Added JohnT and Andrew Bartlett's PAM changes.

Jeremy.
(This used to be commit ecd00e258c6fe4e8d90f48da74874e090dce4a40)

2 files changed, 444 insertions, 134 deletions

diff --git a/source3/passdb/pampass.c b/source3/passdb/pampass.c
new file mode 100644
index 0000000000..a23727b689
--- /dev/null
+++ b/source3/passdb/pampass.c
@@ -0,0 +1,440 @@
+/* 
+   Unix SMB/Netbios implementation.
+   Version 2.2.
+   PAM Password checking
+   Copyright (C) Andrew Tridgell 1992-2001
+   Copyright (C) John H Terpsta 1999-2001
+   Copyright (C) Andrew Barton 2001
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+/*
+ * This module provides PAM based functions for validation of
+ * username/password pairs, account managment, session and access control.
+ * Note: SMB password checking is done in smbpass.c
+ */
+
+#include "includes.h"
+
+extern int DEBUGLEVEL;
+
+#ifdef WITH_PAM
+
+/*******************************************************************
+ * Handle PAM authentication 
+ * 	- Access, Authentication, Session, Password
+ *   Note: See PAM Documentation and refer to local system PAM implementation
+ *   which determines what actions/limitations/allowances become affected.
+ *********************************************************************/
+
+#include <security/pam_appl.h>
+
+/*
+ * Static variables used to communicate between the conversation function
+ * and the server_login function
+ */
+
+static char *PAM_username;
+static char *PAM_password;
+
+/*
+ *  Macros to help make life easy
+ */
+#define COPY_STRING(s) (s) ? strdup(s) : NULL
+
+/*
+ * Macro converted to a function to simplyify this thing
+ */
+static BOOL pam_error_handler(pam_handle_t *pamh, int pam_error, char *msg, int dbglvl)
+{
+
+	int retval;
+
+       	if( pam_error != PAM_SUCCESS)
+	{
+		DEBUG(dbglvl, ("PAM %s: %s\n", pam_strerror(pamh, pam_error)));
+		return False;
+	}
+	return True;
+}
+
+/*
+ * PAM conversation function
+ * Here we assume (for now, at least) that echo on means login name, and
+ * echo off means password.
+ */
+
+static int PAM_conv(int num_msg,
+		    const struct pam_message **msg,
+		    struct pam_response **resp,
+		    void *appdata_ptr)
+{
+	int replies = 0;
+	struct pam_response *reply = NULL;
+
+	reply = malloc(sizeof(struct pam_response) * num_msg);
+	if (!reply)
+		return PAM_CONV_ERR;
+
+	for (replies = 0; replies < num_msg; replies++)
+	{
+		switch (msg[replies]->msg_style)
+		{
+			case PAM_PROMPT_ECHO_ON:
+				reply[replies].resp_retcode = PAM_SUCCESS;
+			reply[replies].resp =
+					COPY_STRING(PAM_username);
+				/* PAM frees resp */
+				break;
+
+			case PAM_PROMPT_ECHO_OFF:
+				reply[replies].resp_retcode = PAM_SUCCESS;
+				reply[replies].resp =
+					COPY_STRING(PAM_password);
+				/* PAM frees resp */
+				break;
+
+			case PAM_TEXT_INFO:
+				/* fall through */
+
+			case PAM_ERROR_MSG:
+				/* ignore it... */
+				reply[replies].resp_retcode = PAM_SUCCESS;
+				reply[replies].resp = NULL;
+				break;
+
+			default:
+				/* Must be an error of some sort... */
+				free(reply);
+				return PAM_CONV_ERR;
+		}
+	}
+	if (reply)
+		*resp = reply;
+	return PAM_SUCCESS;
+}
+
+static struct pam_conv PAM_conversation = {
+	&PAM_conv,
+	NULL
+};
+
+static BOOL proc_pam_end(pam_handle_t *pamh)
+{
+       int pam_error;
+       
+       if( pamh != NULL )
+       {
+		pam_error = pam_end(pamh, 0);
+		if(pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
+    			return True;
+		}
+       }
+       DEBUG(2,("PAM not initialised"));
+       return False;
+}
+
+
+static BOOL pam_auth(char *user, char *password)
+{
+	pam_handle_t *pamh;
+	int pam_error;
+
+	/*
+	 * Now use PAM to do authentication.  Bail out if there are any
+	 * errors.
+	 */
+
+	PAM_password = password;
+	PAM_username = user;
+        DEBUG(4,("PAM Start for User: %s\n", user));
+	pam_error = pam_start("samba", user, &PAM_conversation, &pamh);
+	if(!pam_error_handler(pamh, pam_error, "start failure", 2)) {
+		proc_pam_end(pamh);
+		return False;
+	}
+
+	/*
+	 * To enable debugging set in /etc/pam.d/samba:
+	 *	auth required /lib/security/pam_pwdb.so nullok shadow audit
+	 */
+	
+	pam_error = pam_authenticate(pamh, PAM_SILENT); /* Can we authenticate user? */
+	switch( pam_error ){
+		case PAM_AUTH_ERR:
+			DEBUG(2, ("PAM: Athentication Error\n"));
+			break;
+		case PAM_CRED_INSUFFICIENT:
+			DEBUG(2, ("PAM: Insufficient Credentials\n"));
+			break;
+		case PAM_AUTHINFO_UNAVAIL:
+			DEBUG(2, ("PAM: Authentication Information Unavailable\n"));
+			break;
+		case PAM_USER_UNKNOWN:
+			DEBUG(2, ("PAM: Username NOT known to Authentication system\n"));
+			break;
+		case PAM_MAXTRIES:
+			DEBUG(2, ("PAM: One or more authentication modules reports user limit exceeeded\n"));
+			break;
+		case PAM_ABORT:
+			DEBUG(0, ("PAM: One or more PAM modules failed to load\n"));
+			break;
+		default:
+			DEBUG(4, ("PAM: User %s Authenticated OK\n", user));
+	}
+	if(!pam_error_handler(pamh, pam_error, "Authentication Failure", 2)) {
+		proc_pam_end(pamh);
+		return False;
+	}
+
+	/* 
+	 * Now do account management control and validation
+	 */
+	pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
+	switch( pam_error ) {
+		case PAM_AUTHTOK_EXPIRED:
+			DEBUG(2, ("PAM: User is valid but password is expired\n"));
+			break;
+		case PAM_ACCT_EXPIRED:
+			DEBUG(2, ("PAM: User no longer permitted to access system\n"));
+			break;
+		case PAM_AUTH_ERR:
+			DEBUG(2, ("PAM: There was an authentication error\n"));
+			break;
+		case PAM_PERM_DENIED:
+			DEBUG(0, ("PAM: User is NOT permitted to access system at this time\n"));
+			break;
+		case PAM_USER_UNKNOWN:
+			DEBUG(2, ("PAM: User \"%s\" is NOT known to account management\n", user));
+			break;
+		default:
+			DEBUG(4, ("PAM: Account OK for User: %s\n", user));
+	}
+	if(!pam_error_handler(pamh, pam_error, "Account Check Failed", 2)) {
+		proc_pam_end(pamh);
+		return False;
+	}
+
+	/*
+	 * This will allow samba to aquire a kerberos token. And, when
+	 * exporting an AFS cell, be able to /write/ to this cell.
+	 */
+
+	pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED|PAM_SILENT)); 
+	if(!pam_error_handler(pamh, pam_error, "Set Credential Failure", 2)) {
+		proc_pam_end(pamh);
+		return False;
+	}
+	
+	if( !proc_pam_end(pamh))
+		return False;
+
+	/* If this point is reached, the user has been authenticated. */
+	DEBUG(4, ("PAM: pam_authentication passed for User: %s\n", user));
+	return (True);
+}
+
+#if NOTBLOCKEDOUT
+/* Start PAM authentication for specified account */
+static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
+{
+       int pam_error;
+       char * rhost;
+
+       DEBUG(4,("PAM Init for user: %s\n", user));
+
+       pam_error = pam_start("samba", user, &PAM_conversation, pamh);
+       if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
+	       proc_pam_end(*pamh);
+               return False;
+       }
+
+       rhost = client_name();
+       if (strcmp(rhost,"UNKNOWN") == 0)
+               rhost = client_addr();
+
+#ifdef PAM_RHOST
+       DEBUG(4,("PAM setting rhost to: %s\n", rhost));
+       pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
+       if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
+	       proc_pam_end(*pamh);
+               return False;
+       }
+#endif
+
+#if defined(PAM_TTY_KLUDGE) && defined(PAM_TTY)
+       pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
+       if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
+	       proc_pam_end(*pamh);
+               return False;
+       }
+#endif
+
+       return True;
+}
+
+static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance)
+{
+       int pam_error;
+
+       PAM_password = NULL;
+       PAM_username = user;
+
+#ifdef PAM_TTY
+       DEBUG(4,("PAM tty set to: %s\"\n", tty));
+       pam_error = pam_set_item(pamh, PAM_TTY, tty);
+       if (!pam_error_handler(pamh, pam_error, "set tty failed", 0)) {
+	       proc_pam_end(pamh);
+               return False;
+       }
+#endif
+
+       if (instance) {
+         pam_error = pam_open_session(pamh, PAM_SILENT);
+         if (!pam_error_handler(pamh, pam_error, "session setup failed", 0)) {
+	       proc_pam_end(pamh);
+               return False;
+         }
+       }
+       else
+       {
+         pam_error = pam_close_session(pamh, PAM_SILENT);
+         if (!pam_error_handler(pamh, pam_error, "session close failed", 0)) {
+	       proc_pam_end(pamh);
+               return False;
+         }
+       }
+      return (True);
+}
+
+static BOOL pam_account(pam_handle_t *pamh, char *user)
+{
+       int pam_error;
+
+       PAM_password = NULL;
+       PAM_username = user;
+
+       DEBUG(4,("PAM starting account management for user: %s \n", user));
+
+       pam_error = pam_acct_mgmt(pamh, PAM_SILENT);
+       if (!pam_error_handler(pamh, pam_error, "PAM set account management failed", 0)) {
+	   proc_pam_end(pamh);
+           return False;
+       } else {
+           DEBUG(4,("PAM account management passed\n"));
+       }
+
+       /*
+        * This will allow samba to aquire a kerberos token. And, when
+        * exporting an AFS cell, be able to /write/ to this cell.
+        */
+       pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED));
+       if (!pam_error_handler(pamh, pam_error, "set credentials failed\n", 0)) {
+	   proc_pam_end(pamh);
+           return False;
+       }
+
+       /* If this point is reached, the user has been authenticated. */
+       return (True);
+}
+static BOOL account_pam(char *user)
+{
+         /*
+	  * Check the account with the PAM account module:
+          *  - This means that accounts can be disabled
+          *    and or expired with avoidance of samba then just
+          *    bypassing the situation.
+          */
+
+         pam_handle_t *pamh = NULL;
+         char * PAMuser;
+
+         PAMuser = malloc(strlen(user)+1);
+         /* This is freed by PAM */
+         strncpy(PAMuser, user, strlen(user)+1);
+
+         if (proc_pam_start(&pamh, PAMuser))
+	 {
+           if (pam_account(pamh, PAMuser))
+	   {
+             return proc_pam_end(pamh);
+	   }
+	 }
+         proc_pam_end(pamh);
+         return False;
+}
+
+BOOL PAM_session(BOOL instance, const connection_struct *conn, char *tty)
+{
+	pam_handle_t *pamh=NULL;
+	char * user;
+
+	user = malloc(strlen(conn->user)+1);
+
+	/* This is freed by PAM */
+	strncpy(user, conn->user, strlen(conn->user)+1);
+
+	if (!proc_pam_start(&pamh, user))
+	{
+	  proc_pam_end(pamh);
+	  return False;
+	}
+
+	if (pam_session(pamh, user, tty, instance))
+	{
+	  return proc_pam_end(pamh);
+	}
+	else
+	{
+	  proc_pam_end(pamh);
+	  return False;
+	}
+}
+
+BOOL pam_passcheck(char * user, char * password)
+{
+	pam_handle_t *pamh = NULL;
+
+	PAM_username = user;
+	PAM_password = password;
+
+	if( proc_pam_start(&pamh, user))
+	{
+		if( pam_auth(user, password))
+		{
+			if( account_pam(user))
+			{
+				return( proc_pam_end(pamh));
+			}
+		}	
+	}
+	proc_pam_end(pamh);
+	return( False );
+}
+#endif /* NOTBLOCKEDOUT */
+
+BOOL pam_passcheck( char * user, char * password )
+{
+	return( pam_auth( user, password ));
+	
+}
+#else
+
+ /* Do *NOT* make this function static. Doing so breaks the compile on gcc */
+
+ void pampass_dummy_function( void ) { } /*This stops compiler complaints */
+
+#endif /* WITH_PAM */
diff --git a/source3/passdb/pass_check.c b/source3/passdb/pass_check.c
index c803816e04..6acbb91606 100644
--- a/source3/passdb/pass_check.c
+++ b/source3/passdb/pass_check.c
@@ -31,124 +31,6 @@ static char this_user[100] = "";
 static char this_salt[100] = "";
 static char this_crypted[100] = "";
 
-
-#ifdef WITH_PAM
-/*******************************************************************
-check on PAM authentication
-********************************************************************/
-
-/* We first need some helper functions */
-#include <security/pam_appl.h>
-/* Static variables used to communicate between the conversation function
- * and the server_login function
- */
-static char *PAM_username;
-static char *PAM_password;
-
-/* PAM conversation function
- * Here we assume (for now, at least) that echo on means login name, and
- * echo off means password.
- */
-static int PAM_conv(int num_msg,
-		    const struct pam_message **msg,
-		    struct pam_response **resp, void *appdata_ptr)
-{
-	int replies = 0;
-	struct pam_response *reply = NULL;
-
-#define COPY_STRING(s) (s) ? strdup(s) : NULL
-
-	reply = malloc(sizeof(struct pam_response) * num_msg);
-	if (!reply)
-		return PAM_CONV_ERR;
-
-	for (replies = 0; replies < num_msg; replies++)
-	{
-		switch (msg[replies]->msg_style)
-		{
-			case PAM_PROMPT_ECHO_ON:
-				reply[replies].resp_retcode = PAM_SUCCESS;
-				reply[replies].resp =
-					COPY_STRING(PAM_username);
-				/* PAM frees resp */
-				break;
-			case PAM_PROMPT_ECHO_OFF:
-				reply[replies].resp_retcode = PAM_SUCCESS;
-				reply[replies].resp =
-					COPY_STRING(PAM_password);
-				/* PAM frees resp */
-				break;
-			case PAM_TEXT_INFO:
-				/* fall through */
-			case PAM_ERROR_MSG:
-				/* ignore it... */
-				reply[replies].resp_retcode = PAM_SUCCESS;
-				reply[replies].resp = NULL;
-				break;
-			default:
-				/* Must be an error of some sort... */
-				free(reply);
-				return PAM_CONV_ERR;
-		}
-	}
-	if (reply)
-		*resp = reply;
-	return PAM_SUCCESS;
-}
-static struct pam_conv PAM_conversation = {
-	&PAM_conv,
-	NULL
-};
-
-
-static BOOL pam_auth(char *user, char *password)
-{
-	pam_handle_t *pamh;
-	int pam_error;
-
-	/* Now use PAM to do authentication.  For now, we won't worry about
-	 * session logging, only authentication.  Bail out if there are any
-	 * errors.  Since this is a limited protocol, and an even more limited
-	 * function within a server speaking this protocol, we can't be as
-	 * verbose as would otherwise make sense.
-	 * Query: should we be using PAM_SILENT to shut PAM up?
-	 */
-#define PAM_BAIL if (pam_error != PAM_SUCCESS) { \
-     pam_end(pamh, 0); return False; \
-   }
-	PAM_password = password;
-	PAM_username = user;
-	pam_error = pam_start("samba", user, &PAM_conversation, &pamh);
-	PAM_BAIL;
-/* Setting PAM_SILENT stops generation of error messages to syslog
- * to enable debugging on Red Hat Linux set:
- * /etc/pam.d/samba:
- *	auth required /lib/security/pam_pwdb.so nullok shadow audit
- * _OR_ change PAM_SILENT to 0 to force detailed reporting (logging)
- */
-	pam_error = pam_authenticate(pamh, PAM_SILENT);
-	PAM_BAIL;
-	/* It is not clear to me that account management is the right thing
-	 * to do, but it is not clear that it isn't, either.  This can be
-	 * removed if no account management should be done.  Alternately,
-	 * put a pam_allow.so entry in /etc/pam.conf for account handling. */
-	pam_error = pam_acct_mgmt(pamh, PAM_SILENT);
-	PAM_BAIL;
-
-	/*
-	 * This will allow samba to aquire a kerberos token. And, when
-	 * exporting an AFS cell, be able to /write/ to this cell.
-	 */
-	pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED|PAM_SILENT));
-	PAM_BAIL;
-	
-	pam_end(pamh, PAM_SUCCESS);
-	/* If this point is reached, the user has been authenticated. */
-	return (True);
-}
-#endif
-
-
 #ifdef WITH_AFS
 
 #include <afs/stds.h>
@@ -724,16 +606,7 @@ static BOOL password_check(char *password)
 {
 
 #ifdef WITH_PAM
-	/* This falls through if the password check fails
-	   - if HAVE_CRYPT is not defined this causes an error msg
-	   saying Warning - no crypt available
-	   - if HAVE_CRYPT is defined this is a potential security hole
-	   as it may authenticate via the crypt call when PAM
-	   settings say it should fail.
-	   if (pam_auth(user,password)) return(True);
-	   Hence we make a direct return to avoid a second chance!!!
-	 */
-	return (pam_auth(this_user, password));
+	return (pam_passcheck(this_user, password));
 #endif /* WITH_PAM */
 
 #ifdef WITH_AFS
@@ -946,16 +819,13 @@ BOOL pass_check(char *user, char *password, int pwlen, struct passwd *pwd,
 
 	fstrcpy(this_crypted, pass->pw_passwd);
 
-	if (!*this_crypted)
-	{
-		if (!lp_null_passwords())
-		{
+	if (!*this_crypted) {
+		if (!lp_null_passwords()) {
 			DEBUG(2, ("Disallowing %s with null password\n",
 				  this_user));
 			return (False);
 		}
-		if (!*password)
-		{
+		if (!*password) {
 			DEBUG(3,
 			      ("Allowing access to %s with null password\n",
 			       this_user));