (password_encrypted_with_nt_hash && old_nt_hash_encrypted);
 766         BOOL lm_pass_set = (password_encrypted_with_lm_hash && old_lm_hash_encrypted);
 767
 768         *hnd = NULL;
 769
 770         pdb_init_sam(&sampass);
 771
 772         become_root();
 773         ret = pdb_getsampwnam(sampass, user);
 774         unbecome_root();
 775
 776         if (ret == False) {
 777                 DEBUG(0, ("check_oem_password: getsmbpwnam returned NULL\n"));
 778                 pdb_free_sam(&sampass);
 779                 return NT_STATUS_NO_SUCH_USER;
 780         }
 781
 782         acct_ctrl = pdb_get_acct_ctrl(sampass);
 783
 784         if (acct_ctrl & ACB_DISABLED) {
 785                 DEBUG(2,("check_lanman_password: account %s disabled.\n", user));
 786                 pdb_free_sam(&sampass);
 787                 return NT_STATUS_ACCOUNT_DISABLED;
 788         }
 789
 790         if ((acct_ctrl & ACB_PWNOTREQ) && lp_null_passwords()) {
 791                 /* construct a null password (in case one is needed */
 792                 no_pw[0] = 0;
 793                 no_pw[1] = 0;
 794                 nt_lm_owf_gen(no_pw, null_ntpw, null_pw);
 795                 lanman_pw = null_pw;
 796                 nt_pw = null_pw;
 797
 798         } else {
 799                 /* save pointers to passwords so we don't have to keep looking them up */
 800                 if (lp_lanman_auth()) {
 801                         lanman_pw = pdb_get_lanman_passwd(sampass);
 802                 } else {
 803                         lanman_pw = NULL;
 804                 }
 805                 nt_pw = pdb_get_nt_passwd(sampass);
 806         }
 807
 808         if (nt_pw && nt_pass_set) {
 809                 /* IDEAL Case: passwords are in unicode, and we can
 810                  * read use the password encrypted with the NT hash
 811                  */
 812                 password_encrypted = password_encrypted_with_nt_hash;
 813                 encryption_key = nt_pw;
 814         } else if (lanman_pw && lm_pass_set) {
 815                 /* password may still be in unicode, but use LM hash version */
 816                 password_encrypted = password_encrypted_with_lm_hash;
 817                 encryption_key = lanman_pw;
 818         } else if (nt_pass_set) {
 819                 DEBUG(1, ("NT password change supplied for user %s, but we have no NT password to check it with\n",
 820                           user));
 821                 pdb_free_sam(&sampass);
 822                 return NT_STATUS_WRONG_PASSWORD;
 823         } else if (lm_pass_set) {
 824                 if (lp_lanman_auth()) {
 825                         DEBUG(1, ("LM password change supplied for user %s, but we have no LanMan password to check it with\n",
 826                                   user));
 827                 } else {
 828                         DEBUG(1, ("LM password change supplied for user %s, but we have disabled LanMan authentication\n",
 829                                   user));
 830                 }
 831                         pdb_free_sam(&sampass);
 832                 return NT_STATUS_WRONG_PASSWORD;
 833         } else {
 834                 DEBUG(1, ("password change requested for user %s, but no password supplied!\n",
 835                           user));
 836                 pdb_free_sam(&sampass);
 837                 return NT_STATUS_WRONG_PASSWORD;
 838         }
 839
 840         /*
 841          * Decrypt the password with the key
 842          */
 843         SamOEMhash( password_encrypted, encryption_key, 516);
 844
 845         if ( !decode_pw_buffer(password_encrypted, new_passwd, new_passwd_size, &new_pw_len,
 846                                nt_pass_set ? STR_UNICODE : STR_ASCII)) {
 847                 pdb_free_sam(&sampass);
 848                 return NT_STATUS_WRONG_PASSWORD;
 849         }
 850
 851         /*
 852          * To ensure we got the correct new password, hash it and
 853          * use it as a key to test the passed old password.
 854          */
 855
 856         if (nt_pass_set) {
 857                 /* NT passwords, verify the NT hash. */
 858
 859                 /* Calculate the MD4 hash (NT compatible) of the password */
 860                 memset(new_nt_hash, '\0', 16);
 861                 E_md4hash(new_passwd, new_nt_hash);
 862
 863                 if (nt_pw) {
 864                         /*
 865                          * check the NT verifier
 866                          */
 867                         E_old_pw_hash(new_nt_hash, nt_pw, verifier);
 868                         if (memcmp(verifier, old_nt_hash_encrypted, 16)) {
 869                                 DEBUG(0,("check_oem_password: old lm password doesn't match.\n"));
 870                                 pdb_free_sam(&sampass);
 871                                 return NT_STATUS_WRONG_PASSWORD;
 872                         }
 873
 874                         /* We could check the LM password here, but there is
 875                          * little point, we already know the password is
 876                          * correct, and the LM password might not even be
 877                          * present. */
 878
 879                         /* Further, LM hash generation algorithms
 880                          * differ with charset, so we could
 881                          * incorrectly fail a perfectly valid password
 882                          * change */
 883 #ifdef DEBUG_PASSWORD
 884                         DEBUG(100,
 885                               ("check_oem_password: password %s ok\n", new_passwd));
 886 #endif
 887                         *hnd = sampass;
 888                         return NT_STATUS_OK;
 889                 }
 890
 891                 if (lanman_pw) {
 892                         /*
 893                          * check the lm verifier
 894                          */
 895                         E_old_pw_hash(new_nt_hash, lanman_pw, verifier);
 896                         if (memcmp(verifier, old_lm_hash_encrypted, 16)) {
 897                                 DEBUG(0,("check_oem_password: old lm password doesn't match.\n"));
 898                                 pdb_free_sam(&sampass);
 899                                 return NT_STATUS_WRONG_PASSWORD;
 900                         }
 901 #ifdef DEBUG_PASSWORD
 902                         DEBUG(100,
 903                               ("check_oem_password: password %s ok\n", new_passwd));
 904 #endif
 905                         *hnd = sampass;
 906                         return NT_STATUS_OK;
 907                 }
 908         }
 909
 910         if (lanman_pw && lm_pass_set) {
 911
 912                 E_deshash(new_passwd, new_lm_hash);
 913
 914                 /*
 915                  * check the lm verifier
 916                  */
 917                 E_old_pw_hash(new_lm_hash, lanman_pw, verifier);
 918                 if (memcmp(verifier, old_lm_hash_encrypted, 16)) {
 919                         DEBUG(0,("check_oem_password: old lm password doesn't match.\n"));
 920                         pdb_free_sam(&sampass);
 921                         return NT_STATUS_WRONG_PASSWORD;
 922                 }
 923
 924 #ifdef DEBUG_PASSWORD
 925                 DEBUG(100,
 926                       ("check_oem_password: password %s ok\n", new_passwd));
 927 #endif
 928                 *hnd = sampass;
 929                 return NT_STATUS_OK;
 930         }
 931
 932         /* should not be reached */
 933         pdb_free_sam(&sampass);
 934         return NT_STATUS_WRONG_PASSWORD;
 935 }
 936
 937 /***********************************************************
 938  This routine takes the given password and checks it against
 939  the password history. Returns True if this password has been
 940  found in the history list.
 941 ************************************************************/
 942
 943 static BOOL check_passwd_history(SAM_ACCOUNT *sampass, const char *plaintext)
 944 {
 945         uchar new_nt_p16[NT_HASH_LEN];
 946         uchar zero_md5_nt_pw[SALTED_MD5_HASH_LEN];
 947         const uint8 *nt_pw;
 948         const uint8 *pwhistory;
 949         BOOL found = False;
 950         int i;
 951         uint32 pwHisLen, curr_pwHisLen;
 952
 953         pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHisLen);
 954         if (pwHisLen == 0) {
 955                 return False;
 956         }
 957
 958         pwhistory = pdb_get_pw_history(sampass, &curr_pwHisLen);
 959         if (!pwhistory || curr_pwHisLen == 0) {
 960                 return False;
 961         }
 962
 963         /* Only examine the minimum of the current history len and
 964            the stored history len. Avoids race conditions. */
 965         pwHisLen = MIN(pwHisLen,curr_pwHisLen);
 966
 967         nt_pw = pdb_get_nt_passwd(sampass);
 968
 969         E_md4hash(plaintext, new_nt_p16);
 970
 971         if (!memcmp(nt_pw, new_nt_p16, NT_HASH_LEN)) {
 972                 DEBUG(10,("check_passwd_history: proposed new password for user %s is the same as the current password !\n",
 973                         pdb_get_username(sampass) ));
 974                 return True;
 975         }
 976
 977         dump_data(100, (const char *)new_nt_p16, NT_HASH_LEN);
 978         dump_data(100, (const char *)pwhistory, PW_HISTORY_ENTRY_LEN*pwHisLen);
 979
 980         memset(zero_md5_nt_pw, '\0', SALTED_MD5_HASH_LEN);
 981         for (i=0; i<pwHisLen; i++) {
 982                 uchar new_nt_pw_salted_md5_hash[SALTED_MD5_HASH_LEN];
 983                 const uchar *current_salt = &pwhistory[i*PW_HISTORY_ENTRY_LEN];
 984                 const uchar *old_nt_pw_salted_md5_hash = &pwhistory[(i*PW_HISTORY_ENTRY_LEN)+
 985                                                         PW_HISTORY_SALT_LEN];
 986                 if (!memcmp(zero_md5_nt_pw, old_nt_pw_salted_md5_hash, SALTED_MD5_HASH_LEN)) {
 987                         /* Ignore zero valued entries. */
 988                         continue;
 989                 }
 990                 /* Create salted versions of new to compare. */
 991                 E_md5hash(current_salt, new_nt_p16, new_nt_pw_salted_md5_hash);
 992
 993                 if (!memcmp(new_nt_pw_salted_md5_hash, old_nt_pw_salted_md5_hash, SALTED_MD5_HASH_LEN)) {
 994                         DEBUG(1,("check_passwd_history: proposed new password for user %s found in history list !\n",
 995                                 pdb_get_username(sampass) ));
 996                         found = True;
 997                         break;
 998                 }
 999         }
1000         return found;
1001 }
1002
1003 /***********************************************************
1004  Code to change the oem password. Changes both the lanman
1005  and NT hashes.  Old_passwd is almost always NULL.
1006  NOTE this function is designed to be called as root. Check the old password
1007  is correct before calling. JRA.
1008 ************************************************************/
1009
1010 NTSTATUS change_oem_password(SAM_ACCOUNT *hnd, char *old_passwd, char *new_passwd, BOOL as_root)
1011 {
1012         BOOL ret;
1013         uint32 min_len, min_age;
1014         struct passwd *pass = NULL;
1015         const char *username = pdb_get_username(hnd);
1016         time_t last_change_time = pdb_get_pass_last_set_time(hnd);
1017         time_t can_change_time = pdb_get_pass_can_change_time(hnd);
1018
1019         if (pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &min_age)) {
1020                 /*
1021                  * Windows calculates the minimum password age check
1022                  * dynamically, it basically ignores the pwdcanchange
1023                  * timestamp. Do likewise.
1024                  */
1025                 if (last_change_time + min_age > time(NULL)) {
1026                         DEBUG(1, ("user %s cannot change password now, must "
1027                                   "wait until %s\n", username,
1028                                   http_timestring(last_change_time+min_age)));
1029                         return NT_STATUS_ACCOUNT_RESTRICTION;
1030                 }
1031         } else {
1032                 if ((can_change_time != 0) && (time(NULL) < can_change_time)) {
1033                         DEBUG(1, ("user %s cannot change password now, must "
1034                                   "wait until %s\n", username,
1035                                   http_timestring(can_change_time)));
1036                         return NT_STATUS_ACCOUNT_RESTRICTION;
1037                 }
1038         }
1039
1040         if (pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &min_len) && (str_charnum(new_passwd) < min_len)) {
1041                 DEBUG(1, ("user %s cannot change password - password too short\n",
1042                           username));
1043                 DEBUGADD(1, (" account policy min password len = %d\n", min_len));
1044                 return NT_STATUS_PASSWORD_RESTRICTION;
1045 /*              return NT_STATUS_PWD_TOO_SHORT; */
1046         }
1047
1048         if (check_passwd_history(hnd,new_passwd)) {
1049                 return NT_STATUS_PASSWORD_RESTRICTION;
1050         }
1051
1052         pass = Get_Pwnam(username);
1053         if (!pass) {
1054                 DEBUG(1, ("check_oem_password: Username %s does not exist in system !?!\n", username));
1055                 return NT_STATUS_ACCESS_DENIED;
1056         }
1057
1058         /* Use external script to check password complexity */
1059         if (lp_check_password_script() && *(lp_check_password_script())) {
1060                 int check_ret;
1061
1062                 check_ret = smbrunsecret(lp_check_password_script(), new_passwd);
1063                 DEBUG(5, ("change_oem_password: check password script (%s) returned [%d]\n", lp_check_password_script(), check_ret));
1064
1065                 if (check_ret != 0) {
1066                         DEBUG(1, ("change_oem_password: check password script said new password is not good enough!\n"));
1067                         return NT_STATUS_PASSWORD_RESTRICTION;
1068                 }
1069         }
1070
1071         /*
1072          * If unix password sync was requested, attempt to change
1073          * the /etc/passwd database first. Return failure if this cannot
1074          * be done.
1075          *
1076          * This occurs before the oem change, because we don't want to
1077          * update it if chgpasswd failed.
1078          *
1079          * Conditional on lp_unix_password_sync() because we don't want
1080          * to touch the unix db unless we have admin permission.
1081          */
1082
1083         if(lp_unix_password_sync() &&
1084                 !chgpasswd(username, pass, old_passwd, new_passwd, as_root)) {
1085                 return NT_STATUS_ACCESS_DENIED;
1086         }
1087
1088         if (!pdb_set_plaintext_passwd (hnd, new_passwd)) {
1089                 return NT_STATUS_ACCESS_DENIED;
1090         }
1091
1092         /* Now write it into the file. */
1093         ret = pdb_update_sam_account (hnd);
1094
1095         if (!ret) {
1096                 return NT_STATUS_ACCESS_DENIED;
1097         }
1098
1099         return NT_STATUS_OK;
1100 }