1 files changed, 65 insertions, 0 deletions
diff --git a/source3/auth/auth_domain.c b/source3/auth/auth_domain.c
index c25e62ab80..f11dbe60ee 100644
--- a/source3/auth/auth_domain.c
+++ b/source3/auth/auth_domain.c
@@ -26,6 +26,71 @@
 extern bool global_machine_password_needs_changing;
 static struct named_mutex *mutex;
 
+/*
+ * Change machine password (called from main loop
+ * idle timeout. Must be done as root.
+ */
+
+void attempt_machine_password_change(void)
+{
+	unsigned char trust_passwd_hash[16];
+	time_t lct;
+	void *lock;
+
+	if (!global_machine_password_needs_changing) {
+		return;
+	}
+
+	if (lp_security() != SEC_DOMAIN) {
+		return;
+	}
+
+	/*
+	 * We're in domain level security, and the code that
+	 * read the machine password flagged that the machine
+	 * password needs changing.
+	 */
+
+	/*
+	 * First, open the machine password file with an exclusive lock.
+	 */
+
+	lock = secrets_get_trust_account_lock(NULL, lp_workgroup());
+
+	if (lock == NULL) {
+		DEBUG(0,("attempt_machine_password_change: unable to lock "
+			"the machine account password for machine %s in "
+			"domain %s.\n",
+			global_myname(), lp_workgroup() ));
+		return;
+	}
+
+	if(!secrets_fetch_trust_account_password(lp_workgroup(),
+			trust_passwd_hash, &lct, NULL)) {
+		DEBUG(0,("attempt_machine_password_change: unable to read the "
+			"machine account password for %s in domain %s.\n",
+			global_myname(), lp_workgroup()));
+		TALLOC_FREE(lock);
+		return;
+	}
+
+	/*
+	 * Make sure someone else hasn't already done this.
+	 */
+
+	if(time(NULL) < lct + lp_machine_password_timeout()) {
+		global_machine_password_needs_changing = false;
+		TALLOC_FREE(lock);
+		return;
+	}
+
+	/* always just contact the PDC here */
+
+	change_trust_account_password( lp_workgroup(), NULL);
+	global_machine_password_needs_changing = false;
+	TALLOC_FREE(lock);
+}
+
 /**
  * Connect to a remote server for (inter)domain security authenticaion.
  *