Finally remove these files, which moved (by cvs backend magic) to source/auth

at the start of the month.
(This used to be commit 30ef625897cd025e1895c932b55dee027f060413)

2 files changed, 0 insertions, 1668 deletions

diff --git a/source3/passdb/pampass.c b/source3/passdb/pampass.c
deleted file mode 100644
index 018eae3a07..0000000000
--- a/source3/passdb/pampass.c
+++ /dev/null
@@ -1,892 +0,0 @@
-/* 
-   Unix SMB/Netbios implementation.
-   Version 2.2.
-   PAM Password checking
-   Copyright (C) Andrew Tridgell 1992-2001
-   Copyright (C) John H Terpsta 1999-2001
-   Copyright (C) Andrew Bartlett 2001
-   Copyright (C) Jeremy Allison 2001
-   
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-/*
- * This module provides PAM based functions for validation of
- * username/password pairs, account managment, session and access control.
- * Note: SMB password checking is done in smbpass.c
- */
-
-#include "includes.h"
-
-#ifdef WITH_PAM
-
-/*******************************************************************
- * Handle PAM authentication 
- * 	- Access, Authentication, Session, Password
- *   Note: See PAM Documentation and refer to local system PAM implementation
- *   which determines what actions/limitations/allowances become affected.
- *********************************************************************/
-
-#include <security/pam_appl.h>
-
-/*
- * Structure used to communicate between the conversation function
- * and the server_login/change password functions.
- */
-
-struct smb_pam_userdata {
-	const char *PAM_username;
-	const char *PAM_password;
-	const char *PAM_newpassword;
-};
-
-typedef int (*smb_pam_conv_fn)(int, const struct pam_message **, struct pam_response **, void *appdata_ptr);
-
-/*
- *  Macros to help make life easy
- */
-#define COPY_STRING(s) (s) ? strdup(s) : NULL
-
-/*******************************************************************
- PAM error handler.
- *********************************************************************/
-
-static BOOL smb_pam_error_handler(pam_handle_t *pamh, int pam_error, char *msg, int dbglvl)
-{
-
-	if( pam_error != PAM_SUCCESS) {
-		DEBUG(dbglvl, ("smb_pam_error_handler: PAM: %s : %s\n",
-				msg, pam_strerror(pamh, pam_error)));
-		
-		return False;
-	}
-	return True;
-}
-
-/*******************************************************************
- This function is a sanity check, to make sure that we NEVER report
- failure as sucess.
-*********************************************************************/
-
-static BOOL smb_pam_nt_status_error_handler(pam_handle_t *pamh, int pam_error,
-							char *msg, int dbglvl, 
-					    NTSTATUS *nt_status)
-{
-	if (smb_pam_error_handler(pamh, pam_error, msg, dbglvl))
-		return True;
-
-	if (NT_STATUS_IS_OK(*nt_status)) {
-		/* Complain LOUDLY */
-		DEBUG(0, ("smb_pam_nt_status_error_handler: PAM: BUG: PAM and NT_STATUS \
-error MISMATCH, forcing to NT_STATUS_LOGON_FAILURE"));
-		*nt_status = NT_STATUS_LOGON_FAILURE;
-	}
-	return False;
-}
-
-/*
- * PAM conversation function
- * Here we assume (for now, at least) that echo on means login name, and
- * echo off means password.
- */
-
-static int smb_pam_conv(int num_msg,
-		    const struct pam_message **msg,
-		    struct pam_response **resp,
-		    void *appdata_ptr)
-{
-	int replies = 0;
-	struct pam_response *reply = NULL;
-	struct smb_pam_userdata *udp = (struct smb_pam_userdata *)appdata_ptr;
-
-	*resp = NULL;
-
-	if (num_msg <= 0)
-		return PAM_CONV_ERR;
-
-	/*
-	 * Apparantly HPUX has a buggy PAM that doesn't support the
-	 * appdata_ptr. Fail if this is the case. JRA.
-	 */
-
-	if (udp == NULL) {
-		DEBUG(0,("smb_pam_conv: PAM on this system is broken - appdata_ptr == NULL !\n"));
-		return PAM_CONV_ERR;
-	}
-
-	reply = malloc(sizeof(struct pam_response) * num_msg);
-	if (!reply)
-		return PAM_CONV_ERR;
-
-	memset(reply, '\0', sizeof(struct pam_response) * num_msg);
-
-	for (replies = 0; replies < num_msg; replies++) {
-		switch (msg[replies]->msg_style) {
-			case PAM_PROMPT_ECHO_ON:
-				reply[replies].resp_retcode = PAM_SUCCESS;
-				reply[replies].resp = COPY_STRING(udp->PAM_username);
-				/* PAM frees resp */
-				break;
-
-			case PAM_PROMPT_ECHO_OFF:
-				reply[replies].resp_retcode = PAM_SUCCESS;
-				reply[replies].resp = COPY_STRING(udp->PAM_password);
-				/* PAM frees resp */
-				break;
-
-			case PAM_TEXT_INFO:
-				/* fall through */
-
-			case PAM_ERROR_MSG:
-				/* ignore it... */
-				reply[replies].resp_retcode = PAM_SUCCESS;
-				reply[replies].resp = NULL;
-				break;
-
-			default:
-				/* Must be an error of some sort... */
-				SAFE_FREE(reply);
-				return PAM_CONV_ERR;
-		}
-	}
-	if (reply)
-		*resp = reply;
-	return PAM_SUCCESS;
-}
-
-/*
- * PAM password change conversation function
- * Here we assume (for now, at least) that echo on means login name, and
- * echo off means password.
- */
-
-static void special_char_sub(char *buf)
-{
-	all_string_sub(buf, "\\n", "", 0);
-	all_string_sub(buf, "\\r", "", 0);
-	all_string_sub(buf, "\\s", " ", 0);
-	all_string_sub(buf, "\\t", "\t", 0);
-}
-
-static void pwd_sub(char *buf, const char *username, const char *oldpass, const char *newpass)
-{
-	pstring_sub(buf, "%u", username);
-	all_string_sub(buf, "%o", oldpass, sizeof(fstring));
-	all_string_sub(buf, "%n", newpass, sizeof(fstring));
-}
-
-
-struct chat_struct {
-	struct chat_struct *next, *prev;
-	fstring prompt;
-	fstring reply;
-};
-
-/**************************************************************
- Create a linked list containing chat data.
-***************************************************************/
-
-static struct chat_struct *make_pw_chat(char *p) 
-{
-	fstring prompt;
-	fstring reply;
-	struct chat_struct *list = NULL;
-	struct chat_struct *t;
-	struct chat_struct *tmp;
-
-	while (1) {
-		t = (struct chat_struct *)malloc(sizeof(*t));
-		if (!t) {
-			DEBUG(0,("make_pw_chat: malloc failed!\n"));
-			return NULL;
-		}
-
-		ZERO_STRUCTP(t);
-
-		DLIST_ADD_END(list, t, tmp);
-
-		if (!next_token(&p, prompt, NULL, sizeof(fstring)))
-			break;
-
-		if (strequal(prompt,"."))
-			fstrcpy(prompt,"*");
-
-		special_char_sub(prompt);
-		fstrcpy(t->prompt, prompt);
-		strlower(t->prompt);
-		trim_string(t->prompt, " ", " ");
-
-		if (!next_token(&p, reply, NULL, sizeof(fstring)))
-			break;
-
-		if (strequal(reply,"."))
-				fstrcpy(reply,"");
-
-		special_char_sub(reply);
-		fstrcpy(t->reply, reply);
-		strlower(t->reply);
-		trim_string(t->reply, " ", " ");
-
-	}
-	return list;
-}
-
-static void free_pw_chat(struct chat_struct *list)
-{
-    while (list) {
-        struct chat_struct *old_head = list;
-        DLIST_REMOVE(list, list);
-        SAFE_FREE(old_head);
-    }
-}
-
-static int smb_pam_passchange_conv(int num_msg,
-				const struct pam_message **msg,
-				struct pam_response **resp,
-				void *appdata_ptr)
-{
-	int replies = 0;
-	struct pam_response *reply = NULL;
-	fstring current_prompt;
-	fstring current_reply;
-	struct smb_pam_userdata *udp = (struct smb_pam_userdata *)appdata_ptr;
-	struct chat_struct *pw_chat= make_pw_chat(lp_passwd_chat());
-	struct chat_struct *t;
-	BOOL found; 
-	*resp = NULL;
-	
-	DEBUG(10,("smb_pam_passchange_conv: starting converstation for %d messages\n", num_msg));
-
-	if (num_msg <= 0)
-		return PAM_CONV_ERR;
-
-	if (pw_chat == NULL)
-		return PAM_CONV_ERR;
-
-	/*
-	 * Apparantly HPUX has a buggy PAM that doesn't support the
-	 * appdata_ptr. Fail if this is the case. JRA.
-	 */
-
-	if (udp == NULL) {
-		DEBUG(0,("smb_pam_passchange_conv: PAM on this system is broken - appdata_ptr == NULL !\n"));
-		free_pw_chat(pw_chat);
-		return PAM_CONV_ERR;
-	}
-
-	reply = malloc(sizeof(struct pam_response) * num_msg);
-	if (!reply) {
-		DEBUG(0,("smb_pam_passchange_conv: malloc for reply failed!\n"));
-		free_pw_chat(pw_chat);
-		return PAM_CONV_ERR;
-	}
-
-	for (replies = 0; replies < num_msg; replies++) {
-		found = False;
-		DEBUG(10,("smb_pam_passchange_conv: Processing message %d\n", replies));
-		switch (msg[replies]->msg_style) {
-		case PAM_PROMPT_ECHO_ON:
-			DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: PAM said: %s\n", msg[replies]->msg));
-			fstrcpy(current_prompt, msg[replies]->msg);
-			trim_string(current_prompt, " ", " ");
-			for (t=pw_chat; t; t=t->next) {
-
-				DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: trying to match |%s| to |%s|\n",
-						t->prompt, current_prompt ));
-
-				if (unix_wild_match(t->prompt, current_prompt) == 0) {
-					fstrcpy(current_reply, t->reply);
-					DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We sent: %s\n", current_reply));
-					pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
-#ifdef DEBUG_PASSWORD
-					DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We actualy sent: %s\n", current_reply));
-#endif
-					reply[replies].resp_retcode = PAM_SUCCESS;
-					reply[replies].resp = COPY_STRING(current_reply);
-					found = True;
-					break;
-				}
-			}
-			/* PAM frees resp */
-			if (!found) {
-				DEBUG(3,("smb_pam_passchange_conv: Could not find reply for PAM prompt: %s\n",msg[replies]->msg));
-				free_pw_chat(pw_chat);
-				SAFE_FREE(reply);
-				return PAM_CONV_ERR;
-			}
-			break;
-
-		case PAM_PROMPT_ECHO_OFF:
-			DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: PAM said: %s\n", msg[replies]->msg));
-			fstrcpy(current_prompt, msg[replies]->msg);
-			trim_string(current_prompt, " ", " ");
-			for (t=pw_chat; t; t=t->next) {
-
-				DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: trying to match |%s| to |%s|\n",
-						t->prompt, current_prompt ));
-
-				if (unix_wild_match(t->prompt, current_prompt) == 0) {
-					fstrcpy(current_reply, t->reply);
-					DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We sent: %s\n", current_reply));
-					pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
-					reply[replies].resp_retcode = PAM_SUCCESS;
-					reply[replies].resp = COPY_STRING(current_reply);
-#ifdef DEBUG_PASSWORD
-					DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We actualy sent: %s\n", current_reply));
-#endif
-					found = True;
-					break;
-				}
-			}
-			/* PAM frees resp */
-			
-			if (!found) {
-				DEBUG(3,("smb_pam_passchange_conv: Could not find reply for PAM prompt: %s\n",msg[replies]->msg));
-				free_pw_chat(pw_chat);
-				SAFE_FREE(reply);
-				return PAM_CONV_ERR;
-			}
-			break;
-
-		case PAM_TEXT_INFO:
-			/* fall through */
-
-		case PAM_ERROR_MSG:
-			/* ignore it... */
-			reply[replies].resp_retcode = PAM_SUCCESS;
-			reply[replies].resp = NULL;
-			break;
-			
-		default:
-			/* Must be an error of some sort... */
-			free_pw_chat(pw_chat);
-			SAFE_FREE(reply);
-			return PAM_CONV_ERR;
-		}
-	}
-		
-	free_pw_chat(pw_chat);
-	if (reply)
-		*resp = reply;
-	return PAM_SUCCESS;
-}
-
-/***************************************************************************
- Free up a malloced pam_conv struct.
-****************************************************************************/
-
-static void smb_free_pam_conv(struct pam_conv *pconv)
-{
-	if (pconv)
-		SAFE_FREE(pconv->appdata_ptr);
-
-	SAFE_FREE(pconv);
-}
-
-/***************************************************************************
- Allocate a pam_conv struct.
-****************************************************************************/
-
-static struct pam_conv *smb_setup_pam_conv(smb_pam_conv_fn smb_pam_conv_fnptr, const char *user,
-					const char *passwd, const char *newpass)
-{
-	struct pam_conv *pconv = (struct pam_conv *)malloc(sizeof(struct pam_conv));
-	struct smb_pam_userdata *udp = (struct smb_pam_userdata *)malloc(sizeof(struct smb_pam_userdata));
-
-	if (pconv == NULL || udp == NULL) {
-		SAFE_FREE(pconv);
-		SAFE_FREE(udp);
-		return NULL;
-	}
-
-	udp->PAM_username = user;
-	udp->PAM_password = passwd;
-	udp->PAM_newpassword = newpass;
-
-	pconv->conv = smb_pam_conv_fnptr;
-	pconv->appdata_ptr = (void *)udp;
-	return pconv;
-}
-
-/* 
- * PAM Closing out cleanup handler
- */
-
-static BOOL smb_pam_end(pam_handle_t *pamh, struct pam_conv *smb_pam_conv_ptr)
-{
-	int pam_error;
-
-	smb_free_pam_conv(smb_pam_conv_ptr);
-       
-	if( pamh != NULL ) {
-		pam_error = pam_end(pamh, 0);
-		if(smb_pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
-			DEBUG(4, ("smb_pam_end: PAM: PAM_END OK.\n"));
-			return True;
-		}
-	}
-	DEBUG(2,("smb_pam_end: PAM: not initialised"));
-	return False;
-}
-
-/*
- * Start PAM authentication for specified account
- */
-
-static BOOL smb_pam_start(pam_handle_t **pamh, const char *user, const char *rhost, struct pam_conv *pconv)
-{
-	int pam_error;
-	const char *our_rhost;
-
-	*pamh = (pam_handle_t *)NULL;
-
-	DEBUG(4,("smb_pam_start: PAM: Init user: %s\n", user));
-
-	pam_error = pam_start("samba", user, pconv, pamh);
-	if( !smb_pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
-		*pamh = (pam_handle_t *)NULL;
-		return False;
-	}
-
-	if (rhost == NULL) {
-		our_rhost = client_name();
-		if (strequal(rhost,"UNKNOWN"))
-			our_rhost = client_addr();
-	} else {
-		our_rhost = rhost;
-	}
-
-#ifdef PAM_RHOST
-	DEBUG(4,("smb_pam_start: PAM: setting rhost to: %s\n", our_rhost));
-	pam_error = pam_set_item(*pamh, PAM_RHOST, our_rhost);
-	if(!smb_pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
-		smb_pam_end(*pamh, pconv);
-		*pamh = (pam_handle_t *)NULL;
-		return False;
-	}
-#endif
-#ifdef PAM_TTY
-	DEBUG(4,("smb_pam_start: PAM: setting tty\n"));
-	pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
-	if (!smb_pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
-		smb_pam_end(*pamh, pconv);
-		*pamh = (pam_handle_t *)NULL;
-		return False;
-	}
-#endif
-	DEBUG(4,("smb_pam_start: PAM: Init passed for user: %s\n", user));
-	return True;
-}
-
-/*
- * PAM Authentication Handler
- */
-static NTSTATUS smb_pam_auth(pam_handle_t *pamh, char *user)
-{
-	int pam_error;
-	NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
-
-	/*
-	 * To enable debugging set in /etc/pam.d/samba:
-	 *	auth required /lib/security/pam_pwdb.so nullok shadow audit
-	 */
-	
-	DEBUG(4,("smb_pam_auth: PAM: Authenticate User: %s\n", user));
-	pam_error = pam_authenticate(pamh, PAM_SILENT | lp_null_passwords() ? 0 : PAM_DISALLOW_NULL_AUTHTOK);
-	switch( pam_error ){
-		case PAM_AUTH_ERR:
-			DEBUG(2, ("smb_pam_auth: PAM: Athentication Error for user %s\n", user));
-			nt_status = NT_STATUS_WRONG_PASSWORD;
-			break;
-		case PAM_CRED_INSUFFICIENT:
-			DEBUG(2, ("smb_pam_auth: PAM: Insufficient Credentials for user %s\n", user));
-			nt_status = NT_STATUS_INSUFFICIENT_LOGON_INFO;
-			break;
-		case PAM_AUTHINFO_UNAVAIL:
-			DEBUG(2, ("smb_pam_auth: PAM: Authentication Information Unavailable for user %s\n", user));
-			nt_status = NT_STATUS_LOGON_FAILURE;
-			break;
-		case PAM_USER_UNKNOWN:
-			DEBUG(2, ("smb_pam_auth: PAM: Username %s NOT known to Authentication system\n", user));
-			nt_status = NT_STATUS_NO_SUCH_USER;
-			break;
-		case PAM_MAXTRIES:
-			DEBUG(2, ("smb_pam_auth: PAM: One or more authentication modules reports user limit for user %s exceeeded\n", user));
-			nt_status = NT_STATUS_REMOTE_SESSION_LIMIT;
-			break;
-		case PAM_ABORT:
-			DEBUG(0, ("smb_pam_auth: PAM: One or more PAM modules failed to load for user %s\n", user));
-			nt_status = NT_STATUS_LOGON_FAILURE;
-			break;
-		case PAM_SUCCESS:
-			DEBUG(4, ("smb_pam_auth: PAM: User %s Authenticated OK\n", user));
-			nt_status = NT_STATUS_OK;
-			break;
-		default:
-			DEBUG(0, ("smb_pam_auth: PAM: UNKNOWN ERROR while authenticating user %s\n", user));
-			nt_status = NT_STATUS_LOGON_FAILURE;
-			break;
-	}
-
-	smb_pam_nt_status_error_handler(pamh, pam_error, "Authentication Failure", 2, &nt_status);
-	return nt_status;
-}
-
-/* 
- * PAM Account Handler
- */
-static NTSTATUS smb_pam_account(pam_handle_t *pamh, const char * user)
-{
-	int pam_error;
-	NTSTATUS nt_status = NT_STATUS_ACCOUNT_DISABLED;
-
-	DEBUG(4,("smb_pam_account: PAM: Account Management for User: %s\n", user));
-	pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
-	switch( pam_error ) {
-		case PAM_AUTHTOK_EXPIRED:
-			DEBUG(2, ("smb_pam_account: PAM: User %s is valid but password is expired\n", user));
-			nt_status = NT_STATUS_PASSWORD_EXPIRED;
-			break;
-		case PAM_ACCT_EXPIRED:
-			DEBUG(2, ("smb_pam_account: PAM: User %s no longer permitted to access system\n", user));
-			nt_status = NT_STATUS_ACCOUNT_EXPIRED;
-			break;
-		case PAM_AUTH_ERR:
-			DEBUG(2, ("smb_pam_account: PAM: There was an authentication error for user %s\n", user));
-			nt_status = NT_STATUS_LOGON_FAILURE;
-			break;
-		case PAM_PERM_DENIED:
-			DEBUG(0, ("smb_pam_account: PAM: User %s is NOT permitted to access system at this time\n", user));
-			nt_status = NT_STATUS_ACCOUNT_RESTRICTION;
-			break;
-		case PAM_USER_UNKNOWN:
-			DEBUG(0, ("smb_pam_account: PAM: User \"%s\" is NOT known to account management\n", user));
-			nt_status = NT_STATUS_NO_SUCH_USER;
-			break;
-		case PAM_SUCCESS:
-			DEBUG(4, ("smb_pam_account: PAM: Account OK for User: %s\n", user));
-			nt_status = NT_STATUS_OK;
-			break;
-		default:
-			nt_status = NT_STATUS_ACCOUNT_DISABLED;
-			DEBUG(0, ("smb_pam_account: PAM: UNKNOWN PAM ERROR (%d) during Account Management for User: %s\n", pam_error, user));
-			break;
-	}
-
-	smb_pam_nt_status_error_handler(pamh, pam_error, "Account Check Failed", 2, &nt_status);
-	return nt_status;
-}
-
-/*
- * PAM Credential Setting
- */
-
-static NTSTATUS smb_pam_setcred(pam_handle_t *pamh, char * user)
-{
-	int pam_error;
-	NTSTATUS nt_status = NT_STATUS_NO_TOKEN;
-
-	/*
-	 * This will allow samba to aquire a kerberos token. And, when
-	 * exporting an AFS cell, be able to /write/ to this cell.
-	 */
-
-	DEBUG(4,("PAM: Account Management SetCredentials for User: %s\n", user));
-	pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED|PAM_SILENT)); 
-	switch( pam_error ) {
-		case PAM_CRED_UNAVAIL:
-			DEBUG(0, ("smb_pam_setcred: PAM: Credentials not found for user:%s\n", user ));
-			 nt_status = NT_STATUS_NO_TOKEN;
-			break;
-		case PAM_CRED_EXPIRED:
-			DEBUG(0, ("smb_pam_setcred: PAM: Credentials for user: \"%s\" EXPIRED!\n", user ));
-			nt_status = NT_STATUS_PASSWORD_EXPIRED;
-			break;
-		case PAM_USER_UNKNOWN:
-			DEBUG(0, ("smb_pam_setcred: PAM: User: \"%s\" is NOT known so can not set credentials!\n", user ));
-			nt_status = NT_STATUS_NO_SUCH_USER;
-			break;
-		case PAM_CRED_ERR:
-			DEBUG(0, ("smb_pam_setcred: PAM: Unknown setcredentials error - unable to set credentials for %s\n", user ));
-			nt_status = NT_STATUS_LOGON_FAILURE;
-			break;
-		case PAM_SUCCESS:
-			DEBUG(4, ("smb_pam_setcred: PAM: SetCredentials OK for User: %s\n", user));
-			nt_status = NT_STATUS_OK;
-			break;
-		default:
-			DEBUG(0, ("smb_pam_setcred: PAM: UNKNOWN PAM ERROR (%d) during SetCredentials for User: %s\n", pam_error, user));
-			nt_status = NT_STATUS_NO_TOKEN;
-			break;
-	}
-
-	smb_pam_nt_status_error_handler(pamh, pam_error, "Set Credential Failure", 2, &nt_status);
-	return nt_status;
-}
-
-/*
- * PAM Internal Session Handler
- */
-static BOOL smb_internal_pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL flag)
-{
-	int pam_error;
-
-#ifdef PAM_TTY
-	DEBUG(4,("smb_internal_pam_session: PAM: tty set to: %s\n", tty));
-	pam_error = pam_set_item(pamh, PAM_TTY, tty);
-	if (!smb_pam_error_handler(pamh, pam_error, "set tty failed", 0))
-		return False;
-#endif
-
-	if (flag) {
-		pam_error = pam_open_session(pamh, PAM_SILENT);
-		if (!smb_pam_error_handler(pamh, pam_error, "session setup failed", 0))
-			return False;
-	} else {
-		pam_setcred(pamh, (PAM_DELETE_CRED|PAM_SILENT)); /* We don't care if this fails */
-		pam_error = pam_close_session(pamh, PAM_SILENT); /* This will probably pick up the error anyway */
-		if (!smb_pam_error_handler(pamh, pam_error, "session close failed", 0))
-			return False;
-	}
-	return (True);
-}
-
-/*
- * Internal PAM Password Changer.
- */
-
-static BOOL smb_pam_chauthtok(pam_handle_t *pamh, const char * user)
-{
-	int pam_error;
-
-	DEBUG(4,("smb_pam_chauthtok: PAM: Password Change for User: %s\n", user));
-
-	pam_error = pam_chauthtok(pamh, PAM_SILENT); /* Change Password */
-
-	switch( pam_error ) {
-	case PAM_AUTHTOK_ERR:
-		DEBUG(2, ("PAM: unable to obtain the new authentication token - is password to weak?\n"));
-		break;
-
-	/* This doesn't seem to be defined on Solaris. JRA */
-#ifdef PAM_AUTHTOK_RECOVER_ERR
-	case PAM_AUTHTOK_RECOVER_ERR:
-		DEBUG(2, ("PAM: unable to obtain the old authentication token - was the old password wrong?.\n"));
-		break;
-#endif
-
-	case PAM_AUTHTOK_LOCK_BUSY:
-		DEBUG(2, ("PAM: unable to change the authentication token since it is currently locked.\n"));
-		break;
-	case PAM_AUTHTOK_DISABLE_AGING:
-		DEBUG(2, ("PAM: Authentication token aging has been disabled.\n"));
-		break;
-	case PAM_PERM_DENIED:
-		DEBUG(0, ("PAM: Permission denied.\n"));
-		break;
-	case PAM_TRY_AGAIN:
-		DEBUG(0, ("PAM: Could not update all authentication token(s). No authentication tokens were updated.\n"));
-		break;
-	case PAM_USER_UNKNOWN:
-		DEBUG(0, ("PAM: User not known to PAM\n"));
-		break;
-	case PAM_SUCCESS:
-		DEBUG(4, ("PAM: Account OK for User: %s\n", user));
-		break;
-	default:
-		DEBUG(0, ("PAM: UNKNOWN PAM ERROR (%d) for User: %s\n", pam_error, user));
-	}
- 
-	if(!smb_pam_error_handler(pamh, pam_error, "Password Change Failed", 2)) {
-		return False;
-	}
-
-	/* If this point is reached, the password has changed. */
-	return True;
-}
-
-/*
- * PAM Externally accessible Session handler
- */
-
-BOOL smb_pam_claim_session(char *user, char *tty, char *rhost)
-{
-	pam_handle_t *pamh = NULL;
-	struct pam_conv *pconv = NULL;
-
-	/* Ignore PAM if told to. */
-
-	if (!lp_obey_pam_restrictions())
-		return True;
-
-	if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
-		return False;
-
-	if (!smb_pam_start(&pamh, user, rhost, pconv))
-		return False;
-
-	if (!smb_internal_pam_session(pamh, user, tty, True)) {
-		smb_pam_end(pamh, pconv);
-		return False;
-	}
-
-	return smb_pam_end(pamh, pconv);
-}
-
-/*
- * PAM Externally accessible Session handler
- */
-
-BOOL smb_pam_close_session(char *user, char *tty, char *rhost)
-{
-	pam_handle_t *pamh = NULL;
-	struct pam_conv *pconv = NULL;
-
-	/* Ignore PAM if told to. */
-
-	if (!lp_obey_pam_restrictions())
-		return True;
-
-	if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
-		return False;
-
-	if (!smb_pam_start(&pamh, user, rhost, pconv))
-		return False;
-
-	if (!smb_internal_pam_session(pamh, user, tty, False)) {
-		smb_pam_end(pamh, pconv);
-		return False;
-	}
-
-	return smb_pam_end(pamh, pconv);
-}
-
-/*
- * PAM Externally accessible Account handler
- */
-
-NTSTATUS smb_pam_accountcheck(const char * user)
-{
-	NTSTATUS nt_status = NT_STATUS_ACCOUNT_DISABLED;
-	pam_handle_t *pamh = NULL;
-	struct pam_conv *pconv = NULL;
-
-	/* Ignore PAM if told to. */
-
-	if (!lp_obey_pam_restrictions())
-		return NT_STATUS_OK;
-
-	if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
-		return NT_STATUS_NO_MEMORY;
-
-	if (!smb_pam_start(&pamh, user, NULL, pconv))
-		return NT_STATUS_ACCOUNT_DISABLED;
-
-	if (!NT_STATUS_IS_OK(nt_status = smb_pam_account(pamh, user)))
-		DEBUG(0, ("smb_pam_accountcheck: PAM: Account Validation Failed - Rejecting User %s!\n", user));
-
-	smb_pam_end(pamh, pconv);
-	return nt_status;
-}
-
-/*
- * PAM Password Validation Suite
- */
-
-NTSTATUS smb_pam_passcheck(char * user, char * password)
-{
-	pam_handle_t *pamh = NULL;
-	NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
-	struct pam_conv *pconv = NULL;
-
-	/*
-	 * Note we can't ignore PAM here as this is the only
-	 * way of doing auths on plaintext passwords when
-	 * compiled --with-pam.
-	 */
-
-	if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, password, NULL)) == NULL)
-		return NT_STATUS_LOGON_FAILURE;
-
-	if (!smb_pam_start(&pamh, user, NULL, pconv))
-		return NT_STATUS_LOGON_FAILURE;
-
-	if (!NT_STATUS_IS_OK(nt_status = smb_pam_auth(pamh, user))) {
-		DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_auth failed - Rejecting User %s !\n", user));
-		smb_pam_end(pamh, pconv);
-		return nt_status;
-	}
-
-	if (!NT_STATUS_IS_OK(nt_status = smb_pam_account(pamh, user))) {
-		DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_account failed - Rejecting User %s !\n", user));
-		smb_pam_end(pamh, pconv);
-		return nt_status;
-	}
-
-	if (!NT_STATUS_IS_OK(nt_status = smb_pam_setcred(pamh, user))) {
-		DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_setcred failed - Rejecting User %s !\n", user));
-		smb_pam_end(pamh, pconv);
-		return nt_status;
-	}
-
-	smb_pam_end(pamh, pconv);
-	return nt_status;
-}
-
-/*
- * PAM Password Change Suite
- */
-
-BOOL smb_pam_passchange(const char * user, const char * oldpassword, const char * newpassword)
-{
-	/* Appropriate quantities of root should be obtained BEFORE calling this function */
-	struct pam_conv *pconv = NULL;
-	pam_handle_t *pamh = NULL;
-
-	if ((pconv = smb_setup_pam_conv(smb_pam_passchange_conv, user, oldpassword, newpassword)) == NULL)
-		return False;
-
-	if(!smb_pam_start(&pamh, user, NULL, pconv))
-		return False;
-
-	if (!smb_pam_chauthtok(pamh, user)) {
-		DEBUG(0, ("smb_pam_passchange: PAM: Password Change Failed for user %s!\n", user));
-		smb_pam_end(pamh, pconv);
-		return False;
-	}
-
-	return smb_pam_end(pamh, pconv);
-}
-
-#else
-
-/* If PAM not used, no PAM restrictions on accounts. */
-NTSTATUS smb_pam_accountcheck(const char * user)
-{
-	return NT_STATUS_OK;
-}
-
-/* If PAM not used, also no PAM restrictions on sessions. */
-BOOL smb_pam_claim_session(char *user, char *tty, char *rhost)
-{
-	return True;
-}
-
-/* If PAM not used, also no PAM restrictions on sessions. */
-BOOL smb_pam_close_session(char *in_user, char *tty, char *rhost)
-{
-	return True;
-}
-#endif /* WITH_PAM */
diff --git a/source3/passdb/pass_check.c b/source3/passdb/pass_check.c
deleted file mode 100644
index 77839e4bb0..0000000000
--- a/source3/passdb/pass_check.c
+++ /dev/null
@@ -1,776 +0,0 @@
-/* 
-   Unix SMB/Netbios implementation.
-   Version 1.9.
-   Password checking
-   Copyright (C) Andrew Tridgell 1992-1998
-   
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-/* this module is for checking a username/password against a system
-   password database. The SMB encrypted password support is elsewhere */
-
-#include "includes.h"
-
-/* these are kept here to keep the string_combinations function simple */
-static fstring this_user;
-#if !defined(WITH_PAM) 
-static fstring this_salt;
-static fstring this_crypted;
-#endif
-
-#ifdef WITH_AFS
-
-#include <afs/stds.h>
-#include <afs/kautils.h>
-
-/*******************************************************************
-check on AFS authentication
-********************************************************************/
-static BOOL afs_auth(char *user, char *password)
-{
-	long password_expires = 0;
-	char *reason;
-
-	/* For versions of AFS prior to 3.3, this routine has few arguments, */
-	/* but since I can't find the old documentation... :-)               */
-	setpag();
-	if (ka_UserAuthenticateGeneral
-	    (KA_USERAUTH_VERSION + KA_USERAUTH_DOSETPAG, user, (char *)0,	/* instance */
-	     (char *)0,		/* cell */
-	     password, 0,	/* lifetime, default */
-	     &password_expires,	/*days 'til it expires */
-	     0,			/* spare 2 */
-	     &reason) == 0)
-	{
-		return (True);
-	}
-	DEBUG(1,
-	      ("AFS authentication for \"%s\" failed (%s)\n", user, reason));
-	return (False);
-}
-#endif
-
-
-#ifdef WITH_DFS
-
-#include <dce/dce_error.h>
-#include <dce/sec_login.h>
-
-/*****************************************************************
- This new version of the DFS_AUTH code was donated by Karsten Muuss
- <muuss@or.uni-bonn.de>. It fixes the following problems with the
- old code :
-
-  - Server credentials may expire
-  - Client credential cache files have wrong owner
-  - purge_context() function is called with invalid argument
-
- This new code was modified to ensure that on exit the uid/gid is
- still root, and the original directory is restored. JRA.
-******************************************************************/
-
-sec_login_handle_t my_dce_sec_context;
-int dcelogin_atmost_once = 0;
-
-/*******************************************************************
-check on a DCE/DFS authentication
-********************************************************************/
-static BOOL dfs_auth(char *user, char *password)
-{
-	error_status_t err;
-	int err2;
-	int prterr;
-	signed32 expire_time, current_time;
-	boolean32 password_reset;
-	struct passwd *pw;
-	sec_passwd_rec_t passwd_rec;
-	sec_login_auth_src_t auth_src = sec_login_auth_src_network;
-	unsigned char dce_errstr[dce_c_error_string_len];
-	gid_t egid;
-
-	if (dcelogin_atmost_once)
-		return (False);
-
-#ifdef HAVE_CRYPT
-	/*
-	 * We only go for a DCE login context if the given password
-	 * matches that stored in the local password file.. 
-	 * Assumes local passwd file is kept in sync w/ DCE RGY!
-	 */
-
-	if (strcmp((char *)crypt(password, this_salt), this_crypted))
-	{
-		return (False);
-	}
-#endif
-
-	sec_login_get_current_context(&my_dce_sec_context, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE can't get current context. %s\n", dce_errstr));
-
-		return (False);
-	}
-
-	sec_login_certify_identity(my_dce_sec_context, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE can't get current context. %s\n", dce_errstr));
-
-		return (False);
-	}
-
-	sec_login_get_expiration(my_dce_sec_context, &expire_time, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE can't get expiration. %s\n", dce_errstr));
-
-		return (False);
-	}
-
-	time(&current_time);
-
-	if (expire_time < (current_time + 60))
-	{
-		struct passwd *pw;
-		sec_passwd_rec_t *key;
-
-		sec_login_get_pwent(my_dce_sec_context,
-				    (sec_login_passwd_t *) & pw, &err);
-		if (err != error_status_ok)
-		{
-			dce_error_inq_text(err, dce_errstr, &err2);
-			DEBUG(0, ("DCE can't get pwent. %s\n", dce_errstr));
-
-			return (False);
-		}
-
-		sec_login_refresh_identity(my_dce_sec_context, &err);
-		if (err != error_status_ok)
-		{
-			dce_error_inq_text(err, dce_errstr, &err2);
-			DEBUG(0, ("DCE can't refresh identity. %s\n",
-				  dce_errstr));
-
-			return (False);
-		}
-
-		sec_key_mgmt_get_key(rpc_c_authn_dce_secret, NULL,
-				     (unsigned char *)pw->pw_name,
-				     sec_c_key_version_none,
-				     (void **)&key, &err);
-		if (err != error_status_ok)
-		{
-			dce_error_inq_text(err, dce_errstr, &err2);
-			DEBUG(0, ("DCE can't get key for %s. %s\n",
-				  pw->pw_name, dce_errstr));
-
-			return (False);
-		}
-
-		sec_login_valid_and_cert_ident(my_dce_sec_context, key,
-					       &password_reset, &auth_src,
-					       &err);
-		if (err != error_status_ok)
-		{
-			dce_error_inq_text(err, dce_errstr, &err2);
-			DEBUG(0,
-			      ("DCE can't validate and certify identity for %s. %s\n",
-			       pw->pw_name, dce_errstr));
-		}
-
-		sec_key_mgmt_free_key(key, &err);
-		if (err != error_status_ok)
-		{
-			dce_error_inq_text(err, dce_errstr, &err2);
-			DEBUG(0, ("DCE can't free key.\n", dce_errstr));
-		}
-	}
-
-	if (sec_login_setup_identity((unsigned char *)user,
-				     sec_login_no_flags,
-				     &my_dce_sec_context, &err) == 0)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE Setup Identity for %s failed: %s\n",
-			  user, dce_errstr));
-		return (False);
-	}
-
-	sec_login_get_pwent(my_dce_sec_context,
-			    (sec_login_passwd_t *) & pw, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE can't get pwent. %s\n", dce_errstr));
-
-		return (False);
-	}
-
-	sec_login_purge_context(&my_dce_sec_context, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE can't purge context. %s\n", dce_errstr));
-
-		return (False);
-	}
-
-	/*
-	 * NB. I'd like to change these to call something like change_to_user()
-	 * instead but currently we don't have a connection
-	 * context to become the correct user. This is already
-	 * fairly platform specific code however, so I think
-	 * this should be ok. I have added code to go
-	 * back to being root on error though. JRA.
-	 */
-
-	egid = getegid();
-
-	set_effective_gid(pw->pw_gid);
-	set_effective_uid(pw->pw_uid);
-
-	if (sec_login_setup_identity((unsigned char *)user,
-				     sec_login_no_flags,
-				     &my_dce_sec_context, &err) == 0)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE Setup Identity for %s failed: %s\n",
-			  user, dce_errstr));
-		goto err;
-	}
-
-	sec_login_get_pwent(my_dce_sec_context,
-			    (sec_login_passwd_t *) & pw, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE can't get pwent. %s\n", dce_errstr));
-		goto err;
-	}
-
-	passwd_rec.version_number = sec_passwd_c_version_none;
-	passwd_rec.pepper = NULL;
-	passwd_rec.key.key_type = sec_passwd_plain;
-	passwd_rec.key.tagged_union.plain = (idl_char *) password;
-
-	sec_login_validate_identity(my_dce_sec_context,
-				    &passwd_rec, &password_reset,
-				    &auth_src, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0,
-		      ("DCE Identity Validation failed for principal %s: %s\n",
-		       user, dce_errstr));
-		goto err;
-	}
-
-	sec_login_certify_identity(my_dce_sec_context, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE certify identity failed: %s\n", dce_errstr));
-		goto err;
-	}
-
-	if (auth_src != sec_login_auth_src_network)
-	{
-		DEBUG(0, ("DCE context has no network credentials.\n"));
-	}
-
-	sec_login_set_context(my_dce_sec_context, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0,
-		      ("DCE login failed for principal %s, cant set context: %s\n",
-		       user, dce_errstr));
-
-		sec_login_purge_context(&my_dce_sec_context, &err);
-		goto err;
-	}
-
-	sec_login_get_pwent(my_dce_sec_context,
-			    (sec_login_passwd_t *) & pw, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE can't get pwent. %s\n", dce_errstr));
-		goto err;
-	}
-
-	DEBUG(0, ("DCE login succeeded for principal %s on pid %d\n",
-		  user, sys_getpid()));
-
-	DEBUG(3, ("DCE principal: %s\n"
-		  "          uid: %d\n"
-		  "          gid: %d\n",
-		  pw->pw_name, pw->pw_uid, pw->pw_gid));
-	DEBUG(3, ("         info: %s\n"
-		  "          dir: %s\n"
-		  "        shell: %s\n",
-		  pw->pw_gecos, pw->pw_dir, pw->pw_shell));
-
-	sec_login_get_expiration(my_dce_sec_context, &expire_time, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0, ("DCE can't get expiration. %s\n", dce_errstr));
-		goto err;
-	}
-
-	set_effective_uid(0);
-	set_effective_gid(0);
-
-	DEBUG(0,
-	      ("DCE context expires: %s", asctime(localtime(&expire_time))));
-
-	dcelogin_atmost_once = 1;
-	return (True);
-
-      err:
-
-	/* Go back to root, JRA. */
-	set_effective_uid(0);
-	set_effective_gid(egid);
-	return (False);
-}
-
-void dfs_unlogin(void)
-{
-	error_status_t err;
-	int err2;
-	unsigned char dce_errstr[dce_c_error_string_len];
-
-	sec_login_purge_context(&my_dce_sec_context, &err);
-	if (err != error_status_ok)
-	{
-		dce_error_inq_text(err, dce_errstr, &err2);
-		DEBUG(0,
-		      ("DCE purge login context failed for server instance %d: %s\n",
-		       sys_getpid(), dce_errstr));
-	}
-}
-#endif
-
-#ifdef LINUX_BIGCRYPT
-/****************************************************************************
-an enhanced crypt for Linux to handle password longer than 8 characters
-****************************************************************************/
-static int linux_bigcrypt(char *password, char *salt1, char *crypted)
-{
-#define LINUX_PASSWORD_SEG_CHARS 8
-	char salt[3];
-	int i;
-
-	StrnCpy(salt, salt1, 2);
-	crypted += 2;
-
-	for (i = strlen(password); i > 0; i -= LINUX_PASSWORD_SEG_CHARS) {
-		char *p = crypt(password, salt) + 2;
-		if (strncmp(p, crypted, LINUX_PASSWORD_SEG_CHARS) != 0)
-			return (0);
-		password += LINUX_PASSWORD_SEG_CHARS;
-		crypted += strlen(p);
-	}
-
-	return (1);
-}
-#endif
-
-#ifdef OSF1_ENH_SEC
-/****************************************************************************
-an enhanced crypt for OSF1
-****************************************************************************/
-static char *osf1_bigcrypt(char *password, char *salt1)
-{
-	static char result[AUTH_MAX_PASSWD_LENGTH] = "";
-	char *p1;
-	char *p2 = password;
-	char salt[3];
-	int i;
-	int parts = strlen(password) / AUTH_CLEARTEXT_SEG_CHARS;
-	if (strlen(password) % AUTH_CLEARTEXT_SEG_CHARS)
-		parts++;
-
-	StrnCpy(salt, salt1, 2);
-	StrnCpy(result, salt1, 2);
-	result[2] = '\0';
-
-	for (i = 0; i < parts; i++) {
-		p1 = crypt(p2, salt);
-		strncat(result, p1 + 2,
-			AUTH_MAX_PASSWD_LENGTH - strlen(p1 + 2) - 1);
-		StrnCpy(salt, &result[2 + i * AUTH_CIPHERTEXT_SEG_CHARS], 2);
-		p2 += AUTH_CLEARTEXT_SEG_CHARS;
-	}
-
-	return (result);
-}
-#endif
-
-
-/****************************************************************************
-apply a function to upper/lower case combinations
-of a string and return true if one of them returns true.
-try all combinations with N uppercase letters.
-offset is the first char to try and change (start with 0)
-it assumes the string starts lowercased
-****************************************************************************/
-static NTSTATUS string_combinations2(char *s, int offset, NTSTATUS (*fn) (char *),
-				 int N)
-{
-	int len = strlen(s);
-	int i;
-	NTSTATUS nt_status;
-
-#ifdef PASSWORD_LENGTH
-	len = MIN(len, PASSWORD_LENGTH);
-#endif
-
-	if (N <= 0 || offset >= len)
-		return (fn(s));
-
-	for (i = offset; i < (len - (N - 1)); i++) {
-		char c = s[i];
-		if (!islower(c))
-			continue;
-		s[i] = toupper(c);
-		if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, i + 1, fn, N - 1),NT_STATUS_WRONG_PASSWORD)) {
-			return (nt_status);
-		}
-		s[i] = c;
-	}
-	return (NT_STATUS_WRONG_PASSWORD);
-}
-
-/****************************************************************************
-apply a function to upper/lower case combinations
-of a string and return true if one of them returns true.
-try all combinations with up to N uppercase letters.
-offset is the first char to try and change (start with 0)
-it assumes the string starts lowercased
-****************************************************************************/
-static NTSTATUS string_combinations(char *s, NTSTATUS (*fn) (char *), int N)
-{
-	int n;
-	NTSTATUS nt_status;
-	for (n = 1; n <= N; n++)
-		if (!NT_STATUS_EQUAL(nt_status = string_combinations2(s, 0, fn, n), NT_STATUS_WRONG_PASSWORD))
-			return nt_status;
-	return NT_STATUS_WRONG_PASSWORD;
-}
-
-
-/****************************************************************************
-core of password checking routine
-****************************************************************************/
-static NTSTATUS password_check(char *password)
-{
-#ifdef WITH_PAM
-	return smb_pam_passcheck(this_user, password);
-#else
-
-	BOOL ret;
-
-#ifdef WITH_AFS
-	if (afs_auth(this_user, password))
-		return NT_STATUS_OK;
-#endif /* WITH_AFS */
-
-#ifdef WITH_DFS
-	if (dfs_auth(this_user, password))
-		return NT_STATUS_OK;
-#endif /* WITH_DFS */
-
-#ifdef OSF1_ENH_SEC
-	
-	ret = (strcmp(osf1_bigcrypt(password, this_salt),
-		      this_crypted) == 0);
-	if (!ret) {
-		DEBUG(2,
-		      ("OSF1_ENH_SEC failed. Trying normal crypt.\n"));
-		ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
-	}
-	if (ret) {
-		return NT_STATUS_OK;
-	} else {
-		return NT_STATUS_WRONG_PASSWORD;
-	}
-	
-#endif /* OSF1_ENH_SEC */
-	
-#ifdef ULTRIX_AUTH
-	ret = (strcmp((char *)crypt16(password, this_salt), this_crypted) == 0);
-	if (ret) {
-		return NT_STATUS_OK;
-        } else {
-		return NT_STATUS_WRONG_PASSWORD;
-	}
-	
-#endif /* ULTRIX_AUTH */
-	
-#ifdef LINUX_BIGCRYPT
-	ret = (linux_bigcrypt(password, this_salt, this_crypted));
-        if (ret) {
-		return NT_STATUS_OK;
-	} else {
-		return NT_STATUS_WRONG_PASSWORD;
-	}
-#endif /* LINUX_BIGCRYPT */
-	
-#if defined(HAVE_BIGCRYPT) && defined(HAVE_CRYPT) && defined(USE_BOTH_CRYPT_CALLS)
-	
-	/*
-	 * Some systems have bigcrypt in the C library but might not
-	 * actually use it for the password hashes (HPUX 10.20) is
-	 * a noteable example. So we try bigcrypt first, followed
-	 * by crypt.
-	 */
-
-	if (strcmp(bigcrypt(password, this_salt), this_crypted) == 0)
-		return NT_STATUS_OK;
-	else
-		ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
-	if (ret) {
-		return NT_STATUS_OK;
-	} else {
-		return NT_STATUS_WRONG_PASSWORD;
-	}
-#else /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
-	
-#ifdef HAVE_BIGCRYPT
-	ret = (strcmp(bigcrypt(password, this_salt), this_crypted) == 0);
-        if (ret) {
-		return NT_STATUS_OK;
-	} else {
-		return NT_STATUS_WRONG_PASSWORD;
-	}
-#endif /* HAVE_BIGCRYPT */
-	
-#ifndef HAVE_CRYPT
-	DEBUG(1, ("Warning - no crypt available\n"));
-	return NT_STATUS_LOGON_FAILURE;
-#else /* HAVE_CRYPT */
-	ret = (strcmp((char *)crypt(password, this_salt), this_crypted) == 0);
-        if (ret) {
-		return NT_STATUS_OK;
-	} else {
-		return NT_STATUS_WRONG_PASSWORD;
-	}
-#endif /* HAVE_CRYPT */
-#endif /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
-#endif /* WITH_PAM || KRB4_AUTH || KRB5_AUTH */
-}
-
-
-
-/****************************************************************************
-CHECK if a username/password is OK
-the function pointer fn() points to a function to call when a successful
-match is found and is used to update the encrypted password file 
-return NT_STATUS_OK on correct match, appropriate error otherwise
-****************************************************************************/
-
-NTSTATUS pass_check(struct passwd *pass, char *user, char *password, 
-		    int pwlen, BOOL (*fn) (char *, char *), BOOL run_cracker)
-{
-	pstring pass2;
-	int level = lp_passwordlevel();
-
-	NTSTATUS nt_status;
-	if (password)
-		password[pwlen] = 0;
-
-#if DEBUG_PASSWORD
-	DEBUG(100, ("checking user=[%s] pass=[%s]\n", user, password));
-#endif
-
-	if (!password)
-		return NT_STATUS_LOGON_FAILURE;
-
-	if (((!*password) || (!pwlen)) && !lp_null_passwords())
-		return NT_STATUS_LOGON_FAILURE;
-
-#if defined(WITH_PAM) 
-
-	/*
-	 * If we're using PAM we want to short-circuit all the 
-	 * checks below and dive straight into the PAM code.
-	 */
-
-	fstrcpy(this_user, user);
-
-	DEBUG(4, ("pass_check: Checking (PAM) password for user %s (l=%d)\n", user, pwlen));
-
-#else /* Not using PAM or Kerebos */
-
-	DEBUG(4, ("pass_check: Checking password for user %s (l=%d)\n", user, pwlen));
-
-	if (!pass) {
-		DEBUG(3, ("Couldn't find user %s\n", user));
-		return NT_STATUS_NO_SUCH_USER;
-	}
-
-#ifdef HAVE_GETSPNAM
-	{
-		struct spwd *spass;
-
-		/* many shadow systems require you to be root to get
-		   the password, in most cases this should already be
-		   the case when this function is called, except
-		   perhaps for IPC password changing requests */
-
-		spass = getspnam(pass->pw_name);
-		if (spass && spass->sp_pwdp)
-			pstrcpy(pass->pw_passwd, spass->sp_pwdp);
-	}
-#elif defined(IA_UINFO)
-	{
-		/* Need to get password with SVR4.2's ia_ functions
-		   instead of get{sp,pw}ent functions. Required by
-		   UnixWare 2.x, tested on version
-		   2.1. (tangent@cyberport.com) */
-		uinfo_t uinfo;
-		if (ia_openinfo(pass->pw_name, &uinfo) != -1)
-			ia_get_logpwd(uinfo, &(pass->pw_passwd));
-	}
-#endif
-
-#ifdef HAVE_GETPRPWNAM
-	{
-		struct pr_passwd *pr_pw = getprpwnam(pass->pw_name);
-		if (pr_pw && pr_pw->ufld.fd_encrypt)
-			pstrcpy(pass->pw_passwd, pr_pw->ufld.fd_encrypt);
-	}
-#endif
-
-#ifdef OSF1_ENH_SEC
-	{
-		struct pr_passwd *mypasswd;
-		DEBUG(5, ("Checking password for user %s in OSF1_ENH_SEC\n",
-			  user));
-		mypasswd = getprpwnam(user);
-		if (mypasswd) {
-			fstrcpy(pass->pw_name, mypasswd->ufld.fd_name);
-			fstrcpy(pass->pw_passwd, mypasswd->ufld.fd_encrypt);
-		} else {
-			DEBUG(5,
-			      ("OSF1_ENH_SEC: No entry for user %s in protected database !\n",
-			       user));
-		}
-	}
-#endif
-
-#ifdef ULTRIX_AUTH
-	{
-		AUTHORIZATION *ap = getauthuid(pass->pw_uid);
-		if (ap) {
-			fstrcpy(pass->pw_passwd, ap->a_password);
-			endauthent();
-		}
-	}
-#endif
-
-	/* extract relevant info */
-	fstrcpy(this_salt, pass->pw_passwd);
-
-#if defined(HAVE_TRUNCATED_SALT)
-	/* crypt on some platforms (HPUX in particular)
-	   won't work with more than 2 salt characters. */
-	this_salt[2] = 0;
-#endif
-
-	fstrcpy(this_crypted, pass->pw_passwd);
-
-	if (!*this_crypted) {
-		if (!lp_null_passwords()) {
-			DEBUG(2, ("Disallowing %s with null password\n",
-				  this_user));
-			return NT_STATUS_LOGON_FAILURE;
-		}
-		if (!*password) {
-			DEBUG(3,
-			      ("Allowing access to %s with null password\n",
-			       this_user));
-			return NT_STATUS_OK;
-		}
-	}
-
-#endif /* defined(WITH_PAM) */
-
-	/* try it as it came to us */
-	nt_status = password_check(password);
-        if NT_STATUS_IS_OK(nt_status) {
-                if (fn) {
-                        fn(user, password);
-		}
-		return (nt_status);
-	} else if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
-                /* No point continuing if its not the password thats to blame (ie PAM disabled). */
-                return (nt_status);
-        }
-
-	if (!run_cracker) {
-		return (nt_status);
-	}
-
-	/* if the password was given to us with mixed case then we don't
-	 * need to proceed as we know it hasn't been case modified by the
-	 * client */
-	if (strhasupper(password) && strhaslower(password)) {
-		return nt_status;
-	}
-
-	/* make a copy of it */
-	StrnCpy(pass2, password, sizeof(pstring) - 1);
-
-	/* try all lowercase if it's currently all uppercase */
-	if (strhasupper(password)) {
-		strlower(password);
-		if NT_STATUS_IS_OK(nt_status = password_check(password)) {
-		        if (fn)
-				fn(user, password);
-			return (nt_status);
-		}
-	}
-
-	/* give up? */
-	if (level < 1) {
-		/* restore it */
-		fstrcpy(password, pass2);
-		return NT_STATUS_WRONG_PASSWORD;
-	}
-
-	/* last chance - all combinations of up to level chars upper! */
-	strlower(password);
-
- 
-        if NT_STATUS_IS_OK(nt_status = string_combinations(password, password_check, level)) {
-                if (fn)
-			fn(user, password);
-		return nt_status;
-	}
-        
-	/* restore it */
-	fstrcpy(password, pass2);
-
-	return NT_STATUS_WRONG_PASSWORD;
-}