diff options
Diffstat (limited to 'source3/passdb')
| -rw-r--r-- | source3/passdb/ldap.c | 1160 | ||||
| -rw-r--r-- | source3/passdb/nispass.c | 643 | ||||
| -rw-r--r-- | source3/passdb/pass_check.c | 183 | ||||
| -rw-r--r-- | source3/passdb/passdb.c | 1079 | ||||
| -rw-r--r-- | source3/passdb/passgrp.c | 56 | ||||
| -rw-r--r-- | source3/passdb/smbpass.c | 682 | ||||
| -rw-r--r-- | source3/passdb/smbpasschange.c | 176 | ||||
| -rw-r--r-- | source3/passdb/smbpassfile.c | 104 | ||||
| -rw-r--r-- | source3/passdb/smbpassgroup.c | 47 |
9 files changed, 3059 insertions, 1071 deletions
diff --git a/source3/passdb/ldap.c b/source3/passdb/ldap.c index 7bdbdab320..43fea00a64 100644 --- a/source3/passdb/ldap.c +++ b/source3/passdb/ldap.c @@ -1,9 +1,8 @@ /* Unix SMB/Netbios implementation. - Version 2.0. + Version 1.9. LDAP protocol helper functions for SAMBA Copyright (C) Jean François Micouleau 1998 - Copyright (C) Matthew Chapman 1998 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -21,536 +20,1005 @@ */ -#include "includes.h" - #ifdef WITH_LDAP +#include "includes.h" + #include <lber.h> #include <ldap.h> +#define ADD_USER 1 +#define MODIFY_USER 2 + extern int DEBUGLEVEL; -/* Internal state */ -LDAP *ldap_struct; -LDAPMessage *ldap_results; -LDAPMessage *ldap_entry; +/******************************************************************* + open a connection to the ldap serve. +******************************************************************/ +static BOOL ldap_open_connection(LDAP **ldap_struct) +{ + if ( (*ldap_struct = ldap_open(lp_ldap_server(),lp_ldap_port()) ) == NULL) + { + DEBUG( 0, ( "The LDAP server is not responding !\n" ) ); + return( False ); + } + DEBUG(2,("ldap_open_connection: connection opened\n")); + return (True); +} + -/* LDAP password */ -static pstring ldap_secret; +/******************************************************************* + connect anonymously to the ldap server. + FIXME: later (jfm) +******************************************************************/ +static BOOL ldap_connect_anonymous(LDAP *ldap_struct) +{ + if ( ldap_simple_bind_s(ldap_struct,lp_ldap_root(),lp_ldap_rootpasswd()) ! = LDAP_SUCCESS) + { + DEBUG( 0, ( "Couldn't bind to the LDAP server !\n" ) ); + return(False); + } + return (True); +} /******************************************************************* - Open connections to the LDAP server. - ******************************************************************/ + connect to the ldap server under system privileg. +******************************************************************/ +static BOOL ldap_connect_system(LDAP *ldap_struct) +{ + if ( ldap_simple_bind_s(ldap_struct,lp_ldap_root(),lp_ldap_rootpasswd()) ! = LDAP_SUCCESS) + { + DEBUG( 0, ( "Couldn't bind to the LDAP server!\n" ) ); + return(False); + } + DEBUG(2,("ldap_connect_system: succesful connection to the LDAP server\n")); + return (True); +} -BOOL ldap_connect(void) +/******************************************************************* + connect to the ldap server under a particular user. +******************************************************************/ +static BOOL ldap_connect_user(LDAP *ldap_struct, char *user, char *password) { - int err; + if ( ldap_simple_bind_s(ldap_struct,lp_ldap_root(),lp_ldap_rootpasswd()) ! = LDAP_SUCCESS) + { + DEBUG( 0, ( "Couldn't bind to the LDAP server !\n" ) ); + return(False); + } + DEBUG(2,("ldap_connect_user: succesful connection to the LDAP server\n")); + return (True); +} - if (!(ldap_struct = ldap_open(lp_ldap_server(), lp_ldap_port()))) { - DEBUG(0, ("open: %s\n", strerror(errno))); - return (False); +/******************************************************************* + run the search by name. +******************************************************************/ +static BOOL ldap_search_one_user(LDAP *ldap_struct, char *filter, LDAPMessage **result) +{ + int scope = LDAP_SCOPE_ONELEVEL; + int rc; + + DEBUG(2,("ldap_search_one_user: searching for:[%s]\n", filter)); + + rc = ldap_search_s(ldap_struct, lp_ldap_suffix(), scope, filter, NULL, 0, result); + + if (rc ! = LDAP_SUCCESS ) + { + DEBUG( 0, ( "Problem during the LDAP search\n" ) ); + return(False); } + return (True); +} - err = ldap_simple_bind_s(ldap_struct, lp_ldap_bind_as(), ldap_secret); - if (err != LDAP_SUCCESS) { - DEBUG(0, ("bind: %s\n", ldap_err2string(err))); - return (False); +/******************************************************************* + run the search by name. +******************************************************************/ +static BOOL ldap_search_one_user_by_name(LDAP *ldap_struct, char *user, LDAPMessage **result) +{ + pstring filter; + /* + in the filter expression, replace %u with the real name + so in ldap filter, %u MUST exist :-) + */ + pstrcpy(filter,lp_ldap_filter()); + pstring_sub(filter,"%u",user); + + if ( !ldap_search_one_user(ldap_struct, filter, result) ) + { + return(False); } + return (True); +} - DEBUG(2,("Connected to LDAP server\n")); +/******************************************************************* + run the search by uid. +******************************************************************/ +static BOOL ldap_search_one_user_by_uid(LDAP *ldap_struct, int uid, LDAPMessage **result) +{ + pstring filter; + + slprintf(filter, sizeof(pstring)-1, "uidAccount = %d", uid); + + if ( !ldap_search_one_user(ldap_struct, filter, result) ) + { + return(False); + } return (True); } /******************************************************************* - close connections to the LDAP server. - ******************************************************************/ + search an attribute and return the first value found. +******************************************************************/ +static void get_single_attribute(LDAP *ldap_struct, LDAPMessage *entry, char *attribute, char *value) +{ + char **valeurs; + + if ( (valeurs = ldap_get_values(ldap_struct, entry, attribute)) ! = NULL) + { + pstrcpy(value, valeurs[0]); + ldap_value_free(valeurs); + DEBUG(3,("get_single_attribute: [%s] = [%s]\n", attribute, value)); + } + else + { + value = NULL; + } +} -void ldap_disconnect(void) +/******************************************************************* + check if the returned entry is a sambaAccount objectclass. +******************************************************************/ +static BOOL ldap_check_user(LDAP *ldap_struct, LDAPMessage *entry) { - if(!ldap_struct) - return; + BOOL sambaAccount = False; + char **valeur; + int i; - if(ldap_results) { - ldap_msgfree(ldap_results); - ldap_results = NULL; } + DEBUG(2,("ldap_check_user: ")); + valeur = ldap_get_values(ldap_struct, entry, "objectclass"); + if (valeur! = NULL) + { + for (i = 0;valeur[i]! = NULL;i++) + { + if (!strcmp(valeur[i],"sambaAccount")) sambaAccount = True; + } + } + DEBUG(2,("%s\n",sambaAccount?"yes":"no")); + ldap_value_free(valeur); + return (sambaAccount); +} - ldap_unbind(ldap_struct); - ldap_struct = NULL; +/******************************************************************* + check if the returned entry is a sambaTrust objectclass. +******************************************************************/ +static BOOL ldap_check_trust(LDAP *ldap_struct, LDAPMessage *entry) +{ + BOOL sambaTrust = False; + char **valeur; + int i; - DEBUG(2,("Connection closed\n")); + DEBUG(2,("ldap_check_trust: ")); + valeur = ldap_get_values(ldap_struct, entry, "objectclass"); + if (valeur! = NULL) + { + for (i = 0;valeur[i]! = NULL;i++) + { + if (!strcmp(valeur[i],"sambaTrust")) sambaTrust = True; + } + } + DEBUG(2,("%s\n",sambaTrust?"yes":"no")); + ldap_value_free(valeur); + return (sambaTrust); } - /******************************************************************* - Search the directory using a given filter. - ******************************************************************/ + retrieve the user's info and contruct a smb_passwd structure. +******************************************************************/ +static void ldap_get_smb_passwd(LDAP *ldap_struct,LDAPMessage *entry, + struct smb_passwd *user) +{ + static pstring user_name; + static pstring user_pass; + static pstring temp; + static unsigned char smblmpwd[16]; + static unsigned char smbntpwd[16]; -BOOL ldap_search_for(char *filter) -{ - int err; + pdb_init_smb(user); - DEBUG(2,("Searching in [%s] for [%s]\n", lp_ldap_suffix(), filter)); + memset((char *)smblmpwd, '\0', sizeof(smblmpwd)); + memset((char *)smbntpwd, '\0', sizeof(smbntpwd)); - err = ldap_search_s(ldap_struct, lp_ldap_suffix(), LDAP_SCOPE_ONELEVEL, - filter, NULL, 0, &ldap_results); + get_single_attribute(ldap_struct, entry, "cn", user_name); + DEBUG(2,("ldap_get_smb_passwd: user: %s\n",user_name)); + +#ifdef LDAP_PLAINTEXT_PASSWORD + get_single_attribute(ldap_struct, entry, "userPassword", temp); + nt_lm_owf_gen(temp, user->smb_nt_passwd, user->smb_passwd); + memset((char *)temp, '\0', sizeof(temp)); /* destroy local copy of the password */ +#else + get_single_attribute(ldap_struct, entry, "unicodePwd", temp); + pdb_gethexpwd(temp, smbntpwd); + memset((char *)temp, '\0', sizeof(temp)); /* destroy local copy of the password */ - if(err != LDAP_SUCCESS) { - DEBUG(0, ("search: %s\n", ldap_err2string(err))); - } + get_single_attribute(ldap_struct, entry, "dBCSPwd", temp); + pdb_gethexpwd(temp, smblmpwd); + memset((char *)temp, '\0', sizeof(temp)); /* destroy local copy of the password */ +#endif + + get_single_attribute(ldap_struct, entry, "userAccountControl", temp); + user->acct_ctrl = pdb_decode_acct_ctrl(temp); - DEBUG(2, ("%d matching entries found\n", - ldap_count_entries(ldap_struct, ldap_results))); + get_single_attribute(ldap_struct, entry, "pwdLastSet", temp); + user->pass_last_set_time = (time_t)strtol(temp, NULL, 16); - ldap_entry = ldap_first_entry(ldap_struct, ldap_results); - return (True); -} + get_single_attribute(ldap_struct, entry, "rid", temp); -BOOL ldap_search_by_name(const char *user) -{ - fstring filter; + /* the smb (unix) ids are not stored: they are created */ + user->smb_userid = pdb_user_rid_to_uid (atoi(temp)); - slprintf(filter, sizeof(filter)-1, - "(&(uid=%s)(objectclass=sambaAccount))", user); - return ldap_search_for(filter); + if (user->acct_ctrl & (ACB_DOMTRUST|ACB_WSTRUST|ACB_SVRTRUST) ) + { + DEBUG(0,("Inconsistency in the LDAP database\n")); + } + if (user->acct_ctrl & ACB_NORMAL) + { + user->smb_name = user_name; + user->smb_passwd = smblmpwd; + user->smb_nt_passwd = smbntpwd; + } } -BOOL ldap_search_by_uid(int uid) -{ - fstring filter; +/******************************************************************* + retrieve the user's info and contruct a sam_passwd structure. + + calls ldap_get_smb_passwd function first, though, to save code duplication. + +******************************************************************/ +static void ldap_get_sam_passwd(LDAP *ldap_struct, LDAPMessage *entry, + struct sam_passwd *user) +{ + static pstring user_name; + static pstring fullname; + static pstring home_dir; + static pstring dir_drive; + static pstring logon_script; + static pstring profile_path; + static pstring acct_desc; + static pstring workstations; + static pstring temp; + static struct smb_passwd pw_buf; + + pdb_init_sam(user); + + ldap_get_smb_passwd(ldap_struct, entry, &pw_buf); - slprintf(filter, sizeof(filter)-1, - "(&(uidNumber=%d)(objectclass=sambaAccount))", uid); - return ldap_search_for(filter); -} + user->pass_last_set_time = pw_buf.pass_last_set_time; + get_single_attribute(ldap_struct, entry, "logonTime", temp); + user->pass_last_set_time = (time_t)strtol(temp, NULL, 16); -/******************************************************************* - Get the first value of an attribute. - ******************************************************************/ + get_single_attribute(ldap_struct, entry, "logoffTime", temp); + user->pass_last_set_time = (time_t)strtol(temp, NULL, 16); -BOOL ldap_get_attribute(char *attribute, char *value) -{ - char **values; - - if(!(values = ldap_get_values(ldap_struct, ldap_entry, attribute))) - return (False); + get_single_attribute(ldap_struct, entry, "kickoffTime", temp); + user->pass_last_set_time = (time_t)strtol(temp, NULL, 16); - pstrcpy(value, values[0]); - ldap_value_free(values); - DEBUG(3, ("get: [%s] = [%s]\n", attribute, value)); - - return (True); -} + get_single_attribute(ldap_struct, entry, "pwdLastSet", temp); + user->pass_last_set_time = (time_t)strtol(temp, NULL, 16); + get_single_attribute(ldap_struct, entry, "pwdCanChange", temp); + user->pass_last_set_time = (time_t)strtol(temp, NULL, 16); -/******************************************************************* - Construct an smb_passwd structure - ******************************************************************/ -struct smb_passwd *ldap_getpw(void) -{ - static struct smb_passwd smbpw; - static pstring unix_name; - static pstring nt_name; - static unsigned char smblmpwd[16]; - static unsigned char smbntpwd[16]; - pstring temp; + get_single_attribute(ldap_struct, entry, "pwdMustChange", temp); + user->pass_last_set_time = (time_t)strtol(temp, NULL, 16); - if(!ldap_entry) - return NULL; + user->smb_name = pw_buf.smb_name; - if(!ldap_get_attribute("uid", unix_name)) { - DEBUG(0,("Missing uid\n")); - return NULL; } - smbpw.unix_name = unix_name; + DEBUG(2,("ldap_get_sam_passwd: user: %s\n", user_name)); + + get_single_attribute(ldap_struct, entry, "userFullName", fullname); + user->full_name = fullname; - DEBUG(2,("Retrieving account [%s]\n",unix_name)); + get_single_attribute(ldap_struct, entry, "homeDirectory", home_dir); + user->home_dir = home_dir; - if(!ldap_get_attribute("uidNumber", temp)) { - DEBUG(0,("Missing uidNumber\n")); - return NULL; } - smbpw.unix_uid = atoi(temp); + get_single_attribute(ldap_struct, entry, "homeDrive", dir_drive); + user->dir_drive = dir_drive; - if(!ldap_get_attribute("ntuid", nt_name)) { - DEBUG(0,("Missing ntuid\n")); - return NULL; } - smbpw.nt_name = nt_name; + get_single_attribute(ldap_struct, entry, "scriptPath", logon_script); + user->logon_script = logon_script; - if(!ldap_get_attribute("rid", temp)) { - DEBUG(0,("Missing rid\n")); - return NULL; } - smbpw.user_rid = strtol(temp, NULL, 16); + get_single_attribute(ldap_struct, entry, "profilePath", profile_path); + user->profile_path = profile_path; - if(ldap_get_attribute("acctFlags", temp)) - smbpw.acct_ctrl = pwdb_decode_acct_ctrl(temp); - else - smbpw.acct_ctrl = ACB_NORMAL; + get_single_attribute(ldap_struct, entry, "comment", acct_desc); + user->acct_desc = acct_desc; - if(ldap_get_attribute("lmPassword", temp)) { - pwdb_gethexpwd(temp, smblmpwd, NULL); - smbpw.smb_passwd = smblmpwd; - } else { - smbpw.smb_passwd = NULL; - smbpw.acct_ctrl |= ACB_DISABLED; - } + get_single_attribute(ldap_struct, entry, "userWorkstations", workstations); + user->workstations = workstations; - if(ldap_get_attribute("ntPassword", temp)) { - pwdb_gethexpwd(temp, smbntpwd, NULL); - smbpw.smb_nt_passwd = smbntpwd; - } else { - smbpw.smb_nt_passwd = NULL; - } + user->unknown_str = NULL; /* don't know, yet! */ + user->munged_dial = NULL; /* "munged" dial-back telephone number */ - if(ldap_get_attribute("pwdLastSet", temp)) - smbpw.pass_last_set_time = (time_t)strtol(temp, NULL, 16); - else - smbpw.pass_last_set_time = (time_t)(-1); + get_single_attribute(ldap_struct, entry, "rid", temp); + user->user_rid = atoi(temp); - return &smbpw; -} + get_single_attribute(ldap_struct, entry, "primaryGroupID", temp); + user->group_rid = atoi(temp); + + /* the smb (unix) ids are not stored: they are created */ + user->smb_userid = pw_buf.smb_userid; + user->smb_grpid = group_rid_to_uid(user->group_rid); + + user->acct_ctrl = pw_buf.acct_ctrl; + user->unknown_3 = 0xffffff; /* don't know */ + user->logon_divs = 168; /* hours per week */ + user->hours_len = 21; /* 21 times 8 bits = 168 */ + memset(user->hours, 0xff, user->hours_len); /* available at all hours */ + user->unknown_5 = 0x00020000; /* don't know */ + user->unknown_5 = 0x000004ec; /* don't know */ + + if (user->acct_ctrl & (ACB_DOMTRUST|ACB_WSTRUST|ACB_SVRTRUST) ) + { + DEBUG(0,("Inconsistency in the LDAP database\n")); + } + + if (!(user->acct_ctrl & ACB_NORMAL)) + { + DEBUG(0,("User's acct_ctrl bits not set to ACT_NORMAL in LDAP database\n")); + return; + } +} /************************************************************************ - Adds a modification to a LDAPMod queue. - ************************************************************************/ + Routine to manage the LDAPMod structure array + manage memory used by the array, by each struct, and values - void ldap_make_mod(LDAPMod ***modlist,int modop, char *attribute, char *value) +************************************************************************/ +static void make_a_mod(LDAPMod ***modlist,int modop, char *attribute, char *value) { LDAPMod **mods; int i; int j; - - DEBUG(3, ("set: [%s] = [%s]\n", attribute, value)); mods = *modlist; - if (mods == NULL) { - mods = (LDAPMod **)malloc(sizeof(LDAPMod *)); + if (mods == NULL) + { + mods = (LDAPMod **)malloc( sizeof(LDAPMod *) ); + if (mods == NULL) + { + DEBUG(0,("make_a_mod: out of memory!\n")); + return; + } mods[0] = NULL; } - for (i = 0; mods[i] != NULL; ++i) { - if (mods[i]->mod_op == modop && - !strcasecmp(mods[i]->mod_type, attribute)) { + for ( i = 0; mods[ i ] ! = NULL; ++i ) + { + if ( mods[ i ]->mod_op == modop && + !strcasecmp( mods[ i ]->mod_type, attribute ) ) + { break; } } - if (mods[i] == NULL) { - mods = (LDAPMod **)realloc(mods, (i+2) * sizeof(LDAPMod *)); - mods[i] = (LDAPMod *)malloc(sizeof(LDAPMod)); + if (mods[i] == NULL) + { + mods = (LDAPMod **)realloc( mods, (i+2) * sizeof( LDAPMod * ) ); + if (mods == NULL) + { + DEBUG(0,("make_a_mod: out of memory!\n")); + return; + } + mods[i] = (LDAPMod *)malloc( sizeof( LDAPMod ) ); + if (mods[i] == NULL) + { + DEBUG(0,("make_a_mod: out of memory!\n")); + return; + } mods[i]->mod_op = modop; mods[i]->mod_values = NULL; - mods[i]->mod_type = strdup(attribute); + mods[i]->mod_type = strdup( attribute ); mods[i+1] = NULL; } - if (value) { + if (value ! = NULL ) + { j = 0; - if (mods[i]->mod_values) { - for (; mods[i]->mod_values[j]; j++); + if ( mods[ i ]->mod_values ! = NULL ) + { + for ( ; mods[ i ]->mod_values[ j ] ! = NULL; j++ ); } - mods[i]->mod_values = (char **)realloc(mods[i]->mod_values, - (j+2) * sizeof(char *)); - mods[i]->mod_values[j] = strdup(value); - mods[i]->mod_values[j+1] = NULL; + mods[ i ]->mod_values = (char **)realloc(mods[ i ]->mod_values, + (j+2) * sizeof( char * )); + if ( mods[ i ]->mod_values == NULL) + { + DEBUG(0, "make_a_mod: Memory allocation failure!\n"); + return; + } + mods[ i ]->mod_values[ j ] = strdup(value); + mods[ i ]->mod_values[ j + 1 ] = NULL; } - *modlist = mods; } - /************************************************************************ - Queues the necessary modifications to save a smb_passwd structure - ************************************************************************/ + Add or modify an entry. Only the smb struct values - void ldap_smbpwmods(struct smb_passwd *newpwd, LDAPMod ***mods, int operation) +*************************************************************************/ +static BOOL modadd_ldappwd_entry(struct smb_passwd *newpwd, int flag) { - fstring temp; - int i; + + /* assume the struct is correct and filled + that's the job of passdb.c to check */ + int scope = LDAP_SCOPE_ONELEVEL; + int rc; + char *smb_name; + int trust = False; + int ldap_state; + pstring filter; + pstring dn; + pstring lmhash; + pstring nthash; + pstring rid; + pstring lst; + pstring temp; - *mods = NULL; - if(operation == LDAP_MOD_ADD) { /* immutable attributes */ - ldap_make_mod(mods, LDAP_MOD_ADD, "objectclass", "sambaAccount"); + LDAP *ldap_struct; + LDAPMessage *result; + LDAPMod **mods; + + smb_name = newpwd->smb_name; - ldap_make_mod(mods, LDAP_MOD_ADD, "uid", newpwd->unix_name); - slprintf(temp, sizeof(temp)-1, "%d", newpwd->unix_uid); - ldap_make_mod(mods, LDAP_MOD_ADD, "uidNumber", temp); + if (!ldap_open_connection(&ldap_struct)) /* open a connection to the server */ + { + return False; + } - ldap_make_mod(mods, LDAP_MOD_ADD, "ntuid", newpwd->nt_name); - slprintf(temp, sizeof(temp)-1, "%x", newpwd->user_rid); - ldap_make_mod(mods, LDAP_MOD_ADD, "rid", temp); + if (!ldap_connect_system(ldap_struct)) /* connect as system account */ + { + ldap_unbind(ldap_struct); + return False; + } + + if (smb_name[strlen(smb_name)-1] == '$' ) + { + smb_name[strlen(smb_name)-1] = '\0'; + trust = True; } - if (newpwd->smb_passwd) { - for( i = 0; i < 16; i++) { - slprintf(&temp[2*i], 3, "%02X", newpwd->smb_passwd[i]); - } - ldap_make_mod(mods, operation, "lmPassword", temp); + slprintf(filter, sizeof(filter)-1, + "(&(cn = %s)(|(objectclass = sambaTrust)(objectclass = sambaAccount)))", + smb_name); + + rc = ldap_search_s(ldap_struct, lp_ldap_suffix(), scope, filter, NULL, 0, &result); + + switch (flag) + { + case ADD_USER: + { + if (ldap_count_entries(ldap_struct, result) ! = 0) + { + DEBUG(0,("User already in the base, with samba properties\n")); + ldap_unbind(ldap_struct); + return False; + } + ldap_state = LDAP_MOD_ADD; + break; + } + case MODIFY_USER: + { + if (ldap_count_entries(ldap_struct, result) ! = 1) + { + DEBUG(0,("No user to modify !\n")); + ldap_unbind(ldap_struct); + return False; + } + ldap_state = LDAP_MOD_REPLACE; + break; + } + default: + { + DEBUG(0,("How did you come here? \n")); + ldap_unbind(ldap_struct); + return False; + break; + } } + slprintf(dn, sizeof(dn)-1, "cn = %s, %s",smb_name, lp_ldap_suffix() ); - if (newpwd->smb_nt_passwd) { - for( i = 0; i < 16; i++) { - slprintf(&temp[2*i], 3, "%02X", newpwd->smb_nt_passwd[i]); - } - ldap_make_mod(mods, operation, "ntPassword", temp); + if (newpwd->smb_passwd ! = NULL) + { + int i; + for( i = 0; i < 16; i++) + { + slprintf(&temp[2*i], sizeof(temp) - 1, "%02X", newpwd->smb_passwd[i]); + } + } + else + { + if (newpwd->acct_ctrl & ACB_PWNOTREQ) + { + slprintf(temp, sizeof(temp) - 1, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX"); + } + else + { + slprintf(temp, sizeof(temp) - 1, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"); + } + } + slprintf(lmhash, sizeof(lmhash)-1, "%s", temp); - newpwd->pass_last_set_time = time(NULL); - slprintf(temp, sizeof(temp)-1, "%08X", newpwd->pass_last_set_time); - ldap_make_mod(mods, operation, "pwdLastSet", temp); + if (newpwd->smb_nt_passwd ! = NULL) + { + int i; + for( i = 0; i < 16; i++) + { + slprintf(&temp[2*i], sizeof(temp) - 1, "%02X", newpwd->smb_nt_passwd[i]); + } + + } + else + { + if (newpwd->acct_ctrl & ACB_PWNOTREQ) + { + slprintf(temp, sizeof(temp) - 1, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX"); + } + else + { + slprintf(temp, sizeof(temp) - 1, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"); + } + } + slprintf(nthash, sizeof(nthash)-1, "%s", temp); - ldap_make_mod(mods, operation, "acctFlags", - pwdb_encode_acct_ctrl(newpwd->acct_ctrl, - NEW_PW_FORMAT_SPACE_PADDED_LEN)); -} + slprintf(rid, sizeof(rid)-1, "%d", uid_to_user_rid(newpwd->smb_userid) ); + slprintf(lst, sizeof(lst)-1, "%08X", newpwd->pass_last_set_time); + + mods = NULL; + if (trust) + { + make_a_mod(&mods, ldap_state, "objectclass", "sambaTrust"); + make_a_mod(&mods, ldap_state, "netbiosTrustName", smb_name); + make_a_mod(&mods, ldap_state, "trustPassword", nthash); + } + else + { + make_a_mod(&mods, ldap_state, "objectclass", "sambaAccount"); + make_a_mod(&mods, ldap_state, "dBCSPwd", lmhash); + make_a_mod(&mods, ldap_state, "uid", smb_name); + make_a_mod(&mods, ldap_state, "unicodePwd", nthash); + } + + make_a_mod(&mods, ldap_state, "cn", smb_name); + + make_a_mod(&mods, ldap_state, "rid", rid); + make_a_mod(&mods, ldap_state, "pwdLastSet", lst); + make_a_mod(&mods, ldap_state, "userAccountControl", pdb_encode_acct_ctrl(newpwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN)); + + switch(flag) + { + case ADD_USER: + { + ldap_add_s(ldap_struct, dn, mods); + DEBUG(2,("modadd_ldappwd_entry: added: cn = %s in the LDAP database\n",smb_name)); + break; + } + case MODIFY_USER: + { + ldap_modify_s(ldap_struct, dn, mods); + DEBUG(2,("modadd_ldappwd_entry: changed: cn = %s in the LDAP database_n",smb_name)); + break; + } + default: + { + DEBUG(2,("modadd_ldappwd_entry: How did you come here? \n")); + ldap_unbind(ldap_struct); + return False; + break; + } + } + + ldap_mods_free(mods, 1); + + ldap_unbind(ldap_struct); + + return True; +} /************************************************************************ - Commit changes to a directory entry. - *************************************************************************/ - BOOL ldap_makemods(char *attribute, char *value, LDAPMod **mods, BOOL add) + Add or modify an entry. everything except the smb struct + +*************************************************************************/ +static BOOL modadd_ldap21pwd_entry(struct sam_passwd *newpwd, int flag) { + + /* assume the struct is correct and filled + that's the job of passdb.c to check */ + int scope = LDAP_SCOPE_ONELEVEL; + int rc; + char *smb_name; + int trust = False; + int ldap_state; pstring filter; - char *dn; - int entries; - int err = 0; - BOOL rc; - - slprintf(filter, sizeof(filter)-1, "%s=%s", attribute, value); + pstring dn; + pstring lmhash; + pstring nthash; + pstring rid; + pstring lst; + pstring temp; - if (!ldap_connect()) - return (False); + LDAP *ldap_struct; + LDAPMessage *result; + LDAPMod **mods; + + smb_name = newpwd->smb_name; - ldap_search_for(filter); + if (!ldap_open_connection(&ldap_struct)) /* open a connection to the server */ + { + return False; + } - if (ldap_entry) + if (!ldap_connect_system(ldap_struct)) /* connect as system account */ { - dn = ldap_get_dn(ldap_struct, ldap_entry); - err = ldap_modify_s(ldap_struct, dn, mods); - free(dn); + ldap_unbind(ldap_struct); + return False; } - else if (add) + + if (smb_name[strlen(smb_name)-1] == '$' ) { - pstrcat(filter, ", "); - pstrcat(filter, lp_ldap_suffix()); - err = ldap_add_s(ldap_struct, filter, mods); + smb_name[strlen(smb_name)-1] = '\0'; + trust = True; } - if (err == LDAP_SUCCESS) + slprintf(filter, sizeof(filter)-1, + "(&(cn = %s)(|(objectclass = sambaTrust)(objectclass = sambaAccount)))", + smb_name); + + rc = ldap_search_s(ldap_struct, lp_ldap_suffix(), scope, filter, NULL, 0, &result); + + switch (flag) { - DEBUG(2,("Updated entry [%s]\n", value)); - rc = True; - } else { - DEBUG(0,("update: %s\n", ldap_err2string(err))); - rc = False; + case ADD_USER: + { + if (ldap_count_entries(ldap_struct, result) ! = 1) + { + DEBUG(2,("User already in the base, with samba properties\n")); + ldap_unbind(ldap_struct); + return False; + } + ldap_state = LDAP_MOD_ADD; + break; + } + + case MODIFY_USER: + { + if (ldap_count_entries(ldap_struct, result) ! = 1) + { + DEBUG(2,("No user to modify !\n")); + ldap_unbind(ldap_struct); + return False; + } + ldap_state = LDAP_MOD_REPLACE; + break; + } + + default: + { + DEBUG(2,("How did you come here? \n")); + ldap_unbind(ldap_struct); + return False; + break; + } } + slprintf(dn, sizeof(dn)-1, "cn = %s, %s",smb_name, lp_ldap_suffix() ); + + mods = NULL; - ldap_disconnect(); + if (trust) + { + } + else + { + } + + make_a_mod(&mods, ldap_state, "cn", smb_name); + + make_a_mod(&mods, ldap_state, "rid", rid); + make_a_mod(&mods, ldap_state, "pwdLastSet", lst); + make_a_mod(&mods, ldap_state, "userAccountControl", pdb_encode_acct_ctrl(newpwd->acct_ctrl,NEW_PW_FORMAT_SPACE_PADDED_LEN)); + + ldap_modify_s(ldap_struct, dn, mods); + ldap_mods_free(mods, 1); - return rc; + + ldap_unbind(ldap_struct); + + return True; } +/************************************************************************ + Routine to add an entry to the ldap passwd file. + + do not call this function directly. use passdb.c instead. + +*************************************************************************/ +static BOOL add_ldappwd_entry(struct smb_passwd *newpwd) +{ + return (modadd_ldappwd_entry(newpwd, ADD_USER) ); +} /************************************************************************ - Return next available RID, starting from 1000 - ************************************************************************/ + Routine to search the ldap passwd file for an entry matching the username. + and then modify its password entry. We can't use the startldappwent()/ + getldappwent()/endldappwent() interfaces here as we depend on looking + in the actual file to decide how much room we have to write data. + override = False, normal + override = True, override XXXXXXXX'd out password or NO PASS -BOOL ldap_allocaterid(uint32 *rid) + do not call this function directly. use passdb.c instead. + +************************************************************************/ +static BOOL mod_ldappwd_entry(struct smb_passwd *pwd, BOOL override) { - pstring newdn; - fstring rid_str; - LDAPMod **mods; - char *dn; - int err; + return (modadd_ldappwd_entry(pwd, MODIFY_USER) ); +} - DEBUG(2, ("Allocating new RID\n")); +/************************************************************************ + Routine to add an entry to the ldap passwd file. - if (!ldap_connect()) - return (False); + do not call this function directly. use passdb.c instead. - ldap_search_for("(&(id=root)(objectClass=sambaConfig))"); +*************************************************************************/ +static BOOL add_ldap21pwd_entry(struct sam_passwd *newpwd) +{ + return( modadd_ldappwd_entry(newpwd, ADD_USER)? + modadd_ldap21pwd_entry(newpwd, ADD_USER):False); +} - if (ldap_entry && ldap_get_attribute("nextrid", rid_str)) - *rid = strtol(rid_str, NULL, 16); - else - *rid = 1000; +/************************************************************************ + Routine to search the ldap passwd file for an entry matching the username. + and then modify its password entry. We can't use the startldappwent()/ + getldappwent()/endldappwent() interfaces here as we depend on looking + in the actual file to decide how much room we have to write data. + override = False, normal + override = True, override XXXXXXXX'd out password or NO PASS - mods = NULL; - if(!ldap_entry) - { - ldap_make_mod(&mods, LDAP_MOD_ADD, "objectClass", - "sambaConfig"); - ldap_make_mod(&mods, LDAP_MOD_ADD, "id", "root"); - } + do not call this function directly. use passdb.c instead. + +************************************************************************/ +static BOOL mod_ldap21pwd_entry(struct sam_passwd *pwd, BOOL override) +{ + return( modadd_ldappwd_entry(pwd, MODIFY_USER)? + modadd_ldap21pwd_entry(pwd, MODIFY_USER):False); +} + +struct ldap_enum_info +{ + LDAP *ldap_struct; + LDAPMessage *result; + LDAPMessage *entry; +}; + +static struct ldap_enum_info ldap_ent; + +/*************************************************************** + Start to enumerate the ldap passwd list. Returns a void pointer + to ensure no modification outside this module. + + do not call this function directly. use passdb.c instead. - slprintf(rid_str, sizeof(fstring)-1, "%x", (*rid) + 1); - ldap_make_mod(&mods, LDAP_MOD_REPLACE, "nextrid", rid_str); + ****************************************************************/ +static void *startldappwent(BOOL update) +{ + int scope = LDAP_SCOPE_ONELEVEL; + int rc; - if (ldap_entry) + pstring filter; + + if (!ldap_open_connection(&ldap_ent.ldap_struct)) /* open a connection to the server */ { - dn = ldap_get_dn(ldap_struct, ldap_entry); - err = ldap_modify_s(ldap_struct, dn, mods); - free(dn); - } else { - pstrcpy(newdn, "id=root, "); - pstrcat(newdn, lp_ldap_suffix()); - ldap_add_s(ldap_struct, newdn, mods); + return NULL; } - ldap_disconnect(); + if (!ldap_connect_system(ldap_ent.ldap_struct)) /* connect as system account */ + { + return NULL; + } - if(err != LDAP_SUCCESS) + /* when the class is known the search is much faster */ + switch (0) { - DEBUG(0,("nextrid update: %s\n", ldap_err2string(err))); - return (False); + case 1: + { + pstrcpy(filter, "objectclass = sambaAccount"); + break; + } + case 2: + { + pstrcpy(filter, "objectclass = sambaTrust"); + break; + } + default: + { + pstrcpy(filter, "(|(objectclass = sambaTrust)(objectclass = sambaAccount))"); + break; + } } - return (True); + rc = ldap_search_s(ldap_ent.ldap_struct, lp_ldap_suffix(), scope, filter, NULL, 0, &ldap_ent.result); + + DEBUG(2,("%d entries in the base!\n", ldap_count_entries(ldap_ent.ldap_struct, ldap_ent.result) )); + + ldap_ent.entry = ldap_first_entry(ldap_ent.ldap_struct, ldap_ent.result); + + return &ldap_ent; } +/************************************************************************* + Routine to return the next entry in the ldap passwd list. -/*************************************************************** - Begin/end account enumeration. - ****************************************************************/ + do not call this function directly. use passdb.c instead. -static void *ldap_enumfirst(BOOL update) + *************************************************************************/ +static struct smb_passwd *getldappwent(void *vp) { - if (!ldap_connect()) - return NULL; + static struct smb_passwd user; + struct ldap_enum_info *ldap_vp = (struct ldap_enum_info *)vp; - ldap_search_for("objectclass=sambaAccount"); + ldap_vp->entry = ldap_next_entry(ldap_vp->ldap_struct, ldap_vp->entry); - return ldap_struct; + if (ldap_vp->entry ! = NULL) + { + ldap_get_smb_passwd(ldap_vp->ldap_struct, ldap_vp->entry, &user); + return &user; + } + return NULL; } -static void ldap_enumclose(void *vp) -{ - ldap_disconnect(); -} +/************************************************************************* + Routine to return the next entry in the ldap passwd list. + do not call this function directly. use passdb.c instead. -/************************************************************************* - Save/restore the current position in a query *************************************************************************/ - -static SMB_BIG_UINT ldap_getdbpos(void *vp) +static struct sam_passwd *getldap21pwent(void *vp) { - return (SMB_BIG_UINT)((ulong)ldap_entry); -} + static struct sam_passwd user; + struct ldap_enum_info *ldap_vp = (struct ldap_enum_info *)vp; -static BOOL ldap_setdbpos(void *vp, SMB_BIG_UINT tok) -{ - ldap_entry = (LDAPMessage *)((ulong)tok); - return (True); + ldap_vp->entry = ldap_next_entry(ldap_vp->ldap_struct, ldap_vp->entry); + + if (ldap_vp->entry ! = NULL) + { + ldap_get_sam_passwd(ldap_vp->ldap_struct, ldap_vp->entry, &user); + return &user; + } + return NULL; } +/*************************************************************** + End enumeration of the ldap passwd list. -/************************************************************************* - Return smb_passwd information. - *************************************************************************/ + do not call this function directly. use passdb.c instead. -static struct smb_passwd *ldap_getpwbynam(const char *name) +****************************************************************/ +static void endldappwent(void *vp) { - struct smb_passwd *ret; - - if(!ldap_connect()) - return NULL; + struct ldap_enum_info *ldap_vp = (struct ldap_enum_info *)vp; + ldap_msgfree(ldap_vp->result); + ldap_unbind(ldap_vp->ldap_struct); +} - ldap_search_by_name(name); - ret = ldap_getpw(); +/************************************************************************* + Return the current position in the ldap passwd list as an SMB_BIG_UINT. + This must be treated as an opaque token. - ldap_disconnect(); - return ret; -} + do not call this function directly. use passdb.c instead. -static struct smb_passwd *ldap_getpwbyuid(uid_t userid) +*************************************************************************/ +static SMB_BIG_UINT getldappwpos(void *vp) { - struct smb_passwd *ret; + return (SMB_BIG_UINT)0; +} - if(!ldap_connect()) - return NULL; +/************************************************************************* + Set the current position in the ldap passwd list from SMB_BIG_UINT. + This must be treated as an opaque token. - ldap_search_by_uid(userid); - ret = ldap_getpw(); + do not call this function directly. use passdb.c instead. - ldap_disconnect(); - return ret; +*************************************************************************/ +static BOOL setldappwpos(void *vp, SMB_BIG_UINT tok) +{ + return False; } -static struct smb_passwd *ldap_getcurrentpw(void *vp) -{ - struct smb_passwd *ret; +/* + * Ldap derived functions. + */ - ret = ldap_getpw(); - ldap_entry = ldap_next_entry(ldap_struct, ldap_entry); - return ret; +static struct smb_passwd *getldappwnam(char *name) +{ + return pdb_sam_to_smb(iterate_getsam21pwnam(name)); } +static struct smb_passwd *getldappwuid(uid_t smb_userid) +{ + return pdb_sam_to_smb(iterate_getsam21pwuid(smb_userid)); +} -/************************************************************************ - Modify user information given an smb_passwd struct. - *************************************************************************/ -static BOOL ldap_addpw(struct smb_passwd *newpwd) +static struct smb_passwd *getldappwrid(uint32 user_rid) { - LDAPMod **mods; + return pdb_sam_to_smb(iterate_getsam21pwuid(pdb_user_rid_to_uid(user_rid))); +} - if (!newpwd || !ldap_allocaterid(&newpwd->user_rid)) - return (False); +static struct smb_passwd *getldappwent(void *vp) +{ + return pdb_sam_to_smb(getldap21pwent(vp)); +} - ldap_smbpwmods(newpwd, &mods, LDAP_MOD_ADD); - return ldap_makemods("uid", newpwd->unix_name, mods, True); +static BOOL add_ldappwd_entry(struct smb_passwd *newpwd) +{ + return add_ldap21pwd_entry(pdb_smb_to_sam(newpwd)); } -static BOOL ldap_modpw(struct smb_passwd *pwd, BOOL override) +static BOOL mod_ldappwd_entry(struct smb_passwd* pwd, BOOL override) { - LDAPMod **mods; + return mod_ldap21pwd_entry(pdb_smb_to_sam(pwd), override); +} - if (!pwd) - return (False); +static struct sam_disp_info *getldapdispnam(char *name) +{ + return pdb_sam_to_dispinfo(getldap21pwnam(name)); +} - ldap_smbpwmods(pwd, &mods, LDAP_MOD_REPLACE); - return ldap_makemods("uid", pwd->unix_name, mods, False); +static struct sam_disp_info *getldapdisprid(uint32 rid) +{ + return pdb_sam_to_dispinfo(getldap21pwrid(rid)); } +static struct sam_disp_info *getldapdispent(void *vp) +{ + return pdb_sam_to_dispinfo(getldap21pwent(vp)); +} -static struct smb_passdb_ops ldap_ops = +static struct sam_passwd *getldap21pwuid(uid_t uid) { - ldap_enumfirst, - ldap_enumclose, - ldap_getdbpos, - ldap_setdbpos, + return pdb_smb_to_sam(iterate_getsam21pwuid(pdb_uid_to_user_rid(uid))); +} - ldap_getpwbynam, - ldap_getpwbyuid, - ldap_getcurrentpw, - ldap_addpw, - ldap_modpw +static struct passdb_ops ldap_ops = +{ + startldappwent, + endldappwent, + getldappwpos, + setldappwpos, + getldappwnam, + getldappwuid, + getldappwrid, + getldappwent, + add_ldappwd_entry, + mod_ldappwd_entry, + getldap21pwent, + iterate_getsam21pwnam, /* From passdb.c */ + iterate_getsam21pwuid, /* From passdb.c */ + iterate_getsam21pwrid, /* From passdb.c */ + add_ldap21pwd_entry, + mod_ldap21pwd_entry, + getldapdispnam, + getldapdisprid, + getldapdispent }; -struct smb_passdb_ops *ldap_initialise_password_db(void) +struct passdb_ops *ldap_initialize_password_db(void) { - FILE *pwdfile; - char *pwdfilename; - char *p; - - pwdfilename = lp_ldap_passwd_file(); - - if(pwdfilename[0]) { - if(pwdfile = sys_fopen(pwdfilename, "r")) { - fgets(ldap_secret, sizeof(ldap_secret), pwdfile); - if(p = strchr(ldap_secret, '\n')) - *p = 0; - fclose(pwdfile); - } else { - DEBUG(0,("Failed to open LDAP passwd file\n")); - } - } - - return &ldap_ops; + return &ldap_ops; } #else - void ldap_dummy_function(void); - void ldap_dummy_function(void) { } /* stop some compilers complaining */ + void dummy_function(void); + void dummy_function(void) { } /* stop some compilers complaining */ #endif diff --git a/source3/passdb/nispass.c b/source3/passdb/nispass.c index f554958ade..27409eca4c 100644 --- a/source3/passdb/nispass.c +++ b/source3/passdb/nispass.c @@ -19,14 +19,37 @@ * Mass Ave, Cambridge, MA 02139, USA. */ +#include "includes.h" + #ifdef WITH_NISPLUS -#include "includes.h" +#ifdef BROKEN_NISPLUS_INCLUDE_FILES + +/* + * The following lines are needed due to buggy include files + * in Solaris 2.6 which define GROUP in both /usr/include/sys/acl.h and + * also in /usr/include/rpcsvc/nis.h. The definitions conflict. JRA. + * Also GROUP_OBJ is defined as 0x4 in /usr/include/sys/acl.h and as + * an enum in /usr/include/rpcsvc/nis.h. + */ + +#if defined(GROUP) +#undef GROUP +#endif + +#if defined(GROUP_OBJ) +#undef GROUP_OBJ +#endif + +#endif + #include <rpcsvc/nis.h> extern int DEBUGLEVEL; +extern pstring samlogon_user; +extern BOOL sam_logon_in_ssb; -static int gotalarm; +static VOLATILE SIG_ATOMIC_T gotalarm; /*************************************************************** @@ -154,9 +177,218 @@ static void get_single_attribute(nis_object *new_obj, int col, len = entry_len; } - safe_strcpy(val, len, ENTRY_VAL(new_obj, col)); + safe_strcpy(val, ENTRY_VAL(new_obj, col), len-1); } +/************************************************************************ + makes a struct sam_passwd from a NIS+ object. + ************************************************************************/ +static BOOL make_sam_from_nisp_object(struct sam_passwd *pw_buf, nis_object *obj) +{ + int uidval; + static pstring user_name; + static pstring full_name; + static pstring home_dir; + static pstring home_drive; + static pstring logon_script; + static pstring profile_path; + static pstring acct_desc; + static pstring workstations; + static pstring temp; + static unsigned char smbpwd[16]; + static unsigned char smbntpwd[16]; + + char *p; + + pdb_init_sam(pw_buf); + pw_buf->acct_ctrl = ACB_NORMAL; + + pstrcpy(user_name, ENTRY_VAL(obj, NPF_NAME)); + pw_buf->smb_name = user_name; + + uidval = atoi(ENTRY_VAL(obj, NPF_UID)); + pw_buf->smb_userid = uidval; + + /* Check the lanman password column. */ + p = (char *)ENTRY_VAL(obj, NPF_LMPWD); + if (*p == '*' || *p == 'X') { + /* Password deliberately invalid - end here. */ + DEBUG(10, ("make_sam_from_nisp_object: entry invalidated for user %s\n", user_name)); + pw_buf->smb_nt_passwd = NULL; + pw_buf->smb_passwd = NULL; + pw_buf->acct_ctrl |= ACB_DISABLED; + return True; + } + if (!strncasecmp(p, "NO PASSWORD", 11)) { + pw_buf->smb_passwd = NULL; + pw_buf->acct_ctrl |= ACB_PWNOTREQ; + } else { + if (strlen(p) != 32 || !pdb_gethexpwd(p, smbpwd)) + { + DEBUG(0, ("make_sam_from_nisp_object: malformed LM pwd entry.\n")); + return False; + } + } + + pw_buf->smb_passwd = smbpwd; + + /* Check the NT password column. */ + p = ENTRY_VAL(obj, NPF_NTPWD); + if (*p != '*' && *p != 'X') { + if (strlen(p) != 32 || !pdb_gethexpwd(p, smbntpwd)) + { + DEBUG(0, ("make_smb_from_nisp_object: malformed NT pwd entry\n")); + return False; + } + pw_buf->smb_nt_passwd = smbntpwd; + } + + p = (char *)ENTRY_VAL(obj, NPF_ACB); + if (*p == '[') + { + pw_buf->acct_ctrl = pdb_decode_acct_ctrl(p); + + /* Must have some account type set. */ + if(pw_buf->acct_ctrl == 0) + pw_buf->acct_ctrl = ACB_NORMAL; + + /* Now try and get the last change time. */ + if(*p == ']') + p++; + if(*p == ':') { + p++; + if(*p && (StrnCaseCmp(p, "LCT-", 4)==0)) { + int i; + p += 4; + for(i = 0; i < 8; i++) { + if(p[i] == '\0' || !isxdigit(p[i])) + break; + } + if(i == 8) { + /* + * p points at 8 characters of hex digits - + * read into a time_t as the seconds since + * 1970 that the password was last changed. + */ + pw_buf->pass_last_set_time = (time_t)strtol(p, NULL, 16); + } + } + } + } else { + /* 'Old' style file. Fake up based on user name. */ + /* + * Currently trust accounts are kept in the same + * password file as 'normal accounts'. If this changes + * we will have to fix this code. JRA. + */ + if(pw_buf->smb_name[strlen(pw_buf->smb_name) - 1] == '$') { + pw_buf->acct_ctrl &= ~ACB_NORMAL; + pw_buf->acct_ctrl |= ACB_WSTRUST; + } + } + + get_single_attribute(obj, NPF_SMB_GRPID, temp, sizeof(pstring)); + pw_buf->smb_grpid = atoi(temp); + + get_single_attribute(obj, NPF_USER_RID, temp, sizeof(pstring)); + pw_buf->user_rid = (strlen(temp) > 0) ? + strtol(temp, NULL, 16) : pdb_uid_to_user_rid (pw_buf->smb_userid); + + if (pw_buf->smb_name[strlen(pw_buf->smb_name)-1] != '$') { + + /* XXXX hack to get standard_sub_basic() to use sam logon username */ + /* possibly a better way would be to do a become_user() call */ + pstrcpy(samlogon_user, pw_buf->smb_name); + sam_logon_in_ssb = True; + + get_single_attribute(obj, NPF_GROUP_RID, temp, sizeof(pstring)); + pw_buf->group_rid = (strlen(temp) > 0) ? + strtol(temp, NULL, 16) : pdb_gid_to_group_rid (pw_buf->smb_grpid); + + get_single_attribute(obj, NPF_FULL_NAME, full_name, sizeof(pstring)); +#if 1 + /* It seems correct to use the global values - but in that case why + * do we want these NIS+ entries anyway ?? + */ + pstrcpy(logon_script , lp_logon_script ()); + pstrcpy(profile_path , lp_logon_path ()); + pstrcpy(home_drive , lp_logon_drive ()); + pstrcpy(home_dir , lp_logon_home ()); +#else + get_single_attribute(obj, NPF_LOGON_SCRIPT, logon_script, sizeof(pstring)); + get_single_attribute(obj, NPF_PROFILE_PATH, profile_path, sizeof(pstring)); + get_single_attribute(obj, NPF_DIR_DRIVE, home_drive, sizeof(pstring)); + get_single_attribute(obj, NPF_HOME_DIR, home_dir, sizeof(pstring)); +#endif + get_single_attribute(obj, NPF_ACCT_DESC, acct_desc, sizeof(pstring)); + get_single_attribute(obj, NPF_WORKSTATIONS, workstations, sizeof(pstring)); + + sam_logon_in_ssb = False; + + } else { + + pw_buf->group_rid = DOMAIN_GROUP_RID_USERS; /* lkclXXXX this is OBSERVED behaviour by NT PDCs, enforced here. */ + + pstrcpy(full_name , ""); + pstrcpy(logon_script , ""); + pstrcpy(profile_path , ""); + pstrcpy(home_drive , ""); + pstrcpy(home_dir , ""); + pstrcpy(acct_desc , ""); + pstrcpy(workstations , ""); + } + + pw_buf->full_name = full_name; + pw_buf->home_dir = home_dir; + pw_buf->dir_drive = home_drive; + pw_buf->logon_script = logon_script; + pw_buf->profile_path = profile_path; + pw_buf->acct_desc = acct_desc; + pw_buf->workstations = workstations; + + pw_buf->unknown_str = NULL; /* don't know, yet! */ + pw_buf->munged_dial = NULL; /* "munged" dial-back telephone number */ + + pw_buf->unknown_3 = 0xffffff; /* don't know */ + pw_buf->logon_divs = 168; /* hours per week */ + pw_buf->hours_len = 21; /* 21 times 8 bits = 168 */ + memset(pw_buf->hours, 0xff, pw_buf->hours_len); /* available at all hours */ + pw_buf->unknown_5 = 0x00020000; /* don't know */ + pw_buf->unknown_6 = 0x000004ec; /* don't know */ + + return True; +} + +/************************************************************************ + makes a struct sam_passwd from a NIS+ result. + ************************************************************************/ +static BOOL make_sam_from_nisresult(struct sam_passwd *pw_buf, nis_result *result) +{ + if (pw_buf == NULL || result == NULL) return False; + + if (result->status != NIS_SUCCESS && result->status != NIS_NOTFOUND) + { + DEBUG(0, ("make_sam_from_nisresult: NIS+ lookup failure: %s\n", + nis_sperrno(result->status))); + return False; + } + + /* User not found. */ + if (NIS_RES_NUMOBJ(result) <= 0) + { + DEBUG(10, ("make_sam_from_nisresult: user not found in NIS+\n")); + return False; + } + + if (NIS_RES_NUMOBJ(result) > 1) + { + DEBUG(10, ("make_sam_from_nisresult: WARNING: Multiple entries for user in NIS+ table!\n")); + } + + /* Grab the first hit. */ + return make_sam_from_nisp_object(pw_buf, &NIS_RES_OBJECT(result)[0]); + } + /*************************************************************** calls nis_list, returns results. ****************************************************************/ @@ -205,21 +437,36 @@ static void *startnisppwent(BOOL update) ****************************************************************/ static void endnisppwent(void *vp) { + struct nisp_enum_info *res = (struct nisp_enum_info *)vp; + nis_freeresult(res->result); + DEBUG(7,("endnisppwent: freed enumeration list\n")); } /************************************************************************* Routine to return the next entry in the nisplus passwd list. - this function is a nice, messy combination of reading: - - the nisplus passwd file - - the unix password database - - nisp.conf options (not done at present). do not call this function directly. use passdb.c instead. *************************************************************************/ static struct sam_passwd *getnisp21pwent(void *vp) { - return NULL; + struct nisp_enum_info *res = (struct nisp_enum_info *)vp; + static struct sam_passwd pw_buf; + int which; + BOOL ret; + + if (res == NULL || (int)(res->enum_entry) < 0 || + (int)(res->enum_entry) > (NIS_RES_NUMOBJ(res->result) - 1)) { + ret = False; + } else { + which = (int)(res->enum_entry); + ret = make_sam_from_nisp_object(&pw_buf, + &NIS_RES_OBJECT(res->result)[which]); + if (ret && which < (NIS_RES_NUMOBJ(res->result) - 1)) + (int)(res->enum_entry)++; + } + + return ret ? &pw_buf : NULL; } /************************************************************************* @@ -231,7 +478,8 @@ static struct sam_passwd *getnisp21pwent(void *vp) *************************************************************************/ static SMB_BIG_UINT getnisppwpos(void *vp) { - return (SMB_BIG_UINT)0; + struct nisp_enum_info *res = (struct nisp_enum_info *)vp; + return (SMB_BIG_UINT)(res->enum_entry); } /************************************************************************* @@ -243,7 +491,13 @@ static SMB_BIG_UINT getnisppwpos(void *vp) *************************************************************************/ static BOOL setnisppwpos(void *vp, SMB_BIG_UINT tok) { - return False; + struct nisp_enum_info *res = (struct nisp_enum_info *)vp; + if (tok < (NIS_RES_NUMOBJ(res->result) - 1)) { + res->enum_entry = tok; + return True; + } else { + return False; + } } /************************************************************************* @@ -255,7 +509,7 @@ static void set_single_attribute(nis_object *new_obj, int col, if (new_obj == NULL) return; ENTRY_VAL(new_obj, col) = val; - ENTRY_LEN(new_obj, col) = len; + ENTRY_LEN(new_obj, col) = len+1; if (flags != 0) { @@ -295,12 +549,12 @@ static BOOL add_nisp21pwd_entry(struct sam_passwd *newpwd) fstring pwdlchg_t; fstring pwdmchg_t; - bzero(logon_t , sizeof(logon_t )); - bzero(logoff_t , sizeof(logoff_t )); - bzero(kickoff_t, sizeof(kickoff_t)); - bzero(pwdlset_t, sizeof(pwdlset_t)); - bzero(pwdlchg_t, sizeof(pwdlchg_t)); - bzero(pwdmchg_t, sizeof(pwdmchg_t)); + memset((char *)logon_t , '\0', sizeof(logon_t )); + memset((char *)logoff_t , '\0', sizeof(logoff_t )); + memset((char *)kickoff_t, '\0', sizeof(kickoff_t)); + memset((char *)pwdlset_t, '\0', sizeof(pwdlset_t)); + memset((char *)pwdlchg_t, '\0', sizeof(pwdlchg_t)); + memset((char *)pwdmchg_t, '\0', sizeof(pwdmchg_t)); pfile = lp_smb_passwd_file(); @@ -308,19 +562,17 @@ static BOOL add_nisp21pwd_entry(struct sam_passwd *newpwd) result = nisp_get_nis_list(nisname); if (result->status != NIS_SUCCESS && result->status != NIS_NOTFOUND) { - DEBUG(3, ( "add_nisppwd_entry: nis_list failure: %s: %s\n", + DEBUG(3, ( "add_nis21ppwd_entry: nis_list failure: %s: %s\n", nisname, nis_sperrno(result->status))); - nis_freeresult(nis_user); nis_freeresult(result); return False; } if (result->status == NIS_SUCCESS && NIS_RES_NUMOBJ(result) > 0) { - DEBUG(3, ("add_nisppwd_entry: User already exists in NIS+ password db: %s\n", + DEBUG(3, ("add_nisp21pwd_entry: User already exists in NIS+ password db: %s\n", pfile)); nis_freeresult(result); - nis_freeresult(nis_user); return False; } @@ -328,10 +580,9 @@ static BOOL add_nisp21pwd_entry(struct sam_passwd *newpwd) /* User not found. */ if (!add_user) { - DEBUG(3, ("add_nisppwd_entry: User not found in NIS+ password db: %s\n", + DEBUG(3, ("add_nisp21pwd_entry: User not found in NIS+ password db: %s\n", pfile)); nis_freeresult(result); - nis_freeresult(nis_user); return False; } @@ -341,9 +592,8 @@ static BOOL add_nisp21pwd_entry(struct sam_passwd *newpwd) if (tblresult->status != NIS_SUCCESS) { nis_freeresult(result); - nis_freeresult(nis_user); nis_freeresult(tblresult); - DEBUG(3, ( "add_nisppwd_entry: nis_lookup failure: %s\n", + DEBUG(3, ( "add_nisp21pwd_entry: nis_lookup failure: %s\n", nis_sperrno(tblresult->status))); return False; } @@ -361,22 +611,37 @@ static BOOL add_nisp21pwd_entry(struct sam_passwd *newpwd) new_obj.zo_data.objdata_u.en_data.en_cols.en_cols_len = NIS_RES_OBJECT(tblresult)->zo_data.objdata_u.ta_data.ta_maxcol; new_obj.zo_data.objdata_u.en_data.en_cols.en_cols_val = calloc(new_obj.zo_data.objdata_u.en_data.en_cols.en_cols_len, sizeof(entry_col)); - pwdb_sethexpwd(smb_passwd , newpwd->smb_passwd , newpwd->acct_ctrl); - pwdb_sethexpwd(smb_nt_passwd, newpwd->smb_nt_passwd, newpwd->acct_ctrl); + if (new_obj.zo_data.objdata_u.en_data.en_cols.en_cols_val == NULL) + { + DEBUG(0, ("add_nisp21pwd_entry: memory allocation failure\n")); + nis_freeresult(result); + nis_freeresult(tblresult); + return False; + } + + pdb_sethexpwd(smb_passwd , newpwd->smb_passwd , newpwd->acct_ctrl); + pdb_sethexpwd(smb_nt_passwd, newpwd->smb_nt_passwd, newpwd->acct_ctrl); + + newpwd->pass_last_set_time = (time_t)time(NULL); + newpwd->logon_time = (time_t)-1; + newpwd->logoff_time = (time_t)-1; + newpwd->kickoff_time = (time_t)-1; + newpwd->pass_can_change_time = (time_t)-1; + newpwd->pass_must_change_time = (time_t)-1; - pwdb_set_logon_time (logon_t , sizeof(logon_t ), newpwd->logon_time ); - pwdb_set_logoff_time (logoff_t , sizeof(logoff_t ), newpwd->logoff_time ); - pwdb_set_kickoff_time (kickoff_t, sizeof(kickoff_t), newpwd->kickoff_time ); - pwdb_set_last_set_time (pwdlset_t, sizeof(pwdlset_t), newpwd->pass_last_set_time ); - pwdb_set_can_change_time (pwdlchg_t, sizeof(pwdlchg_t), newpwd->pass_can_change_time ); - pwdb_set_must_change_time(pwdmchg_t, sizeof(pwdmchg_t), newpwd->pass_must_change_time); + slprintf(logon_t, 13, "LNT-%08X", (uint32)newpwd->logon_time); + slprintf(logoff_t, 13, "LOT-%08X", (uint32)newpwd->logoff_time); + slprintf(kickoff_t, 13, "KOT-%08X", (uint32)newpwd->kickoff_time); + slprintf(pwdlset_t, 13, "LCT-%08X", (uint32)newpwd->pass_last_set_time); + slprintf(pwdlchg_t, 13, "CCT-%08X", (uint32)newpwd->pass_can_change_time); + slprintf(pwdmchg_t, 13, "MCT-%08X", (uint32)newpwd->pass_must_change_time); - slprintf(uid, sizeof(uid), "%u", newpwd->unix_uid); + slprintf(uid, sizeof(uid), "%u", newpwd->smb_userid); slprintf(user_rid, sizeof(user_rid), "0x%x", newpwd->user_rid); slprintf(smb_grpid, sizeof(smb_grpid), "%u", newpwd->smb_grpid); slprintf(group_rid, sizeof(group_rid), "0x%x", newpwd->group_rid); - safe_strcpy(acb, pwdb_encode_acct_ctrl(newpwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN), sizeof(acb)); + safe_strcpy(acb, pdb_encode_acct_ctrl(newpwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN), sizeof(acb)-1); set_single_attribute(&new_obj, NPF_NAME , newpwd->smb_name , strlen(newpwd->smb_name) , 0); set_single_attribute(&new_obj, NPF_UID , uid , strlen(uid) , 0); @@ -392,6 +657,7 @@ static BOOL add_nisp21pwd_entry(struct sam_passwd *newpwd) set_single_attribute(&new_obj, NPF_PWDLSET_T , pwdlset_t , strlen(pwdlset_t) , 0); set_single_attribute(&new_obj, NPF_PWDLCHG_T , pwdlchg_t , strlen(pwdlchg_t) , 0); set_single_attribute(&new_obj, NPF_PWDMCHG_T , pwdmchg_t , strlen(pwdmchg_t) , 0); +#if 0 set_single_attribute(&new_obj, NPF_FULL_NAME , newpwd->full_name , strlen(newpwd->full_name) , 0); set_single_attribute(&new_obj, NPF_HOME_DIR , newpwd->home_dir , strlen(newpwd->home_dir) , 0); set_single_attribute(&new_obj, NPF_DIR_DRIVE , newpwd->dir_drive , strlen(newpwd->dir_drive) , 0); @@ -400,26 +666,24 @@ static BOOL add_nisp21pwd_entry(struct sam_passwd *newpwd) set_single_attribute(&new_obj, NPF_ACCT_DESC , newpwd->acct_desc , strlen(newpwd->acct_desc) , 0); set_single_attribute(&new_obj, NPF_WORKSTATIONS , newpwd->workstations , strlen(newpwd->workstations) , 0); set_single_attribute(&new_obj, NPF_HOURS , newpwd->hours , newpwd->hours_len , 0); +#endif obj = &new_obj; addresult = nis_add_entry(pfile, obj, ADD_OVERWRITE | FOLLOW_PATH | EXPAND_NAME | HARD_LOOKUP); - nis_freeresult(nis_user); - if (tblresult) - { - nis_freeresult(tblresult); - } if (addresult->status != NIS_SUCCESS) { - DEBUG(3, ( "add_nisppwd_entry: NIS+ table update failed: %s\n", + DEBUG(3, ( "add_nisp21pwd_entry: NIS+ table update failed: %s\n", nisname, nis_sperrno(addresult->status))); + nis_freeresult(tblresult); nis_freeresult(addresult); nis_freeresult(result); return False; } + nis_freeresult(tblresult); nis_freeresult(addresult); nis_freeresult(result); @@ -439,73 +703,198 @@ static BOOL add_nisp21pwd_entry(struct sam_passwd *newpwd) ************************************************************************/ static BOOL mod_nisp21pwd_entry(struct sam_passwd* pwd, BOOL override) { - return False; + char *oldnislmpwd, *oldnisntpwd, *oldnisacb, *oldnislct, *user_name; + char lmpwd[33], ntpwd[33], lct[13]; + nis_result *result, *addresult; + nis_object *obj; + fstring acb; + pstring nisname; + BOOL got_pass_last_set_time, ret; + int i; + + if (!*lp_smb_passwd_file()) + { + DEBUG(0, ("mod_getnisp21pwd_entry: no SMB password file set\n")); + return False; + } + + DEBUG(10, ("mod_getnisp21pwd_entry: search by name: %s\n", pwd->smb_name)); + DEBUG(10, ("mod_getnisp21pwd_entry: using NIS+ table %s\n", lp_smb_passwd_file())); + + slprintf(nisname, sizeof(nisname)-1, "[name=%s],%s", pwd->smb_name, lp_smb_passwd_file()); + + /* Search the table. */ + gotalarm = 0; + CatchSignal(SIGALRM, SIGNAL_CAST gotalarm_sig); + alarm(5); + + result = nis_list(nisname, FOLLOW_PATH | EXPAND_NAME | HARD_LOOKUP, NULL, NULL); + + alarm(0); + CatchSignal(SIGALRM, SIGNAL_CAST SIG_DFL); + + if (gotalarm) + { + DEBUG(0,("mod_getnisp21pwd_entry: NIS+ lookup time out\n")); + nis_freeresult(result); + return False; + } + + if(result->status != NIS_SUCCESS || NIS_RES_NUMOBJ(result) <= 0) { + /* User not found. */ + DEBUG(0,("mod_getnisp21pwd_entry: user not found in NIS+\n")); + nis_freeresult(result); + return False; + } + + DEBUG(6,("mod_getnisp21pwd_entry: entry exists\n")); + + obj = NIS_RES_OBJECT(result); + + user_name = ENTRY_VAL(obj, NPF_NAME); + oldnislmpwd = ENTRY_VAL(obj, NPF_LMPWD); + oldnisntpwd = ENTRY_VAL(obj, NPF_NTPWD); + oldnisacb = ENTRY_VAL(obj, NPF_ACB); + oldnislct = ENTRY_VAL(obj, NPF_PWDLSET_T); + + + if (!override && (*oldnislmpwd == '*' || *oldnislmpwd == 'X' || + *oldnisntpwd == '*' || *oldnisntpwd == 'X')) { + /* Password deliberately invalid - end here. */ + DEBUG(10, ("mod_nisp21pwd_entry: entry invalidated for user %s\n", user_name)); + nis_freeresult(result); + return False; + } + + if (strlen(oldnislmpwd) != 32 || strlen(oldnisntpwd) != 32) { + DEBUG(0, ("mod_nisp21pwd_entry: malformed password entry (incorrect length)\n")); + nis_freeresult(result); + return False; + } + + + + /* + * Now check if the account info and the password last + * change time is available. + */ + + /* + * If both NT and lanman passwords are provided - reset password + * not required flag. + */ + + if(pwd->smb_passwd != NULL || pwd->smb_nt_passwd != NULL) { + /* Require password in the future (should ACB_DISABLED also be reset?) */ + pwd->acct_ctrl &= ~(ACB_PWNOTREQ); + } + + if (*oldnisacb == '[') { + + i = 0; + acb[i++] = oldnisacb[i]; + while(i < (sizeof(fstring) - 2) && (oldnisacb[i] != ']')) + acb[i] = oldnisacb[i++]; + + acb[i++] = ']'; + acb[i++] = '\0'; + + if (i == NEW_PW_FORMAT_SPACE_PADDED_LEN) { + /* + * We are using a new format, space padded + * acct ctrl field. Encode the given acct ctrl + * bits into it. + */ + fstrcpy(acb, pdb_encode_acct_ctrl(pwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN)); + } else { + /* + * If using the old format and the ACB_DISABLED or + * ACB_PWNOTREQ are set then set the lanman and NT passwords to NULL + * here as we have no space to encode the change. + */ + if(pwd->acct_ctrl & (ACB_DISABLED|ACB_PWNOTREQ)) { + pwd->smb_passwd = NULL; + pwd->smb_nt_passwd = NULL; + } + } + + /* Now do the LCT stuff. */ + if (StrnCaseCmp(oldnislct, "LCT-", 4) == 0) { + + for(i = 0; i < 8; i++) { + if(oldnislct[i+4] == '\0' || !isxdigit(oldnislct[i+4])) + break; + } + if (i == 8) { + /* + * p points at 8 characters of hex digits - + * read into a time_t as the seconds since + * 1970 that the password was last changed. + */ + got_pass_last_set_time = True; + } /* i == 8 */ + } /* StrnCaseCmp() */ + + } /* p == '[' */ + + /* Entry is correctly formed. */ + + + + /* Create the 32 byte representation of the new p16 */ + if(pwd->smb_passwd != NULL) { + for (i = 0; i < 16; i++) { + slprintf(&lmpwd[i*2], 32, "%02X", (uchar) pwd->smb_passwd[i]); + } + } else { + if(pwd->acct_ctrl & ACB_PWNOTREQ) + fstrcpy(lmpwd, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX"); + else + fstrcpy(lmpwd, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"); + } + + /* Add on the NT md4 hash */ + if (pwd->smb_nt_passwd != NULL) { + for (i = 0; i < 16; i++) { + slprintf(&ntpwd[i*2], 32, "%02X", (uchar) pwd->smb_nt_passwd[i]); + } + } else { + if(pwd->acct_ctrl & ACB_PWNOTREQ) + fstrcpy(ntpwd, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX"); + else + fstrcpy(ntpwd, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"); + } + + pwd->pass_last_set_time = time(NULL); + + if(got_pass_last_set_time) { + slprintf(lct, 12, "LCT-%08X", (uint32)pwd->pass_last_set_time); + } + + set_single_attribute(obj, NPF_LMPWD, lmpwd, strlen(lmpwd), EN_CRYPT); + set_single_attribute(obj, NPF_NTPWD, ntpwd, strlen(ntpwd), EN_CRYPT); + set_single_attribute(obj, NPF_ACB, acb, strlen(acb), 0); + set_single_attribute(obj, NPF_PWDLSET_T, lct, strlen(lct), 0); + + addresult = + nis_add_entry(lp_smb_passwd_file(), obj, + ADD_OVERWRITE | FOLLOW_PATH | EXPAND_NAME | HARD_LOOKUP); + + if(addresult->status != NIS_SUCCESS) { + DEBUG(0, ("mod_nisp21pwd_entry: NIS+ table update failed: %s %s\n", nisname, nis_sperrno(addresult->status))); + nis_freeresult(addresult); + nis_freeresult(result); + return False; + } + + DEBUG(6,("mod_nisp21pwd_entry: password changed\n")); + + nis_freeresult(addresult); + nis_freeresult(result); + + return True; } -/************************************************************************ - makes a struct sam_passwd from a NIS+ result. - ************************************************************************/ -static BOOL make_sam_from_nisp(struct sam_passwd *pw_buf, nis_result *result) -{ - int uidval; - static pstring user_name; - static unsigned char smbpwd[16]; - static unsigned char smbntpwd[16]; - nis_object *obj; - uchar *p; - - if (pw_buf == NULL || result == NULL) return False; - - pwdb_init_sam(pw_buf); - - if (result->status != NIS_SUCCESS) - { - DEBUG(0, ("make_smb_from_nisp: NIS+ lookup failure: %s\n", - nis_sperrno(result->status))); - return False; - } - - /* User not found. */ - if (NIS_RES_NUMOBJ(result) <= 0) - { - DEBUG(10, ("make_smb_from_nisp: user not found in NIS+\n")); - return False; - } - - if (NIS_RES_NUMOBJ(result) > 1) - { - DEBUG(10, ("make_smb_from_nisp: WARNING: Multiple entries for user in NIS+ table!\n")); - } - - /* Grab the first hit. */ - obj = &NIS_RES_OBJECT(result)[0]; - - /* Check the lanman password column. */ - p = (uchar *)ENTRY_VAL(obj, NPF_LMPWD); - if (strlen((char *)p) != 32 || !pwdb_gethexpwd((char *)p, (char *)smbpwd)) - { - DEBUG(0, ("make_smb_from_nisp: malformed LM pwd entry.\n")); - return False; - } - - /* Check the NT password column. */ - p = (uchar *)ENTRY_VAL(obj, NPF_NTPWD); - if (strlen((char *)p) != 32 || !pwdb_gethexpwd((char *)p, (char *)smbntpwd)) - { - DEBUG(0, ("make_smb_from_nisp: malformed NT pwd entry\n")); - return False; - } - - strncpy(user_name, ENTRY_VAL(obj, NPF_NAME), sizeof(user_name)); - uidval = atoi(ENTRY_VAL(obj, NPF_UID)); - - pw_buf->smb_name = user_name; - pw_buf->unix_uid = uidval; - pw_buf->smb_passwd = smbpwd; - pw_buf->smb_nt_passwd = smbntpwd; - - return True; -} /************************************************************************* Routine to search the nisplus passwd file for an entry matching the username @@ -524,8 +913,8 @@ static struct sam_passwd *getnisp21pwnam(char *name) return NULL; } - DEBUG(10, ("getnisppwnam: search by name: %s\n", name)); - DEBUG(10, ("getnisppwnam: using NIS+ table %s\n", lp_smb_passwd_file())); + DEBUG(10, ("getnisp21pwnam: search by name: %s\n", name)); + DEBUG(10, ("getnisp21pwnam: using NIS+ table %s\n", lp_smb_passwd_file())); slprintf(nisname, sizeof(nisname)-1, "[name=%s],%s", name, lp_smb_passwd_file()); @@ -541,12 +930,12 @@ static struct sam_passwd *getnisp21pwnam(char *name) if (gotalarm) { - DEBUG(0,("getnisppwnam: NIS+ lookup time out\n")); + DEBUG(0,("getnisp21pwnam: NIS+ lookup time out\n")); nis_freeresult(result); return NULL; } - ret = make_sam_from_nisp(&pw_buf, result); + ret = make_sam_from_nisresult(&pw_buf, result); nis_freeresult(result); return ret ? &pw_buf : NULL; @@ -565,7 +954,7 @@ static struct sam_passwd *getnisp21pwrid(uint32 rid) if (!*lp_smb_passwd_file()) { - DEBUG(0, ("No SMB password file set\n")); + DEBUG(0, ("getnisp21pwrid: no SMB password file set\n")); return NULL; } @@ -591,7 +980,7 @@ static struct sam_passwd *getnisp21pwrid(uint32 rid) return NULL; } - ret = make_sam_from_nisp(&pw_buf, result); + ret = make_sam_from_nisresult(&pw_buf, result); nis_freeresult(result); return ret ? &pw_buf : NULL; @@ -603,52 +992,52 @@ static struct sam_passwd *getnisp21pwrid(uint32 rid) static struct smb_passwd *getnisppwent(void *vp) { - return pwdb_sam_to_smb(getnisp21pwent(vp)); + return pdb_sam_to_smb(getnisp21pwent(vp)); } static BOOL add_nisppwd_entry(struct smb_passwd *newpwd) { - return add_nisp21pwd_entry(pwdb_smb_to_sam(newpwd)); + return add_nisp21pwd_entry(pdb_smb_to_sam(newpwd)); } static BOOL mod_nisppwd_entry(struct smb_passwd* pwd, BOOL override) { - return mod_nisp21pwd_entry(pwdb_smb_to_sam(pwd), override); + return mod_nisp21pwd_entry(pdb_smb_to_sam(pwd), override); } static struct smb_passwd *getnisppwnam(char *name) { - return pwdb_sam_to_smb(getnisp21pwnam(name)); + return pdb_sam_to_smb(getnisp21pwnam(name)); } -static struct sam_passwd *getnisp21pwuid(uid_t unix_uid) +static struct sam_passwd *getnisp21pwuid(uid_t smb_userid) { - return getnisp21pwrid(pwdb_uid_to_user_rid(unix_uid)); + return getnisp21pwrid(pdb_uid_to_user_rid(smb_userid)); } -static struct smb_passwd *getnisppwrid(uid_t user_rid) +static struct smb_passwd *getnisppwrid(uint32 user_rid) { - return pwdb_sam_to_smb(getnisp21pwuid(pwdb_user_rid_to_uid(user_rid))); + return pdb_sam_to_smb(getnisp21pwuid(pdb_user_rid_to_uid(user_rid))); } -static struct smb_passwd *getnisppwuid(uid_t unix_uid) +static struct smb_passwd *getnisppwuid(uid_t smb_userid) { - return pwdb_sam_to_smb(getnisp21pwuid(unix_uid)); + return pdb_sam_to_smb(getnisp21pwuid(smb_userid)); } static struct sam_disp_info *getnispdispnam(char *name) { - return pwdb_sam_to_dispinfo(getnisp21pwnam(name)); + return pdb_sam_to_dispinfo(getnisp21pwnam(name)); } static struct sam_disp_info *getnispdisprid(uint32 rid) { - return pwdb_sam_to_dispinfo(getnisp21pwrid(rid)); + return pdb_sam_to_dispinfo(getnisp21pwrid(rid)); } static struct sam_disp_info *getnispdispent(void *vp) { - return pwdb_sam_to_dispinfo(getnisp21pwent(vp)); + return pdb_sam_to_dispinfo(getnisp21pwent(vp)); } static struct passdb_ops nispasswd_ops = { @@ -673,7 +1062,7 @@ static struct passdb_ops nispasswd_ops = { getnispdispent }; -struct passdb_ops *nisplus_initialise_password_db(void) +struct passdb_ops *nisplus_initialize_password_db(void) { return &nispasswd_ops; } @@ -693,7 +1082,7 @@ static void useful_code(void) { if (nis_user->status != NIS_SUCCESS || NIS_RES_NUMOBJ(nis_user) <= 0) { - DEBUG(3, ("add_nisppwd_entry: Unable to get NIS+ passwd entry for user: %s.\n", + DEBUG(3, ("useful_code: Unable to get NIS+ passwd entry for user: %s.\n", nis_sperrno(nis_user->status))); return False; } diff --git a/source3/passdb/pass_check.c b/source3/passdb/pass_check.c index 7effbfef8d..11ce0d754e 100644 --- a/source3/passdb/pass_check.c +++ b/source3/passdb/pass_check.c @@ -32,7 +32,7 @@ static char this_salt[100]=""; static char this_crypted[100]=""; -#ifdef HAVE_PAM +#ifdef WITH_PAM /******************************************************************* check on PAM authentication ********************************************************************/ @@ -136,6 +136,10 @@ static BOOL pam_auth(char *user,char *password) #ifdef WITH_AFS + +#include <afs/stds.h> +#include <afs/kautils.h> + /******************************************************************* check on AFS authentication ********************************************************************/ @@ -158,6 +162,7 @@ static BOOL afs_auth(char *user,char *password) &reason) == 0) { return(True); } + DEBUG(1,("AFS authentication for \"%s\" failed (%s)\n", user, reason)); return(False); } #endif @@ -165,6 +170,9 @@ static BOOL afs_auth(char *user,char *password) #ifdef WITH_DFS +#include <dce/dce_error.h> +#include <dce/sec_login.h> + /***************************************************************** This new version of the DFS_AUTH code was donated by Karsten Muuss <muuss@or.uni-bonn.de>. It fixes the following problems with the @@ -195,6 +203,7 @@ static BOOL dfs_auth(char *user,char *password) sec_passwd_rec_t passwd_rec; sec_login_auth_src_t auth_src = sec_login_auth_src_network; unsigned char dce_errstr[dce_c_error_string_len]; + gid_t egid; if (dcelogin_atmost_once) return(False); @@ -322,14 +331,16 @@ static BOOL dfs_auth(char *user,char *password) * back to being root on error though. JRA. */ - if (setregid(-1, pw->pw_gid) != 0) { + egid = getegid(); + + if (set_effective_gid(pw->pw_gid) != 0) { DEBUG(0,("Can't set egid to %d (%s)\n", pw->pw_gid, strerror(errno))); return False; } - if (setreuid(-1, pw->pw_uid) != 0) { - setgid(0); + if (set_effective_uid(pw->pw_uid) != 0) { + set_effective_gid(egid); DEBUG(0,("Can't set euid to %d (%s)\n", pw->pw_uid, strerror(errno))); return False; @@ -340,24 +351,17 @@ static BOOL dfs_auth(char *user,char *password) &my_dce_sec_context, &err) == 0) { dce_error_inq_text(err, dce_errstr, &err2); - /* Go back to root, JRA. */ - setuid(0); - setgid(0); DEBUG(0,("DCE Setup Identity for %s failed: %s\n", user,dce_errstr)); - return(False); + goto err; } sec_login_get_pwent(my_dce_sec_context, (sec_login_passwd_t*)&pw, &err); if (err != error_status_ok ) { dce_error_inq_text(err, dce_errstr, &err2); - /* Go back to root, JRA. */ - setuid(0); - setgid(0); DEBUG(0,("DCE can't get pwent. %s\n", dce_errstr)); - - return(False); + goto err; } passwd_rec.version_number = sec_passwd_c_version_none; @@ -370,24 +374,16 @@ static BOOL dfs_auth(char *user,char *password) &auth_src, &err); if (err != error_status_ok ) { dce_error_inq_text(err, dce_errstr, &err2); - /* Go back to root, JRA. */ - setuid(0); - setgid(0); DEBUG(0,("DCE Identity Validation failed for principal %s: %s\n", user,dce_errstr)); - - return(False); + goto err; } sec_login_certify_identity(my_dce_sec_context, &err); if (err != error_status_ok) { dce_error_inq_text(err, dce_errstr, &err2); - /* Go back to root, JRA. */ - setuid(0); - setgid(0); DEBUG(0,("DCE certify identity failed: %s\n", dce_errstr)); - - return(False); + goto err; } if (auth_src != sec_login_auth_src_network) { @@ -401,10 +397,7 @@ static BOOL dfs_auth(char *user,char *password) user,dce_errstr)); sec_login_purge_context(&my_dce_sec_context, &err); - /* Go back to root, JRA. */ - setuid(0); - setgid(0); - return(False); + goto err; } sec_login_get_pwent(my_dce_sec_context, @@ -412,11 +405,7 @@ static BOOL dfs_auth(char *user,char *password) if (err != error_status_ok) { dce_error_inq_text(err, dce_errstr, &err2); DEBUG(0,("DCE can't get pwent. %s\n", dce_errstr)); - - /* Go back to root, JRA. */ - setuid(0); - setgid(0); - return(False); + goto err; } DEBUG(0,("DCE login succeeded for principal %s on pid %d\n", @@ -434,21 +423,24 @@ static BOOL dfs_auth(char *user,char *password) sec_login_get_expiration(my_dce_sec_context, &expire_time, &err); if (err != error_status_ok) { dce_error_inq_text(err, dce_errstr, &err2); - /* Go back to root, JRA. */ - setuid(0); - setgid(0); DEBUG(0,("DCE can't get expiration. %s\n", dce_errstr)); - - return(False); + goto err; } - setuid(0); - setgid(0); + set_effective_uid(0); + set_effective_gid(0); DEBUG(0,("DCE context expires: %s",asctime(localtime(&expire_time)))); dcelogin_atmost_once = 1; return (True); + +err: + + /* Go back to root, JRA. */ + set_effective_uid(0); + set_effective_gid(egid); + return(False); } void dfs_unlogin(void) @@ -467,6 +459,9 @@ void dfs_unlogin(void) #endif #ifdef KRB5_AUTH + +#include <krb5.h> + /******************************************************************* check on Kerberos authentication ********************************************************************/ @@ -614,6 +609,7 @@ static char *osf1_bigcrypt(char *password,char *salt1) StrnCpy(salt,salt1,2); StrnCpy(result,salt1,2); + result[2]='\0'; for (i=0; i<parts;i++) { p1 = crypt(p2,salt); @@ -680,7 +676,7 @@ core of password checking routine static BOOL password_check(char *password) { -#ifdef HAVE_PAM +#ifdef WITH_PAM /* This falls through if the password check fails - if HAVE_CRYPT is not defined this causes an error msg saying Warning - no crypt available @@ -691,23 +687,23 @@ static BOOL password_check(char *password) Hence we make a direct return to avoid a second chance!!! */ return (pam_auth(this_user,password)); -#endif +#endif /* WITH_PAM */ #ifdef WITH_AFS if (afs_auth(this_user,password)) return(True); -#endif +#endif /* WITH_AFS */ #ifdef WITH_DFS if (dfs_auth(this_user,password)) return(True); -#endif +#endif /* WITH_DFS */ #ifdef KRB5_AUTH if (krb5_auth(this_user,password)) return(True); -#endif +#endif /* KRB5_AUTH */ #ifdef KRB4_AUTH if (krb4_auth(this_user,password)) return(True); -#endif +#endif /* KRB4_AUTH */ #ifdef OSF1_ENH_SEC { @@ -718,26 +714,42 @@ static BOOL password_check(char *password) } return ret; } -#endif +#endif /* OSF1_ENH_SEC */ #ifdef ULTRIX_AUTH return (strcmp((char *)crypt16(password, this_salt ),this_crypted) == 0); -#endif +#endif /* ULTRIX_AUTH */ #ifdef LINUX_BIGCRYPT return(linux_bigcrypt(password,this_salt,this_crypted)); -#endif +#endif /* LINUX_BIGCRYPT */ + +#if defined(HAVE_BIGCRYPT) && defined(HAVE_CRYPT) && defined(USE_BOTH_CRYPT_CALLS) + + /* + * Some systems have bigcrypt in the C library but might not + * actually use it for the password hashes (HPUX 10.20) is + * a noteable example. So we try bigcrypt first, followed + * by crypt. + */ + + if(strcmp(bigcrypt(password,this_salt),this_crypted) == 0) + return True; + else + return (strcmp((char *)crypt(password,this_salt),this_crypted) == 0); +#else /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */ #ifdef HAVE_BIGCRYPT return(strcmp(bigcrypt(password,this_salt),this_crypted) == 0); -#endif +#endif /* HAVE_BIGCRYPT */ #ifndef HAVE_CRYPT DEBUG(1,("Warning - no crypt available\n")); return(False); -#else +#else /* HAVE_CRYPT */ return(strcmp((char *)crypt(password,this_salt),this_crypted) == 0); -#endif +#endif /* HAVE_CRYPT */ +#endif /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */ } @@ -753,13 +765,12 @@ BOOL pass_check(char *user,char *password, int pwlen, struct passwd *pwd, { pstring pass2; int level = lp_passwordlevel(); - const struct passwd *pass; + struct passwd *pass; if (password) password[pwlen] = 0; #if DEBUG_PASSWORD - DEBUG(100,("checking user=[%s] pass=",user)); - dump_data(100, password, strlen(password)); + DEBUG(100,("checking user=[%s] pass=[%s]\n",user,password)); #endif if (!password) { @@ -785,12 +796,76 @@ BOOL pass_check(char *user,char *password, int pwlen, struct passwd *pwd, return(False); } +#ifdef HAVE_GETSPNAM + { + struct spwd *spass; + + /* many shadow systems require you to be root to get + the password, in most cases this should already be + the case when this function is called, except + perhaps for IPC password changing requests */ + + spass = getspnam(pass->pw_name); + if (spass && spass->sp_pwdp) { + pstrcpy(pass->pw_passwd,spass->sp_pwdp); + } + } +#elif defined(IA_UINFO) + { + /* Need to get password with SVR4.2's ia_ functions + instead of get{sp,pw}ent functions. Required by + UnixWare 2.x, tested on version + 2.1. (tangent@cyberport.com) */ + uinfo_t uinfo; + if (ia_openinfo(pass->pw_name, &uinfo) != -1) { + ia_get_logpwd(uinfo, &(pass->pw_passwd)); + } + } +#endif + +#ifdef HAVE_GETPRPWNAM + { + struct pr_passwd *pr_pw = getprpwnam(pass->pw_name); + if (pr_pw && pr_pw->ufld.fd_encrypt) + pstrcpy(pass->pw_passwd,pr_pw->ufld.fd_encrypt); + } +#endif + +#ifdef OSF1_ENH_SEC + { + struct pr_passwd *mypasswd; + DEBUG(5,("Checking password for user %s in OSF1_ENH_SEC\n", + user)); + mypasswd = getprpwnam (user); + if (mypasswd) { + fstrcpy(pass->pw_name,mypasswd->ufld.fd_name); + fstrcpy(pass->pw_passwd,mypasswd->ufld.fd_encrypt); + } else { + DEBUG(5,("OSF1_ENH_SEC: No entry for user %s in protected database !\n", + user)); + } + } +#endif + +#ifdef ULTRIX_AUTH + { + AUTHORIZATION *ap = getauthuid(pass->pw_uid); + if (ap) { + fstrcpy(pass->pw_passwd, ap->a_password); + endauthent(); + } + } +#endif + /* extract relevant info */ fstrcpy(this_user,pass->pw_name); fstrcpy(this_salt,pass->pw_passwd); + +#if defined(HAVE_TRUNCATED_SALT) /* crypt on some platforms (HPUX in particular) won't work with more than 2 salt characters. */ this_salt[2] = 0; +#endif fstrcpy(this_crypted,pass->pw_passwd); diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c index 6579d14351..c0a20f3420 100644 --- a/source3/passdb/passdb.c +++ b/source3/passdb/passdb.c @@ -24,7 +24,16 @@ #include "nterr.h" extern int DEBUGLEVEL; + +/* + * This is set on startup - it defines the SID for this + * machine, and therefore the SAM database for which it is + * responsible. + */ + extern DOM_SID global_sam_sid; +extern pstring global_myname; +extern fstring global_myworkgroup; /* * NOTE. All these functions are abstracted into a structure @@ -42,41 +51,36 @@ extern DOM_SID global_sam_sid; * functions in a first pass, as struct sam_passwd contains more * information, needed by the NT Domain support. * - * an API writer is expected to create either one set (struct smb_passwd) or - * the other (struct sam_passwd) OR both, and optionally also to write display - * info routines * (struct sam_disp_info). functions which the API writer - * chooses NOT to write must be wrapped in conversion functions (pwdb_x_to_y) - * such that API users can call any function and still get valid results. - * - * the password API does NOT fill in the gaps if you set an API function - * to NULL: it will deliberately attempt to call the NULL function. + * a full example set of derivative functions are listed below. an API + * writer is expected to cut/paste these into their module, replace + * either one set (struct smb_passwd) or the other (struct sam_passwd) + * OR both, and optionally also to write display info routines + * (struct sam_disp_info). lkcl * */ -static struct smb_passdb_ops *pwdb_ops; +static struct passdb_ops *pdb_ops; /*************************************************************** - Initialise the password db operations. + Initialize the password db operations. ***************************************************************/ -BOOL initialise_password_db(void) +BOOL initialize_password_db(void) { - if (pwdb_ops) + if (pdb_ops) { return True; } #ifdef WITH_NISPLUS - pwdb_ops = nisplus_initialise_password_db(); + pdb_ops = nisplus_initialize_password_db(); #elif defined(WITH_LDAP) - pwdb_ops = ldap_initialise_password_db(); -#elif defined(HAVE_MYSQL_H) && defined(WITH_MYSQLSAM) - pwdb_ops = mysql_initialise_password_db(); -#elif defined(USE_SMBPASS_DB) - pwdb_ops = file_initialise_password_db(); + pdb_ops = ldap_initialize_password_db(); +#else + pdb_ops = file_initialize_password_db(); #endif - return (pwdb_ops != NULL); + return (pdb_ops != NULL); } /* @@ -84,16 +88,25 @@ BOOL initialise_password_db(void) */ /************************************************************************ + Utility function to search smb passwd by rid. +*************************************************************************/ + +struct smb_passwd *iterate_getsmbpwrid(uint32 user_rid) +{ + return iterate_getsmbpwuid(pdb_user_rid_to_uid(user_rid)); +} + +/************************************************************************ Utility function to search smb passwd by uid. use this if your database does not have search facilities. *************************************************************************/ -struct smb_passwd *iterate_getsmbpwuid(uid_t unix_uid) +struct smb_passwd *iterate_getsmbpwuid(uid_t smb_userid) { struct smb_passwd *pwd = NULL; void *fp = NULL; - DEBUG(10, ("search by unix_uid: %x\n", (int)unix_uid)); + DEBUG(10, ("search by smb_userid: %x\n", (int)smb_userid)); /* Open the smb password database - not for update. */ fp = startsmbpwent(False); @@ -104,13 +117,12 @@ struct smb_passwd *iterate_getsmbpwuid(uid_t unix_uid) return NULL; } - while ((pwd = getsmbpwent(fp)) != NULL && pwd->unix_uid != unix_uid) - { - } + while ((pwd = getsmbpwent(fp)) != NULL && pwd->smb_userid != smb_userid) + ; if (pwd != NULL) { - DEBUG(10, ("found by unix_uid: %x\n", (int)unix_uid)); + DEBUG(10, ("found by smb_userid: %x\n", (int)smb_userid)); } endsmbpwent(fp); @@ -122,7 +134,7 @@ struct smb_passwd *iterate_getsmbpwuid(uid_t unix_uid) does not have search facilities. *************************************************************************/ -struct smb_passwd *iterate_getsmbpwnam(const char *name) +struct smb_passwd *iterate_getsmbpwnam(char *name) { struct smb_passwd *pwd = NULL; void *fp = NULL; @@ -138,10 +150,8 @@ struct smb_passwd *iterate_getsmbpwnam(const char *name) return NULL; } - while ((pwd = getsmbpwent(fp)) != NULL && !strequal(pwd->unix_name, name)) - { - DEBUG(10, ("iterate: %s 0x%x\n", pwd->unix_name, pwd->unix_uid)); - } + while ((pwd = getsmbpwent(fp)) != NULL && !strequal(pwd->smb_name, name)) + ; if (pwd != NULL) { @@ -165,7 +175,7 @@ struct smb_passwd *iterate_getsmbpwnam(const char *name) void *startsmbpwent(BOOL update) { - return pwdb_ops->startsmbpwent(update); + return pdb_ops->startsmbpwent(update); } /*************************************************************** @@ -180,17 +190,7 @@ void *startsmbpwent(BOOL update) void endsmbpwent(void *vp) { - pwdb_ops->endsmbpwent(vp); -} - -SMB_BIG_UINT getsmbpwpos(void *vp) -{ - return pwdb_ops->getsmbpwpos(vp); -} - -BOOL setsmbpwpos(void *vp, SMB_BIG_UINT tok) -{ - return pwdb_ops->setsmbpwpos(vp, tok); + pdb_ops->endsmbpwent(vp); } /************************************************************************* @@ -199,7 +199,7 @@ BOOL setsmbpwpos(void *vp, SMB_BIG_UINT tok) struct smb_passwd *getsmbpwent(void *vp) { - return pwdb_smb_map_names(pwdb_ops->getsmbpwent(vp)); + return pdb_ops->getsmbpwent(vp); } /************************************************************************ @@ -208,12 +208,7 @@ struct smb_passwd *getsmbpwent(void *vp) BOOL add_smbpwd_entry(struct smb_passwd *newpwd) { - struct smb_passwd *mapped = pwdb_smb_map_names(newpwd); - if (mapped) - { - return pwdb_ops->add_smbpwd_entry(mapped); - } - return False; + return pdb_ops->add_smbpwd_entry(newpwd); } /************************************************************************ @@ -227,121 +222,985 @@ BOOL add_smbpwd_entry(struct smb_passwd *newpwd) BOOL mod_smbpwd_entry(struct smb_passwd* pwd, BOOL override) { - struct smb_passwd *mapped = pwdb_smb_map_names(pwd); - if (mapped) - { - return pwdb_ops->mod_smbpwd_entry(mapped, override); - } - return False; + return pdb_ops->mod_smbpwd_entry(pwd, override); } /************************************************************************ Routine to search smb passwd by name. *************************************************************************/ -struct smb_passwd *getsmbpwnam(const char *name) +struct smb_passwd *getsmbpwnam(char *name) { - return pwdb_smb_map_names(pwdb_ops->getsmbpwnam(name)); + return pdb_ops->getsmbpwnam(name); +} + +/************************************************************************ + Routine to search smb passwd by user rid. +*************************************************************************/ + +struct smb_passwd *getsmbpwrid(uint32 user_rid) +{ + return pdb_ops->getsmbpwrid(user_rid); } /************************************************************************ Routine to search smb passwd by uid. *************************************************************************/ -struct smb_passwd *getsmbpwuid(uid_t unix_uid) +struct smb_passwd *getsmbpwuid(uid_t smb_userid) { - return pwdb_smb_map_names(pwdb_ops->getsmbpwuid(unix_uid)); + return pdb_ops->getsmbpwuid(smb_userid); +} + +/* + * Functions that manupulate a struct sam_passwd. + */ + +/************************************************************************ + Utility function to search sam passwd by name. use this if your database + does not have search facilities. +*************************************************************************/ + +struct sam_passwd *iterate_getsam21pwnam(char *name) +{ + struct sam_passwd *pwd = NULL; + void *fp = NULL; + + DEBUG(10, ("search by name: %s\n", name)); + + /* Open the smb password database - not for update. */ + fp = startsmbpwent(False); + + if (fp == NULL) + { + DEBUG(0, ("unable to open sam password database.\n")); + return NULL; + } + + while ((pwd = getsam21pwent(fp)) != NULL && !strequal(pwd->smb_name, name)) + { + DEBUG(10, ("iterate: %s 0x%x\n", pwd->smb_name, pwd->user_rid)); + } + + if (pwd != NULL) + { + DEBUG(10, ("found by name: %s\n", name)); + } + + endsmbpwent(fp); + return pwd; +} + +/************************************************************************ + Utility function to search sam passwd by rid. use this if your database + does not have search facilities. + + search capability by both rid and uid are needed as the rid <-> uid + mapping may be non-monotonic. + +*************************************************************************/ + +struct sam_passwd *iterate_getsam21pwrid(uint32 rid) +{ + struct sam_passwd *pwd = NULL; + void *fp = NULL; + + DEBUG(10, ("search by rid: %x\n", rid)); + + /* Open the smb password file - not for update. */ + fp = startsmbpwent(False); + + if (fp == NULL) + { + DEBUG(0, ("unable to open sam password database.\n")); + return NULL; + } + + while ((pwd = getsam21pwent(fp)) != NULL && pwd->user_rid != rid) + { + DEBUG(10, ("iterate: %s 0x%x\n", pwd->smb_name, pwd->user_rid)); + } + + if (pwd != NULL) + { + DEBUG(10, ("found by user_rid: %x\n", rid)); + } + + endsmbpwent(fp); + return pwd; +} + +/************************************************************************ + Utility function to search sam passwd by uid. use this if your database + does not have search facilities. + + search capability by both rid and uid are needed as the rid <-> uid + mapping may be non-monotonic. + +*************************************************************************/ + +struct sam_passwd *iterate_getsam21pwuid(uid_t uid) +{ + struct sam_passwd *pwd = NULL; + void *fp = NULL; + + DEBUG(10, ("search by uid: %x\n", (int)uid)); + + /* Open the smb password file - not for update. */ + fp = startsmbpwent(False); + + if (fp == NULL) + { + DEBUG(0, ("unable to open sam password database.\n")); + return NULL; + } + + while ((pwd = getsam21pwent(fp)) != NULL && pwd->smb_userid != uid) + ; + + if (pwd != NULL) + { + DEBUG(10, ("found by smb_userid: %x\n", (int)uid)); + } + + endsmbpwent(fp); + return pwd; +} + +/************************************************************************* + Routine to return a display info structure, by rid + *************************************************************************/ +struct sam_disp_info *getsamdisprid(uint32 rid) +{ + return pdb_ops->getsamdisprid(rid); +} + +/************************************************************************* + Routine to return the next entry in the sam passwd list. + *************************************************************************/ + +struct sam_passwd *getsam21pwent(void *vp) +{ + return pdb_ops->getsam21pwent(vp); +} + + +/************************************************************************ + Routine to search sam passwd by name. +*************************************************************************/ + +struct sam_passwd *getsam21pwnam(char *name) +{ + return pdb_ops->getsam21pwnam(name); +} + +/************************************************************************ + Routine to search sam passwd by rid. +*************************************************************************/ + +struct sam_passwd *getsam21pwrid(uint32 rid) +{ + return pdb_ops->getsam21pwrid(rid); +} + + +/********************************************************** + ********************************************************** + + utility routines which are likely to be useful to all password + databases + + ********************************************************** + **********************************************************/ + +/************************************************************* + initialises a struct sam_disp_info. + **************************************************************/ + +static void pdb_init_dispinfo(struct sam_disp_info *user) +{ + if (user == NULL) return; + memset((char *)user, '\0', sizeof(*user)); } /************************************************************* initialises a struct smb_passwd. **************************************************************/ -void pwdb_init_smb(struct smb_passwd *user) + +void pdb_init_smb(struct smb_passwd *user) { if (user == NULL) return; - bzero(user, sizeof(*user)); + memset((char *)user, '\0', sizeof(*user)); user->pass_last_set_time = (time_t)-1; - user->unix_uid = (uid_t)-1; - user->user_rid = 0xffffffff; } /************************************************************* - fills in missing details. one set of details _must_ exist. + initialises a struct sam_passwd. + **************************************************************/ +void pdb_init_sam(struct sam_passwd *user) +{ + if (user == NULL) return; + memset((char *)user, '\0', sizeof(*user)); + user->logon_time = (time_t)-1; + user->logoff_time = (time_t)-1; + user->kickoff_time = (time_t)-1; + user->pass_last_set_time = (time_t)-1; + user->pass_can_change_time = (time_t)-1; + user->pass_must_change_time = (time_t)-1; +} + +/************************************************************************* + Routine to return the next entry in the sam passwd list. + *************************************************************************/ + +struct sam_disp_info *pdb_sam_to_dispinfo(struct sam_passwd *user) +{ + static struct sam_disp_info disp_info; + + if (user == NULL) return NULL; + + pdb_init_dispinfo(&disp_info); + + disp_info.smb_name = user->smb_name; + disp_info.full_name = user->full_name; + disp_info.user_rid = user->user_rid; + + return &disp_info; +} + +/************************************************************* + converts a sam_passwd structure to a smb_passwd structure. + **************************************************************/ + +struct smb_passwd *pdb_sam_to_smb(struct sam_passwd *user) +{ + static struct smb_passwd pw_buf; + + if (user == NULL) return NULL; + + pdb_init_smb(&pw_buf); + + pw_buf.smb_userid = user->smb_userid; + pw_buf.smb_name = user->smb_name; + pw_buf.smb_passwd = user->smb_passwd; + pw_buf.smb_nt_passwd = user->smb_nt_passwd; + pw_buf.acct_ctrl = user->acct_ctrl; + pw_buf.pass_last_set_time = user->pass_last_set_time; + + return &pw_buf; +} + + +/************************************************************* + converts a smb_passwd structure to a sam_passwd structure. **************************************************************/ -struct smb_passwd *pwdb_smb_map_names(struct smb_passwd *smb) + +struct sam_passwd *pdb_smb_to_sam(struct smb_passwd *user) { - DOM_NAME_MAP gmep; - BOOL found = False; - DOM_SID sid; - static fstring unix_name; - static fstring nt_name; + static struct sam_passwd pw_buf; + + if (user == NULL) return NULL; + + pdb_init_sam(&pw_buf); + + pw_buf.smb_userid = user->smb_userid; + pw_buf.smb_name = user->smb_name; + pw_buf.smb_passwd = user->smb_passwd; + pw_buf.smb_nt_passwd = user->smb_nt_passwd; + pw_buf.acct_ctrl = user->acct_ctrl; + pw_buf.pass_last_set_time = user->pass_last_set_time; + + return &pw_buf; +} + +/********************************************************** + Encode the account control bits into a string. + length = length of string to encode into (including terminating + null). length *MUST BE MORE THAN 2* ! + **********************************************************/ + +char *pdb_encode_acct_ctrl(uint16 acct_ctrl, size_t length) +{ + static fstring acct_str; + size_t i = 0; + + acct_str[i++] = '['; + + if (acct_ctrl & ACB_PWNOTREQ ) acct_str[i++] = 'N'; + if (acct_ctrl & ACB_DISABLED ) acct_str[i++] = 'D'; + if (acct_ctrl & ACB_HOMDIRREQ) acct_str[i++] = 'H'; + if (acct_ctrl & ACB_TEMPDUP ) acct_str[i++] = 'T'; + if (acct_ctrl & ACB_NORMAL ) acct_str[i++] = 'U'; + if (acct_ctrl & ACB_MNS ) acct_str[i++] = 'M'; + if (acct_ctrl & ACB_WSTRUST ) acct_str[i++] = 'W'; + if (acct_ctrl & ACB_SVRTRUST ) acct_str[i++] = 'S'; + if (acct_ctrl & ACB_AUTOLOCK ) acct_str[i++] = 'L'; + if (acct_ctrl & ACB_PWNOEXP ) acct_str[i++] = 'X'; + if (acct_ctrl & ACB_DOMTRUST ) acct_str[i++] = 'I'; + + for ( ; i < length - 2 ; i++ ) { acct_str[i] = ' '; } - if (smb == NULL) + i = length - 2; + acct_str[i++] = ']'; + acct_str[i++] = '\0'; + + return acct_str; +} + +/********************************************************** + Decode the account control bits from a string. + + this function breaks coding standards minimum line width of 80 chars. + reason: vertical line-up code clarity - all case statements fit into + 15 lines, which is more important. + **********************************************************/ + +uint16 pdb_decode_acct_ctrl(const char *p) +{ + uint16 acct_ctrl = 0; + BOOL finished = False; + + /* + * Check if the account type bits have been encoded after the + * NT password (in the form [NDHTUWSLXI]). + */ + + if (*p != '[') return 0; + + for (p++; *p && !finished; p++) { - DEBUG(10,("pwdb_smb_map_names: NULL\n")); - return NULL; + switch (*p) + { + case 'N': { acct_ctrl |= ACB_PWNOTREQ ; break; /* 'N'o password. */ } + case 'D': { acct_ctrl |= ACB_DISABLED ; break; /* 'D'isabled. */ } + case 'H': { acct_ctrl |= ACB_HOMDIRREQ; break; /* 'H'omedir required. */ } + case 'T': { acct_ctrl |= ACB_TEMPDUP ; break; /* 'T'emp account. */ } + case 'U': { acct_ctrl |= ACB_NORMAL ; break; /* 'U'ser account (normal). */ } + case 'M': { acct_ctrl |= ACB_MNS ; break; /* 'M'NS logon user account. What is this ? */ } + case 'W': { acct_ctrl |= ACB_WSTRUST ; break; /* 'W'orkstation account. */ } + case 'S': { acct_ctrl |= ACB_SVRTRUST ; break; /* 'S'erver account. */ } + case 'L': { acct_ctrl |= ACB_AUTOLOCK ; break; /* 'L'ocked account. */ } + case 'X': { acct_ctrl |= ACB_PWNOEXP ; break; /* No 'X'piry on password */ } + case 'I': { acct_ctrl |= ACB_DOMTRUST ; break; /* 'I'nterdomain trust account. */ } + case ' ': { break; } + case ':': + case '\n': + case '\0': + case ']': + default: { finished = True; } + } } - DEBUG(10,("pwdb_smb_map_names: unix %s nt %s unix %d nt%d\n", - smb->unix_name != NULL ? smb->unix_name : "NULL", - smb->nt_name != NULL ? smb->nt_name : "NULL", - smb->unix_uid, smb->user_rid)); + return acct_ctrl; +} + +/******************************************************************* + gets password-database-format time from a string. + ********************************************************************/ - if (smb->unix_name == NULL && smb->nt_name == NULL && - smb->unix_uid == (uid_t)-1 && smb->user_rid == 0xffffffff) +static time_t get_time_from_string(const char *p) +{ + int i; + + for (i = 0; i < 8; i++) { - return NULL; + if (p[i] == '\0' || !isxdigit((int)(p[i]&0xFF))) + break; + } + if (i == 8) + { + /* + * p points at 8 characters of hex digits - + * read into a time_t as the seconds since + * 1970 that the password was last changed. + */ + return (time_t)strtol(p, NULL, 16); } - if (smb->unix_name != NULL && smb->nt_name != NULL && - smb->unix_uid != (uid_t)-1 && smb->user_rid != 0xffffffff) + return (time_t)-1; +} + +/******************************************************************* + gets password last set time + ********************************************************************/ + +time_t pdb_get_last_set_time(const char *p) +{ + if (*p && StrnCaseCmp(p, "LCT-", 4)) { - return smb; + return get_time_from_string(p + 4); } + return (time_t)-1; +} - if (!found && smb->unix_name != NULL) + +/******************************************************************* + sets password-database-format time in a string. + ********************************************************************/ +static void set_time_in_string(char *p, int max_len, char *type, time_t t) +{ + slprintf(p, max_len, ":%s-%08X:", type, (uint32)t); +} + +/******************************************************************* + sets logon time + ********************************************************************/ +void pdb_set_logon_time(char *p, int max_len, time_t t) +{ + set_time_in_string(p, max_len, "LNT", t); +} + +/******************************************************************* + sets logoff time + ********************************************************************/ +void pdb_set_logoff_time(char *p, int max_len, time_t t) +{ + set_time_in_string(p, max_len, "LOT", t); +} + +/******************************************************************* + sets kickoff time + ********************************************************************/ +void pdb_set_kickoff_time(char *p, int max_len, time_t t) +{ + set_time_in_string(p, max_len, "KOT", t); +} + +/******************************************************************* + sets password can change time + ********************************************************************/ +void pdb_set_can_change_time(char *p, int max_len, time_t t) +{ + set_time_in_string(p, max_len, "CCT", t); +} + +/******************************************************************* + sets password last set time + ********************************************************************/ +void pdb_set_must_change_time(char *p, int max_len, time_t t) +{ + set_time_in_string(p, max_len, "MCT", t); +} + +/******************************************************************* + sets password last set time + ********************************************************************/ +void pdb_set_last_set_time(char *p, int max_len, time_t t) +{ + set_time_in_string(p, max_len, "LCT", t); +} + + +/************************************************************* + Routine to set 32 hex password characters from a 16 byte array. +**************************************************************/ +void pdb_sethexpwd(char *p, unsigned char *pwd, uint16 acct_ctrl) +{ + if (pwd != NULL) { - found = lookupsmbpwnam(smb->unix_name, &gmep); + int i; + for (i = 0; i < 16; i++) + { + slprintf(&p[i*2], 3, "%02X", pwd[i]); + } } - if (!found && smb->unix_uid != (uid_t)-1) + else { - found = lookupsmbpwuid(smb->unix_uid , &gmep); + if (IS_BITS_SET_ALL(acct_ctrl, ACB_PWNOTREQ)) + { + safe_strcpy(p, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX", 33); + } + else + { + safe_strcpy(p, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 33); + } } +} +/************************************************************* + Routine to get the 32 hex characters and turn them + into a 16 byte array. +**************************************************************/ +BOOL pdb_gethexpwd(char *p, unsigned char *pwd) +{ + int i; + unsigned char lonybble, hinybble; + char *hexchars = "0123456789ABCDEF"; + char *p1, *p2; - if (!found) + for (i = 0; i < 32; i += 2) { - sid_copy(&sid, &global_sam_sid); - sid_append_rid(&sid, smb->user_rid); + hinybble = toupper(p[i]); + lonybble = toupper(p[i + 1]); + + p1 = strchr(hexchars, hinybble); + p2 = strchr(hexchars, lonybble); + + if (!p1 || !p2) + { + return (False); + } + + hinybble = PTR_DIFF(p1, hexchars); + lonybble = PTR_DIFF(p2, hexchars); + + pwd[i / 2] = (hinybble << 4) | lonybble; } + return (True); +} + +/******************************************************************* + Group and User RID username mapping function + ********************************************************************/ - if (!found && smb->user_rid != 0xffffffff) +BOOL pdb_name_to_rid(char *user_name, uint32 *u_rid, uint32 *g_rid) +{ + struct passwd *pw = Get_Pwnam(user_name, False); + + if (u_rid == NULL || g_rid == NULL || user_name == NULL) { - found = lookupsmbpwsid (&sid , &gmep); + return False; } - if (!found && smb->nt_name != NULL) + + if (!pw) { - found = lookupsmbpwntnam(smb->nt_name, &gmep); + DEBUG(1,("Username %s is invalid on this system\n", user_name)); + return False; } - if (!found) + if (user_in_list(user_name, lp_domain_guest_users())) { - return NULL; + *u_rid = DOMAIN_USER_RID_GUEST; } - - if (!sid_front_equal(&global_sam_sid, &gmep.sid)) + else if (user_in_list(user_name, lp_domain_admin_users())) { - fstring sid_str; - sid_to_string(sid_str, &gmep.sid); - DEBUG(0,("UNIX User %s Primary Group is in the wrong domain! %s\n", - smb->unix_name, sid_str)); - return NULL; + *u_rid = DOMAIN_USER_RID_ADMIN; + } + else + { + /* turn the unix UID into a Domain RID. this is what the posix + sub-system does (adds 1000 to the uid) */ + *u_rid = pdb_uid_to_user_rid(pw->pw_uid); + } + + /* absolutely no idea what to do about the unix GID to Domain RID mapping */ + *g_rid = pdb_gid_to_group_rid(pw->pw_gid); + + return True; +} + +/**************************************************************************** + Read the machine SID from a file. +****************************************************************************/ + +static BOOL read_sid_from_file(int fd, char *sid_file) +{ + fstring fline; + + memset(fline, '\0', sizeof(fline)); + + if(read(fd, fline, sizeof(fline) -1 ) < 0) { + DEBUG(0,("unable to read file %s. Error was %s\n", + sid_file, strerror(errno) )); + return False; + } + + /* + * Convert to the machine SID. + */ + + fline[sizeof(fline)-1] = '\0'; + if(!string_to_sid( &global_sam_sid, fline)) { + DEBUG(0,("unable to generate machine SID.\n")); + return False; + } + + return True; +} + +/**************************************************************************** + Generate the global machine sid. Look for the MACHINE.SID file first, if + not found then look in smb.conf and use it to create the MACHINE.SID file. +****************************************************************************/ +BOOL pdb_generate_sam_sid(void) +{ + int fd; + char *p; + pstring sid_file; + fstring sid_string; + SMB_STRUCT_STAT st; + BOOL overwrite_bad_sid = False; + + generate_wellknown_sids(); + + pstrcpy(sid_file, lp_smb_passwd_file()); + p = strrchr(sid_file, '/'); + if(p != NULL) { + *++p = '\0'; + } + + if (!directory_exist(sid_file, NULL)) { + if (mkdir(sid_file, 0700) != 0) { + DEBUG(0,("can't create private directory %s : %s\n", + sid_file, strerror(errno))); + return False; + } + } + + pstrcat(sid_file, "MACHINE.SID"); + + if((fd = sys_open(sid_file, O_RDWR | O_CREAT, 0644)) == -1) { + DEBUG(0,("unable to open or create file %s. Error was %s\n", + sid_file, strerror(errno) )); + return False; + } + + /* + * Check if the file contains data. + */ + + if(sys_fstat( fd, &st) < 0) { + DEBUG(0,("unable to stat file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); + return False; + } + + if(st.st_size > 0) { + /* + * We have a valid SID - read it. + */ + if(!read_sid_from_file( fd, sid_file)) { + DEBUG(0,("unable to read file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); + return False; + } + + /* + * JRA. Reversed the sense of this test now that I have + * actually done this test *personally*. One more reason + * to never trust third party information you have not + * independently verified.... sigh. JRA. + */ + + if(global_sam_sid.num_auths > 0 && global_sam_sid.sub_auths[0] == 0x21) { + /* + * Fix and re-write... + */ + overwrite_bad_sid = True; + global_sam_sid.sub_auths[0] = 21; + DEBUG(5,("pdb_generate_sam_sid: Old (incorrect) sid id_auth of hex 21 \ +detected - re-writing to be decimal 21 instead.\n" )); + sid_to_string(sid_string, &global_sam_sid); + if(sys_lseek(fd, (SMB_OFF_T)0, SEEK_SET) != 0) { + DEBUG(0,("unable to seek file file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); + return False; + } + } else { + close(fd); + return True; + } + } else { + /* + * The file contains no data - we need to generate our + * own sid. + * Generate the new sid data & turn it into a string. + */ + int i; + uchar raw_sid_data[12]; + DOM_SID mysid; + + memset((char *)&mysid, '\0', sizeof(DOM_SID)); + mysid.sid_rev_num = 1; + mysid.id_auth[5] = 5; + mysid.num_auths = 0; + mysid.sub_auths[mysid.num_auths++] = 21; + + generate_random_buffer( raw_sid_data, 12, True); + for( i = 0; i < 3; i++) + mysid.sub_auths[mysid.num_auths++] = IVAL(raw_sid_data, i*4); + + sid_to_string(sid_string, &mysid); + } + + fstrcat(sid_string, "\n"); + + /* + * Ensure our new SID is valid. + */ + + if(!string_to_sid( &global_sam_sid, sid_string)) { + DEBUG(0,("unable to generate machine SID.\n")); + return False; + } + + /* + * Do an exclusive blocking lock on the file. + */ + + if(!do_file_lock( fd, 60, F_WRLCK)) { + DEBUG(0,("unable to lock file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); + return False; + } + + if(!overwrite_bad_sid) { + /* + * At this point we have a blocking lock on the SID + * file - check if in the meantime someone else wrote + * SID data into the file. If so - they were here first, + * use their data. + */ + + if(sys_fstat( fd, &st) < 0) { + DEBUG(0,("unable to stat file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); + return False; + } + + if(st.st_size > 0) { + /* + * Unlock as soon as possible to reduce + * contention on the exclusive lock. + */ + do_file_lock( fd, 60, F_UNLCK); + + /* + * We have a valid SID - read it. + */ + + if(!read_sid_from_file( fd, sid_file)) { + DEBUG(0,("unable to read file %s. Error was %s\n", + sid_file, strerror(errno) )); + close(fd); + return False; + } + close(fd); + return True; + } + } + + /* + * The file is still empty and we have an exlusive lock on it, + * or we're fixing an earlier mistake. + * Write out out SID data into the file. + */ + + /* + * Use chmod here as some (strange) UNIX's don't + * have fchmod. JRA. + */ + + if(chmod(sid_file, 0644) < 0) { + DEBUG(0,("unable to set correct permissions on file %s. \ +Error was %s\n", sid_file, strerror(errno) )); + do_file_lock( fd, 60, F_UNLCK); + close(fd); + return False; + } + + if(write( fd, sid_string, strlen(sid_string)) != strlen(sid_string)) { + DEBUG(0,("unable to write file %s. Error was %s\n", + sid_file, strerror(errno) )); + do_file_lock( fd, 60, F_UNLCK); + close(fd); + return False; + } + + /* + * Unlock & exit. + */ + + do_file_lock( fd, 60, F_UNLCK); + close(fd); + return True; +} + +/******************************************************************* + Converts NT user RID to a UNIX uid. + ********************************************************************/ + +uid_t pdb_user_rid_to_uid(uint32 user_rid) +{ + return (uid_t)(((user_rid & (~USER_RID_TYPE))- 1000)/RID_MULTIPLIER); +} + +/******************************************************************* + Converts NT user RID to a UNIX gid. + ********************************************************************/ + +gid_t pdb_user_rid_to_gid(uint32 user_rid) +{ + return (uid_t)(((user_rid & (~GROUP_RID_TYPE))- 1000)/RID_MULTIPLIER); +} + +/******************************************************************* + converts UNIX uid to an NT User RID. + ********************************************************************/ + +uint32 pdb_uid_to_user_rid(uid_t uid) +{ + return (((((uint32)uid)*RID_MULTIPLIER) + 1000) | USER_RID_TYPE); +} + +/******************************************************************* + converts NT Group RID to a UNIX uid. + ********************************************************************/ + +uint32 pdb_gid_to_group_rid(gid_t gid) +{ + return (((((uint32)gid)*RID_MULTIPLIER) + 1000) | GROUP_RID_TYPE); +} + +/******************************************************************* + Decides if a RID is a well known RID. + ********************************************************************/ + +static BOOL pdb_rid_is_well_known(uint32 rid) +{ + return (rid < 1000); +} + +/******************************************************************* + Decides if a RID is a user or group RID. + ********************************************************************/ + +BOOL pdb_rid_is_user(uint32 rid) +{ + /* lkcl i understand that NT attaches an enumeration to a RID + * such that it can be identified as either a user, group etc + * type. there are 5 such categories, and they are documented. + */ + if(pdb_rid_is_well_known(rid)) { + /* + * The only well known user RIDs are DOMAIN_USER_RID_ADMIN + * and DOMAIN_USER_RID_GUEST. + */ + if(rid == DOMAIN_USER_RID_ADMIN || rid == DOMAIN_USER_RID_GUEST) + return True; + } else if((rid & RID_TYPE_MASK) == USER_RID_TYPE) { + return True; + } + return False; +} + +/******************************************************************* + Convert a rid into a name. Used in the lookup SID rpc. + ********************************************************************/ + +BOOL lookup_local_rid(uint32 rid, char *name, uint8 *psid_name_use) +{ + + BOOL is_user = pdb_rid_is_user(rid); + + DEBUG(5,("lookup_local_rid: looking up %s RID %u.\n", is_user ? "user" : + "group", (unsigned int)rid)); + + if(is_user) { + if(rid == DOMAIN_USER_RID_ADMIN) { + pstring admin_users; + char *p = admin_users; + pstrcpy( admin_users, lp_domain_admin_users()); + if(!next_token(&p, name, NULL, sizeof(fstring))) + fstrcpy(name, "Administrator"); + } else if (rid == DOMAIN_USER_RID_GUEST) { + pstring guest_users; + char *p = guest_users; + pstrcpy( guest_users, lp_domain_guest_users()); + if(!next_token(&p, name, NULL, sizeof(fstring))) + fstrcpy(name, "Guest"); + } else { + uid_t uid = pdb_user_rid_to_uid(rid); + struct passwd *pass = sys_getpwuid(uid); + + *psid_name_use = SID_NAME_USER; + + DEBUG(5,("lookup_local_rid: looking up uid %u %s\n", (unsigned int)uid, + pass ? "succeeded" : "failed" )); + + if(!pass) { + slprintf(name, sizeof(fstring)-1, "unix_user.%u", (unsigned int)uid); + return True; + } + + fstrcpy(name, pass->pw_name); + + DEBUG(5,("lookup_local_rid: found user %s for rid %u\n", name, + (unsigned int)rid )); + } + + } else { + gid_t gid = pdb_user_rid_to_gid(rid); + struct group *gr = getgrgid(gid); + + *psid_name_use = SID_NAME_ALIAS; + + DEBUG(5,("lookup_local_rid: looking up gid %u %s\n", (unsigned int)gid, + gr ? "succeeded" : "failed" )); + + if(!gr) { + slprintf(name, sizeof(fstring)-1, "unix_group.%u", (unsigned int)gid); + return True; + } + + fstrcpy( name, gr->gr_name); + + DEBUG(5,("lookup_local_rid: found group %s for rid %u\n", name, + (unsigned int)rid )); + } + + return True; +} + +/******************************************************************* + Convert a name into a SID. Used in the lookup name rpc. + ********************************************************************/ + +BOOL lookup_local_name(char *domain, char *user, DOM_SID *psid, uint8 *psid_name_use) +{ + extern DOM_SID global_sid_World_Domain; + struct passwd *pass = NULL; + DOM_SID local_sid; + + sid_copy(&local_sid, &global_sam_sid); + + if(!strequal(global_myname, domain) && !strequal(global_myworkgroup, domain)) + return False; + + /* + * Special case for MACHINE\Everyone. Map to the world_sid. + */ + + if(strequal(user, "Everyone")) { + sid_copy( psid, &global_sid_World_Domain); + sid_append_rid(psid, 0); + *psid_name_use = SID_NAME_ALIAS; + return True; + } + + (void)map_username(user); + + if(!(pass = Get_Pwnam(user, False))) { + /* + * Maybe it was a group ? + */ + struct group *grp = getgrnam(user); + + if(!grp) + return False; + + sid_append_rid( &local_sid, pdb_gid_to_group_rid(grp->gr_gid)); + *psid_name_use = SID_NAME_ALIAS; + } else { + + sid_append_rid( &local_sid, pdb_uid_to_user_rid(pass->pw_uid)); + *psid_name_use = SID_NAME_USER; } - fstrcpy(unix_name, gmep.unix_name); - fstrcpy(nt_name , gmep.nt_name ); - if (smb->unix_name == NULL ) smb->unix_name = unix_name; - if (smb->nt_name == NULL ) smb->nt_name = nt_name ; - if (smb->unix_uid == (uid_t)-1 ) smb->unix_uid = (uid_t)gmep.unix_id; - if (smb->user_rid == 0xffffffff) sid_split_rid(&gmep.sid, &smb->user_rid); + sid_copy( psid, &local_sid); - return smb; + return True; } diff --git a/source3/passdb/passgrp.c b/source3/passdb/passgrp.c index 41b01a1a49..f578d9a20e 100644 --- a/source3/passdb/passgrp.c +++ b/source3/passdb/passgrp.c @@ -34,7 +34,7 @@ extern int DEBUGLEVEL; * */ -static struct passgrp_ops *pwgrp_ops = NULL; +static struct passgrp_ops *pwgrp_ops; /*************************************************************** Initialise the passgrp operations. @@ -50,10 +50,8 @@ BOOL initialise_passgrp_db(void) #ifdef WITH_NISPLUS pwgrp_ops = nisplus_initialise_password_grp(); #elif defined(WITH_LDAP) - pwgrp_ops = ldap_initialise_password_grp(); -#elif defined(USE_SMBUNIX_DB) - pwgrp_ops = unix_initialise_password_grp(); -#elif defined(USE_SMBPASS_DB) + pwgrp_ops = ldap_initialize_password_grp(); +#else pwgrp_ops = file_initialise_password_grp(); #endif @@ -72,30 +70,8 @@ struct smb_passwd *iterate_getsmbgrprid(uint32 user_rid, uint32 **grps, int *num_grps, uint32 **alss, int *num_alss) { - struct smb_passwd *pwd = NULL; - void *fp = NULL; - - DEBUG(10, ("search by user_rid: 0x%x\n", user_rid)); - - /* Open the smb password database - not for update. */ - fp = startsmbgrpent(False); - - if (fp == NULL) - { - DEBUG(0, ("unable to open smb passgrp database.\n")); - return NULL; - } - - while ((pwd = getsmbgrpent(fp, grps, num_grps, alss, num_alss)) != NULL && pwd->user_rid != user_rid) - ; - - if (pwd != NULL) - { - DEBUG(10, ("found by user_rid: 0x%x\n", user_rid)); - } - - endsmbgrpent(fp); - return pwd; + return iterate_getsmbgrpuid(pwdb_user_rid_to_uid(user_rid), + grps, num_grps, alss, num_alss); } /************************************************************************ @@ -103,14 +79,14 @@ struct smb_passwd *iterate_getsmbgrprid(uint32 user_rid, does not have search facilities. *************************************************************************/ -struct smb_passwd *iterate_getsmbgrpuid(uid_t unix_uid, +struct smb_passwd *iterate_getsmbgrpuid(uid_t smb_userid, uint32 **grps, int *num_grps, uint32 **alss, int *num_alss) { struct smb_passwd *pwd = NULL; void *fp = NULL; - DEBUG(10, ("search by unix_uid: %x\n", (int)unix_uid)); + DEBUG(10, ("search by smb_userid: %x\n", (int)smb_userid)); /* Open the smb password database - not for update. */ fp = startsmbgrpent(False); @@ -121,12 +97,12 @@ struct smb_passwd *iterate_getsmbgrpuid(uid_t unix_uid, return NULL; } - while ((pwd = getsmbgrpent(fp, grps, num_grps, alss, num_alss)) != NULL && pwd->unix_uid != unix_uid) + while ((pwd = getsmbgrpent(fp, grps, num_grps, alss, num_alss)) != NULL && pwd->smb_userid != smb_userid) ; if (pwd != NULL) { - DEBUG(10, ("found by unix_uid: %x\n", (int)unix_uid)); + DEBUG(10, ("found by smb_userid: %x\n", (int)smb_userid)); } endsmbgrpent(fp); @@ -138,14 +114,12 @@ struct smb_passwd *iterate_getsmbgrpuid(uid_t unix_uid, does not have search facilities. *************************************************************************/ -struct smb_passwd *iterate_getsmbgrpntnam(const char *nt_name, +struct smb_passwd *iterate_getsmbgrpnam(char *name, uint32 **grps, int *num_grps, uint32 **alss, int *num_alss) { struct smb_passwd *pwd = NULL; - fstring name; void *fp = NULL; - fstrcpy(name, nt_name); DEBUG(10, ("search by name: %s\n", name)); @@ -158,7 +132,7 @@ struct smb_passwd *iterate_getsmbgrpntnam(const char *nt_name, return NULL; } - while ((pwd = getsmbgrpent(fp, grps, num_grps, alss, num_alss)) != NULL && !strequal(pwd->nt_name, name)) + while ((pwd = getsmbgrpent(fp, grps, num_grps, alss, num_alss)) != NULL && !strequal(pwd->smb_name, name)) ; if (pwd != NULL) @@ -216,11 +190,11 @@ struct smb_passwd *getsmbgrpent(void *vp, Routine to search smb passwd by name. *************************************************************************/ -struct smb_passwd *getsmbgrpntnam(char *name, +struct smb_passwd *getsmbgrpnam(char *name, uint32 **grps, int *num_grps, uint32 **alss, int *num_alss) { - return pwgrp_ops->getsmbgrpntnam(name, grps, num_grps, alss, num_alss); + return pwgrp_ops->getsmbgrpnam(name, grps, num_grps, alss, num_alss); } /************************************************************************ @@ -238,10 +212,10 @@ struct smb_passwd *getsmbgrprid(uint32 user_rid, Routine to search smb passwd by uid. *************************************************************************/ -struct smb_passwd *getsmbgrpuid(uid_t unix_uid, +struct smb_passwd *getsmbgrpuid(uid_t smb_userid, uint32 **grps, int *num_grps, uint32 **alss, int *num_alss) { - return pwgrp_ops->getsmbgrpuid(unix_uid, grps, num_grps, alss, num_alss); + return pwgrp_ops->getsmbgrpuid(smb_userid, grps, num_grps, alss, num_alss); } diff --git a/source3/passdb/smbpass.c b/source3/passdb/smbpass.c index e3c6a5da44..4cfac6d948 100644 --- a/source3/passdb/smbpass.c +++ b/source3/passdb/smbpass.c @@ -21,10 +21,12 @@ #ifdef USE_SMBPASS_DB -static int pw_file_lock_depth = 0; extern int DEBUGLEVEL; +extern pstring samlogon_user; +extern BOOL sam_logon_in_ssb; static char s_readbuf[1024]; +static int pw_file_lock_depth; /*************************************************************** Start to enumerate the smbpasswd list. Returns a void pointer @@ -33,8 +35,37 @@ static char s_readbuf[1024]; static void *startsmbfilepwent(BOOL update) { - return startfileent(lp_smb_passwd_file(), s_readbuf, sizeof(s_readbuf), - &pw_file_lock_depth, update); + FILE *fp = NULL; + char *pfile = lp_smb_passwd_file(); + + if (!*pfile) { + DEBUG(0, ("startsmbfilepwent: No SMB password file set\n")); + return (NULL); + } + DEBUG(10, ("startsmbfilepwent: opening file %s\n", pfile)); + + fp = sys_fopen(pfile, update ? "r+b" : "rb"); + + if (fp == NULL) { + DEBUG(0, ("startsmbfilepwent: unable to open file %s\n", pfile)); + return NULL; + } + + /* Set a buffer to do more efficient reads */ + setvbuf(fp, s_readbuf, _IOFBF, sizeof(s_readbuf)); + + if (!pw_file_lock(fileno(fp), (update ? F_WRLCK : F_RDLCK), 5, &pw_file_lock_depth)) + { + DEBUG(0, ("startsmbfilepwent: unable to lock file %s\n", pfile)); + fclose(fp); + return NULL; + } + + /* Make sure it is only rw by the owner */ + chmod(pfile, 0600); + + /* We have a lock on the file. */ + return (void *)fp; } /*************************************************************** @@ -43,216 +74,361 @@ static void *startsmbfilepwent(BOOL update) static void endsmbfilepwent(void *vp) { - endfileent(vp, &pw_file_lock_depth); + FILE *fp = (FILE *)vp; + + pw_file_unlock(fileno(fp), &pw_file_lock_depth); + fclose(fp); + DEBUG(7, ("endsmbfilepwent: closed password file.\n")); } /************************************************************************* - Return the current position in the smbpasswd list as an SMB_BIG_UINT. - This must be treated as an opaque token. -*************************************************************************/ - -static SMB_BIG_UINT getsmbfilepwpos(void *vp) + Routine to return the next entry in the smbpasswd list. + *************************************************************************/ +static struct smb_passwd *getsmbfilepwent(void *vp) { - return getfilepwpos(vp); -} + /* Static buffers we will return. */ + static struct smb_passwd pw_buf; + static pstring user_name; + static unsigned char smbpwd[16]; + static unsigned char smbntpwd[16]; + FILE *fp = (FILE *)vp; + char linebuf[256]; + unsigned char c; + unsigned char *p; + long uidval; + size_t linebuf_len; -/************************************************************************* - Set the current position in the smbpasswd list from an SMB_BIG_UINT. - This must be treated as an opaque token. -*************************************************************************/ + if(fp == NULL) { + DEBUG(0,("getsmbfilepwent: Bad password file pointer.\n")); + return NULL; + } -static BOOL setsmbfilepwpos(void *vp, SMB_BIG_UINT tok) -{ - return setfilepwpos(vp, tok); + pdb_init_smb(&pw_buf); + + pw_buf.acct_ctrl = ACB_NORMAL; + + /* + * Scan the file, a line at a time and check if the name matches. + */ + while (!feof(fp)) { + linebuf[0] = '\0'; + + fgets(linebuf, 256, fp); + if (ferror(fp)) { + return NULL; + } + + /* + * Check if the string is terminated with a newline - if not + * then we must keep reading and discard until we get one. + */ + linebuf_len = strlen(linebuf); + if (linebuf[linebuf_len - 1] != '\n') { + c = '\0'; + while (!ferror(fp) && !feof(fp)) { + c = fgetc(fp); + if (c == '\n') + break; + } + } else + linebuf[linebuf_len - 1] = '\0'; + +#ifdef DEBUG_PASSWORD + DEBUG(100, ("getsmbfilepwent: got line |%s|\n", linebuf)); +#endif + if ((linebuf[0] == 0) && feof(fp)) { + DEBUG(4, ("getsmbfilepwent: end of file reached\n")); + break; + } + /* + * The line we have should be of the form :- + * + * username:uid:32hex bytes:[Account type]:LCT-12345678....other flags presently + * ignored.... + * + * or, + * + * username:uid:32hex bytes:32hex bytes:[Account type]:LCT-12345678....ignored.... + * + * if Windows NT compatible passwords are also present. + * [Account type] is an ascii encoding of the type of account. + * LCT-(8 hex digits) is the time_t value of the last change time. + */ + + if (linebuf[0] == '#' || linebuf[0] == '\0') { + DEBUG(6, ("getsmbfilepwent: skipping comment or blank line\n")); + continue; + } + p = (unsigned char *) strchr(linebuf, ':'); + if (p == NULL) { + DEBUG(0, ("getsmbfilepwent: malformed password entry (no :)\n")); + continue; + } + /* + * As 256 is shorter than a pstring we don't need to check + * length here - if this ever changes.... + */ + strncpy(user_name, linebuf, PTR_DIFF(p, linebuf)); + user_name[PTR_DIFF(p, linebuf)] = '\0'; + + /* Get smb uid. */ + + p++; /* Go past ':' */ + + if(*p == '-') { + DEBUG(0, ("getsmbfilepwent: uids in the smbpasswd file must not be negative.\n")); + continue; + } + + if (!isdigit(*p)) { + DEBUG(0, ("getsmbfilepwent: malformed password entry (uid not number)\n")); + continue; + } + + uidval = atoi((char *) p); + + while (*p && isdigit(*p)) + p++; + + if (*p != ':') { + DEBUG(0, ("getsmbfilepwent: malformed password entry (no : after uid)\n")); + continue; + } + + pw_buf.smb_name = user_name; + pw_buf.smb_userid = uidval; + + /* + * Now get the password value - this should be 32 hex digits + * which are the ascii representations of a 16 byte string. + * Get two at a time and put them into the password. + */ + + /* Skip the ':' */ + p++; + + if (*p == '*' || *p == 'X') { + /* Password deliberately invalid - end here. */ + DEBUG(10, ("getsmbfilepwent: entry invalidated for user %s\n", user_name)); + pw_buf.smb_nt_passwd = NULL; + pw_buf.smb_passwd = NULL; + pw_buf.acct_ctrl |= ACB_DISABLED; + return &pw_buf; + } + + if (linebuf_len < (PTR_DIFF(p, linebuf) + 33)) { + DEBUG(0, ("getsmbfilepwent: malformed password entry (passwd too short)\n")); + continue; + } + + if (p[32] != ':') { + DEBUG(0, ("getsmbfilepwent: malformed password entry (no terminating :)\n")); + continue; + } + + if (!strncasecmp((char *) p, "NO PASSWORD", 11)) { + pw_buf.smb_passwd = NULL; + pw_buf.acct_ctrl |= ACB_PWNOTREQ; + } else { + if (!pdb_gethexpwd((char *)p, smbpwd)) { + DEBUG(0, ("getsmbfilepwent: Malformed Lanman password entry (non hex chars)\n")); + continue; + } + pw_buf.smb_passwd = smbpwd; + } + + /* + * Now check if the NT compatible password is + * available. + */ + pw_buf.smb_nt_passwd = NULL; + + p += 33; /* Move to the first character of the line after + the lanman password. */ + if ((linebuf_len >= (PTR_DIFF(p, linebuf) + 33)) && (p[32] == ':')) { + if (*p != '*' && *p != 'X') { + if(pdb_gethexpwd((char *)p,smbntpwd)) + pw_buf.smb_nt_passwd = smbntpwd; + } + p += 33; /* Move to the first character of the line after + the NT password. */ + } + + DEBUG(5,("getsmbfilepwent: returning passwd entry for user %s, uid %ld\n", + user_name, uidval)); + + if (*p == '[') + { + pw_buf.acct_ctrl = pdb_decode_acct_ctrl((char*)p); + + /* Must have some account type set. */ + if(pw_buf.acct_ctrl == 0) + pw_buf.acct_ctrl = ACB_NORMAL; + + /* Now try and get the last change time. */ + if(*p == ']') + p++; + if(*p == ':') { + p++; + if(*p && (StrnCaseCmp((char *)p, "LCT-", 4)==0)) { + int i; + p += 4; + for(i = 0; i < 8; i++) { + if(p[i] == '\0' || !isxdigit(p[i])) + break; + } + if(i == 8) { + /* + * p points at 8 characters of hex digits - + * read into a time_t as the seconds since + * 1970 that the password was last changed. + */ + pw_buf.pass_last_set_time = (time_t)strtol((char *)p, NULL, 16); + } + } + } + } else { + /* 'Old' style file. Fake up based on user name. */ + /* + * Currently trust accounts are kept in the same + * password file as 'normal accounts'. If this changes + * we will have to fix this code. JRA. + */ + if(pw_buf.smb_name[strlen(pw_buf.smb_name) - 1] == '$') { + pw_buf.acct_ctrl &= ~ACB_NORMAL; + pw_buf.acct_ctrl |= ACB_WSTRUST; + } + } + + return &pw_buf; + } + + DEBUG(5,("getsmbfilepwent: end of file reached.\n")); + return NULL; } /************************************************************************* Routine to return the next entry in the smbpasswd list. - - this function is non-static as it is called (exclusively and only) - from getsamfile21pwent(). + this function is a nice, messy combination of reading: + - the smbpasswd file + - the unix password database + - smb.conf options (not done at present). *************************************************************************/ -struct smb_passwd *getsmbfilepwent(void *vp) + +static struct sam_passwd *getsmbfile21pwent(void *vp) { - /* Static buffers we will return. */ - static struct smb_passwd pw_buf; - static pstring unix_name; - static unsigned char smbpwd[16]; - static unsigned char smbntpwd[16]; - char linebuf[256]; - char *p; - int uidval; - size_t linebuf_len; - - if (vp == NULL) + struct smb_passwd *pw_buf = getsmbfilepwent(vp); + static struct sam_passwd user; + struct passwd *pwfile; + + static pstring full_name; + static pstring home_dir; + static pstring home_drive; + static pstring logon_script; + static pstring profile_path; + static pstring acct_desc; + static pstring workstations; + + DEBUG(5,("getsmbfile21pwent\n")); + + if (pw_buf == NULL) return NULL; + + pwfile = sys_getpwnam(pw_buf->smb_name); + if (pwfile == NULL) { - DEBUG(0,("getsmbfilepwent: Bad password file pointer.\n")); + DEBUG(0,("getsmbfile21pwent: smbpasswd database is corrupt!\n")); + DEBUG(0,("getsmbfile21pwent: username %s not in unix passwd database!\n", pw_buf->smb_name)); return NULL; } - pwdb_init_smb(&pw_buf); + pdb_init_sam(&user); + + pstrcpy(samlogon_user, pw_buf->smb_name); - pw_buf.acct_ctrl = ACB_NORMAL; + if (samlogon_user[strlen(samlogon_user)-1] != '$') + { + /* XXXX hack to get standard_sub_basic() to use sam logon username */ + /* possibly a better way would be to do a become_user() call */ + sam_logon_in_ssb = True; + + user.smb_userid = pw_buf->smb_userid; + user.smb_grpid = pwfile->pw_gid; + + user.user_rid = pdb_uid_to_user_rid (user.smb_userid); + user.group_rid = pdb_gid_to_group_rid(user.smb_grpid ); - /* - * Scan the file, a line at a time. - */ - while ((linebuf_len = getfileline(vp, linebuf, sizeof(linebuf))) > 0) + pstrcpy(full_name , pwfile->pw_gecos ); + pstrcpy(logon_script , lp_logon_script ()); + pstrcpy(profile_path , lp_logon_path ()); + pstrcpy(home_drive , lp_logon_drive ()); + pstrcpy(home_dir , lp_logon_home ()); + pstrcpy(acct_desc , ""); + pstrcpy(workstations , ""); + + sam_logon_in_ssb = False; + } + else { - /* - * The line we have should be of the form :- - * - * username:uid:32hex bytes:[Account type]:LCT-12345678....other flags presently - * ignored.... - * - * or, - * - * username:uid:32hex bytes:32hex bytes:[Account type]:LCT-12345678....ignored.... - * - * if Windows NT compatible passwords are also present. - * [Account type] is an ascii encoding of the type of account. - * LCT-(8 hex digits) is the time_t value of the last change time. - */ - - /* - * As 256 is shorter than a pstring we don't need to check - * length here - if this ever changes.... - */ - p = strncpyn(unix_name, linebuf, sizeof(unix_name), ':'); - - if (p == NULL) - { - DEBUG(0,("getsmbfilepwent: no ':' separator found\n")); - continue; - } - - /* Go past ':' */ - p++; - - /* Get smb uid. */ - - p = Atoic( p, &uidval, ":"); - - pw_buf.unix_name = unix_name; - pw_buf.unix_uid = uidval; - - /* - * Now get the password value - this should be 32 hex digits - * which are the ascii representations of a 16 byte string. - * Get two at a time and put them into the password. - */ - - /* Skip the ':' */ - p++; - - if (linebuf_len < (PTR_DIFF(p, linebuf) + 33)) - { - DEBUG(0, ("getsmbfilepwent: malformed password entry (passwd too short)\n")); - continue; - } - - if (p[32] != ':') - { - DEBUG(0, ("getsmbfilepwent: malformed password entry (no terminating :)\n")); - continue; - } - - if (!strncasecmp( p, "NO PASSWORD", 11)) - { - pw_buf.smb_passwd = NULL; - pw_buf.acct_ctrl |= ACB_PWNOTREQ; - } - else - { - if (!pwdb_gethexpwd(p, (char *)smbpwd, NULL)) - { - DEBUG(0, ("getsmbfilepwent: Malformed Lanman password entry (non hex chars)\n")); - continue; - } - pw_buf.smb_passwd = smbpwd; - } - - /* - * Now check if the NT compatible password is - * available. - */ - pw_buf.smb_nt_passwd = NULL; - - /* Move to the first character of the line after the lanman password. */ - p += 33; - if ((linebuf_len >= (PTR_DIFF(p, linebuf) + 33)) && (p[32] == ':')) - { - if (*p != '*' && *p != 'X') - { - if(pwdb_gethexpwd(p,(char *)smbntpwd, NULL)) - { - pw_buf.smb_nt_passwd = smbntpwd; - } - } - /* Move to the first character of the line after the NT password. */ - p += 33; - } - - DEBUG(5,("getsmbfilepwent: returning passwd entry for unix user %s, unix uid %d\n", - unix_name, uidval)); - - if (*p == '[') - { - pw_buf.acct_ctrl = pwdb_decode_acct_ctrl((char*)p); - - /* Must have some account type set. */ - if (pw_buf.acct_ctrl == 0) - { - pw_buf.acct_ctrl = ACB_NORMAL; - } - - /* Now try and get the last change time. */ - while (*p != ']' && *p != ':') - { - p++; - } - if (*p == ']') - { - p++; - } - if (*p == ':') - { - p++; - pw_buf.pass_last_set_time = pwdb_get_last_set_time(p); - } - } - else - { - /* 'Old' style file. Fake up based on user name. */ - /* - * Currently trust accounts are kept in the same - * password file as 'normal accounts'. If this changes - * we will have to fix this code. JRA. - */ - if (pw_buf.unix_name[strlen(pw_buf.unix_name) - 1] == '$') - { - pw_buf.acct_ctrl &= ~ACB_NORMAL; - pw_buf.acct_ctrl |= ACB_WSTRUST; - } - } - - if (*p == '*' || *p == 'X') - { - /* Password deliberately invalid - end here. */ - DEBUG(10, ("getsmbfilepwent: entry invalidated for unix user %s\n", unix_name)); - pw_buf.smb_nt_passwd = NULL; - pw_buf.smb_passwd = NULL; - pw_buf.acct_ctrl |= ACB_DISABLED; - } - - DEBUG(6,("unixuser:%s uid:%d acb:%x\n", - pw_buf.unix_name, pw_buf.unix_uid, pw_buf.acct_ctrl)); - - return &pw_buf; + user.smb_userid = pw_buf->smb_userid; + user.smb_grpid = pwfile->pw_gid; + + user.user_rid = pdb_uid_to_user_rid (user.smb_userid); + user.group_rid = DOMAIN_GROUP_RID_USERS; /* lkclXXXX this is OBSERVED behaviour by NT PDCs, enforced here. */ + + pstrcpy(full_name , ""); + pstrcpy(logon_script , ""); + pstrcpy(profile_path , ""); + pstrcpy(home_drive , ""); + pstrcpy(home_dir , ""); + pstrcpy(acct_desc , ""); + pstrcpy(workstations , ""); } - DEBUG(5,("getsmbfilepwent: end of file reached.\n")); - return NULL; + user.smb_name = pw_buf->smb_name; + user.full_name = full_name; + user.home_dir = home_dir; + user.dir_drive = home_drive; + user.logon_script = logon_script; + user.profile_path = profile_path; + user.acct_desc = acct_desc; + user.workstations = workstations; + + user.unknown_str = NULL; /* don't know, yet! */ + user.munged_dial = NULL; /* "munged" dial-back telephone number */ + + user.smb_nt_passwd = pw_buf->smb_nt_passwd; + user.smb_passwd = pw_buf->smb_passwd; + + user.acct_ctrl = pw_buf->acct_ctrl; + + user.unknown_3 = 0xffffff; /* don't know */ + user.logon_divs = 168; /* hours per week */ + user.hours_len = 21; /* 21 times 8 bits = 168 */ + memset(user.hours, 0xff, user.hours_len); /* available at all hours */ + user.unknown_5 = 0x00020000; /* don't know */ + user.unknown_5 = 0x000004ec; /* don't know */ + + return &user; +} + +/************************************************************************* + Return the current position in the smbpasswd list as an SMB_BIG_UINT. + This must be treated as an opaque token. +*************************************************************************/ + +static SMB_BIG_UINT getsmbfilepwpos(void *vp) +{ + return (SMB_BIG_UINT)sys_ftell((FILE *)vp); +} + +/************************************************************************* + Set the current position in the smbpasswd list from an SMB_BIG_UINT. + This must be treated as an opaque token. +*************************************************************************/ + +static BOOL setsmbfilepwpos(void *vp, SMB_BIG_UINT tok) +{ + return !sys_fseek((FILE *)vp, (SMB_OFF_T)tok, SEEK_SET); } /************************************************************************ @@ -287,8 +463,8 @@ static BOOL add_smbfilepwd_entry(struct smb_passwd *newpwd) */ while ((pwd = getsmbfilepwent(fp)) != NULL) { - if (strequal(newpwd->unix_name, pwd->unix_name)) { - DEBUG(0, ("add_smbfilepwd_entry: entry with unix name %s already exists\n", pwd->unix_name)); + if (strequal(newpwd->smb_name, pwd->smb_name)) { + DEBUG(0, ("add_smbfilepwd_entry: entry with name %s already exists\n", pwd->smb_name)); endsmbfilepwent(fp); return False; } @@ -305,21 +481,21 @@ static BOOL add_smbfilepwd_entry(struct smb_passwd *newpwd) if((offpos = sys_lseek(fd, 0, SEEK_END)) == -1) { DEBUG(0, ("add_smbfilepwd_entry(sys_lseek): Failed to add entry for user %s to file %s. \ -Error was %s\n", newpwd->unix_name, pfile, strerror(errno))); +Error was %s\n", newpwd->smb_name, pfile, strerror(errno))); endsmbfilepwent(fp); return False; } - new_entry_length = strlen(newpwd->unix_name) + 1 + 15 + 1 + 32 + 1 + 32 + 1 + NEW_PW_FORMAT_SPACE_PADDED_LEN + 1 + 13 + 2; + new_entry_length = strlen(newpwd->smb_name) + 1 + 15 + 1 + 32 + 1 + 32 + 1 + NEW_PW_FORMAT_SPACE_PADDED_LEN + 1 + 13 + 2; if((new_entry = (char *)malloc( new_entry_length )) == NULL) { DEBUG(0, ("add_smbfilepwd_entry(malloc): Failed to add entry for user %s to file %s. \ -Error was %s\n", newpwd->unix_name, pfile, strerror(errno))); +Error was %s\n", newpwd->smb_name, pfile, strerror(errno))); endsmbfilepwent(fp); return False; } - slprintf(new_entry, new_entry_length - 1, "%s:%u:", newpwd->unix_name, (unsigned)newpwd->unix_uid); + slprintf(new_entry, new_entry_length - 1, "%s:%u:", newpwd->smb_name, (unsigned)newpwd->smb_userid); p = &new_entry[strlen(new_entry)]; if(newpwd->smb_passwd != NULL) { @@ -355,7 +531,7 @@ Error was %s\n", newpwd->unix_name, pfile, strerror(errno))); /* Add the account encoding and the last change time. */ slprintf((char *)p, new_entry_length - 1 - (p - new_entry), "%s:LCT-%08X:\n", - pwdb_encode_acct_ctrl(newpwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN), (uint32)time(NULL)); + pdb_encode_acct_ctrl(newpwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN), (uint32)time(NULL)); #ifdef DEBUG_PASSWORD DEBUG(100, ("add_smbfilepwd_entry(%d): new_entry_len %d entry_len %d made line |%s|", @@ -364,13 +540,13 @@ Error was %s\n", newpwd->unix_name, pfile, strerror(errno))); if ((wr_len = write(fd, new_entry, strlen(new_entry))) != strlen(new_entry)) { DEBUG(0, ("add_smbfilepwd_entry(write): %d Failed to add entry for user %s to file %s. \ -Error was %s\n", wr_len, newpwd->unix_name, pfile, strerror(errno))); +Error was %s\n", wr_len, newpwd->smb_name, pfile, strerror(errno))); /* Remove the entry we just wrote. */ if(sys_ftruncate(fd, offpos) == -1) { DEBUG(0, ("add_smbfilepwd_entry: ERROR failed to ftruncate file %s. \ Error was %s. Password file may be corrupt ! Please examine by hand !\n", - newpwd->unix_name, strerror(errno))); + newpwd->smb_name, strerror(errno))); } endsmbfilepwent(fp); @@ -395,7 +571,7 @@ Error was %s. Password file may be corrupt ! Please examine by hand !\n", static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) { /* Static buffers we will return. */ - static pstring unix_name; + static pstring user_name; char linebuf[256]; char readbuf[1024]; @@ -416,17 +592,6 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) int wr_len; int fd; -#ifdef DEBUG_PASSWORD - DEBUG(100,("mod_smbfilepwd_entry: password entries\n")); - if (pwd->smb_passwd != NULL) - { - dump_data(100, pwd->smb_passwd, 16); - } - if (pwd->smb_nt_passwd != NULL) - { - dump_data(100, pwd->smb_nt_passwd, 16); - } -#endif if (!*pfile) { DEBUG(0, ("No SMB password file set\n")); return False; @@ -444,7 +609,7 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) lockfd = fileno(fp); - if (!file_lock(lockfd, F_WRLCK, 5, &pw_file_lock_depth)) { + if (!pw_file_lock(lockfd, F_WRLCK, 5, &pw_file_lock_depth)) { DEBUG(0, ("mod_smbfilepwd_entry: unable to lock file %s\n", pfile)); fclose(fp); return False; @@ -464,7 +629,7 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) fgets(linebuf, sizeof(linebuf), fp); if (ferror(fp)) { - file_unlock(lockfd, &pw_file_lock_depth); + pw_file_unlock(lockfd, &pw_file_lock_depth); fclose(fp); return False; } @@ -524,16 +689,16 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) * As 256 is shorter than a pstring we don't need to check * length here - if this ever changes.... */ - strncpy(unix_name, linebuf, PTR_DIFF(p, linebuf)); - unix_name[PTR_DIFF(p, linebuf)] = '\0'; - if (strequal(unix_name, pwd->unix_name)) { + strncpy(user_name, linebuf, PTR_DIFF(p, linebuf)); + user_name[PTR_DIFF(p, linebuf)] = '\0'; + if (strequal(user_name, pwd->smb_name)) { found_entry = True; break; } } if (!found_entry) { - file_unlock(lockfd, &pw_file_lock_depth); + pw_file_unlock(lockfd, &pw_file_lock_depth); fclose(fp); return False; } @@ -545,7 +710,7 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) if (!isdigit(*p)) { DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry (uid not number)\n")); - file_unlock(lockfd, &pw_file_lock_depth); + pw_file_unlock(lockfd, &pw_file_lock_depth); fclose(fp); return False; } @@ -554,7 +719,7 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) p++; if (*p != ':') { DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry (no : after uid)\n")); - file_unlock(lockfd, &pw_file_lock_depth); + pw_file_unlock(lockfd, &pw_file_lock_depth); fclose(fp); return False; } @@ -571,28 +736,28 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) if (!override && (*p == '*' || *p == 'X')) { /* Password deliberately invalid - end here. */ - DEBUG(10, ("mod_smbfilepwd_entry: entry invalidated for unix user %s\n", unix_name)); - file_unlock(lockfd, &pw_file_lock_depth); + DEBUG(10, ("mod_smbfilepwd_entry: entry invalidated for user %s\n", user_name)); + pw_file_unlock(lockfd, &pw_file_lock_depth); fclose(fp); return False; } if (linebuf_len < (PTR_DIFF(p, linebuf) + 33)) { DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry (passwd too short)\n")); - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return (False); } if (p[32] != ':') { DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry (no terminating :)\n")); - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return False; } if (!override && (*p == '*' || *p == 'X')) { - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return False; } @@ -603,14 +768,14 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) the lanman password. */ if (linebuf_len < (PTR_DIFF(p, linebuf) + 33)) { DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry (passwd too short)\n")); - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return (False); } if (p[32] != ':') { DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry (no terminating :)\n")); - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return False; } @@ -648,7 +813,7 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) * acct ctrl field. Encode the given acct ctrl * bits into it. */ - fstrcpy(encode_bits, pwdb_encode_acct_ctrl(pwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN)); + fstrcpy(encode_bits, pdb_encode_acct_ctrl(pwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN)); } else { /* * If using the old format and the ACB_DISABLED or @@ -738,7 +903,7 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) if(wr_len > sizeof(linebuf)) { DEBUG(0, ("mod_smbfilepwd_entry: line to write (%d) is too long.\n", wr_len+1)); - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return (False); } @@ -756,7 +921,7 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) if (sys_lseek(fd, pwd_seekpos - 1, SEEK_SET) != pwd_seekpos - 1) { DEBUG(0, ("mod_smbfilepwd_entry: seek fail on file %s.\n", pfile)); - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return False; } @@ -764,50 +929,89 @@ static BOOL mod_smbfilepwd_entry(struct smb_passwd* pwd, BOOL override) /* Sanity check - ensure the areas we are writing are framed by ':' */ if (read(fd, linebuf, wr_len+1) != wr_len+1) { DEBUG(0, ("mod_smbfilepwd_entry: read fail on file %s.\n", pfile)); - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return False; } if ((linebuf[0] != ':') || (linebuf[wr_len] != ':')) { DEBUG(0, ("mod_smbfilepwd_entry: check on passwd file %s failed.\n", pfile)); - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return False; } if (sys_lseek(fd, pwd_seekpos, SEEK_SET) != pwd_seekpos) { DEBUG(0, ("mod_smbfilepwd_entry: seek fail on file %s.\n", pfile)); - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return False; } if (write(fd, ascii_p16, wr_len) != wr_len) { DEBUG(0, ("mod_smbfilepwd_entry: write failed in passwd file %s\n", pfile)); - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return False; } - file_unlock(lockfd,&pw_file_lock_depth); + pw_file_unlock(lockfd,&pw_file_lock_depth); fclose(fp); return True; } -static struct smb_passdb_ops file_ops = { +/* + * Stub functions - implemented in terms of others. + */ + +static BOOL mod_smbfile21pwd_entry(struct sam_passwd* pwd, BOOL override) +{ + return mod_smbfilepwd_entry(pdb_sam_to_smb(pwd), override); +} + +static BOOL add_smbfile21pwd_entry(struct sam_passwd *newpwd) +{ + return add_smbfilepwd_entry(pdb_sam_to_smb(newpwd)); +} + +static struct sam_disp_info *getsmbfiledispnam(char *name) +{ + return pdb_sam_to_dispinfo(getsam21pwnam(name)); +} + +static struct sam_disp_info *getsmbfiledisprid(uint32 rid) +{ + return pdb_sam_to_dispinfo(getsam21pwrid(rid)); +} + +static struct sam_disp_info *getsmbfiledispent(void *vp) +{ + return pdb_sam_to_dispinfo(getsam21pwent(vp)); +} + +static struct passdb_ops file_ops = { startsmbfilepwent, endsmbfilepwent, getsmbfilepwpos, setsmbfilepwpos, iterate_getsmbpwnam, /* In passdb.c */ iterate_getsmbpwuid, /* In passdb.c */ + iterate_getsmbpwrid, /* In passdb.c */ getsmbfilepwent, add_smbfilepwd_entry, - mod_smbfilepwd_entry + mod_smbfilepwd_entry, + getsmbfile21pwent, + iterate_getsam21pwnam, + iterate_getsam21pwuid, + iterate_getsam21pwrid, + add_smbfile21pwd_entry, + mod_smbfile21pwd_entry, + getsmbfiledispnam, + getsmbfiledisprid, + getsmbfiledispent }; -struct smb_passdb_ops *file_initialise_password_db(void) +struct passdb_ops *file_initialize_password_db(void) { return &file_ops; } diff --git a/source3/passdb/smbpasschange.c b/source3/passdb/smbpasschange.c index a0d9b1b143..9d0aecf8b8 100644 --- a/source3/passdb/smbpasschange.c +++ b/source3/passdb/smbpasschange.c @@ -25,23 +25,24 @@ /************************************************************* add a new user to the local smbpasswd file *************************************************************/ -static BOOL add_new_user(char *user_name, uid_t uid, - uint16 acb_info, - uchar *new_p16, uchar *new_nt_p16) +static BOOL add_new_user(char *user_name, uid_t uid, BOOL trust_account, + BOOL disable_user, BOOL set_no_password, + uchar *new_p16, uchar *new_nt_p16) { struct smb_passwd new_smb_pwent; - pwdb_init_smb(&new_smb_pwent); - /* Create a new smb passwd entry and set it to the given password. */ - new_smb_pwent.unix_uid = uid; - new_smb_pwent.nt_name = user_name; + new_smb_pwent.smb_userid = uid; + new_smb_pwent.smb_name = user_name; new_smb_pwent.smb_passwd = NULL; new_smb_pwent.smb_nt_passwd = NULL; - new_smb_pwent.acct_ctrl = acb_info; + new_smb_pwent.acct_ctrl = (trust_account ? ACB_WSTRUST : ACB_NORMAL); - if (IS_BITS_CLR_ALL(acb_info, ACB_DISABLED | ACB_PWNOTREQ)) - { + if(disable_user) { + new_smb_pwent.acct_ctrl |= ACB_DISABLED; + } else if (set_no_password) { + new_smb_pwent.acct_ctrl |= ACB_PWNOTREQ; + } else { new_smb_pwent.smb_passwd = new_p16; new_smb_pwent.smb_nt_passwd = new_nt_p16; } @@ -51,93 +52,83 @@ static BOOL add_new_user(char *user_name, uid_t uid, /************************************************************* -change a password entry in the local smbpasswd file. - -when modifying an account, set acb_mask to those bits that -require changing (to zero or one) and set acb_info to the -value required in those bits. all bits NOT set in acb_mask -will NOT be modified. - -when _adding_ an account, acb_mask must be set to 0xFFFF and -it is ignored, btw :-) - +change a password entry in the local smbpasswd file *************************************************************/ -BOOL local_password_change(char *user_name, - BOOL add_user, - uint16 acb_info, uint16 acb_mask, - char *new_passwd, - char *err_str, size_t err_str_len, - char *msg_str, size_t msg_str_len) + +BOOL local_password_change(char *user_name, BOOL trust_account, BOOL add_user, + BOOL enable_user, BOOL disable_user, BOOL set_no_password, + char *new_passwd, + char *err_str, size_t err_str_len, + char *msg_str, size_t msg_str_len) { - const struct passwd *pwd; + struct passwd *pwd; + void *vp; struct smb_passwd *smb_pwent; - static struct smb_passwd new_pwent; - static uchar new_p16[16]; - static uchar new_nt_p16[16]; - fstring unix_name; - uid_t unix_uid; + uchar new_p16[16]; + uchar new_nt_p16[16]; *err_str = '\0'; *msg_str = '\0'; - pwd = Get_Pwnam(user_name, False); + pwd = sys_getpwnam(user_name); /* - * Check for a trust account. + * Check for a local account. */ - if ((acb_info & acb_mask) != acb_info) - { - slprintf(err_str, err_str_len - 1, "programmer error: acb_info (%x) requests bits to be set outside of acb_mask (%x) range\n", acb_info, acb_mask); - } - - if (pwd == NULL) - { - if (!IS_BITS_SET_ALL(acb_info, ACB_NORMAL)) - { - slprintf(err_str, err_str_len - 1, "User %s does not \ -exist in system password file (usually /etc/passwd). \ -Cannot add trust account without a valid system user.\n", user_name); - } - else - { - slprintf(err_str, err_str_len - 1, "User %s does not \ -exist in system password file (usually /etc/passwd).\n", user_name); - } + if(!pwd) { + slprintf(err_str, err_str_len - 1, "User %s does not \ +exist in system password file (usually /etc/passwd). Cannot add \ +account without a valid local system user.\n", user_name); return False; } - unix_uid = pwd->pw_uid; - fstrcpy(unix_name, pwd->pw_name); - /* Calculate the MD4 hash (NT compatible) of the new password. */ nt_lm_owf_gen(new_passwd, new_nt_p16, new_p16); + /* + * Open the smbpaswd file. + */ + vp = startsmbpwent(True); + if (!vp && errno == ENOENT) { + FILE *fp; + slprintf(msg_str,msg_str_len-1, + "smbpasswd file did not exist - attempting to create it.\n"); + fp = sys_fopen(lp_smb_passwd_file(), "w"); + if (fp) { + fprintf(fp, "# Samba SMB password file\n"); + fclose(fp); + vp = startsmbpwent(True); + } + } + + if (!vp) { + slprintf(err_str, err_str_len-1, "Cannot open file %s. Error was %s\n", + lp_smb_passwd_file(), strerror(errno) ); + return False; + } + /* Get the smb passwd entry for this user */ smb_pwent = getsmbpwnam(user_name); - if (smb_pwent == NULL) - { - if (!add_user) - { + if (smb_pwent == NULL) { + if(add_user == False) { slprintf(err_str, err_str_len-1, - "Failed to find entry for user %s.\n", unix_name); + "Failed to find entry for user %s.\n", pwd->pw_name); + endsmbpwent(vp); return False; } - if (add_new_user(user_name, unix_uid, acb_info, - new_p16, new_nt_p16)) - { + if (add_new_user(user_name, pwd->pw_uid, trust_account, disable_user, + set_no_password, new_p16, new_nt_p16)) { slprintf(msg_str, msg_str_len-1, "Added user %s.\n", user_name); + endsmbpwent(vp); return True; - } - else - { + } else { slprintf(err_str, err_str_len-1, "Failed to add entry for user %s.\n", user_name); + endsmbpwent(vp); return False; } - } - else - { + } else { /* the entry already existed */ add_user = False; } @@ -147,25 +138,44 @@ exist in system password file (usually /etc/passwd).\n", user_name); * and the valid last change time. */ - memcpy(&new_pwent, smb_pwent, sizeof(new_pwent)); - new_pwent.nt_name = user_name; - new_pwent.acct_ctrl &= ~acb_mask; - new_pwent.acct_ctrl |= (acb_info & acb_mask); - new_pwent.smb_passwd = NULL; - new_pwent.smb_nt_passwd = NULL; - - if (IS_BITS_CLR_ALL(acb_info, ACB_DISABLED | ACB_PWNOTREQ)) - { - new_pwent.smb_passwd = new_p16; - new_pwent.smb_nt_passwd = new_nt_p16; + if(disable_user) { + smb_pwent->acct_ctrl |= ACB_DISABLED; + } else if (enable_user) { + if(smb_pwent->smb_passwd == NULL) { + smb_pwent->smb_passwd = new_p16; + smb_pwent->smb_nt_passwd = new_nt_p16; + } + smb_pwent->acct_ctrl &= ~ACB_DISABLED; + } else if (set_no_password) { + smb_pwent->acct_ctrl |= ACB_PWNOTREQ; + /* This is needed to preserve ACB_PWNOTREQ in mod_smbfilepwd_entry */ + smb_pwent->smb_passwd = NULL; + smb_pwent->smb_nt_passwd = NULL; + } else { + /* + * If we're dealing with setting a completely empty user account + * ie. One with a password of 'XXXX', but not set disabled (like + * an account created from scratch) then if the old password was + * 'XX's then getsmbpwent will have set the ACB_DISABLED flag. + * We remove that as we're giving this user their first password + * and the decision hasn't really been made to disable them (ie. + * don't create them disabled). JRA. + */ + if((smb_pwent->smb_passwd == NULL) && (smb_pwent->acct_ctrl & ACB_DISABLED)) + smb_pwent->acct_ctrl &= ~ACB_DISABLED; + smb_pwent->acct_ctrl &= ~ACB_PWNOTREQ; + smb_pwent->smb_passwd = new_p16; + smb_pwent->smb_nt_passwd = new_nt_p16; } - if (!mod_smbpwd_entry(&new_pwent, True)) - { + if(mod_smbpwd_entry(smb_pwent,True) == False) { slprintf(err_str, err_str_len-1, "Failed to modify entry for user %s.\n", - unix_name); + pwd->pw_name); + endsmbpwent(vp); return False; } + endsmbpwent(vp); + return True; } diff --git a/source3/passdb/smbpassfile.c b/source3/passdb/smbpassfile.c index 7a73bf5932..bbe24131b8 100644 --- a/source3/passdb/smbpassfile.c +++ b/source3/passdb/smbpassfile.c @@ -22,8 +22,51 @@ extern int DEBUGLEVEL; BOOL global_machine_password_needs_changing = False; -static int mach_passwd_lock_depth = 0; -static FILE *mach_passwd_fp = NULL; + +/*************************************************************** + Lock an fd. Abandon after waitsecs seconds. +****************************************************************/ + +BOOL pw_file_lock(int fd, int type, int secs, int *plock_depth) +{ + if (fd < 0) + return False; + + if(*plock_depth == 0) { + if (!do_file_lock(fd, secs, type)) { + DEBUG(10,("pw_file_lock: locking file failed, error = %s.\n", + strerror(errno))); + return False; + } + } + + (*plock_depth)++; + + return True; +} + +/*************************************************************** + Unlock an fd. Abandon after waitsecs seconds. +****************************************************************/ + +BOOL pw_file_unlock(int fd, int *plock_depth) +{ + BOOL ret=True; + + if(*plock_depth == 1) + ret = do_file_lock(fd, 5, F_UNLCK); + + if (*plock_depth > 0) + (*plock_depth)--; + + if(!ret) + DEBUG(10,("pw_file_unlock: unlocking file failed, error = %s.\n", + strerror(errno))); + return ret; +} + +static int mach_passwd_lock_depth; +static FILE *mach_passwd_fp; /************************************************************************ Routine to get the name for a trust account file. @@ -43,7 +86,7 @@ static void get_trust_account_file_name( char *domain, char *name, char *mac_fil if ((int)(sizeof(pstring) - mac_file_len - strlen(domain) - strlen(name) - 6) < 0) { - DEBUG(0,("get_trust_account_file_name: path %s too long to add trust details.\n", + DEBUG(0,("trust_password_lock: path %s too long to add trust details.\n", mac_file)); return; } @@ -52,8 +95,6 @@ static void get_trust_account_file_name( char *domain, char *name, char *mac_fil pstrcat(mac_file, "."); pstrcat(mac_file, name); pstrcat(mac_file, ".mac"); - - DEBUG(5,("trust_account_file_name: %s\n", mac_file)); } /************************************************************************ @@ -82,7 +123,7 @@ BOOL trust_password_lock( char *domain, char *name, BOOL update) chmod(mac_file, 0600); - if(!file_lock(fileno(mach_passwd_fp), (update ? F_WRLCK : F_RDLCK), + if(!pw_file_lock(fileno(mach_passwd_fp), (update ? F_WRLCK : F_RDLCK), 60, &mach_passwd_lock_depth)) { DEBUG(0,("trust_password_lock: cannot lock file %s\n", mac_file)); @@ -101,7 +142,7 @@ BOOL trust_password_lock( char *domain, char *name, BOOL update) BOOL trust_password_unlock(void) { - BOOL ret = file_unlock(fileno(mach_passwd_fp), &mach_passwd_lock_depth); + BOOL ret = pw_file_unlock(fileno(mach_passwd_fp), &mach_passwd_lock_depth); if(mach_passwd_lock_depth == 0) fclose(mach_passwd_fp); return ret; @@ -158,7 +199,7 @@ BOOL get_trust_account_password( unsigned char *ret_pwd, time_t *pass_last_set_t if(strlen(linebuf) != 45) { DEBUG(0,("get_trust_account_password: Malformed trust password file (wrong length \ -- was %d, should be 45).\n", strlen(linebuf))); +- was %d, should be 45).\n", (int)strlen(linebuf))); #ifdef DEBUG_PASSWORD DEBUG(100,("get_trust_account_password: line = |%s|\n", linebuf)); #endif @@ -169,7 +210,7 @@ BOOL get_trust_account_password( unsigned char *ret_pwd, time_t *pass_last_set_t * Get the hex password. */ - if (!pwdb_gethexpwd((char *)linebuf, (char *)ret_pwd, NULL) || linebuf[32] != ':' || + if (!pdb_gethexpwd((char *)linebuf, ret_pwd) || linebuf[32] != ':' || strncmp(&linebuf[33], "TLC-", 4)) { DEBUG(0,("get_trust_account_password: Malformed trust password file (incorrect format).\n")); #ifdef DEBUG_PASSWORD @@ -240,17 +281,17 @@ BOOL trust_get_passwd( unsigned char trust_passwd[16], char *domain, char *mynam time_t lct; /* - * Get the trust account password. + * Get the machine account password. */ if(!trust_password_lock( domain, myname, False)) { - DEBUG(0,("trust_get_passwd: unable to open the trust account password file for \ -trust %s in domain %s.\n", myname, domain )); + DEBUG(0,("domain_client_validate: unable to open the machine account password file for \ +machine %s in domain %s.\n", myname, domain )); return False; } if(get_trust_account_password( trust_passwd, &lct) == False) { - DEBUG(0,("trust_get_passwd: unable to read the trust account password for \ -trust %s in domain %s.\n", myname, domain )); + DEBUG(0,("domain_client_validate: unable to read the machine account password for \ +machine %s in domain %s.\n", myname, domain )); trust_password_unlock(); return False; } @@ -258,7 +299,7 @@ trust %s in domain %s.\n", myname, domain )); trust_password_unlock(); /* - * Here we check the last change time to see if the trust + * Here we check the last change time to see if the machine * password needs changing. JRA. */ @@ -268,36 +309,3 @@ trust %s in domain %s.\n", myname, domain )); } return True; } - -/********************************************************* -record Trust Account password. -**********************************************************/ -BOOL create_trust_account_file(char *domain, char *name, uchar pass[16]) -{ - /* - * Create the machine account password file. - */ - - if (!trust_password_lock( domain, name, True)) - { - DEBUG(0,("unable to open the trust account password file for \ -account %s in domain %s.\n", name, domain)); - return False; - } - - /* - * Write the old machine account password. - */ - - if (!set_trust_account_password( pass)) - { - DEBUG(0,("unable to write the trust account password for \ -%s in domain %s.\n", name, domain)); - trust_password_unlock(); - return False; - } - - trust_password_unlock(); - - return True; -} diff --git a/source3/passdb/smbpassgroup.c b/source3/passdb/smbpassgroup.c index 8991cad978..4636c08c94 100644 --- a/source3/passdb/smbpassgroup.c +++ b/source3/passdb/smbpassgroup.c @@ -19,7 +19,7 @@ #include "includes.h" -#ifdef USE_SMBGROUP_DB +#ifdef USE_SMBPASS_DB static int grp_file_lock_depth = 0; extern int DEBUGLEVEL; @@ -32,7 +32,7 @@ extern int DEBUGLEVEL; static void *startsmbfilegrpent(BOOL update) { static char s_readbuf[1024]; - return startfileent(lp_smb_passgrp_file(), s_readbuf, sizeof(s_readbuf), + return startfilepwent(lp_smb_passgrp_file(), s_readbuf, sizeof(s_readbuf), &grp_file_lock_depth, update); } @@ -42,7 +42,7 @@ static void *startsmbfilegrpent(BOOL update) static void endsmbfilegrpent(void *vp) { - endfileent(vp, &grp_file_lock_depth); + endfilepwent(vp, &grp_file_lock_depth); } /************************************************************************* @@ -77,8 +77,9 @@ static struct smb_passwd *getsmbfilegrpent(void *vp, static pstring user_name; struct passwd *pwfile; pstring linebuf; - char *p; + unsigned char *p; int uidval; + size_t linebuf_len; if (vp == NULL) { @@ -91,12 +92,12 @@ static struct smb_passwd *getsmbfilegrpent(void *vp, /* * Scan the file, a line at a time. */ - while (getfileline(vp, linebuf, sizeof(linebuf)) > 0) + while ((linebuf_len = getfileline(vp, linebuf, sizeof(linebuf))) > 0) { /* * The line we have should be of the form :- * - * username:uid:aliasrid1,aliasrid2..:domainrid1,domainrid2..: + * username:uid:domainrid1,domainrid2..:aliasrid1,aliasrid2..: */ /* @@ -105,12 +106,6 @@ static struct smb_passwd *getsmbfilegrpent(void *vp, */ p = strncpyn(user_name, linebuf, sizeof(user_name), ':'); - if (p == NULL) - { - DEBUG(0,("getsmbfilegrpent: no ':' separator found\n")); - continue; - } - /* Go past ':' */ p++; @@ -119,42 +114,48 @@ static struct smb_passwd *getsmbfilegrpent(void *vp, p = Atoic((char *) p, &uidval, ":"); pw_buf.smb_name = user_name; - pw_buf.unix_uid = uidval; + pw_buf.smb_userid = uidval; /* - * Now get a list of alias RIDs + * Now get the password value - this should be 32 hex digits + * which are the ascii representations of a 16 byte string. + * Get two at a time and put them into the password. */ /* Skip the ':' */ p++; - if (als_rids != NULL && num_alss != NULL) + if (grp_rids != NULL && num_grps != NULL) { int i; - p = get_numlist(p, als_rids, num_alss); + p = get_numlist(p, grp_rids, num_grps); if (p == NULL) { DEBUG(0,("getsmbfilegrpent: invalid line\n")); return NULL; } + for (i = 0; i < (*num_grps); i++) + { + (*grp_rids)[i] = pwdb_gid_to_group_rid((*grp_rids)[i]); + } } - /* - * Now get a list of group RIDs - */ - /* Skip the ':' */ p++; - if (grp_rids != NULL && num_grps != NULL) + if (als_rids != NULL && num_alss != NULL) { int i; - p = get_numlist(p, grp_rids, num_grps); + p = get_numlist(p, als_rids, num_alss); if (p == NULL) { DEBUG(0,("getsmbfilegrpent: invalid line\n")); return NULL; } + for (i = 0; i < (*num_alss); i++) + { + (*als_rids)[i] = pwdb_gid_to_alias_rid((*als_rids)[i]); + } } pwfile = Get_Pwnam(pw_buf.smb_name, False); @@ -191,5 +192,5 @@ struct passgrp_ops *file_initialise_password_grp(void) #else /* Do *NOT* make this function static. It breaks the compile on gcc. JRA */ - void smbpassgroup_dummy_function(void) { } /* stop some compilers complaining */ + void smbpass_dummy_function(void) { } /* stop some compilers complaining */ #endif /* USE_SMBPASS_DB */ |