source3/smbd/auth.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    Password and authentication handling
   5    Copyright (C) Andrew Tridgell              1992-2000
   6    Copyright (C) Luke Kenneth Casson Leighton 1996-2000
   7    Copyright (C) Andrew Bartlett              2001
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25
  26 extern int DEBUGLEVEL;
  27
  28 /****************************************************************************
  29  Check user is in correct domain if required
  30 ****************************************************************************/
  31
  32 static BOOL check_domain_match(char *user, char *domain)
  33 {
  34   /*
  35    * If we aren't serving to trusted domains, we must make sure that
  36    * the validation request comes from an account in the same domain
  37    * as the Samba server
  38    */
  39
  40   if (!lp_allow_trusted_domains() &&
  41       !strequal(lp_workgroup(), domain) ) {
  42       DEBUG(1, ("check_domain_match: Attempt to connect as user %s from domain %s denied.\n", user, domain));
  43       return False;
  44   } else {
  45       return True;
  46   }
  47 }
  48
  49 /****************************************************************************
  50  Check a users password, as given in the user-info struct and return various
  51  interesting details in the server_info struct.
  52
  53  This functions does NOT need to be in a become_root()/unbecome_root() pair
  54  as it makes the calls itself when needed.
  55 ****************************************************************************/
  56
  57 NTSTATUS check_password(const auth_usersupplied_info *user_info,
  58                         auth_serversupplied_info *server_info)
  59 {
  60
  61         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
  62         BOOL done_pam = False;
  63
  64         DEBUG(3, ("check_password:  Checking password for smb user %s\\%s@%s with the new password interface\n",
  65                   user_info->smb_username.str, user_info->requested_domain.str, user_info->wksta_name.str));
  66         if (!check_domain_match(user_info->smb_username.str, user_info->domain.str)) {
  67                 return NT_STATUS_LOGON_FAILURE;
  68         }
  69
  70         if (!NT_STATUS_IS_OK(nt_status)) {
  71                 nt_status = check_rhosts_security(user_info, server_info);
  72         }
  73
  74         if ((lp_security() == SEC_DOMAIN) && !NT_STATUS_IS_OK(nt_status)) {
  75                 nt_status = check_domain_security(user_info, server_info);
  76         }
  77
  78         if ((lp_security() == SEC_SERVER) && !NT_STATUS_IS_OK(nt_status)) {
  79                 nt_status = check_server_security(user_info, server_info);
  80         }
  81
  82         if (lp_security() >= SEC_SERVER) {
  83                 smb_user_control(user_info->unix_username.str, nt_status);
  84         }
  85
  86         if (!NT_STATUS_IS_OK(nt_status)) {
  87                 if ((user_info->plaintext_password.len > 0)
  88                     && (!lp_plaintext_to_smbpasswd())) {
  89                         nt_status = check_unix_security(user_info, server_info);
  90                         done_pam = True;
  91                 } else {
  92                         nt_status = check_smbpasswd_security(user_info, server_info);
  93                 }
  94         }
  95
  96         if (NT_STATUS_IS_OK(nt_status) && !done_pam) {
  97                 /* We might not be root if we are an RPC call */
  98                 become_root();
  99                 nt_status = smb_pam_accountcheck(user_info->unix_username.str);
 100                 unbecome_root();
 101         }
 102
 103         if (NT_STATUS_IS_OK(nt_status)) {
 104                 DEBUG(5, ("check_password:  Password for smb user %s suceeded\n", user_info->smb_username.str));
 105         } else {
 106                 DEBUG(3, ("check_password:  Password for smb user %s FAILED with error %s\n", user_info->smb_username.str, get_nt_error_msg(nt_status)));
 107
 108         }
 109         return nt_status;
 110
 111 }
 112
 113 /****************************************************************************
 114  COMPATABILITY INTERFACES:
 115  ***************************************************************************/
 116
 117 /****************************************************************************
 118 check if a username/password is OK assuming the password is a 24 byte
 119 SMB hash
 120 return True if the password is correct, False otherwise
 121 ****************************************************************************/
 122
 123 NTSTATUS pass_check_smb_with_chal(char *smb_user, char *unix_user,
 124                                   char *domain, char* workstation,
 125                                   uchar chal[8],
 126                                   uchar *lm_pwd, int lm_pwd_len,
 127                                   uchar *nt_pwd, int nt_pwd_len)
 128 {
 129
 130         auth_usersupplied_info user_info;
 131         auth_serversupplied_info server_info;
 132         AUTH_STR ourdomain, theirdomain, unix_username, smb_username,
 133                 wksta_name;
 134
 135         ZERO_STRUCT(user_info);
 136         ZERO_STRUCT(ourdomain);
 137         ZERO_STRUCT(theirdomain);
 138         ZERO_STRUCT(smb_username);
 139         ZERO_STRUCT(wksta_name);
 140
 141         ourdomain.str = lp_workgroup();
 142         ourdomain.len = strlen(ourdomain.str);
 143
 144         theirdomain.str = domain;
 145         theirdomain.len = strlen(theirdomain.str);
 146
 147         user_info.requested_domain = theirdomain;
 148         user_info.domain = ourdomain;
 149
 150         smb_username.str = smb_user;
 151         smb_username.len = strlen(smb_username.str);
 152
 153         /* If unix user is NULL, use smb user */
 154
 155         unix_username.str = unix_user ? unix_user : smb_user;
 156         unix_username.len = strlen(unix_username.str);
 157
 158         user_info.unix_username = unix_username;
 159         user_info.smb_username = smb_username;
 160
 161         wksta_name.str = workstation;
 162         wksta_name.len = strlen(workstation);
 163
 164         user_info.wksta_name = wksta_name;
 165
 166         memcpy(user_info.chal, chal, 8);
 167
 168         if ((lm_pwd_len >= 24 || nt_pwd_len >= 24) ||
 169             (lp_encrypted_passwords() && (lm_pwd_len == 0) && lp_null_passwords())) {
 170                 /* if 24 bytes long assume it is an encrypted password */
 171
 172                 user_info.lm_resp.buffer = (uint8 *)lm_pwd;
 173                 user_info.lm_resp.len = lm_pwd_len;
 174                 user_info.nt_resp.buffer = (uint8 *)nt_pwd;
 175                 user_info.nt_resp.len = nt_pwd_len;
 176
 177         } else {
 178                 unsigned char local_lm_response[24];
 179                 unsigned char local_nt_response[24];
 180
 181                 /*
 182                  * Not encrypted - do so.
 183                  */
 184
 185                 DEBUG(5,("pass_check_smb: User passwords not in encrypted format.\n"));
 186
 187                 if (lm_pwd_len > 0) {
 188                         SMBencrypt( (uchar *)lm_pwd, user_info.chal, local_lm_response);
 189                         user_info.lm_resp.buffer = (uint8 *)local_lm_response;
 190                         user_info.lm_resp.len = 24;
 191
 192
 193                         /* WATCH OUT. This doesn't work if the incoming password is incorrectly cased.
 194                            We might want to add a check here and only do an LM in that case */
 195
 196                         /* This encrypts the lm_pwd feild, which actualy contains the password
 197                            rather than the nt_pwd field becouse that contains nothing */
 198                         SMBNTencrypt((uchar *)lm_pwd, user_info.chal, local_nt_response);
 199                         user_info.nt_resp.buffer = (uint8 *)local_nt_response;
 200                         user_info.nt_resp.len = 24;
 201                 }
 202
 203                 user_info.plaintext_password.str = (char *)lm_pwd;
 204                 user_info.plaintext_password.len = lm_pwd_len;
 205
 206         }
 207
 208         return check_password(&user_info, &server_info);
 209 }
 210
 211 NTSTATUS pass_check_smb(char *smb_user, char *unix_user,
 212                         char *domain, char *workstation,
 213                         uchar *lm_pwd, int lm_pwd_len,
 214                         uchar *nt_pwd, int nt_pwd_len)
 215 {
 216         uchar chal[8];
 217
 218         if (!last_challenge(chal)) {
 219                 generate_random_buffer( chal, 8, False);
 220         }
 221
 222         return pass_check_smb_with_chal(smb_user, unix_user,
 223                                         domain, workstation, chal,
 224                                         lm_pwd, lm_pwd_len,
 225                                         nt_pwd, nt_pwd_len);
 226
 227 }
 228
 229 /****************************************************************************
 230 check if a username/password pair is OK either via the system password
 231 database or the encrypted SMB password database
 232 return True if the password is correct, False otherwise
 233 ****************************************************************************/
 234 BOOL password_ok(char *user, char *password, int pwlen)
 235 {
 236         extern fstring remote_machine;
 237
 238         /*
 239          *  This hack must die!  But until I rewrite the rest of samba
 240          *  it must stay - abartlet 2001-08-03
 241          */
 242
 243         if ((pwlen == 0) && !lp_null_passwords()) {
 244                 DEBUG(4,("Null passwords not allowed.\n"));
 245                 return False;
 246         }
 247
 248         /* The password could be either NTLM or plain LM.  Try NTLM first, but fall-through as
 249            required. */
 250         if (NT_STATUS_IS_OK(pass_check_smb(user, NULL, remote_machine, lp_workgroup(), NULL, 0, (unsigned char *)password, pwlen))) {
 251                 return True;
 252         }
 253
 254         if (NT_STATUS_IS_OK(pass_check_smb(user, NULL, remote_machine, lp_workgroup(), (unsigned char *)password, pwlen, NULL, 0))) {
 255                 return True;
 256         }
 257
 258         return False;
 259 }
 260