Commit of a modified version of Andrew Bartlett's patch that removes the

horrid utmp hostname parameter - now uses the client name instead.
Also tidies up some of the unencrypted password checking when PAM
is compiled in.
FIXME ! An pam_accountcheck() is being called even when smb encrypted
passwords are negotiated. Is this the correct thing to do when winbindd
is running ! This needs *SEVERE* testing....
Jeremy.
(This used to be commit 071c799f479dd25efdb9c41745fc8f2beea7b568)

7 files changed, 225 insertions, 214 deletions

diff --git a/source3/auth/pampass.c b/source3/auth/pampass.c
index bf1aca1e2c..e84a045d49 100644
--- a/source3/auth/pampass.c
+++ b/source3/auth/pampass.c
@@ -61,8 +61,7 @@ static char *PAM_password;
 static BOOL pam_error_handler(pam_handle_t *pamh, int pam_error, char *msg, int dbglvl)
 {
 
-       	if( pam_error != PAM_SUCCESS)
-	{
+	if( pam_error != PAM_SUCCESS) {
 		DEBUG(dbglvl, ("PAM: %s : %s\n", msg, pam_strerror(pamh, pam_error)));
 		return False;
 	}
@@ -87,10 +86,8 @@ static int PAM_conv(int num_msg,
 	if (!reply)
 		return PAM_CONV_ERR;
 
-	for (replies = 0; replies < num_msg; replies++)
-	{
-		switch (msg[replies]->msg_style)
-		{
+	for (replies = 0; replies < num_msg; replies++) {
+		switch (msg[replies]->msg_style) {
 			case PAM_PROMPT_ECHO_ON:
 				reply[replies].resp_retcode = PAM_SUCCESS;
 			reply[replies].resp =
@@ -135,58 +132,58 @@ static struct pam_conv PAM_conversation = {
  */
 static BOOL proc_pam_end(pam_handle_t *pamh)
 {
-       int pam_error;
+	int pam_error;
        
-       if( pamh != NULL )
-       {
+	if( pamh != NULL ) {
 		pam_error = pam_end(pamh, 0);
 		if(pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
 			DEBUG(4, ("PAM: PAM_END OK.\n"));
-    			return True;
+			return True;
 		}
-       }
-       DEBUG(2,("PAM: not initialised"));
-       return False;
+	}
+	DEBUG(2,("PAM: not initialised"));
+	return False;
 }
 
 /*
  * Start PAM authentication for specified account
  */
-static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
+static BOOL proc_pam_start(pam_handle_t **pamh, char *user, char *rhost)
 {
-       int pam_error;
-       char * rhost;
+	int pam_error;
 
-       DEBUG(4,("PAM: Init user: %s\n", user));
+	DEBUG(4,("PAM: Init user: %s\n", user));
 
-       pam_error = pam_start("samba", user, &PAM_conversation, pamh);
-       if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
-	       proc_pam_end(*pamh);
-               return False;
-       }
+	pam_error = pam_start("samba", user, &PAM_conversation, pamh);
+	if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
+		proc_pam_end(*pamh);
+		return False;
+	}
 
-       rhost = client_name();
-       if (strcmp(rhost,"UNKNOWN") == 0)
-               rhost = client_addr();
+	if (rhost == NULL) {
+		rhost = client_name();
+		if (strequal(rhost,"UNKNOWN"))
+			rhost = client_addr();
+	}
 
 #ifdef PAM_RHOST
-       DEBUG(4,("PAM: setting rhost to: %s\n", rhost));
-       pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
-       if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
-	       proc_pam_end(*pamh);
-               return False;
-       }
+	DEBUG(4,("PAM: setting rhost to: %s\n", rhost));
+	pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
+	if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
+		proc_pam_end(*pamh);
+		return False;
+	}
 #endif
 #ifdef PAM_TTY
-       DEBUG(4,("PAM: setting tty\n"));
-       pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
-       if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
-	       proc_pam_end(*pamh);
-               return False;
-       }
+	DEBUG(4,("PAM: setting tty\n"));
+	pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
+	if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
+		proc_pam_end(*pamh);
+		return False;
+	}
 #endif
-       DEBUG(4,("PAM: Init passed for user: %s\n", user));
-       return True;
+	DEBUG(4,("PAM: Init passed for user: %s\n", user));
+	return True;
 }
 
 /*
@@ -201,7 +198,7 @@ static BOOL pam_auth(pam_handle_t *pamh, char *user, char *password)
 	 *	auth required /lib/security/pam_pwdb.so nullok shadow audit
 	 */
 	
-        DEBUG(4,("PAM: Authenticate User: %s\n", user));
+	DEBUG(4,("PAM: Authenticate User: %s\n", user));
 	pam_error = pam_authenticate(pamh, PAM_SILENT); /* Can we authenticate user? */
 	switch( pam_error ){
 		case PAM_AUTH_ERR:
@@ -243,7 +240,7 @@ static BOOL pam_account(pam_handle_t *pamh, char * user, char * password, BOOL p
 {
 	int pam_error;
 
-        DEBUG(4,("PAM: Account Management for User: %s\n", user));
+	DEBUG(4,("PAM: Account Management for User: %s\n", user));
 	pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
 	switch( pam_error ) {
 		case PAM_AUTHTOK_EXPIRED:
@@ -285,7 +282,7 @@ static BOOL pam_account(pam_handle_t *pamh, char * user, char * password, BOOL p
 	 * exporting an AFS cell, be able to /write/ to this cell.
 	 */
 
-        DEBUG(4,("PAM: Account Management SetCredentials for User: %s\n", user));
+	DEBUG(4,("PAM: Account Management SetCredentials for User: %s\n", user));
 	pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED|PAM_SILENT)); 
 	switch( pam_error ) {
 		case PAM_CRED_UNAVAIL:
@@ -321,49 +318,46 @@ static BOOL pam_account(pam_handle_t *pamh, char * user, char * password, BOOL p
  */
 static BOOL proc_pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL flag)
 {
-       int pam_error;
+	int pam_error;
 
-       PAM_password = NULL;
-       PAM_username = user;
+	PAM_password = NULL;
+	PAM_username = user;
 
 #ifdef PAM_TTY
-       DEBUG(4,("PAM: tty set to: %s\n", tty));
-       pam_error = pam_set_item(pamh, PAM_TTY, tty);
-       if (!pam_error_handler(pamh, pam_error, "set tty failed", 0)) {
-	       proc_pam_end(pamh);
-               return False;
-       }
+	DEBUG(4,("PAM: tty set to: %s\n", tty));
+	pam_error = pam_set_item(pamh, PAM_TTY, tty);
+	if (!pam_error_handler(pamh, pam_error, "set tty failed", 0)) {
+		proc_pam_end(pamh);
+		return False;
+	}
 #endif
 
-       if (flag) {
-         pam_error = pam_open_session(pamh, PAM_SILENT);
-         if (!pam_error_handler(pamh, pam_error, "session setup failed", 0)) {
-	       proc_pam_end(pamh);
-               return False;
-         }
-       }
-       else
-       {
-         pam_error = pam_close_session(pamh, PAM_SILENT);
-         if (!pam_error_handler(pamh, pam_error, "session close failed", 0)) {
-	       proc_pam_end(pamh);
-               return False;
-         }
-       }
-      return (True);
+	if (flag) {
+		pam_error = pam_open_session(pamh, PAM_SILENT);
+		if (!pam_error_handler(pamh, pam_error, "session setup failed", 0)) {
+			proc_pam_end(pamh);
+			return False;
+		}
+	} else {
+		pam_error = pam_close_session(pamh, PAM_SILENT);
+		if (!pam_error_handler(pamh, pam_error, "session close failed", 0)) {
+			proc_pam_end(pamh);
+			return False;
+		}
+	}
+	return (True);
 }
 
 /*
  * PAM Externally accessible Session handler
  */
-BOOL pam_session(BOOL flag, const char *in_user, char *tty)
+BOOL pam_session(BOOL flag, const char *in_user, char *tty, char *rhost)
 {
 	pam_handle_t *pamh = NULL;
 	char * user;
 
 	user = malloc(strlen(in_user)+1);
-	if ( user == NULL )
-	{
+	if ( user == NULL ) {
 		DEBUG(0, ("PAM: PAM_session Malloc Failed!\n"));
 		return False;
 	}
@@ -371,20 +365,16 @@ BOOL pam_session(BOOL flag, const char *in_user, char *tty)
 	/* This is freed by PAM */
 	StrnCpy(user, in_user, strlen(in_user)+1);
 
-	if (!proc_pam_start(&pamh, user))
-	{
-	  proc_pam_end(pamh);
-	  return False;
+	if (!proc_pam_start(&pamh, user, rhost)) {
+		proc_pam_end(pamh);
+		return False;
 	}
 
-	if (proc_pam_session(pamh, user, tty, flag))
-	{
-	  return proc_pam_end(pamh);
-	}
-	else
-	{
-	  proc_pam_end(pamh);
-	  return False;
+	if (proc_pam_session(pamh, user, tty, flag)) {
+		return proc_pam_end(pamh);
+	} else {
+		proc_pam_end(pamh);
+		return False;
 	}
 }
 
@@ -398,12 +388,10 @@ BOOL pam_accountcheck(char * user)
 	PAM_username = user;
 	PAM_password = NULL;
 
-	if( proc_pam_start(&pamh, user))
-	{
-			if ( pam_account(pamh, user, NULL, False))
-			{
-				return( proc_pam_end(pamh));
-			}
+	if( proc_pam_start(&pamh, user, NULL)) {
+		if ( pam_account(pamh, user, NULL, False)) {
+			return( proc_pam_end(pamh));
+		}
 	}
 	DEBUG(0, ("PAM: Account Validation Failed - Rejecting User!\n"));
 	return( False );
@@ -419,12 +407,9 @@ BOOL pam_passcheck(char * user, char * password)
 	PAM_username = user;
 	PAM_password = password;
 
-	if( proc_pam_start(&pamh, user))
-	{
-		if ( pam_auth(pamh, user, password))
-		{
-			if ( pam_account(pamh, user, password, True))
-			{
+	if( proc_pam_start(&pamh, user, NULL)) {
+		if ( pam_auth(pamh, user, password)) {
+			if ( pam_account(pamh, user, password, True)) {
 				return( proc_pam_end(pamh));
 			}
 		}
@@ -435,8 +420,10 @@ BOOL pam_passcheck(char * user, char * password)
 
 #else
 
- /* Do *NOT* make this function static. Doing so breaks the compile on gcc */
-
- void pampass_dummy_function( void ) { } /*This stops compiler complaints */
+/* If PAM not used, no PAM restrictions on accounts. */
+ BOOL pam_accountcheck(char * user)
+{
+	return True;
+}
 
 #endif /* WITH_PAM */
diff --git a/source3/auth/pass_check.c b/source3/auth/pass_check.c
index 236465bc90..08961e5099 100644
--- a/source3/auth/pass_check.c
+++ b/source3/auth/pass_check.c
@@ -681,12 +681,13 @@ the function pointer fn() points to a function to call when a successful
 match is found and is used to update the encrypted password file 
 return True on correct match, False otherwise
 ****************************************************************************/
+
 BOOL pass_check(char *user, char *password, int pwlen, struct passwd *pwd,
 		BOOL (*fn) (char *, char *))
 {
 	pstring pass2;
 	int level = lp_passwordlevel();
-	struct passwd *pass;
+	struct passwd *pass = NULL;
 
 	if (password)
 		password[pwlen] = 0;
@@ -708,8 +709,20 @@ BOOL pass_check(char *user, char *password, int pwlen, struct passwd *pwd,
 		pass = Get_Pwnam(user, True);
 	}
 
+#ifdef WITH_PAM
+
+	/*
+	 * If we're using PAM we want to short-circuit all the 
+	 * checks below and dive straight into the PAM code.
+	 */
+
+	fstrcpy(this_user, user);
+
+	DEBUG(4, ("pass_check: Checking (PAM) password for user %s (l=%d)\n", user, pwlen));
+
+#else /* Not using PAM */
 
-	DEBUG(4, ("Checking password for user %s (l=%d)\n", user, pwlen));
+	DEBUG(4, ("pass_check: Checking password for user %s (l=%d)\n", user, pwlen));
 
 	if (!pass) {
 		DEBUG(3, ("Couldn't find user %s\n", user));
@@ -802,6 +815,8 @@ BOOL pass_check(char *user, char *password, int pwlen, struct passwd *pwd,
 		}
 	}
 
+#endif /* WITH_PAM */
+
 	/* try it as it came to us */
 	if (password_check(password)) {
 		if (fn)
diff --git a/source3/include/proto.h b/source3/include/proto.h
index a53dab7f71..bb5bc6ea32 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1922,7 +1922,7 @@ BOOL pdb_generate_sam_sid(void);
 
 /*The following definitions come from  passdb/pampass.c  */
 
-BOOL pam_session(BOOL flag, const char *in_user, char *tty);
+BOOL pam_session(BOOL flag, const char *in_user, char *tty, char *rhost);
 BOOL pam_accountcheck(char * user);
 BOOL pam_passcheck(char * user, char * password);
 
diff --git a/source3/passdb/pampass.c b/source3/passdb/pampass.c
index bf1aca1e2c..e84a045d49 100644
--- a/source3/passdb/pampass.c
+++ b/source3/passdb/pampass.c
@@ -61,8 +61,7 @@ static char *PAM_password;
 static BOOL pam_error_handler(pam_handle_t *pamh, int pam_error, char *msg, int dbglvl)
 {
 
-       	if( pam_error != PAM_SUCCESS)
-	{
+	if( pam_error != PAM_SUCCESS) {
 		DEBUG(dbglvl, ("PAM: %s : %s\n", msg, pam_strerror(pamh, pam_error)));
 		return False;
 	}
@@ -87,10 +86,8 @@ static int PAM_conv(int num_msg,
 	if (!reply)
 		return PAM_CONV_ERR;
 
-	for (replies = 0; replies < num_msg; replies++)
-	{
-		switch (msg[replies]->msg_style)
-		{
+	for (replies = 0; replies < num_msg; replies++) {
+		switch (msg[replies]->msg_style) {
 			case PAM_PROMPT_ECHO_ON:
 				reply[replies].resp_retcode = PAM_SUCCESS;
 			reply[replies].resp =
@@ -135,58 +132,58 @@ static struct pam_conv PAM_conversation = {
  */
 static BOOL proc_pam_end(pam_handle_t *pamh)
 {
-       int pam_error;
+	int pam_error;
        
-       if( pamh != NULL )
-       {
+	if( pamh != NULL ) {
 		pam_error = pam_end(pamh, 0);
 		if(pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
 			DEBUG(4, ("PAM: PAM_END OK.\n"));
-    			return True;
+			return True;
 		}
-       }
-       DEBUG(2,("PAM: not initialised"));
-       return False;
+	}
+	DEBUG(2,("PAM: not initialised"));
+	return False;
 }
 
 /*
  * Start PAM authentication for specified account
  */
-static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
+static BOOL proc_pam_start(pam_handle_t **pamh, char *user, char *rhost)
 {
-       int pam_error;
-       char * rhost;
+	int pam_error;
 
-       DEBUG(4,("PAM: Init user: %s\n", user));
+	DEBUG(4,("PAM: Init user: %s\n", user));
 
-       pam_error = pam_start("samba", user, &PAM_conversation, pamh);
-       if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
-	       proc_pam_end(*pamh);
-               return False;
-       }
+	pam_error = pam_start("samba", user, &PAM_conversation, pamh);
+	if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
+		proc_pam_end(*pamh);
+		return False;
+	}
 
-       rhost = client_name();
-       if (strcmp(rhost,"UNKNOWN") == 0)
-               rhost = client_addr();
+	if (rhost == NULL) {
+		rhost = client_name();
+		if (strequal(rhost,"UNKNOWN"))
+			rhost = client_addr();
+	}
 
 #ifdef PAM_RHOST
-       DEBUG(4,("PAM: setting rhost to: %s\n", rhost));
-       pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
-       if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
-	       proc_pam_end(*pamh);
-               return False;
-       }
+	DEBUG(4,("PAM: setting rhost to: %s\n", rhost));
+	pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
+	if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
+		proc_pam_end(*pamh);
+		return False;
+	}
 #endif
 #ifdef PAM_TTY
-       DEBUG(4,("PAM: setting tty\n"));
-       pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
-       if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
-	       proc_pam_end(*pamh);
-               return False;
-       }
+	DEBUG(4,("PAM: setting tty\n"));
+	pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
+	if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
+		proc_pam_end(*pamh);
+		return False;
+	}
 #endif
-       DEBUG(4,("PAM: Init passed for user: %s\n", user));
-       return True;
+	DEBUG(4,("PAM: Init passed for user: %s\n", user));
+	return True;
 }
 
 /*
@@ -201,7 +198,7 @@ static BOOL pam_auth(pam_handle_t *pamh, char *user, char *password)
 	 *	auth required /lib/security/pam_pwdb.so nullok shadow audit
 	 */
 	
-        DEBUG(4,("PAM: Authenticate User: %s\n", user));
+	DEBUG(4,("PAM: Authenticate User: %s\n", user));
 	pam_error = pam_authenticate(pamh, PAM_SILENT); /* Can we authenticate user? */
 	switch( pam_error ){
 		case PAM_AUTH_ERR:
@@ -243,7 +240,7 @@ static BOOL pam_account(pam_handle_t *pamh, char * user, char * password, BOOL p
 {
 	int pam_error;
 
-        DEBUG(4,("PAM: Account Management for User: %s\n", user));
+	DEBUG(4,("PAM: Account Management for User: %s\n", user));
 	pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
 	switch( pam_error ) {
 		case PAM_AUTHTOK_EXPIRED:
@@ -285,7 +282,7 @@ static BOOL pam_account(pam_handle_t *pamh, char * user, char * password, BOOL p
 	 * exporting an AFS cell, be able to /write/ to this cell.
 	 */
 
-        DEBUG(4,("PAM: Account Management SetCredentials for User: %s\n", user));
+	DEBUG(4,("PAM: Account Management SetCredentials for User: %s\n", user));
 	pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED|PAM_SILENT)); 
 	switch( pam_error ) {
 		case PAM_CRED_UNAVAIL:
@@ -321,49 +318,46 @@ static BOOL pam_account(pam_handle_t *pamh, char * user, char * password, BOOL p
  */
 static BOOL proc_pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL flag)
 {
-       int pam_error;
+	int pam_error;
 
-       PAM_password = NULL;
-       PAM_username = user;
+	PAM_password = NULL;
+	PAM_username = user;
 
 #ifdef PAM_TTY
-       DEBUG(4,("PAM: tty set to: %s\n", tty));
-       pam_error = pam_set_item(pamh, PAM_TTY, tty);
-       if (!pam_error_handler(pamh, pam_error, "set tty failed", 0)) {
-	       proc_pam_end(pamh);
-               return False;
-       }
+	DEBUG(4,("PAM: tty set to: %s\n", tty));
+	pam_error = pam_set_item(pamh, PAM_TTY, tty);
+	if (!pam_error_handler(pamh, pam_error, "set tty failed", 0)) {
+		proc_pam_end(pamh);
+		return False;
+	}
 #endif
 
-       if (flag) {
-         pam_error = pam_open_session(pamh, PAM_SILENT);
-         if (!pam_error_handler(pamh, pam_error, "session setup failed", 0)) {
-	       proc_pam_end(pamh);
-               return False;
-         }
-       }
-       else
-       {
-         pam_error = pam_close_session(pamh, PAM_SILENT);
-         if (!pam_error_handler(pamh, pam_error, "session close failed", 0)) {
-	       proc_pam_end(pamh);
-               return False;
-         }
-       }
-      return (True);
+	if (flag) {
+		pam_error = pam_open_session(pamh, PAM_SILENT);
+		if (!pam_error_handler(pamh, pam_error, "session setup failed", 0)) {
+			proc_pam_end(pamh);
+			return False;
+		}
+	} else {
+		pam_error = pam_close_session(pamh, PAM_SILENT);
+		if (!pam_error_handler(pamh, pam_error, "session close failed", 0)) {
+			proc_pam_end(pamh);
+			return False;
+		}
+	}
+	return (True);
 }
 
 /*
  * PAM Externally accessible Session handler
  */
-BOOL pam_session(BOOL flag, const char *in_user, char *tty)
+BOOL pam_session(BOOL flag, const char *in_user, char *tty, char *rhost)
 {
 	pam_handle_t *pamh = NULL;
 	char * user;
 
 	user = malloc(strlen(in_user)+1);
-	if ( user == NULL )
-	{
+	if ( user == NULL ) {
 		DEBUG(0, ("PAM: PAM_session Malloc Failed!\n"));
 		return False;
 	}
@@ -371,20 +365,16 @@ BOOL pam_session(BOOL flag, const char *in_user, char *tty)
 	/* This is freed by PAM */
 	StrnCpy(user, in_user, strlen(in_user)+1);
 
-	if (!proc_pam_start(&pamh, user))
-	{
-	  proc_pam_end(pamh);
-	  return False;
+	if (!proc_pam_start(&pamh, user, rhost)) {
+		proc_pam_end(pamh);
+		return False;
 	}
 
-	if (proc_pam_session(pamh, user, tty, flag))
-	{
-	  return proc_pam_end(pamh);
-	}
-	else
-	{
-	  proc_pam_end(pamh);
-	  return False;
+	if (proc_pam_session(pamh, user, tty, flag)) {
+		return proc_pam_end(pamh);
+	} else {
+		proc_pam_end(pamh);
+		return False;
 	}
 }
 
@@ -398,12 +388,10 @@ BOOL pam_accountcheck(char * user)
 	PAM_username = user;
 	PAM_password = NULL;
 
-	if( proc_pam_start(&pamh, user))
-	{
-			if ( pam_account(pamh, user, NULL, False))
-			{
-				return( proc_pam_end(pamh));
-			}
+	if( proc_pam_start(&pamh, user, NULL)) {
+		if ( pam_account(pamh, user, NULL, False)) {
+			return( proc_pam_end(pamh));
+		}
 	}
 	DEBUG(0, ("PAM: Account Validation Failed - Rejecting User!\n"));
 	return( False );
@@ -419,12 +407,9 @@ BOOL pam_passcheck(char * user, char * password)
 	PAM_username = user;
 	PAM_password = password;
 
-	if( proc_pam_start(&pamh, user))
-	{
-		if ( pam_auth(pamh, user, password))
-		{
-			if ( pam_account(pamh, user, password, True))
-			{
+	if( proc_pam_start(&pamh, user, NULL)) {
+		if ( pam_auth(pamh, user, password)) {
+			if ( pam_account(pamh, user, password, True)) {
 				return( proc_pam_end(pamh));
 			}
 		}
@@ -435,8 +420,10 @@ BOOL pam_passcheck(char * user, char * password)
 
 #else
 
- /* Do *NOT* make this function static. Doing so breaks the compile on gcc */
-
- void pampass_dummy_function( void ) { } /*This stops compiler complaints */
+/* If PAM not used, no PAM restrictions on accounts. */
+ BOOL pam_accountcheck(char * user)
+{
+	return True;
+}
 
 #endif /* WITH_PAM */
diff --git a/source3/passdb/pass_check.c b/source3/passdb/pass_check.c
index 236465bc90..08961e5099 100644
--- a/source3/passdb/pass_check.c
+++ b/source3/passdb/pass_check.c
@@ -681,12 +681,13 @@ the function pointer fn() points to a function to call when a successful
 match is found and is used to update the encrypted password file 
 return True on correct match, False otherwise
 ****************************************************************************/
+
 BOOL pass_check(char *user, char *password, int pwlen, struct passwd *pwd,
 		BOOL (*fn) (char *, char *))
 {
 	pstring pass2;
 	int level = lp_passwordlevel();
-	struct passwd *pass;
+	struct passwd *pass = NULL;
 
 	if (password)
 		password[pwlen] = 0;
@@ -708,8 +709,20 @@ BOOL pass_check(char *user, char *password, int pwlen, struct passwd *pwd,
 		pass = Get_Pwnam(user, True);
 	}
 
+#ifdef WITH_PAM
+
+	/*
+	 * If we're using PAM we want to short-circuit all the 
+	 * checks below and dive straight into the PAM code.
+	 */
+
+	fstrcpy(this_user, user);
+
+	DEBUG(4, ("pass_check: Checking (PAM) password for user %s (l=%d)\n", user, pwlen));
+
+#else /* Not using PAM */
 
-	DEBUG(4, ("Checking password for user %s (l=%d)\n", user, pwlen));
+	DEBUG(4, ("pass_check: Checking password for user %s (l=%d)\n", user, pwlen));
 
 	if (!pass) {
 		DEBUG(3, ("Couldn't find user %s\n", user));
@@ -802,6 +815,8 @@ BOOL pass_check(char *user, char *password, int pwlen, struct passwd *pwd,
 		}
 	}
 
+#endif /* WITH_PAM */
+
 	/* try it as it came to us */
 	if (password_check(password)) {
 		if (fn)
diff --git a/source3/smbd/password.c b/source3/smbd/password.c
index 6c0fe79845..698c6a1356 100644
--- a/source3/smbd/password.c
+++ b/source3/smbd/password.c
@@ -606,24 +606,33 @@ return True if the password is correct, False otherwise
 ****************************************************************************/
 BOOL password_ok(char *user, char *password, int pwlen, struct passwd *pwd)
 {
+	BOOL ret;
+
 	if ((pwlen == 0) && !lp_null_passwords()) {
 		DEBUG(4,("Null passwords not allowed.\n"));
 		return False;
 	}
 
-	if (pwlen == 24 || (lp_encrypted_passwords() && (pwlen == 0) && lp_null_passwords()))
-	{
+	if (pwlen == 24 || (lp_encrypted_passwords() && (pwlen == 0) && lp_null_passwords())) {
 		/* if 24 bytes long assume it is an encrypted password */
 		uchar challenge[8];
 
-		if (!last_challenge(challenge))
-		{
+		if (!last_challenge(challenge)) {
 			DEBUG(0,("Error: challenge not done for user=%s\n", user));
 			return False;
 		}
 
-		return pass_check_smb(user, global_myworkgroup,
+		ret = pass_check_smb(user, global_myworkgroup,
 		                      challenge, (uchar *)password, (uchar *)password, pwd);
+
+		/*
+		 * Try with PAM (may not be compiled in - returns True if not. JRA).
+		 * FIXME ! Should this be called if we're using winbindd ? What about
+		 * non-local accounts ? JRA.
+		 */
+
+		if (ret)
+			return pam_accountcheck(user);
 	} 
 
 	return pass_check(user, password, pwlen, pwd, 
diff --git a/source3/smbd/session.c b/source3/smbd/session.c
index 4ede1d9a68..fb13019812 100644
--- a/source3/smbd/session.c
+++ b/source3/smbd/session.c
@@ -51,6 +51,7 @@ BOOL session_claim(uint16 vuid)
 	uint32 pid = (uint32)sys_getpid();
 	TDB_DATA key;		
 	fstring keystr;
+	char * hostname;
 
 	vuser->session_id = 0;
 
@@ -88,15 +89,12 @@ BOOL session_claim(uint16 vuid)
 		return False;
 	}
 
+	hostname = client_name();
+	if (strequal(hostname,"UNKNOWN"))
+		hostname = client_addr();
+
 	fstrcpy(sessionid.username, vuser->user.unix_name);
-#if WITH_UTMP	
-	fstrcpy(sessionid.hostname, lp_utmp_hostname());
-#else
-	{
-		extern fstring remote_machine;
-		fstrcpy(sessionid.hostname, remote_machine);
-	}
-#endif
+	fstrcpy(sessionid.hostname, hostname);
 	slprintf(sessionid.id_str, sizeof(sessionid.id_str)-1, SESSION_TEMPLATE, i);
 	sessionid.id_num = i;
 	sessionid.pid = pid;
@@ -113,7 +111,7 @@ BOOL session_claim(uint16 vuid)
 	}
 
 #if WITH_PAM
-	if (!pam_session(True, sessionid.username, sessionid.id_str)) {
+	if (!pam_session(True, sessionid.username, sessionid.id_str, sessionid.hostname)) {
 		DEBUG(1,("pam_session rejected the session for %s [%s]\n",
 			 sessionid.username, sessionid.id_str));
 		tdb_delete(tdb, key);
@@ -169,7 +167,7 @@ void session_yield(uint16 vuid)
 #endif
 
 #if WITH_PAM
-	pam_session(False, sessionid.username, sessionid.id_str);
+	pam_session(False, sessionid.username, sessionid.id_str, sessionid.hostname);
 #endif
 
 	tdb_delete(tdb, key);