summaryrefslogtreecommitdiff
path: root/source4/auth
diff options
context:
space:
mode:
Diffstat (limited to 'source4/auth')
-rw-r--r--source4/auth/auth.h2
-rw-r--r--source4/auth/auth_sam.c194
-rw-r--r--source4/auth/auth_util.c235
-rw-r--r--source4/auth/config.m41
4 files changed, 207 insertions, 225 deletions
diff --git a/source4/auth/auth.h b/source4/auth/auth.h
index bf6e1b77e1..db50e24959 100644
--- a/source4/auth/auth.h
+++ b/source4/auth/auth.h
@@ -64,6 +64,8 @@ typedef struct auth_usersupplied_info
typedef struct auth_serversupplied_info
{
+ TALLOC_CTX *mem_ctx;
+
BOOL guest;
/* NT group information taken from the info3 structure */
diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 028fda74fe..6f61820ae5 100644
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -33,17 +33,14 @@
static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
TALLOC_CTX *mem_ctx,
- SAM_ACCOUNT *sampass,
+ const char *username,
+ uint16 acct_flags,
+ const uint8 lm_pw[16], const uint8 nt_pw[16],
const auth_usersupplied_info *user_info,
DATA_BLOB *user_sess_key,
DATA_BLOB *lm_sess_key)
{
- uint16 acct_ctrl;
- const uint8 *lm_pw, *nt_pw;
- const char *username = pdb_get_username(sampass);
-
- acct_ctrl = pdb_get_acct_ctrl(sampass);
- if (acct_ctrl & ACB_PWNOTREQ) {
+ if (acct_flags & ACB_PWNOTREQ) {
if (lp_null_passwords()) {
DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", username));
return NT_STATUS_OK;
@@ -53,9 +50,6 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
}
}
- lm_pw = pdb_get_lanman_passwd(sampass);
- nt_pw = pdb_get_nt_passwd(sampass);
-
return ntlm_password_check(mem_ctx, &auth_context->challenge,
&user_info->lm_resp, &user_info->nt_resp,
&user_info->lm_interactive_pwd, &user_info->nt_interactive_pwd,
@@ -72,49 +66,51 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
****************************************************************************/
static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
- SAM_ACCOUNT *sampass,
+ const char *username,
+ uint16 acct_flags,
+ struct ldb_message **msgs,
const auth_usersupplied_info *user_info)
{
- uint16 acct_ctrl = pdb_get_acct_ctrl(sampass);
char *workstation_list;
time_t kickoff_time;
- DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n",pdb_get_username(sampass)));
+ DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n", username));
/* Quit if the account was disabled. */
- if (acct_ctrl & ACB_DISABLED) {
- DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", pdb_get_username(sampass)));
+ if (acct_flags & ACB_DISABLED) {
+ DEBUG(1,("sam_account_ok: Account for user '%s' was disabled.\n", username));
return NT_STATUS_ACCOUNT_DISABLED;
}
/* Quit if the account was locked out. */
- if (acct_ctrl & ACB_AUTOLOCK) {
- DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", pdb_get_username(sampass)));
+ if (acct_flags & ACB_AUTOLOCK) {
+ DEBUG(1,("sam_account_ok: Account for user %s was locked out.\n", username));
return NT_STATUS_ACCOUNT_LOCKED_OUT;
}
+#if 0
/* Test account expire time */
kickoff_time = pdb_get_kickoff_time(sampass);
if (kickoff_time != 0 && time(NULL) > kickoff_time) {
- DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", pdb_get_username(sampass)));
+ DEBUG(1,("sam_account_ok: Account for user '%s' has expired.\n", username));
DEBUG(3,("sam_account_ok: Account expired at '%ld' unix time.\n", (long)kickoff_time));
return NT_STATUS_ACCOUNT_EXPIRED;
}
- if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOEXP)) {
+ if (!(acct_flags & ACB_PWNOEXP)) {
time_t must_change_time = pdb_get_pass_must_change_time(sampass);
time_t last_set_time = pdb_get_pass_last_set_time(sampass);
/* check for immediate expiry "must change at next logon" */
if (must_change_time == 0 && last_set_time != 0) {
- DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", pdb_get_username(sampass)));
+ DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", username));
return NT_STATUS_PASSWORD_MUST_CHANGE;
}
/* check for expired password */
if (must_change_time < time(NULL) && must_change_time != 0) {
- DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", pdb_get_username(sampass)));
+ DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", username));
DEBUG(1,("sam_account_ok: Password expired at '%s' (%ld) unix time.\n", timestring(mem_ctx, must_change_time), (long)must_change_time));
return NT_STATUS_PASSWORD_EXPIRED;
}
@@ -144,19 +140,19 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
if (invalid_ws)
return NT_STATUS_INVALID_WORKSTATION;
}
-
- if (acct_ctrl & ACB_DOMTRUST) {
- DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", pdb_get_username(sampass)));
+#endif
+ if (acct_flags & ACB_DOMTRUST) {
+ DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", username));
return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
}
- if (acct_ctrl & ACB_SVRTRUST) {
- DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", pdb_get_username(sampass)));
+ if (acct_flags & ACB_SVRTRUST) {
+ DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", username));
return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
}
- if (acct_ctrl & ACB_WSTRUST) {
- DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", pdb_get_username(sampass)));
+ if (acct_flags & ACB_WSTRUST) {
+ DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", username));
return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
}
@@ -175,60 +171,156 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
const auth_usersupplied_info *user_info,
auth_serversupplied_info **server_info)
{
- SAM_ACCOUNT *sampass=NULL;
+ struct ldb_message **msgs;
+ void *sam_ctx;
+ uint16 acct_flags;
+ char *username = user_info->internal_username.str;
BOOL ret;
NTSTATUS nt_status;
DATA_BLOB user_sess_key = data_blob(NULL, 0);
DATA_BLOB lm_sess_key = data_blob(NULL, 0);
+ const uint8 *lm_pwd, *nt_pwd;
+ const char *unicodePwd;
+ struct samr_Hash lmPwdHash_u, ntPwdHash_u;
+ struct samr_Hash *lmPwdHash, *ntPwdHash;
+ uint_t num_lm, num_nt;
if (!user_info || !auth_context) {
return NT_STATUS_UNSUCCESSFUL;
}
-
- /* Can't use the talloc version here, because the returned struct gets
- kept on the server_info */
- if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(&sampass))) {
- return nt_status;
+
+ sam_ctx = samdb_connect();
+ if (sam_ctx == NULL) {
+ return NT_STATUS_INVALID_SYSTEM_SERVICE;
}
-
- /* get the account information */
-
- become_root();
- ret = pdb_getsampwnam(sampass, user_info->internal_username.str);
- unbecome_root();
-
- if (ret == False) {
- DEBUG(3,("check_sam_security: Couldn't find user '%s' in passdb file.\n", user_info->internal_username.str));
- pdb_free_sam(&sampass);
+ /* pull all the user attributes */
+ ret = samdb_search(sam_ctx, mem_ctx, NULL, &msgs, NULL,
+ "(&(sAMAccountName=%s)(objectclass=user))",
+ username);
+
+ if (ret == 0) {
+ DEBUG(3,("check_sam_security: Couldn't find user [%s] in passdb file.\n",
+ username));
return NT_STATUS_NO_SUCH_USER;
}
+ if (ret > 1) {
+ DEBUG(1,("Found %d records matching user [%s]\n", ret, username));
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ }
+
+ acct_flags = samdb_result_acct_flags(msgs[0], "sAMAcctFlags");
+
/* Quit if the account was locked out. */
- if (pdb_get_acct_ctrl(sampass) & ACB_AUTOLOCK) {
- DEBUG(3,("check_sam_security: Account for user %s was locked out.\n", pdb_get_username(sampass)));
+ if (acct_flags & ACB_AUTOLOCK) {
+ DEBUG(3,("check_sam_security: Account for user %s was locked out.\n",
+ username));
return NT_STATUS_ACCOUNT_LOCKED_OUT;
}
- nt_status = sam_password_ok(auth_context, mem_ctx, sampass,
+ unicodePwd = samdb_result_string(msgs[0], "unicodePwd", NULL);
+
+ if (unicodePwd) {
+ BOOL lm_hash_ok;
+ /* compute the new nt and lm hashes */
+ lm_hash_ok = E_deshash(unicodePwd, lmPwdHash_u.hash);
+ E_md4hash(unicodePwd, ntPwdHash_u.hash);
+
+ if (lm_hash_ok) {
+ lm_pwd = lmPwdHash_u.hash;
+ } else {
+ lm_pwd = NULL;
+ }
+
+ nt_pwd = ntPwdHash_u.hash;
+
+ } else {
+ num_lm = samdb_result_hashes(mem_ctx, msgs[0], "lmPwdHash", &lmPwdHash);
+ if (num_lm == 0) {
+ lm_pwd = NULL;
+ } else if (num_lm > 1) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ } else {
+ lm_pwd = lmPwdHash[0].hash;
+ }
+
+ num_nt = samdb_result_hashes(mem_ctx, msgs[0], "ntPwdHash", &ntPwdHash);
+ if (num_nt == 0) {
+ nt_pwd = NULL;
+ } else if (num_nt > 1) {
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+ } else {
+ nt_pwd = ntPwdHash[0].hash;
+ }
+ }
+
+ nt_status = sam_password_ok(auth_context, mem_ctx,
+ username, acct_flags,
+ lm_pwd, nt_pwd,
user_info, &user_sess_key, &lm_sess_key);
if (!NT_STATUS_IS_OK(nt_status)) {
- pdb_free_sam(&sampass);
return nt_status;
}
- nt_status = sam_account_ok(mem_ctx, sampass, user_info);
+ nt_status = sam_account_ok(mem_ctx, username, acct_flags, msgs, user_info);
if (!NT_STATUS_IS_OK(nt_status)) {
- pdb_free_sam(&sampass);
return nt_status;
}
- if (!NT_STATUS_IS_OK(nt_status = make_server_info_sam(server_info, sampass))) {
+ if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, username))) {
DEBUG(0,("check_sam_security: make_server_info_sam() failed with '%s'\n", nt_errstr(nt_status)));
return nt_status;
}
+ {
+ struct ldb_message **group_msgs;
+ char *dn = msgs[0]->dn;
+ int group_ret;
+ const char *group_attrs[3] = { "sAMAccountType", "objectSid", NULL };
+ /* find list of sids */
+ struct dom_sid **groupSIDs = NULL;
+ struct dom_sid *user_sid;
+ struct dom_sid *group_sid;
+ const char *sidstr;
+ int i;
+
+ group_ret = samdb_search(sam_ctx,
+ mem_ctx, NULL, &group_msgs, group_attrs,
+ "(&(member=%s)(sAMAccountType=*))",
+ dn);
+
+ if (!(groupSIDs = talloc_realloc_p((*server_info)->mem_ctx, groupSIDs,
+ struct dom_sid *, group_ret))) {
+ talloc_destroy((*server_info)->mem_ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* Need to unroll some nested groups, but not aliases */
+ for (i = 0; i < group_ret; i++) {
+ sidstr = ldb_msg_find_string(group_msgs[i], "objectSid", NULL);
+ groupSIDs[i] = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
+ }
+
+ sidstr = ldb_msg_find_string(msgs[0], "objectSid", NULL);
+ user_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
+ group_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
+ group_sid->sub_auths[group_sid->num_auths-1]
+ = samdb_result_uint(msgs[0], "primaryGroupID", 0);
+
+ if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token((*server_info)->mem_ctx,
+ user_sid, group_sid,
+ group_ret, groupSIDs,
+ False, &(*server_info)->ptok))) {
+ DEBUG(1,("check_sam_security: create_nt_user_token failed with '%s'\n", nt_errstr(nt_status)));
+ free_server_info(server_info);
+ return nt_status;
+ }
+ }
+
+ (*server_info)->guest = False;
+
(*server_info)->user_session_key = user_sess_key;
(*server_info)->lm_session_key = lm_sess_key;
diff --git a/source4/auth/auth_util.c b/source4/auth/auth_util.c
index 6becf8c8b5..fda8c18fa4 100644
--- a/source4/auth/auth_util.c
+++ b/source4/auth/auth_util.c
@@ -26,40 +26,11 @@
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
-extern DOM_SID global_sid_World;
-extern DOM_SID global_sid_Network;
-extern DOM_SID global_sid_Builtin_Guests;
-extern DOM_SID global_sid_Authenticated_Users;
-
-/****************************************************************************
- Create a SAM_ACCOUNT - either by looking in the pdb, or by faking it up from
- unix info.
-****************************************************************************/
-
-NTSTATUS auth_get_sam_account(const char *user, SAM_ACCOUNT **account)
-{
- BOOL pdb_ret;
- NTSTATUS nt_status;
- if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(account))) {
- return nt_status;
- }
-
- become_root();
- pdb_ret = pdb_getsampwnam(*account, user);
- unbecome_root();
-
- if (!pdb_ret) {
-
- struct passwd *pass = Get_Pwnam(user);
- if (!pass)
- return NT_STATUS_NO_SUCH_USER;
-
- if (!NT_STATUS_IS_OK(nt_status = pdb_fill_sam_pw(*account, pass))) {
- return nt_status;
- }
- }
- return NT_STATUS_OK;
-}
+extern struct dom_sid *global_sid_World;
+extern struct dom_sid *global_sid_Anonymous;
+extern struct dom_sid *global_sid_Network;
+extern struct dom_sid *global_sid_Builtin_Guests;
+extern struct dom_sid *global_sid_Authenticated_Users;
/****************************************************************************
Create an auth_usersupplied_data structure
@@ -428,11 +399,11 @@ void debug_nt_user_token(int dbg_class, int dbg_lev, NT_USER_TOKEN *token)
}
DEBUGC(dbg_class, dbg_lev, ("NT user token of user %s\n",
- sid_to_string(sid_str, &token->user_sids[0]) ));
+ sid_to_string(sid_str, token->user_sids[0]) ));
DEBUGADDC(dbg_class, dbg_lev, ("contains %lu SIDs\n", (unsigned long)token->num_sids));
for (i = 0; i < token->num_sids; i++)
DEBUGADDC(dbg_class, dbg_lev, ("SID[%3lu]: %s\n", (unsigned long)i,
- sid_to_string(sid_str, &token->user_sids[i])));
+ sid_to_string(sid_str, token->user_sids[i])));
}
/****************************************************************************
@@ -454,33 +425,30 @@ void debug_unix_user_token(int dbg_class, int dbg_lev, uid_t uid, gid_t gid, int
Create the SID list for this user.
****************************************************************************/
-static NTSTATUS create_nt_user_token(const DOM_SID *user_sid, const DOM_SID *group_sid,
- int n_groupSIDs, DOM_SID *groupSIDs,
- BOOL is_guest, NT_USER_TOKEN **token)
+NTSTATUS create_nt_user_token(TALLOC_CTX *mem_ctx,
+ struct dom_sid *user_sid, struct dom_sid *group_sid,
+ int n_groupSIDs, struct dom_sid **groupSIDs,
+ BOOL is_guest, struct nt_user_token **token)
{
NTSTATUS nt_status = NT_STATUS_OK;
- NT_USER_TOKEN *ptoken;
+ struct nt_user_token *ptoken;
int i;
int sid_ndx;
- if ((ptoken = malloc( sizeof(NT_USER_TOKEN) ) ) == NULL) {
+ if (!(ptoken = talloc_p(mem_ctx, struct nt_user_token))) {
DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
nt_status = NT_STATUS_NO_MEMORY;
return nt_status;
}
- ZERO_STRUCTP(ptoken);
-
- ptoken->num_sids = n_groupSIDs + 5;
+ ptoken->num_sids = 0;
- if ((ptoken->user_sids = (DOM_SID *)malloc( sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
+ if (!(ptoken->user_sids = talloc_array_p(mem_ctx, struct dom_sid*, n_groupSIDs + 5))) {
DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
nt_status = NT_STATUS_NO_MEMORY;
return nt_status;
}
- memset((char*)ptoken->user_sids,0,sizeof(DOM_SID) * ptoken->num_sids);
-
/*
* Note - user SID *MUST* be first in token !
* se_access_check depends on this.
@@ -488,9 +456,10 @@ static NTSTATUS create_nt_user_token(const DOM_SID *user_sid, const DOM_SID *gro
* Primary group SID is second in token. Convention.
*/
- sid_copy(&ptoken->user_sids[PRIMARY_USER_SID_INDEX], user_sid);
- if (group_sid)
- sid_copy(&ptoken->user_sids[PRIMARY_GROUP_SID_INDEX], group_sid);
+ ptoken->user_sids[PRIMARY_USER_SID_INDEX] = user_sid;
+ ptoken->num_sids++;
+ ptoken->user_sids[PRIMARY_GROUP_SID_INDEX] = group_sid;
+ ptoken->num_sids++;
/*
* Finally add the "standard" SIDs.
@@ -498,29 +467,31 @@ static NTSTATUS create_nt_user_token(const DOM_SID *user_sid, const DOM_SID *gro
* don't really support) is the addition of Authenticated_Users.
*/
- sid_copy(&ptoken->user_sids[2], &global_sid_World);
- sid_copy(&ptoken->user_sids[3], &global_sid_Network);
+ ptoken->user_sids[2] = global_sid_World;
+ ptoken->user_sids[3] = global_sid_Network;
+
+ if (is_guest) {
+ ptoken->user_sids[4] = global_sid_Builtin_Guests;
+ ptoken->num_sids++;
+ } else {
+ ptoken->user_sids[4] = global_sid_Authenticated_Users;
+ ptoken->num_sids++;
+ }
- if (is_guest)
- sid_copy(&ptoken->user_sids[4], &global_sid_Builtin_Guests);
- else
- sid_copy(&ptoken->user_sids[4], &global_sid_Authenticated_Users);
-
sid_ndx = 5; /* next available spot */
for (i = 0; i < n_groupSIDs; i++) {
size_t check_sid_idx;
for (check_sid_idx = 1; check_sid_idx < ptoken->num_sids; check_sid_idx++) {
- if (sid_equal(&ptoken->user_sids[check_sid_idx],
- &groupSIDs[i])) {
+ if (sid_equal(ptoken->user_sids[check_sid_idx],
+ groupSIDs[i])) {
break;
}
}
if (check_sid_idx >= ptoken->num_sids) /* Not found already */ {
- sid_copy(&ptoken->user_sids[sid_ndx++], &groupSIDs[i]);
- } else {
- ptoken->num_sids--;
+ ptoken->user_sids[sid_ndx++] = groupSIDs[i];
+ ptoken->num_sids++;
}
}
@@ -535,65 +506,18 @@ static NTSTATUS create_nt_user_token(const DOM_SID *user_sid, const DOM_SID *gro
Make a user_info struct
***************************************************************************/
-static NTSTATUS make_server_info(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass)
+NTSTATUS make_server_info(auth_serversupplied_info **server_info, const char *username)
{
- *server_info = malloc(sizeof(**server_info));
+ TALLOC_CTX *mem_ctx = talloc_init("auth subsystem: server_info for %s", username);
+ *server_info = talloc_p(mem_ctx, auth_serversupplied_info);
if (!*server_info) {
DEBUG(0,("make_server_info: malloc failed!\n"));
+ talloc_destroy(mem_ctx);
return NT_STATUS_NO_MEMORY;
}
- ZERO_STRUCTP(*server_info);
-
- return NT_STATUS_OK;
-}
-
-/***************************************************************************
- Make (and fill) a user_info struct from a SAM_ACCOUNT
-***************************************************************************/
-
-NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
- SAM_ACCOUNT *sampass)
-{
- NTSTATUS nt_status = NT_STATUS_OK;
- const DOM_SID *user_sid = pdb_get_user_sid(sampass);
- const DOM_SID *group_sid = pdb_get_group_sid(sampass);
- NT_USER_TOKEN *token;
- BOOL is_guest;
- uint32 rid;
-
- if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, sampass))) {
- return nt_status;
- }
-
- is_guest = (sid_peek_rid(user_sid, &rid) && rid == DOMAIN_USER_RID_GUEST);
-
- if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token(user_sid, group_sid,
- 0, NULL, is_guest,
- &token)))
- {
- DEBUG(4,("create_nt_user_token failed\n"));
- free_server_info(server_info);
- return nt_status;
- }
-
- (*server_info)->ptok = token;
+ (*server_info)->mem_ctx = mem_ctx;
- return nt_status;
-}
-
-/***************************************************************************
- Make (and fill) a user_info struct from a 'struct passwd' by conversion
- to a SAM_ACCOUNT
-***************************************************************************/
-
-NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info, const struct passwd *pwd)
-{
- NTSTATUS nt_status;
- SAM_ACCOUNT *sampass = NULL;
- if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_pw(&sampass, pwd))) {
- return nt_status;
- }
- return make_server_info_sam(server_info, sampass);
+ return NT_STATUS_OK;
}
/***************************************************************************
@@ -603,35 +527,29 @@ NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info, const struc
NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
{
NTSTATUS nt_status;
- SAM_ACCOUNT *sampass = NULL;
- DOM_SID guest_sid;
+ static const char zeros[16];
- if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(&sampass))) {
- return nt_status;
- }
+ nt_status = make_server_info(server_info, "");
- sid_copy(&guest_sid, get_global_sam_sid());
- sid_append_rid(&guest_sid, DOMAIN_USER_RID_GUEST);
-
- become_root();
- if (!pdb_getsampwsid(sampass, &guest_sid)) {
- unbecome_root();
- return NT_STATUS_NO_SUCH_USER;
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
}
- unbecome_root();
-
- nt_status = make_server_info_sam(server_info, sampass);
-
- if (NT_STATUS_IS_OK(nt_status)) {
- static const char zeros[16];
- (*server_info)->guest = True;
-
- /* annoying, but the Guest really does have a session key,
- and it is all zeros! */
- (*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
- (*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
+
+ (*server_info)->guest = True;
+
+ if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token((*server_info)->mem_ctx,
+ global_sid_Anonymous, global_sid_Builtin_Guests,
+ 0, NULL,
+ True, &(*server_info)->ptok))) {
+ DEBUG(1,("check_sam_security: create_nt_user_token failed with '%s'\n", nt_errstr(nt_status)));
+ free_server_info(server_info);
+ return nt_status;
}
-
+
+ /* annoying, but the Guest really does have a session key,
+ and it is all zeros! */
+ (*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
+ (*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
return nt_status;
}
@@ -666,14 +584,11 @@ void free_user_info(auth_usersupplied_info **user_info)
void free_server_info(auth_serversupplied_info **server_info)
{
- DEBUG(5,("attempting to free (and zero) a server_info structure\n"));
- if (*server_info != NULL) {
-
- /* call pam_end here, unless we know we are keeping it */
- delete_nt_token( &(*server_info)->ptok );
- ZERO_STRUCT(**server_info);
+ DEBUG(5,("attempting to free a server_info structure\n"));
+ if (!*server_info) {
+ talloc_destroy((*server_info)->mem_ctx);
}
- SAFE_FREE(*server_info);
+ *server_info = NULL;
}
/***************************************************************************
@@ -714,32 +629,6 @@ void delete_nt_token(NT_USER_TOKEN **pptoken)
SAFE_FREE(*pptoken);
}
-/****************************************************************************
- Duplicate a SID token.
-****************************************************************************/
-
-struct nt_user_token *dup_nt_token(NT_USER_TOKEN *ptoken)
-{
- NT_USER_TOKEN *token;
-
- if (!ptoken)
- return NULL;
-
- if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
- return NULL;
-
- ZERO_STRUCTP(token);
-
- if ((token->user_sids = (DOM_SID *)memdup( ptoken->user_sids, sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
- SAFE_FREE(token);
- return NULL;
- }
-
- token->num_sids = ptoken->num_sids;
-
- return token;
-}
-
/**
* Squash an NT_STATUS in line with security requirements.
* In an attempt to avoid giving the whole game away when users
diff --git a/source4/auth/config.m4 b/source4/auth/config.m4
index b84ec5d475..8fc1f5edeb 100644
--- a/source4/auth/config.m4
+++ b/source4/auth/config.m4
@@ -2,7 +2,6 @@ dnl # AUTH Server subsystem
SMB_MODULE(auth_sam,AUTH,STATIC,[auth/auth_sam.o])
SMB_MODULE(auth_builtin,AUTH,STATIC,[auth/auth_builtin.o])
-SMB_MODULE(auth_unix,AUTH,STATIC,[auth/auth_unix.o])
SMB_SUBSYSTEM(AUTH,auth/auth.o,
[auth/auth_ntlmssp.o
generated by cgit (git 2.34.1) at 2024-08-16 18:02:28 +0000