Add 'net rpc join' to match the ADS equiv.

This kills off the offending code in smbpasswd -j -Uab%c

In the process we have changed from unsing compelatly random passwords
to random, 15 char ascii strings.  While this does produce a decrese in
entropy, it is still vastly greater than we need, considering the application.

In the meantime this allows us to actually *type* the machine account
password duruign debugging.

This code also adds a 'check' step to the join, confirming that the
stored password does indeed do somthing of value :-)

Andrew Bartlett
(This used to be commit c0b7ee6ee547dc7ff798eaf8cb63fbe344073029)

1 files changed, 3 insertions, 294 deletions

diff --git a/source3/utils/smbpasswd.c b/source3/utils/smbpasswd.c
index 8d50b94a0a..92136bea7a 100644
--- a/source3/utils/smbpasswd.c
+++ b/source3/utils/smbpasswd.c
@@ -121,298 +121,6 @@ unable to join domain.\n");
 	return (int)ret;
 }
 
-/* Initialise client credentials for authenticated pipe access */
-
-void init_rpcclient_creds(struct ntuser_creds *creds, char* username,
-			  char* domain, char* password)
-{
-	ZERO_STRUCTP(creds);
-	
-	if (lp_encrypted_passwords()) {
-		pwd_make_lm_nt_16(&creds->pwd, password);
-	} else {
-		pwd_set_cleartext(&creds->pwd, password);
-	}
-
-	fstrcpy(creds->user_name, username);
-	fstrcpy(creds->domain, domain);
-}
-
-/*********************************************************
-Join a domain using the administrator username and password
-**********************************************************/
-
-/* Macro for checking RPC error codes to make things more readable */
-
-#define CHECK_RPC_ERR(rpc, msg) \
-        if (!NT_STATUS_IS_OK(result = rpc)) { \
-                DEBUG(0, (msg ": %s\n", get_nt_error_msg(result))); \
-                goto done; \
-        }
-
-#define CHECK_RPC_ERR_DEBUG(rpc, debug_args) \
-        if (!NT_STATUS_IS_OK(result = rpc)) { \
-                DEBUG(0, debug_args); \
-                goto done; \
-        }
-
-static int join_domain_byuser(char *domain, char *remote_machine,
-			      char *username, char *password)
-{
-	/* libsmb variables */
-
-	struct nmb_name calling, called;
-	struct ntuser_creds creds;
-	struct cli_state cli;
-	fstring dest_host, acct_name;
-	struct in_addr dest_ip;
-	TALLOC_CTX *mem_ctx;
-        uint32 acb_info;
-
-	/* rpc variables */
-
-	POLICY_HND lsa_pol, sam_pol, domain_pol, user_pol;
-	DOM_SID domain_sid;
-	uint32 user_rid;
-
-	/* Password stuff */
-
-	char *machine_pwd;
-	int plen = 0;
-	uchar pwbuf[516], ntpw[16], sess_key[16];
-	SAM_USERINFO_CTR ctr;
-	SAM_USER_INFO_24 p24;
-	SAM_USER_INFO_10 p10;
-
-	/* Misc */
-
-	NTSTATUS result;
-	int retval = 1;
-
-	/* Connect to remote machine */
-
-	ZERO_STRUCT(cli);
-	ZERO_STRUCT(creds);
-
-	if (!(mem_ctx = talloc_init())) {
-		DEBUG(0, ("Could not initialise talloc context\n"));
-		goto done;
-	}
-
-	if (!cli_initialise(&cli)) {
-		DEBUG(0, ("Could not initialise client structure\n"));
-		goto done;
-	}
-
-	init_rpcclient_creds(&creds, username, domain, password);
-	cli_init_creds(&cli, &creds);
-
-	if (!resolve_srv_name(remote_machine, dest_host, &dest_ip)) {
-		DEBUG(0, ("Could not resolve name %s\n", remote_machine));
-		goto done;
-	}
-
-	make_nmb_name(&called, dns_to_netbios_name(dest_host), 0x20);
-	make_nmb_name(&calling, dns_to_netbios_name(global_myname), 0);
-
-	if (!cli_establish_connection(&cli, dest_host, &dest_ip, &calling, 
-				      &called, "IPC$", "IPC", False, True)) {
-		DEBUG(0, ("Error connecting to %s\n", dest_host));
-		goto done;
-	}
-
-	/* Fetch domain sid */
-
-	if (!cli_nt_session_open(&cli, PIPE_LSARPC)) {
-		DEBUG(0, ("Error connecting to SAM pipe\n"));
-		goto done;
-	}
-
-
-	CHECK_RPC_ERR(cli_lsa_open_policy(&cli, mem_ctx, True,
-					  SEC_RIGHTS_MAXIMUM_ALLOWED,
-					  &lsa_pol),
-		      "error opening lsa policy handle");
-
-	CHECK_RPC_ERR(cli_lsa_query_info_policy(&cli, mem_ctx, &lsa_pol,
-						5, domain, &domain_sid),
-		      "error querying info policy");
-
-	cli_lsa_close(&cli, mem_ctx, &lsa_pol);
-
-	cli_nt_session_close(&cli); /* Done with this pipe */
-
-	/* Create domain user */
-
-	if (!cli_nt_session_open(&cli, PIPE_SAMR)) {
-		DEBUG(0, ("Error connecting to SAM pipe\n"));
-		goto done;
-	}
-
-	CHECK_RPC_ERR(cli_samr_connect(&cli, mem_ctx, 
-				       SEC_RIGHTS_MAXIMUM_ALLOWED,
-				       &sam_pol),
-		      "could not connect to SAM database");
-
-	
-	CHECK_RPC_ERR(cli_samr_open_domain(&cli, mem_ctx, &sam_pol,
-					   SEC_RIGHTS_MAXIMUM_ALLOWED,
-					   &domain_sid, &domain_pol),
-		      "could not open domain");
-
-	/* Create domain user */
-
-	fstrcpy(acct_name, global_myname);
-	fstrcat(acct_name, "$");
-
-	strlower(acct_name);
-
-        acb_info = (lp_server_role() == ROLE_DOMAIN_BDC) ? ACB_SVRTRUST :
-                ACB_WSTRUST;
-
-	{
-		uint32 unknown = 0xe005000b;
-
-		result = cli_samr_create_dom_user(&cli, mem_ctx, &domain_pol,
-						  acct_name, acb_info,
-						  unknown, &user_pol, 
-						  &user_rid);
-
-		/* We *must* do this.... don't ask... */
-
-		CHECK_RPC_ERR_DEBUG(cli_samr_close(&cli, mem_ctx, &user_pol), ("error closing user policy"));
-		result = NT_STATUS_USER_EXISTS;
-	}	
-
-	if (NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_USER_EXISTS)) {
-		uint32 num_rids, *name_types, *user_rids;
-		uint32 flags = 0x3e8;
-		char *names;
-		
-		/* Look up existing rid */
-		
-		names = (char *)&acct_name[0];
-
-		CHECK_RPC_ERR_DEBUG(
-			cli_samr_lookup_names(&cli, mem_ctx,
-					      &domain_pol, flags,
-					      1, &names, &num_rids,
-					      &user_rids, &name_types),
-			("error looking up rid for user %s: %s\n",
-			 acct_name, get_nt_error_msg(result)));
-
-		if (name_types[0] != SID_NAME_USER) {
-			DEBUG(0, ("%s is not a user account\n", acct_name));
-			goto done;
-		}
-
-		user_rid = user_rids[0];
-		
-		/* Open handle on user */
-
-		CHECK_RPC_ERR_DEBUG(
-			cli_samr_open_user(&cli, mem_ctx, &domain_pol,
-					   SEC_RIGHTS_MAXIMUM_ALLOWED,
-					   user_rid, &user_pol),
-			("could not re-open existing user %s: %s\n",
-			 acct_name, get_nt_error_msg(result)));
-		
-	} else if (!NT_STATUS_IS_OK(result)) {
-		DEBUG(0, ("error creating domain user: %s\n",
-			  get_nt_error_msg(result)));
-		goto done;
-	}
-
-	/* Create a random machine account password */
-
-	{
-		UNISTR2 upw;	/* Unicode password */
-
-		upw.buffer = (uint16 *)talloc_zero(mem_ctx, 0xc * 
-						   sizeof(uint16));
-
-		upw.uni_str_len = 0xc;
-		upw.uni_max_len = 0xc;
-
-		machine_pwd = (char *)upw.buffer;
-		plen = upw.uni_str_len * 2;
-		generate_random_buffer((unsigned char *)machine_pwd, plen, True);
-
-		encode_pw_buffer((char *)pwbuf, machine_pwd, plen, False);
-
-		nt_owf_genW(&upw, ntpw);
-	}
-
-	/* Set password on machine account */
-
-	ZERO_STRUCT(ctr);
-	ZERO_STRUCT(p24);
-
-	init_sam_user_info24(&p24, (char *)pwbuf,24);
-
-	ctr.switch_value = 24;
-	ctr.info.id24 = &p24;
-
-	/* I don't think this is quite the right place for this
-	   calculation.  It should be moved somewhere where the credentials
-	   are calculated. )-: */
-
-	mdfour(sess_key, cli.pwd.smb_nt_pwd, 16);
-
-	CHECK_RPC_ERR(cli_samr_set_userinfo(&cli, mem_ctx, &user_pol, 24, 
-					    sess_key, &ctr),
-		      "error setting trust account password");
-
-	/* Why do we have to try to (re-)set the ACB to be the same as what
-	   we passed in the samr_create_dom_user() call?  When a NT
-	   workstation is joined to a domain by an administrator the
-	   acb_info is set to 0x80.  For a normal user with "Add
-	   workstations to the domain" rights the acb_info is 0x84.  I'm
-	   not sure whether it is supposed to make a difference or not.  NT
-	   seems to cope with either value so don't bomb out if the set
-	   userinfo2 level 0x10 fails.  -tpot */
-
-	ZERO_STRUCT(ctr);
-	ctr.switch_value = 0x10;
-	ctr.info.id10 = &p10;
-
-	init_sam_user_info10(&p10, acb_info);
-
-	/* Ignoring the return value is necessary for joining a domain
-	   as a normal user with "Add workstation to domain" privilege. */
-
-	result = cli_samr_set_userinfo2(&cli, mem_ctx, &user_pol, 0x10, 
-					sess_key, &ctr);
-
-	/* Now store the secret in the secrets database */
-
-	strupper(domain);
-
-	if (!secrets_store_domain_sid(domain, &domain_sid) ||
-	    !secrets_store_trust_account_password(domain, ntpw)) {
-		DEBUG(0, ("error storing domain secrets\n"));
-		goto done;
-	}
-
-	retval = 0;		/* Success! */
-
- done:
-	/* Close down pipe - this will clean up open policy handles */
-
-	if (cli.nt_pipe_fnum)
-		cli_nt_session_close(&cli);
-
-	/* Display success or failure */
-
-	if (retval != 0) {
-		trust_password_delete(domain);
-		fprintf(stderr,"Unable to join domain %s.\n",domain);
-	} else {
-		printf("Joined domain %s.\n",domain);
-	}
-	
-	return retval;
-}
 
 static void set_line_buffering(FILE *f)
 {
@@ -657,8 +365,9 @@ static int process_root(int argc, char *argv[])
 					pstrcpy(user_password, pass);
 			}
 				
-			return join_domain_byuser(new_domain, remote_machine,
-						  user_name, user_password);
+			d_printf("use net rpc join to do this now.\n");
+			return 1;
+			
 		} else {
 
 			/* Or just with the server manager? */