diff options
Diffstat (limited to 'source3/smbd')
| -rw-r--r-- | source3/smbd/password.c | 39 | ||||
| -rw-r--r-- | source3/smbd/reply.c | 12 | ||||
| -rw-r--r-- | source3/smbd/server.c | 4 |
3 files changed, 51 insertions, 4 deletions
diff --git a/source3/smbd/password.c b/source3/smbd/password.c index b69b58f54e..c347f2de0d 100644 --- a/source3/smbd/password.c +++ b/source3/smbd/password.c @@ -1755,12 +1755,48 @@ BOOL server_validate(char *user, char *domain, char *ntpass, int ntpasslen) { extern fstring local_machine; + static unsigned char badpass[24]; if (!cli.initialised) { DEBUG(1,("password server %s is not connected\n", cli.desthost)); return(False); } + if(badpass[0] == 0) { + memset(badpass, 0x1f, sizeof(badpass)); + } + + if((passlen == sizeof(badpass)) && !memcmp(badpass, pass, passlen)) { + /* Very unlikely, our random bad password is the same as the users + password. */ + memset(badpass, badpass[0]+1, sizeof(badpass)); + } + + /* + * Attempt a session setup with a totally incorrect password. + * If this succeeds with the guest bit *NOT* set then the password + * server is broken and is not correctly setting the guest bit. We + * need to detect this as some versions of NT4.x are broken. JRA. + */ + + if (cli_session_setup(&cli, user, badpass, sizeof(badpass), badpass, sizeof(badpass), + domain)) { + if ((SVAL(cli.inbuf,smb_vwv2) & 1) == 0) { + DEBUG(0,("server_validate: password server %s allows users as non-guest \ +with a bad password.\n", cli.desthost)); + DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \ +use this machine as the password server.\n")); + cli_ulogoff(&cli); + return False; + } + cli_ulogoff(&cli); + } + + /* + * Now we know the password server will correctly set the guest bit, or is + * not guest enabled, we can try with the real password. + */ + if (!cli_session_setup(&cli, user, pass, passlen, ntpass, ntpasslen, domain)) { DEBUG(1,("password server %s rejected the password\n", cli.desthost)); return False; @@ -1773,7 +1809,6 @@ BOOL server_validate(char *user, char *domain, return(False); } - if (!cli_send_tconX(&cli, "IPC$", "IPC", "", 1)) { DEBUG(1,("password server %s refused IPC$ connect\n", cli.desthost)); cli_ulogoff(&cli); @@ -1825,5 +1860,3 @@ BOOL server_validate(char *user, char *domain, return(True); } - - diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c index 2c4800b1c2..2f3b3660fc 100644 --- a/source3/smbd/reply.c +++ b/source3/smbd/reply.c @@ -515,7 +515,11 @@ int reply_sesssetup_and_X(char *inbuf,char *outbuf,int length,int bufsize) passlen1 = MIN(passlen1, MAX_PASS_LEN); passlen2 = MIN(passlen2, MAX_PASS_LEN); - if(doencrypt || (lp_security() == SEC_SERVER)) { +#ifdef DOMAIN_CLIENT + if(doencrypt || ((lp_security() == SEC_SERVER) || (lp_security() == SEC_DOMAIN))) { +#else /* DOMAIN_CLIENT */ + if(doencrypt || lp_security() == SEC_SERVER) { +#endif /* DOMAIN_CLIENT */ /* Save the lanman2 password and the NT md4 password. */ smb_apasslen = passlen1; memcpy(smb_apasswd,p,smb_apasslen); @@ -603,6 +607,12 @@ int reply_sesssetup_and_X(char *inbuf,char *outbuf,int length,int bufsize) server_validate(user, domain, smb_apasswd, smb_apasslen, smb_ntpasswd, smb_ntpasslen)) && +#ifdef DOMAIN_CLIENT + !(lp_security() == SEC_DOMAIN && + domain_client_validate(user, domain, + smb_apasswd, smb_apasslen, + smb_ntpasswd, smb_ntpasslen)) && +#endif /* DOMAIN_CLIENT */ !check_hosts_equiv(user)) { diff --git a/source3/smbd/server.c b/source3/smbd/server.c index 4a3edeb871..81fe5c9306 100644 --- a/source3/smbd/server.c +++ b/source3/smbd/server.c @@ -4133,7 +4133,11 @@ static int reply_negprot(char *inbuf,char *outbuf, int dum_size, int dum_buffsiz /* a special case to stop password server loops */ if (Index == 1 && strequal(remote_machine,myhostname) && +#ifdef DOMAIN_CLIENT + (lp_security()==SEC_SERVER || lp_security()==SEC_DOMAIN)) +#else /* DOMAIN_CLIENT */ lp_security()==SEC_SERVER) +#endif /* DOMAIN_CLIENT */ exit_server("Password server loop!"); /* Check for protocols, most desirable first */ |