diff options
Diffstat (limited to 'source3')
| -rw-r--r-- | source3/auth/auth_sam.c | 184 | ||||
| -rw-r--r-- | source3/smbd/auth_smbpasswd.c | 184 |
2 files changed, 222 insertions, 146 deletions
diff --git a/source3/auth/auth_sam.c b/source3/auth/auth_sam.c index cb8d711770..7a21c3111b 100644 --- a/source3/auth/auth_sam.c +++ b/source3/auth/auth_sam.c @@ -31,7 +31,7 @@ core of smb password checking routine. static BOOL smb_pwd_check_ntlmv1(const uchar *password, const uchar *part_passwd, const uchar *c8, - uchar user_sess_key[16]) + char user_sess_key[16]) { /* Finish the encryption of part_passwd. */ uchar p24[24]; @@ -45,7 +45,7 @@ static BOOL smb_pwd_check_ntlmv1(const uchar *password, SMBOWFencrypt(part_passwd, c8, p24); if (user_sess_key != NULL) { - SMBsesskeygen_ntv1(part_passwd, NULL, (char *)user_sess_key); + SMBsesskeygen_ntv1(part_passwd, NULL, user_sess_key); } @@ -70,7 +70,7 @@ static BOOL smb_pwd_check_ntlmv2(const uchar *password, size_t pwd_len, uchar *part_passwd, uchar const *c8, const char *user, const char *domain, - char *user_sess_key) + char user_sess_key[16]) { /* Finish the encryption of part_passwd. */ uchar kr[16]; @@ -109,17 +109,104 @@ static BOOL smb_pwd_check_ntlmv2(const uchar *password, size_t pwd_len, Do a specific test for an smb password being correct, given a smb_password and the lanman and NT responses. ****************************************************************************/ -NTSTATUS smb_password_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info) +NTSTATUS sam_password_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *user_info, char user_sess_key[16]) { uint8 *nt_pw, *lm_pw; uint16 acct_ctrl = pdb_get_acct_ctrl(sampass); + + if (!user_info || !sampass) + return NT_STATUS_LOGON_FAILURE; + + if (acct_ctrl & ACB_PWNOTREQ) + { + if (lp_null_passwords()) + { + DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", sampass->username)); + return(NT_STATUS_OK); + } + else + { + DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", sampass->username)); + return(NT_STATUS_LOGON_FAILURE); + } + } else { + nt_pw = pdb_get_nt_passwd(sampass); + lm_pw = pdb_get_lanman_passwd(sampass); + + if (nt_pw != NULL && user_info->nt_resp.len > 0) { + if ((user_info->nt_resp.len > 24 )) { + /* We have the NT MD4 hash challenge available - see if we can + use it (ie. does it exist in the smbpasswd file). + */ + DEBUG(4,("smb_password_ok: Checking NTLMv2 password\n")); + if (smb_pwd_check_ntlmv2( user_info->nt_resp.buffer, + user_info->nt_resp.len, + nt_pw, + user_info->chal, user_info->smb_username.str, + user_info->requested_domain.str, + user_sess_key)) + { + return NT_STATUS_OK; + } else { + DEBUG(4,("smb_password_ok: NTLMv2 password check failed\n")); + return NT_STATUS_WRONG_PASSWORD; + } + + } else if (lp_ntlm_auth() && (user_info->nt_resp.len == 24)) { + /* We have the NT MD4 hash challenge available - see if we can + use it (ie. does it exist in the smbpasswd file). + */ + DEBUG(4,("smb_password_ok: Checking NT MD4 password\n")); + if (smb_pwd_check_ntlmv1(user_info->nt_resp.buffer, + nt_pw, user_info->chal, + user_sess_key)) + { + return NT_STATUS_OK; + } else { + DEBUG(4,("smb_password_ok: NT MD4 password check failed\n")); + return NT_STATUS_WRONG_PASSWORD; + } + } else { + return NT_STATUS_LOGON_FAILURE; + } + } else if (lm_pw != NULL && user_info->lm_resp.len == 24) { + if (lp_lanman_auth()) { + DEBUG(4,("smb_password_ok: Checking LM password\n")); + if (smb_pwd_check_ntlmv1(user_info->lm_resp.buffer, + lm_pw, user_info->chal, + user_sess_key)) + { + return NT_STATUS_OK; + } else { + DEBUG(4,("smb_password_ok: LM password check failed\n")); + return NT_STATUS_WRONG_PASSWORD; + } + } + } + } + /* Should not be reached */ + return NT_STATUS_LOGON_FAILURE; +} + +/**************************************************************************** + Do a specific test for a SAM_ACCOUNT being vaild for this connection + (ie not disabled, expired and the like). +****************************************************************************/ +NTSTATUS sam_account_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *user_info) +{ + uint16 acct_ctrl = pdb_get_acct_ctrl(sampass); char *workstation_list; time_t kickoff_time; + if (!user_info || !sampass) + return NT_STATUS_LOGON_FAILURE; + + DEBUG(4,("smb_password_ok: Checking SMB password for user %s\n",sampass->username)); + /* Quit if the account was disabled. */ if(acct_ctrl & ACB_DISABLED) { DEBUG(1,("Account for user '%s' was disabled.\n", sampass->username)); - return(NT_STATUS_ACCOUNT_DISABLED); + return NT_STATUS_ACCOUNT_DISABLED; } /* Test account expire time */ @@ -127,6 +214,8 @@ NTSTATUS smb_password_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *use kickoff_time = pdb_get_kickoff_time(sampass); if (kickoff_time != (time_t)-1) { if (time(NULL) > kickoff_time) { + DEBUG(1,("Account for user '%s' has expried.\n", sampass->username)); + DEBUG(3,("Account expired at '%d' unix time.\n", kickoff_time)); return NT_STATUS_ACCOUNT_EXPIRED; } } @@ -161,77 +250,21 @@ NTSTATUS smb_password_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *use return NT_STATUS_NO_MEMORY; } - if (acct_ctrl & ACB_PWNOTREQ) { - if (lp_null_passwords()) - { - DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", sampass->username)); - return(NT_STATUS_OK); - } - else - { - DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", sampass->username)); - return(NT_STATUS_LOGON_FAILURE); - } - } - - if (!user_info || !sampass) - return(NT_STATUS_LOGON_FAILURE); - - DEBUG(4,("smb_password_ok: Checking SMB password for user %s\n",sampass->username)); - - nt_pw = pdb_get_nt_passwd(sampass); - - if (nt_pw != NULL) { - if ((user_info->nt_resp.len > 24 )) { - /* We have the NT MD4 hash challenge available - see if we can - use it (ie. does it exist in the smbpasswd file). - */ - DEBUG(4,("smb_password_ok: Checking NTLMv2 password\n")); - if (smb_pwd_check_ntlmv2( user_info->nt_resp.buffer, - user_info->nt_resp.len, - nt_pw, - user_info->chal, user_info->smb_username.str, - user_info->requested_domain.str, - (char *)server_info->session_key)) - { - return NT_STATUS_OK; - } - DEBUG(4,("smb_password_ok: NTLMv2 password check failed\n")); - - } else if (lp_ntlm_auth() && (user_info->nt_resp.len == 24 )) { - /* We have the NT MD4 hash challenge available - see if we can - use it (ie. does it exist in the smbpasswd file). - */ - DEBUG(4,("smb_password_ok: Checking NT MD4 password\n")); - if (smb_pwd_check_ntlmv1(user_info->nt_resp.buffer, - nt_pw, user_info->chal, - server_info->session_key)) { - DEBUG(4,("smb_password_ok: NT MD4 password check succeeded\n")); - return NT_STATUS_OK; - } else { - DEBUG(4,("smb_password_ok: NT MD4 password check failed\n")); - return NT_STATUS_WRONG_PASSWORD; - } + time_t must_change_time = pdb_get_pass_must_change_time(sampass); + if (must_change_time == 0) { + DEBUG(1,("Account for user '%s' must change password at next logon! (ie now).\n", sampass->username)); + return NT_STATUS_PASSWORD_MUST_CHANGE; } - } - - lm_pw = pdb_get_lanman_passwd(sampass); - - if(lp_lanman_auth() && (lm_pw != NULL) && (user_info->lm_resp.len == 24 )) { - DEBUG(4,("smb_password_ok: Checking LM password\n")); - if (smb_pwd_check_ntlmv1(user_info->lm_resp.buffer, - lm_pw, user_info->chal, - server_info->session_key)) { - DEBUG(4,("smb_password_ok: LM password check succeeded\n")); - return NT_STATUS_OK; - } else { - DEBUG(4,("smb_password_ok: LM password check failed\n")); - return NT_STATUS_WRONG_PASSWORD; + + if (must_change_time != (time_t)-1 && must_change_time < time(NULL)) { + DEBUG(1,("Account for user '%s' password expired!.\n", sampass->username)); + DEBUG(1,("Password expired at '%d' unix time.\n", must_change_time)); + return NT_STATUS_PASSWORD_EXPIRED; } } - return NT_STATUS_LOGON_FAILURE; + return NT_STATUS_OK; } @@ -262,10 +295,15 @@ NTSTATUS check_smbpasswd_security(const auth_usersupplied_info *user_info, auth_ return NT_STATUS_NO_SUCH_USER; } - nt_status = smb_password_ok(sampass, user_info, server_info); - + nt_status = sam_password_ok(sampass, user_info, server_info->session_key); + + if NT_STATUS_IS_OK(nt_status) { + nt_status = sam_account_ok(sampass, user_info); + } + pdb_free_sam(sampass); return nt_status; } + diff --git a/source3/smbd/auth_smbpasswd.c b/source3/smbd/auth_smbpasswd.c index cb8d711770..7a21c3111b 100644 --- a/source3/smbd/auth_smbpasswd.c +++ b/source3/smbd/auth_smbpasswd.c @@ -31,7 +31,7 @@ core of smb password checking routine. static BOOL smb_pwd_check_ntlmv1(const uchar *password, const uchar *part_passwd, const uchar *c8, - uchar user_sess_key[16]) + char user_sess_key[16]) { /* Finish the encryption of part_passwd. */ uchar p24[24]; @@ -45,7 +45,7 @@ static BOOL smb_pwd_check_ntlmv1(const uchar *password, SMBOWFencrypt(part_passwd, c8, p24); if (user_sess_key != NULL) { - SMBsesskeygen_ntv1(part_passwd, NULL, (char *)user_sess_key); + SMBsesskeygen_ntv1(part_passwd, NULL, user_sess_key); } @@ -70,7 +70,7 @@ static BOOL smb_pwd_check_ntlmv2(const uchar *password, size_t pwd_len, uchar *part_passwd, uchar const *c8, const char *user, const char *domain, - char *user_sess_key) + char user_sess_key[16]) { /* Finish the encryption of part_passwd. */ uchar kr[16]; @@ -109,17 +109,104 @@ static BOOL smb_pwd_check_ntlmv2(const uchar *password, size_t pwd_len, Do a specific test for an smb password being correct, given a smb_password and the lanman and NT responses. ****************************************************************************/ -NTSTATUS smb_password_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info) +NTSTATUS sam_password_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *user_info, char user_sess_key[16]) { uint8 *nt_pw, *lm_pw; uint16 acct_ctrl = pdb_get_acct_ctrl(sampass); + + if (!user_info || !sampass) + return NT_STATUS_LOGON_FAILURE; + + if (acct_ctrl & ACB_PWNOTREQ) + { + if (lp_null_passwords()) + { + DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", sampass->username)); + return(NT_STATUS_OK); + } + else + { + DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", sampass->username)); + return(NT_STATUS_LOGON_FAILURE); + } + } else { + nt_pw = pdb_get_nt_passwd(sampass); + lm_pw = pdb_get_lanman_passwd(sampass); + + if (nt_pw != NULL && user_info->nt_resp.len > 0) { + if ((user_info->nt_resp.len > 24 )) { + /* We have the NT MD4 hash challenge available - see if we can + use it (ie. does it exist in the smbpasswd file). + */ + DEBUG(4,("smb_password_ok: Checking NTLMv2 password\n")); + if (smb_pwd_check_ntlmv2( user_info->nt_resp.buffer, + user_info->nt_resp.len, + nt_pw, + user_info->chal, user_info->smb_username.str, + user_info->requested_domain.str, + user_sess_key)) + { + return NT_STATUS_OK; + } else { + DEBUG(4,("smb_password_ok: NTLMv2 password check failed\n")); + return NT_STATUS_WRONG_PASSWORD; + } + + } else if (lp_ntlm_auth() && (user_info->nt_resp.len == 24)) { + /* We have the NT MD4 hash challenge available - see if we can + use it (ie. does it exist in the smbpasswd file). + */ + DEBUG(4,("smb_password_ok: Checking NT MD4 password\n")); + if (smb_pwd_check_ntlmv1(user_info->nt_resp.buffer, + nt_pw, user_info->chal, + user_sess_key)) + { + return NT_STATUS_OK; + } else { + DEBUG(4,("smb_password_ok: NT MD4 password check failed\n")); + return NT_STATUS_WRONG_PASSWORD; + } + } else { + return NT_STATUS_LOGON_FAILURE; + } + } else if (lm_pw != NULL && user_info->lm_resp.len == 24) { + if (lp_lanman_auth()) { + DEBUG(4,("smb_password_ok: Checking LM password\n")); + if (smb_pwd_check_ntlmv1(user_info->lm_resp.buffer, + lm_pw, user_info->chal, + user_sess_key)) + { + return NT_STATUS_OK; + } else { + DEBUG(4,("smb_password_ok: LM password check failed\n")); + return NT_STATUS_WRONG_PASSWORD; + } + } + } + } + /* Should not be reached */ + return NT_STATUS_LOGON_FAILURE; +} + +/**************************************************************************** + Do a specific test for a SAM_ACCOUNT being vaild for this connection + (ie not disabled, expired and the like). +****************************************************************************/ +NTSTATUS sam_account_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *user_info) +{ + uint16 acct_ctrl = pdb_get_acct_ctrl(sampass); char *workstation_list; time_t kickoff_time; + if (!user_info || !sampass) + return NT_STATUS_LOGON_FAILURE; + + DEBUG(4,("smb_password_ok: Checking SMB password for user %s\n",sampass->username)); + /* Quit if the account was disabled. */ if(acct_ctrl & ACB_DISABLED) { DEBUG(1,("Account for user '%s' was disabled.\n", sampass->username)); - return(NT_STATUS_ACCOUNT_DISABLED); + return NT_STATUS_ACCOUNT_DISABLED; } /* Test account expire time */ @@ -127,6 +214,8 @@ NTSTATUS smb_password_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *use kickoff_time = pdb_get_kickoff_time(sampass); if (kickoff_time != (time_t)-1) { if (time(NULL) > kickoff_time) { + DEBUG(1,("Account for user '%s' has expried.\n", sampass->username)); + DEBUG(3,("Account expired at '%d' unix time.\n", kickoff_time)); return NT_STATUS_ACCOUNT_EXPIRED; } } @@ -161,77 +250,21 @@ NTSTATUS smb_password_ok(SAM_ACCOUNT *sampass, const auth_usersupplied_info *use return NT_STATUS_NO_MEMORY; } - if (acct_ctrl & ACB_PWNOTREQ) { - if (lp_null_passwords()) - { - DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", sampass->username)); - return(NT_STATUS_OK); - } - else - { - DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", sampass->username)); - return(NT_STATUS_LOGON_FAILURE); - } - } - - if (!user_info || !sampass) - return(NT_STATUS_LOGON_FAILURE); - - DEBUG(4,("smb_password_ok: Checking SMB password for user %s\n",sampass->username)); - - nt_pw = pdb_get_nt_passwd(sampass); - - if (nt_pw != NULL) { - if ((user_info->nt_resp.len > 24 )) { - /* We have the NT MD4 hash challenge available - see if we can - use it (ie. does it exist in the smbpasswd file). - */ - DEBUG(4,("smb_password_ok: Checking NTLMv2 password\n")); - if (smb_pwd_check_ntlmv2( user_info->nt_resp.buffer, - user_info->nt_resp.len, - nt_pw, - user_info->chal, user_info->smb_username.str, - user_info->requested_domain.str, - (char *)server_info->session_key)) - { - return NT_STATUS_OK; - } - DEBUG(4,("smb_password_ok: NTLMv2 password check failed\n")); - - } else if (lp_ntlm_auth() && (user_info->nt_resp.len == 24 )) { - /* We have the NT MD4 hash challenge available - see if we can - use it (ie. does it exist in the smbpasswd file). - */ - DEBUG(4,("smb_password_ok: Checking NT MD4 password\n")); - if (smb_pwd_check_ntlmv1(user_info->nt_resp.buffer, - nt_pw, user_info->chal, - server_info->session_key)) { - DEBUG(4,("smb_password_ok: NT MD4 password check succeeded\n")); - return NT_STATUS_OK; - } else { - DEBUG(4,("smb_password_ok: NT MD4 password check failed\n")); - return NT_STATUS_WRONG_PASSWORD; - } + time_t must_change_time = pdb_get_pass_must_change_time(sampass); + if (must_change_time == 0) { + DEBUG(1,("Account for user '%s' must change password at next logon! (ie now).\n", sampass->username)); + return NT_STATUS_PASSWORD_MUST_CHANGE; } - } - - lm_pw = pdb_get_lanman_passwd(sampass); - - if(lp_lanman_auth() && (lm_pw != NULL) && (user_info->lm_resp.len == 24 )) { - DEBUG(4,("smb_password_ok: Checking LM password\n")); - if (smb_pwd_check_ntlmv1(user_info->lm_resp.buffer, - lm_pw, user_info->chal, - server_info->session_key)) { - DEBUG(4,("smb_password_ok: LM password check succeeded\n")); - return NT_STATUS_OK; - } else { - DEBUG(4,("smb_password_ok: LM password check failed\n")); - return NT_STATUS_WRONG_PASSWORD; + + if (must_change_time != (time_t)-1 && must_change_time < time(NULL)) { + DEBUG(1,("Account for user '%s' password expired!.\n", sampass->username)); + DEBUG(1,("Password expired at '%d' unix time.\n", must_change_time)); + return NT_STATUS_PASSWORD_EXPIRED; } } - return NT_STATUS_LOGON_FAILURE; + return NT_STATUS_OK; } @@ -262,10 +295,15 @@ NTSTATUS check_smbpasswd_security(const auth_usersupplied_info *user_info, auth_ return NT_STATUS_NO_SUCH_USER; } - nt_status = smb_password_ok(sampass, user_info, server_info); - + nt_status = sam_password_ok(sampass, user_info, server_info->session_key); + + if NT_STATUS_IS_OK(nt_status) { + nt_status = sam_account_ok(sampass, user_info); + } + pdb_free_sam(sampass); return nt_status; } + |