Move pass_check.c over to NTSTATUS, allowing full NTSTATUS from PAM to wire!

Add the ability for swat to run in non-root-mode (ie non-root from inetd).
 - we still need some of the am_root() calls fixed however.
(This used to be commit 2c2317c56ee13abdbdbc866363c3b52dab826e3c)

5 files changed, 247 insertions, 174 deletions

diff --git a/source3/auth/auth_unix.c b/source3/auth/auth_unix.c
index 4740f7fb0d..5582682d98 100644
--- a/source3/auth/auth_unix.c
+++ b/source3/auth/auth_unix.c
@@ -77,14 +77,14 @@ NTSTATUS check_unix_security(const auth_usersupplied_info *user_info, auth_serve
 	
 	pass = Get_Pwnam(user_info->unix_username.str, False);
 
-	nt_status = (pass_check(pass,
+	nt_status = pass_check(pass,
 				pass ? pass->pw_name : user_info->unix_username.str, 
 				user_info->plaintext_password.str,
 				user_info->plaintext_password.len,
 				lp_update_encrypted() ? 
 				update_smbpassword_file : NULL,
-				True) 
-		     ? NT_STATUS_OK : NT_STATUS_LOGON_FAILURE);
+				True);
+
 	unbecome_root();
 
 	return nt_status;
diff --git a/source3/auth/pass_check.c b/source3/auth/pass_check.c
index 7426bfcbe3..594983e53b 100644
--- a/source3/auth/pass_check.c
+++ b/source3/auth/pass_check.c
@@ -28,8 +28,10 @@ extern int DEBUGLEVEL;
 
 /* these are kept here to keep the string_combinations function simple */
 static fstring this_user;
+#if !(defined(WITH_PAM) || defined(KRB4_AUTH) || defined(KRB5_AUTH))
 static fstring this_salt;
 static fstring this_crypted;
+#endif
 
 #ifdef WITH_AFS
 
@@ -550,11 +552,12 @@ try all combinations with N uppercase letters.
 offset is the first char to try and change (start with 0)
 it assumes the string starts lowercased
 ****************************************************************************/
-static BOOL string_combinations2(char *s, int offset, BOOL (*fn) (char *),
+static NTSTATUS string_combinations2(char *s, int offset, NTSTATUS (*fn) (char *),
 				 int N)
 {
 	int len = strlen(s);
 	int i;
+	NTSTATUS nt_status;
 
 #ifdef PASSWORD_LENGTH
 	len = MIN(len, PASSWORD_LENGTH);
@@ -568,11 +571,12 @@ static BOOL string_combinations2(char *s, int offset, BOOL (*fn) (char *),
 		if (!islower(c))
 			continue;
 		s[i] = toupper(c);
-		if (string_combinations2(s, i + 1, fn, N - 1))
-			return (True);
+		if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, i + 1, fn, N - 1),NT_STATUS_WRONG_PASSWORD)) {
+			return (nt_status);
+		}
 		s[i] = c;
 	}
-	return (False);
+	return (NT_STATUS_WRONG_PASSWORD);
 }
 
 /****************************************************************************
@@ -582,71 +586,80 @@ try all combinations with up to N uppercase letters.
 offset is the first char to try and change (start with 0)
 it assumes the string starts lowercased
 ****************************************************************************/
-static BOOL string_combinations(char *s, BOOL (*fn) (char *), int N)
+static NTSTATUS string_combinations(char *s, NTSTATUS (*fn) (char *), int N)
 {
 	int n;
+	NTSTATUS nt_status;
 	for (n = 1; n <= N; n++)
-		if (string_combinations2(s, 0, fn, n))
-			return (True);
-	return (False);
+		if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, 0, fn, n), NT_STATUS_WRONG_PASSWORD))
+			return nt_status;
+	return NT_STATUS_WRONG_PASSWORD;
 }
 
 
 /****************************************************************************
 core of password checking routine
 ****************************************************************************/
-static BOOL password_check(char *password)
+static NTSTATUS password_check(char *password)
 {
-
 #ifdef WITH_PAM
-	return NT_STATUS_IS_OK(smb_pam_passcheck(this_user, password));
-#endif /* WITH_PAM */
+	return smb_pam_passcheck(this_user, password);
+#elif defined(KRB5_AUTH)
+	return krb5_auth(this_user, password) ? NT_STATUS_WRONG_PASSWORD : NT_STATUS_OK;
+#elif defined(KRB4_AUTH)
+	return krb4_auth(this_user, password) ? NT_STATUS_WRONG_PASSWORD : NT_STATUS_OK;
+#else
+
+	BOOL ret;
 
 #ifdef WITH_AFS
 	if (afs_auth(this_user, password))
-		return (True);
+		return NT_STATUS_OK;
 #endif /* WITH_AFS */
 
 #ifdef WITH_DFS
 	if (dfs_auth(this_user, password))
-		return (True);
+		return NT_STATUS_OK;
 #endif /* WITH_DFS */
 
-#ifdef KRB5_AUTH
-	if (krb5_auth(this_user, password))
-		return (True);
-#endif /* KRB5_AUTH */
-
-#ifdef KRB4_AUTH
-	if (krb4_auth(this_user, password))
-		return (True);
-#endif /* KRB4_AUTH */
-
 #ifdef OSF1_ENH_SEC
-	{
-		BOOL ret =
-			(strcmp
-			 (osf1_bigcrypt(password, this_salt),
-			  this_crypted) == 0);
-		if (!ret) {
-			DEBUG(2,
-			      ("OSF1_ENH_SEC failed. Trying normal crypt.\n"));
-			ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
-		}
-		return ret;
-	}
+	
+	ret = (strcmp(osf1_bigcrypt(password, this_salt),
+		      this_crypted) == 0);
+	if (!ret) {
+		DEBUG(2,
+		      ("OSF1_ENH_SEC failed. Trying normal crypt.\n"));
+		ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+	}
+	if (ret) {
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+	
 #endif /* OSF1_ENH_SEC */
-
+	
 #ifdef ULTRIX_AUTH
-	return (strcmp((char *)crypt16(password, this_salt), this_crypted) == 0);
+	ret = (strcmp((char *)crypt16(password, this_salt), this_crypted) == 0);
+	if (ret) {
+		return NT_STATUS_OK;
+        } else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+	
 #endif /* ULTRIX_AUTH */
-
+	
 #ifdef LINUX_BIGCRYPT
-	return (linux_bigcrypt(password, this_salt, this_crypted));
+	ret = (linux_bigcrypt(password, this_salt, this_crypted));
+        if (ret) {
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
 #endif /* LINUX_BIGCRYPT */
-
+	
 #if defined(HAVE_BIGCRYPT) && defined(HAVE_CRYPT) && defined(USE_BOTH_CRYPT_CALLS)
-
+	
 	/*
 	 * Some systems have bigcrypt in the C library but might not
 	 * actually use it for the password hashes (HPUX 10.20) is
@@ -655,39 +668,56 @@ static BOOL password_check(char *password)
 	 */
 
 	if (strcmp(bigcrypt(password, this_salt), this_crypted) == 0)
-		return True;
+		return NT_STATUS_OK;
 	else
-		return (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+		ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+	if (ret) {
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
 #else /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
-
+	
 #ifdef HAVE_BIGCRYPT
-	return (strcmp(bigcrypt(password, this_salt), this_crypted) == 0);
+	ret = (strcmp(bigcrypt(password, this_salt), this_crypted) == 0);
+        if (ret) {
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
 #endif /* HAVE_BIGCRYPT */
-
+	
 #ifndef HAVE_CRYPT
 	DEBUG(1, ("Warning - no crypt available\n"));
-	return (False);
+	return NT_STATUS_LOGON_FAILURE;
 #else /* HAVE_CRYPT */
-	return (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+	ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+        if (ret) {
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
 #endif /* HAVE_CRYPT */
 #endif /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
+#endif /* WITH_PAM || KRB4_AUTH || KRB5_AUTH */
 }
 
 
 
 /****************************************************************************
-check if a username/password is OK
+CHECK if a username/password is OK
 the function pointer fn() points to a function to call when a successful
 match is found and is used to update the encrypted password file 
-return True on correct match, False otherwise
+return NT_STATUS_OK on correct match, appropriate error otherwise
 ****************************************************************************/
 
-BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen, 
-		BOOL (*fn) (char *, char *), BOOL run_cracker)
+NTSTATUS pass_check(struct passwd *pass, char *user, char *password, 
+		    int pwlen, BOOL (*fn) (char *, char *), BOOL run_cracker)
 {
 	pstring pass2;
 	int level = lp_passwordlevel();
 
+	NTSTATUS nt_status;
 	if (password)
 		password[pwlen] = 0;
 
@@ -696,12 +726,12 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 #endif
 
 	if (!password)
-		return (False);
+		return NT_STATUS_LOGON_FAILURE;
 
 	if (((!*password) || (!pwlen)) && !lp_null_passwords())
-		return (False);
+		return NT_STATUS_LOGON_FAILURE;
 
-#ifdef WITH_PAM
+#if defined(WITH_PAM) || defined(KRB4_AUTH) || defined(KRB5_AUTH)
 
 	/*
 	 * If we're using PAM we want to short-circuit all the 
@@ -712,13 +742,13 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 
 	DEBUG(4, ("pass_check: Checking (PAM) password for user %s (l=%d)\n", user, pwlen));
 
-#else /* Not using PAM */
+#else /* Not using PAM or Kerebos */
 
 	DEBUG(4, ("pass_check: Checking password for user %s (l=%d)\n", user, pwlen));
 
 	if (!pass) {
 		DEBUG(3, ("Couldn't find user %s\n", user));
-		return (False);
+		return NT_STATUS_NO_SUCH_USER;
 	}
 
 #ifdef HAVE_GETSPNAM
@@ -782,7 +812,6 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 #endif
 
 	/* extract relevant info */
-	fstrcpy(this_user, pass->pw_name);
 	fstrcpy(this_salt, pass->pw_passwd);
 
 #if defined(HAVE_TRUNCATED_SALT)
@@ -797,34 +826,39 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 		if (!lp_null_passwords()) {
 			DEBUG(2, ("Disallowing %s with null password\n",
 				  this_user));
-			return (False);
+			return NT_STATUS_LOGON_FAILURE;
 		}
 		if (!*password) {
 			DEBUG(3,
 			      ("Allowing access to %s with null password\n",
 			       this_user));
-			return (True);
+			return NT_STATUS_OK;
 		}
 	}
 
-#endif /* WITH_PAM */
+#endif /* defined(WITH_PAM) || defined(KRB4_AUTH) || defined(KRB5_AUTH) */
 
 	/* try it as it came to us */
-	if (password_check(password)) {
-		if (fn)
-			fn(user, password);
-		return (True);
-	}
+	nt_status = password_check(password);
+        if NT_STATUS_IS_OK(nt_status) {
+                if (fn) {
+                        fn(user, password);
+		}
+		return (nt_status);
+	} else if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
+                /* No point continuing if its not the password thats to blame (ie PAM disabled). */
+                return (nt_status);
+        }
 
 	if (!run_cracker) {
-		return False;
+		return (nt_status);
 	}
 
 	/* if the password was given to us with mixed case then we don't
-	   need to proceed as we know it hasn't been case modified by the
-	   client */
+	 * need to proceed as we know it hasn't been case modified by the
+	 * client */
 	if (strhasupper(password) && strhaslower(password)) {
-		return (False);
+		return nt_status;
 	}
 
 	/* make a copy of it */
@@ -833,10 +867,10 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 	/* try all lowercase if it's currently all uppercase */
 	if (strhasupper(password)) {
 		strlower(password);
-		if (password_check(password)) {
-			if (fn)
+		if NT_STATUS_IS_OK(nt_status = password_check(password)) {
+		        if (fn)
 				fn(user, password);
-			return (True);
+			return (nt_status);
 		}
 	}
 
@@ -844,20 +878,24 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 	if (level < 1) {
 		/* restore it */
 		fstrcpy(password, pass2);
-		return (False);
+		return NT_STATUS_WRONG_PASSWORD;
 	}
 
 	/* last chance - all combinations of up to level chars upper! */
 	strlower(password);
 
-	if (string_combinations(password, password_check, level)) {
-		if (fn)
+ 
+        if NT_STATUS_IS_OK(nt_status = string_combinations(password, password_check, level)) {
+                if (fn)
 			fn(user, password);
-		return (True);
+		return nt_status;
 	}
-
+        
 	/* restore it */
 	fstrcpy(password, pass2);
 
-	return (False);
+	return NT_STATUS_WRONG_PASSWORD;
 }
+
+
+
diff --git a/source3/passdb/pass_check.c b/source3/passdb/pass_check.c
index 7426bfcbe3..594983e53b 100644
--- a/source3/passdb/pass_check.c
+++ b/source3/passdb/pass_check.c
@@ -28,8 +28,10 @@ extern int DEBUGLEVEL;
 
 /* these are kept here to keep the string_combinations function simple */
 static fstring this_user;
+#if !(defined(WITH_PAM) || defined(KRB4_AUTH) || defined(KRB5_AUTH))
 static fstring this_salt;
 static fstring this_crypted;
+#endif
 
 #ifdef WITH_AFS
 
@@ -550,11 +552,12 @@ try all combinations with N uppercase letters.
 offset is the first char to try and change (start with 0)
 it assumes the string starts lowercased
 ****************************************************************************/
-static BOOL string_combinations2(char *s, int offset, BOOL (*fn) (char *),
+static NTSTATUS string_combinations2(char *s, int offset, NTSTATUS (*fn) (char *),
 				 int N)
 {
 	int len = strlen(s);
 	int i;
+	NTSTATUS nt_status;
 
 #ifdef PASSWORD_LENGTH
 	len = MIN(len, PASSWORD_LENGTH);
@@ -568,11 +571,12 @@ static BOOL string_combinations2(char *s, int offset, BOOL (*fn) (char *),
 		if (!islower(c))
 			continue;
 		s[i] = toupper(c);
-		if (string_combinations2(s, i + 1, fn, N - 1))
-			return (True);
+		if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, i + 1, fn, N - 1),NT_STATUS_WRONG_PASSWORD)) {
+			return (nt_status);
+		}
 		s[i] = c;
 	}
-	return (False);
+	return (NT_STATUS_WRONG_PASSWORD);
 }
 
 /****************************************************************************
@@ -582,71 +586,80 @@ try all combinations with up to N uppercase letters.
 offset is the first char to try and change (start with 0)
 it assumes the string starts lowercased
 ****************************************************************************/
-static BOOL string_combinations(char *s, BOOL (*fn) (char *), int N)
+static NTSTATUS string_combinations(char *s, NTSTATUS (*fn) (char *), int N)
 {
 	int n;
+	NTSTATUS nt_status;
 	for (n = 1; n <= N; n++)
-		if (string_combinations2(s, 0, fn, n))
-			return (True);
-	return (False);
+		if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, 0, fn, n), NT_STATUS_WRONG_PASSWORD))
+			return nt_status;
+	return NT_STATUS_WRONG_PASSWORD;
 }
 
 
 /****************************************************************************
 core of password checking routine
 ****************************************************************************/
-static BOOL password_check(char *password)
+static NTSTATUS password_check(char *password)
 {
-
 #ifdef WITH_PAM
-	return NT_STATUS_IS_OK(smb_pam_passcheck(this_user, password));
-#endif /* WITH_PAM */
+	return smb_pam_passcheck(this_user, password);
+#elif defined(KRB5_AUTH)
+	return krb5_auth(this_user, password) ? NT_STATUS_WRONG_PASSWORD : NT_STATUS_OK;
+#elif defined(KRB4_AUTH)
+	return krb4_auth(this_user, password) ? NT_STATUS_WRONG_PASSWORD : NT_STATUS_OK;
+#else
+
+	BOOL ret;
 
 #ifdef WITH_AFS
 	if (afs_auth(this_user, password))
-		return (True);
+		return NT_STATUS_OK;
 #endif /* WITH_AFS */
 
 #ifdef WITH_DFS
 	if (dfs_auth(this_user, password))
-		return (True);
+		return NT_STATUS_OK;
 #endif /* WITH_DFS */
 
-#ifdef KRB5_AUTH
-	if (krb5_auth(this_user, password))
-		return (True);
-#endif /* KRB5_AUTH */
-
-#ifdef KRB4_AUTH
-	if (krb4_auth(this_user, password))
-		return (True);
-#endif /* KRB4_AUTH */
-
 #ifdef OSF1_ENH_SEC
-	{
-		BOOL ret =
-			(strcmp
-			 (osf1_bigcrypt(password, this_salt),
-			  this_crypted) == 0);
-		if (!ret) {
-			DEBUG(2,
-			      ("OSF1_ENH_SEC failed. Trying normal crypt.\n"));
-			ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
-		}
-		return ret;
-	}
+	
+	ret = (strcmp(osf1_bigcrypt(password, this_salt),
+		      this_crypted) == 0);
+	if (!ret) {
+		DEBUG(2,
+		      ("OSF1_ENH_SEC failed. Trying normal crypt.\n"));
+		ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+	}
+	if (ret) {
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+	
 #endif /* OSF1_ENH_SEC */
-
+	
 #ifdef ULTRIX_AUTH
-	return (strcmp((char *)crypt16(password, this_salt), this_crypted) == 0);
+	ret = (strcmp((char *)crypt16(password, this_salt), this_crypted) == 0);
+	if (ret) {
+		return NT_STATUS_OK;
+        } else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
+	
 #endif /* ULTRIX_AUTH */
-
+	
 #ifdef LINUX_BIGCRYPT
-	return (linux_bigcrypt(password, this_salt, this_crypted));
+	ret = (linux_bigcrypt(password, this_salt, this_crypted));
+        if (ret) {
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
 #endif /* LINUX_BIGCRYPT */
-
+	
 #if defined(HAVE_BIGCRYPT) && defined(HAVE_CRYPT) && defined(USE_BOTH_CRYPT_CALLS)
-
+	
 	/*
 	 * Some systems have bigcrypt in the C library but might not
 	 * actually use it for the password hashes (HPUX 10.20) is
@@ -655,39 +668,56 @@ static BOOL password_check(char *password)
 	 */
 
 	if (strcmp(bigcrypt(password, this_salt), this_crypted) == 0)
-		return True;
+		return NT_STATUS_OK;
 	else
-		return (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+		ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+	if (ret) {
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
 #else /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
-
+	
 #ifdef HAVE_BIGCRYPT
-	return (strcmp(bigcrypt(password, this_salt), this_crypted) == 0);
+	ret = (strcmp(bigcrypt(password, this_salt), this_crypted) == 0);
+        if (ret) {
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
 #endif /* HAVE_BIGCRYPT */
-
+	
 #ifndef HAVE_CRYPT
 	DEBUG(1, ("Warning - no crypt available\n"));
-	return (False);
+	return NT_STATUS_LOGON_FAILURE;
 #else /* HAVE_CRYPT */
-	return (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+	ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
+        if (ret) {
+		return NT_STATUS_OK;
+	} else {
+		return NT_STATUS_WRONG_PASSWORD;
+	}
 #endif /* HAVE_CRYPT */
 #endif /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
+#endif /* WITH_PAM || KRB4_AUTH || KRB5_AUTH */
 }
 
 
 
 /****************************************************************************
-check if a username/password is OK
+CHECK if a username/password is OK
 the function pointer fn() points to a function to call when a successful
 match is found and is used to update the encrypted password file 
-return True on correct match, False otherwise
+return NT_STATUS_OK on correct match, appropriate error otherwise
 ****************************************************************************/
 
-BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen, 
-		BOOL (*fn) (char *, char *), BOOL run_cracker)
+NTSTATUS pass_check(struct passwd *pass, char *user, char *password, 
+		    int pwlen, BOOL (*fn) (char *, char *), BOOL run_cracker)
 {
 	pstring pass2;
 	int level = lp_passwordlevel();
 
+	NTSTATUS nt_status;
 	if (password)
 		password[pwlen] = 0;
 
@@ -696,12 +726,12 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 #endif
 
 	if (!password)
-		return (False);
+		return NT_STATUS_LOGON_FAILURE;
 
 	if (((!*password) || (!pwlen)) && !lp_null_passwords())
-		return (False);
+		return NT_STATUS_LOGON_FAILURE;
 
-#ifdef WITH_PAM
+#if defined(WITH_PAM) || defined(KRB4_AUTH) || defined(KRB5_AUTH)
 
 	/*
 	 * If we're using PAM we want to short-circuit all the 
@@ -712,13 +742,13 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 
 	DEBUG(4, ("pass_check: Checking (PAM) password for user %s (l=%d)\n", user, pwlen));
 
-#else /* Not using PAM */
+#else /* Not using PAM or Kerebos */
 
 	DEBUG(4, ("pass_check: Checking password for user %s (l=%d)\n", user, pwlen));
 
 	if (!pass) {
 		DEBUG(3, ("Couldn't find user %s\n", user));
-		return (False);
+		return NT_STATUS_NO_SUCH_USER;
 	}
 
 #ifdef HAVE_GETSPNAM
@@ -782,7 +812,6 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 #endif
 
 	/* extract relevant info */
-	fstrcpy(this_user, pass->pw_name);
 	fstrcpy(this_salt, pass->pw_passwd);
 
 #if defined(HAVE_TRUNCATED_SALT)
@@ -797,34 +826,39 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 		if (!lp_null_passwords()) {
 			DEBUG(2, ("Disallowing %s with null password\n",
 				  this_user));
-			return (False);
+			return NT_STATUS_LOGON_FAILURE;
 		}
 		if (!*password) {
 			DEBUG(3,
 			      ("Allowing access to %s with null password\n",
 			       this_user));
-			return (True);
+			return NT_STATUS_OK;
 		}
 	}
 
-#endif /* WITH_PAM */
+#endif /* defined(WITH_PAM) || defined(KRB4_AUTH) || defined(KRB5_AUTH) */
 
 	/* try it as it came to us */
-	if (password_check(password)) {
-		if (fn)
-			fn(user, password);
-		return (True);
-	}
+	nt_status = password_check(password);
+        if NT_STATUS_IS_OK(nt_status) {
+                if (fn) {
+                        fn(user, password);
+		}
+		return (nt_status);
+	} else if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
+                /* No point continuing if its not the password thats to blame (ie PAM disabled). */
+                return (nt_status);
+        }
 
 	if (!run_cracker) {
-		return False;
+		return (nt_status);
 	}
 
 	/* if the password was given to us with mixed case then we don't
-	   need to proceed as we know it hasn't been case modified by the
-	   client */
+	 * need to proceed as we know it hasn't been case modified by the
+	 * client */
 	if (strhasupper(password) && strhaslower(password)) {
-		return (False);
+		return nt_status;
 	}
 
 	/* make a copy of it */
@@ -833,10 +867,10 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 	/* try all lowercase if it's currently all uppercase */
 	if (strhasupper(password)) {
 		strlower(password);
-		if (password_check(password)) {
-			if (fn)
+		if NT_STATUS_IS_OK(nt_status = password_check(password)) {
+		        if (fn)
 				fn(user, password);
-			return (True);
+			return (nt_status);
 		}
 	}
 
@@ -844,20 +878,24 @@ BOOL pass_check(struct passwd *pass, char *user, char *password, int pwlen,
 	if (level < 1) {
 		/* restore it */
 		fstrcpy(password, pass2);
-		return (False);
+		return NT_STATUS_WRONG_PASSWORD;
 	}
 
 	/* last chance - all combinations of up to level chars upper! */
 	strlower(password);
 
-	if (string_combinations(password, password_check, level)) {
-		if (fn)
+ 
+        if NT_STATUS_IS_OK(nt_status = string_combinations(password, password_check, level)) {
+                if (fn)
 			fn(user, password);
-		return (True);
+		return nt_status;
 	}
-
+        
 	/* restore it */
 	fstrcpy(password, pass2);
 
-	return (False);
+	return NT_STATUS_WRONG_PASSWORD;
 }
+
+
+
diff --git a/source3/smbd/auth_unix.c b/source3/smbd/auth_unix.c
index 4740f7fb0d..5582682d98 100644
--- a/source3/smbd/auth_unix.c
+++ b/source3/smbd/auth_unix.c
@@ -77,14 +77,14 @@ NTSTATUS check_unix_security(const auth_usersupplied_info *user_info, auth_serve
 	
 	pass = Get_Pwnam(user_info->unix_username.str, False);
 
-	nt_status = (pass_check(pass,
+	nt_status = pass_check(pass,
 				pass ? pass->pw_name : user_info->unix_username.str, 
 				user_info->plaintext_password.str,
 				user_info->plaintext_password.len,
 				lp_update_encrypted() ? 
 				update_smbpassword_file : NULL,
-				True) 
-		     ? NT_STATUS_OK : NT_STATUS_LOGON_FAILURE);
+				True);
+
 	unbecome_root();
 
 	return nt_status;
diff --git a/source3/web/cgi.c b/source3/web/cgi.c
index b4356af46e..a8af9b2722 100644
--- a/source3/web/cgi.c
+++ b/source3/web/cgi.c
@@ -390,7 +390,7 @@ static BOOL cgi_handle_authorization(char *line)
 	 * Validate the password they have given.
 	 */
 	
-	if (pass_check(pass, user, user_pass, 
+	if NT_STATUS_IS_OK(pass_check(pass, user, user_pass, 
 		      strlen(user_pass), NULL, False)) {
 		
 		if (pass) {
@@ -398,13 +398,7 @@ static BOOL cgi_handle_authorization(char *line)
 			 * Password was ok.
 			 */
 			
-			if(pass->pw_uid != 0) {
-				/*
-				 * We have not authenticated as root,
-				 * become the user *permanently*.
-				 */
-				become_user_permanently(pass->pw_uid, pass->pw_gid);
-			}
+			become_user_permanently(pass->pw_uid, pass->pw_gid);
 			
 			/* Save the users name */
 			C_user = strdup(user);
@@ -508,6 +502,9 @@ void cgi_setup(char *rootdir, int auth_required)
 				"chdir failed - the server is not configured correctly");
 	}
 
+	/* Handle the possability we might be running as non-root */
+	sec_init();
+
 	/* maybe we are running under a web server */
 	if (getenv("CONTENT_LENGTH") || getenv("REQUEST_METHOD")) {
 		if (auth_required) {