2 * Unix SMB/Netbios implementation. Version 1.9. smbpasswd module. Copyright
3 * (C) Jeremy Allison 1995-1998
5 * This program is free software; you can redistribute it and/or modify it under
6 * the terms of the GNU General Public License as published by the Free
7 * Software Foundation; either version 2 of the License, or (at your option)
10 * This program is distributed in the hope that it will be useful, but WITHOUT
11 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
15 * You should have received a copy of the GNU General Public License along with
16 * this program; if not, write to the Free Software Foundation, Inc., 675
17 * Mass Ave, Cambridge, MA 02139, USA.
22 /*********************************************************
23 Print command usage on stderr and die.
24 **********************************************************/
26 static void usage(char *name, BOOL is_root)
29 fprintf(stderr, "Usage is : %s [-D DEBUGLEVEL] [-a] [-d] [-m] [-n] [username] [password]\n\
30 %s: [-R <name resolve order>] [-D DEBUGLEVEL] [-r machine] [username] [password]\n%s: [-h]\n", name, name, name);
32 fprintf(stderr, "Usage is : %s [-h] [-D DEBUGLEVEL] [-r machine] [password]\n", name);
36 /*********************************************************
38 **********************************************************/
40 int main(int argc, char **argv)
44 extern int DEBUGLEVEL;
53 struct smb_passwd *smb_pwent;
59 char *remote_machine = NULL;
60 BOOL add_user = False;
61 BOOL got_new_pass = False;
62 BOOL machine_account = False;
63 BOOL disable_user = False;
64 BOOL set_no_password = False;
65 pstring servicesf = CONFIGFILE;
71 memset(old_passwd, '\0', sizeof(old_passwd));
72 memset(new_passwd, '\0', sizeof(new_passwd));
78 setup_logging(prog_name,True);
82 if (!lp_load(servicesf,True,False,False)) {
83 fprintf(stderr, "%s: Can't load %s - run testparm to debug it\n", prog_name, servicesf);
86 codepage_initialise(lp_client_code_page());
88 /* Get the real uid */
91 /* Check the effective uid */
92 if ((geteuid() == 0) && (real_uid != 0)) {
93 fprintf(stderr, "%s: Must *NOT* be setuid root.\n", prog_name);
97 is_root = (real_uid == 0);
99 while ((ch = getopt(argc, argv, "adhmnr:R:D:")) != EOF) {
105 usage(prog_name, is_root);
111 strcpy(new_passwd, "XXXXXX");
113 usage(prog_name, is_root);
116 DEBUGLEVEL = atoi(optarg);
120 set_no_password = True;
122 strcpy(new_passwd, "NO PASSWORD");
124 usage(prog_name, is_root);
126 remote_machine = optarg;
130 lp_set_name_resolve_order(optarg);
133 usage(prog_name, is_root);
136 machine_account = True;
138 usage(prog_name, is_root);
142 usage(prog_name, is_root);
150 * Ensure add_user and remote machine are
153 if(add_user && (remote_machine != NULL))
154 usage(prog_name, True);
159 * Deal with root - can add a user, but only locally.
166 /* If we are root we can change another's password. */
167 pstrcpy(user_name, argv[0]);
170 pstrcpy(user_name, argv[0]);
171 fstrcpy(new_passwd, argv[1]);
175 usage(prog_name, True);
180 if(machine_account) {
181 int username_len = strlen(user_name);
182 if(username_len >= sizeof(pstring) - 1) {
183 fprintf(stderr, "%s: machine account name too long.\n", user_name);
187 if(user_name[username_len-1] != '$') {
188 user_name[username_len] = '$';
189 user_name[username_len+1] = '\0';
194 * Setup the pwd struct to point to known
195 * values for a machine account (it doesn't
196 * exist in /etc/passwd).
198 if((pwd = getpwnam(user_name)) == NULL) {
199 fprintf(stderr, "%s: User \"%s\" was not found in system password file.\n",
200 prog_name, user_name);
204 if((pwd = getpwuid(real_uid)) != NULL)
205 pstrcpy( user_name, pwd->pw_name);
211 fprintf(stderr, "%s: Only root can set anothers password.\n", prog_name);
212 usage(prog_name, False);
216 usage(prog_name, False);
219 fstrcpy(new_passwd, argv[0]);
223 if((pwd = getpwuid(real_uid)) != NULL)
224 pstrcpy( user_name, pwd->pw_name);
227 * A non-root user is always setting a password
228 * via a remote machine (even if that machine is
232 if(remote_machine == NULL)
233 remote_machine = "127.0.0.1";
236 if (*user_name == '\0') {
237 fprintf(stderr, "%s: Unable to get a user name for password change.\n", prog_name);
242 * If we are adding a machine account then pretend
243 * we already have the new password, we will be using
244 * the machinename as the password.
247 if(add_user && machine_account) {
249 strncpy(new_passwd, user_name, sizeof(fstring));
250 new_passwd[sizeof(fstring)-1] = '\0';
251 strlower(new_passwd);
252 if(new_passwd[strlen(new_passwd)-1] == '$')
253 new_passwd[strlen(new_passwd)-1] = '\0';
257 * If we are root we don't ask for the old password (unless it's on a
261 if (remote_machine != NULL) {
262 p = getpass("Old SMB password:");
263 fstrcpy(old_passwd, p);
267 new_passwd[0] = '\0';
269 p = getpass("New SMB password:");
271 strncpy(new_passwd, p, sizeof(fstring));
272 new_passwd[sizeof(fstring)-1] = '\0';
274 p = getpass("Retype new SMB password:");
276 if (strncmp(p, new_passwd, sizeof(fstring)-1))
278 fprintf(stderr, "%s: Mismatch - password unchanged.\n", prog_name);
283 if (new_passwd[0] == '\0') {
284 printf("Password not set\n");
289 * Now do things differently depending on if we're changing the
290 * password on a remote machine. Remember - a normal user is
291 * always using this code, looping back to the local smbd.
294 if(remote_machine != NULL) {
295 struct cli_state cli;
299 if(get_myname(myname,NULL) == False) {
300 fprintf(stderr, "%s: unable to get my hostname.\n", prog_name );
304 if(!resolve_name( remote_machine, &ip)) {
305 fprintf(stderr, "%s: unable to find an IP address for machine %s.\n",
306 prog_name, remote_machine );
310 memset(&cli, '\0', sizeof(struct cli_state));
312 if (!cli_initialise(&cli) || !cli_connect(&cli, remote_machine, &ip)) {
313 fprintf(stderr, "%s: unable to connect to SMB server on machine %s. Error was : %s.\n",
314 prog_name, remote_machine, cli_errstr(&cli) );
318 if (!cli_session_request(&cli, remote_machine, 0x20, myname)) {
319 fprintf(stderr, "%s: machine %s rejected the session setup. Error was : %s.\n",
320 prog_name, remote_machine, cli_errstr(&cli) );
325 cli.protocol = PROTOCOL_NT1;
327 if (!cli_negprot(&cli)) {
328 fprintf(stderr, "%s: machine %s rejected the negotiate protocol. Error was : %s.\n",
329 prog_name, remote_machine, cli_errstr(&cli) );
334 if (!cli_session_setup(&cli, user_name, old_passwd, strlen(old_passwd),
336 fprintf(stderr, "%s: machine %s rejected the session setup. Error was : %s.\n",
337 prog_name, remote_machine, cli_errstr(&cli) );
342 if (!cli_send_tconX(&cli, "IPC$", "IPC", "", 1)) {
343 fprintf(stderr, "%s: machine %s rejected the tconX on the IPC$ share. Error was : %s.\n",
344 prog_name, remote_machine, cli_errstr(&cli) );
349 if(!cli_oem_change_password(&cli, user_name, new_passwd, old_passwd)) {
350 fprintf(stderr, "%s: machine %s rejected the password change: Error was : %s.\n",
351 prog_name, remote_machine, cli_errstr(&cli) );
361 * Check for a machine account.
364 if(machine_account && !pwd) {
365 fprintf(stderr, "%s: User %s does not exist in system password file \
366 (usually /etc/passwd). Cannot add machine account without a valid system user.\n",
367 prog_name, user_name);
371 /* Calculate the MD4 hash (NT compatible) of the new password. */
373 memset(new_nt_p16, '\0', 16);
374 E_md4hash((uchar *) new_passwd, new_nt_p16);
376 /* Mangle the password into Lanman format */
377 new_passwd[14] = '\0';
378 strupper(new_passwd);
381 * Calculate the SMB (lanman) hash functions of the new password.
384 memset(new_p16, '\0', 16);
385 E_P16((uchar *) new_passwd, new_p16);
388 * Open the smbpaswd file.
390 vp = startsmbpwent(True);
391 if (!vp && errno == ENOENT) {
392 fp = fopen(lp_smb_passwd_file(), "w");
394 fprintf(fp, "# Samba SMB password file\n");
396 vp = startsmbpwent(True);
401 fprintf(stderr, "%s: Failed to open password file %s.\n",
402 prog_name, lp_smb_passwd_file());
408 /* Get the smb passwd entry for this user */
409 smb_pwent = getsmbpwnam(user_name);
410 if (smb_pwent == NULL) {
411 if(add_user == False) {
412 fprintf(stderr, "%s: Failed to find entry for user %s.\n",
413 prog_name, pwd->pw_name);
418 /* Create a new smb passwd entry and set it to the given password. */
420 struct smb_passwd new_smb_pwent;
422 new_smb_pwent.smb_userid = pwd->pw_uid;
423 new_smb_pwent.smb_name = pwd->pw_name;
424 new_smb_pwent.smb_passwd = NULL;
425 new_smb_pwent.smb_nt_passwd = NULL;
426 new_smb_pwent.acct_ctrl = (machine_account ? ACB_WSTRUST : ACB_NORMAL);
429 new_smb_pwent.acct_ctrl |= ACB_DISABLED;
430 } else if (set_no_password) {
431 new_smb_pwent.acct_ctrl |= ACB_PWNOTREQ;
433 new_smb_pwent.smb_passwd = new_p16;
434 new_smb_pwent.smb_nt_passwd = new_nt_p16;
437 if(add_smbpwd_entry(&new_smb_pwent) == False) {
438 fprintf(stderr, "%s: Failed to add entry for user %s.\n",
439 prog_name, pwd->pw_name);
445 printf("%s: Added user %s.\n", prog_name, user_name);
449 /* the entry already existed */
454 * We are root - just write the new password
455 * and the valid last change time.
460 * This currently won't work as it means changing
461 * the length of the record. JRA.
463 smb_pwent->acct_ctrl |= ACB_DISABLED;
464 smb_pwent->smb_passwd = NULL;
465 smb_pwent->smb_nt_passwd = NULL;
466 } else if (set_no_password) {
468 * This currently won't work as it means changing
469 * the length of the record. JRA.
471 smb_pwent->acct_ctrl |= ACB_PWNOTREQ;
472 smb_pwent->smb_passwd = NULL;
473 smb_pwent->smb_nt_passwd = NULL;
475 smb_pwent->smb_passwd = new_p16;
476 smb_pwent->smb_nt_passwd = new_nt_p16;
479 if(mod_smbpwd_entry(smb_pwent) == False) {
480 fprintf(stderr, "%s: Failed to modify entry for user %s.\n",
481 prog_name, pwd->pw_name);
488 printf("User %s disabled.\n", user_name);
489 else if (set_no_password)
490 printf("User %s - set to no password.\n", user_name);
492 printf("Password changed for user %s.\n", user_name);