/*
- Unix SMB/Netbios implementation.
- Version 1.9.
+ Unix SMB/CIFS implementation.
Password checking
Copyright (C) Andrew Tridgell 1992-1998
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
#include "includes.h"
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_AUTH
+
/* these are kept here to keep the string_combinations function simple */
static fstring this_user;
-#if !(defined(WITH_PAM) || defined(KRB4_AUTH) || defined(KRB5_AUTH))
+#if !defined(WITH_PAM)
static fstring this_salt;
static fstring this_crypted;
#endif
********************************************************************/
static BOOL dfs_auth(char *user, char *password)
{
+ struct tm *t;
error_status_t err;
int err2;
int prterr;
}
/*
- * NB. I'd like to change these to call something like become_user()
+ * NB. I'd like to change these to call something like change_to_user()
* instead but currently we don't have a connection
* context to become the correct user. This is already
* fairly platform specific code however, so I think
set_effective_uid(0);
set_effective_gid(0);
- DEBUG(0,
- ("DCE context expires: %s", asctime(localtime(&expire_time))));
+ t = localtime(&expire_time);
+ if (t) {
+ const char *asct = asctime(t);
+ if (asct) {
+ DEBUG(0,("DCE context expires: %s", asct));
+ }
+ }
dcelogin_atmost_once = 1;
return (True);
}
#endif
-#ifdef KRB5_AUTH
-
-#include <krb5.h>
-
-/*******************************************************************
-check on Kerberos authentication
-********************************************************************/
-static BOOL krb5_auth(char *user, char *password)
-{
- krb5_data tgtname = {
- 0,
- KRB5_TGS_NAME_SIZE,
- KRB5_TGS_NAME
- };
- krb5_context kcontext;
- krb5_principal kprinc;
- krb5_principal server;
- krb5_creds kcreds;
- int options = 0;
- krb5_address **addrs = (krb5_address **) 0;
- krb5_preauthtype *preauth = NULL;
- krb5_keytab keytab = NULL;
- krb5_timestamp now;
- krb5_ccache ccache = NULL;
- int retval;
- char *name;
-
- if (retval = krb5_init_context(&kcontext))
- {
- return (False);
- }
-
- if (retval = krb5_timeofday(kcontext, &now))
- {
- return (False);
- }
-
- if (retval = krb5_cc_default(kcontext, &ccache))
- {
- return (False);
- }
-
- if (retval = krb5_parse_name(kcontext, user, &kprinc))
- {
- return (False);
- }
-
- ZERO_STRUCT(kcreds);
-
- kcreds.client = kprinc;
-
- if ((retval = krb5_build_principal_ext(kcontext, &server,
- krb5_princ_realm(kcontext,
- kprinc)->
- length,
- krb5_princ_realm(kcontext,
- kprinc)->data,
- tgtname.length, tgtname.data,
- krb5_princ_realm(kcontext,
- kprinc)->
- length,
- krb5_princ_realm(kcontext,
- kprinc)->data,
- 0)))
- {
- return (False);
- }
-
- kcreds.server = server;
-
- retval = krb5_get_in_tkt_with_password(kcontext,
- options,
- addrs,
- NULL,
- preauth,
- password, 0, &kcreds, 0);
-
- if (retval)
- {
- return (False);
- }
-
- return (True);
-}
-#endif /* KRB5_AUTH */
-
-#ifdef KRB4_AUTH
-#include <krb.h>
-
-/*******************************************************************
-check on Kerberos authentication
-********************************************************************/
-static BOOL krb4_auth(char *user, char *password)
-{
- char realm[REALM_SZ];
- char tkfile[MAXPATHLEN];
-
- if (krb_get_lrealm(realm, 1) != KSUCCESS)
- {
- (void)safe_strcpy(realm, KRB_REALM, sizeof(realm) - 1);
- }
-
- (void)slprintf(tkfile, sizeof(tkfile) - 1, "/tmp/samba_tkt_%d",
- (int)sys_getpid());
-
- krb_set_tkt_string(tkfile);
- if (krb_verify_user(user, "", realm, password, 0, "rmcd") == KSUCCESS)
- {
- unlink(tkfile);
- return 1;
- }
- unlink(tkfile);
- return 0;
-}
-#endif /* KRB4_AUTH */
-
#ifdef LINUX_BIGCRYPT
/****************************************************************************
an enhanced crypt for Linux to handle password longer than 8 characters
offset is the first char to try and change (start with 0)
it assumes the string starts lowercased
****************************************************************************/
-static NTSTATUS string_combinations2(char *s, int offset, NTSTATUS (*fn) (char *),
+static NTSTATUS string_combinations2(char *s, int offset, NTSTATUS (*fn) (const char *),
int N)
{
int len = strlen(s);
for (i = offset; i < (len - (N - 1)); i++) {
char c = s[i];
- if (!islower(c))
+ if (!islower_ascii(c))
continue;
- s[i] = toupper(c);
+ s[i] = toupper_ascii(c);
if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, i + 1, fn, N - 1),NT_STATUS_WRONG_PASSWORD)) {
return (nt_status);
}
offset is the first char to try and change (start with 0)
it assumes the string starts lowercased
****************************************************************************/
-static NTSTATUS string_combinations(char *s, NTSTATUS (*fn) (char *), int N)
+static NTSTATUS string_combinations(char *s, NTSTATUS (*fn) (const char *), int N)
{
int n;
NTSTATUS nt_status;
/****************************************************************************
core of password checking routine
****************************************************************************/
-static NTSTATUS password_check(char *password)
+static NTSTATUS password_check(const char *password)
{
#ifdef WITH_PAM
return smb_pam_passcheck(this_user, password);
-#elif defined(KRB5_AUTH)
- return krb5_auth(this_user, password) ? NT_STATUS_WRONG_PASSWORD : NT_STATUS_OK;
-#elif defined(KRB4_AUTH)
- return krb4_auth(this_user, password) ? NT_STATUS_WRONG_PASSWORD : NT_STATUS_OK;
#else
BOOL ret;
}
#endif /* HAVE_CRYPT */
#endif /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
-#endif /* WITH_PAM || KRB4_AUTH || KRB5_AUTH */
+#endif /* WITH_PAM */
}
return NT_STATUS_OK on correct match, appropriate error otherwise
****************************************************************************/
-NTSTATUS pass_check(struct passwd *pass, char *user, char *password,
- int pwlen, BOOL (*fn) (char *, char *), BOOL run_cracker)
+NTSTATUS pass_check(const struct passwd *pass, const char *user, const char *password,
+ int pwlen, BOOL (*fn) (const char *, const char *), BOOL run_cracker)
{
pstring pass2;
int level = lp_passwordlevel();
NTSTATUS nt_status;
- if (password)
- password[pwlen] = 0;
-#if DEBUG_PASSWORD
+#ifdef DEBUG_PASSWORD
DEBUG(100, ("checking user=[%s] pass=[%s]\n", user, password));
#endif
if (((!*password) || (!pwlen)) && !lp_null_passwords())
return NT_STATUS_LOGON_FAILURE;
-#if defined(WITH_PAM) || defined(KRB4_AUTH) || defined(KRB5_AUTH)
+#if defined(WITH_PAM)
/*
* If we're using PAM we want to short-circuit all the
DEBUG(4, ("pass_check: Checking (PAM) password for user %s (l=%d)\n", user, pwlen));
-#else /* Not using PAM or Kerebos */
+#else /* Not using PAM */
DEBUG(4, ("pass_check: Checking password for user %s (l=%d)\n", user, pwlen));
return NT_STATUS_NO_SUCH_USER;
}
+
+ /* Copy into global for the convenience of looping code */
+ /* Also the place to keep the 'password' no matter what
+ crazy struct it started in... */
+ fstrcpy(this_crypted, pass->pw_passwd);
+ fstrcpy(this_salt, pass->pw_passwd);
+
#ifdef HAVE_GETSPNAM
{
struct spwd *spass;
perhaps for IPC password changing requests */
spass = getspnam(pass->pw_name);
- if (spass && spass->sp_pwdp)
- pstrcpy(pass->pw_passwd, spass->sp_pwdp);
+ if (spass && spass->sp_pwdp) {
+ fstrcpy(this_crypted, spass->sp_pwdp);
+ fstrcpy(this_salt, spass->sp_pwdp);
+ }
}
#elif defined(IA_UINFO)
{
{
struct pr_passwd *pr_pw = getprpwnam(pass->pw_name);
if (pr_pw && pr_pw->ufld.fd_encrypt)
- pstrcpy(pass->pw_passwd, pr_pw->ufld.fd_encrypt);
+ fstrcpy(this_crypted, pr_pw->ufld.fd_encrypt);
+ }
+#endif
+
+#ifdef HAVE_GETPWANAM
+ {
+ struct passwd_adjunct *pwret;
+ pwret = getpwanam(s);
+ if (pwret && pwret->pwa_passwd)
+ fstrcpy(this_crypted, pwret->pwa_passwd);
}
#endif
user));
mypasswd = getprpwnam(user);
if (mypasswd) {
- fstrcpy(pass->pw_name, mypasswd->ufld.fd_name);
- fstrcpy(pass->pw_passwd, mypasswd->ufld.fd_encrypt);
+ fstrcpy(this_user, mypasswd->ufld.fd_name);
+ fstrcpy(this_crypted, mypasswd->ufld.fd_encrypt);
} else {
DEBUG(5,
("OSF1_ENH_SEC: No entry for user %s in protected database !\n",
{
AUTHORIZATION *ap = getauthuid(pass->pw_uid);
if (ap) {
- fstrcpy(pass->pw_passwd, ap->a_password);
+ fstrcpy(this_crypted, ap->a_password);
endauthent();
}
}
#endif
- /* extract relevant info */
- fstrcpy(this_salt, pass->pw_passwd);
-
#if defined(HAVE_TRUNCATED_SALT)
/* crypt on some platforms (HPUX in particular)
won't work with more than 2 salt characters. */
this_salt[2] = 0;
#endif
- fstrcpy(this_crypted, pass->pw_passwd);
-
if (!*this_crypted) {
if (!lp_null_passwords()) {
DEBUG(2, ("Disallowing %s with null password\n",
}
}
-#endif /* defined(WITH_PAM) || defined(KRB4_AUTH) || defined(KRB5_AUTH) */
+#endif /* defined(WITH_PAM) */
/* try it as it came to us */
nt_status = password_check(password);
}
/* make a copy of it */
- StrnCpy(pass2, password, sizeof(pstring) - 1);
+ pstrcpy(pass2, password);
/* try all lowercase if it's currently all uppercase */
- if (strhasupper(password)) {
- strlower(password);
- if NT_STATUS_IS_OK(nt_status = password_check(password)) {
+ if (strhasupper(pass2)) {
+ strlower_m(pass2);
+ if NT_STATUS_IS_OK(nt_status = password_check(pass2)) {
if (fn)
- fn(user, password);
+ fn(user, pass2);
return (nt_status);
}
}
/* give up? */
if (level < 1) {
- /* restore it */
- fstrcpy(password, pass2);
return NT_STATUS_WRONG_PASSWORD;
}
/* last chance - all combinations of up to level chars upper! */
- strlower(password);
-
+ strlower_m(pass2);
- if NT_STATUS_IS_OK(nt_status = string_combinations(password, password_check, level)) {
+ if (NT_STATUS_IS_OK(nt_status = string_combinations(pass2, password_check, level))) {
if (fn)
- fn(user, password);
+ fn(user, pass2);
return nt_status;
}
- /* restore it */
- fstrcpy(password, pass2);
-
return NT_STATUS_WRONG_PASSWORD;
}
git.samba.org / sfrench / samba-autobuild / .git / blobdiff