summaryrefslogtreecommitdiff
path: root/source4/auth
diff options
context:
space:
mode:
Diffstat (limited to 'source4/auth')
-rw-r--r--source4/auth/auth_unix.c150
-rw-r--r--source4/auth/auth_util.c2
2 files changed, 90 insertions, 62 deletions
diff --git a/source4/auth/auth_unix.c b/source4/auth/auth_unix.c
index 26f2ed464f..f673beb43d 100644
--- a/source4/auth/auth_unix.c
+++ b/source4/auth/auth_unix.c
@@ -23,37 +23,53 @@
#include "includes.h"
#include "auth/auth.h"
#include "system/passwd.h" /* needed by some systems for struct passwd */
+#include "lib/socket/socket.h"
/* TODO: look at how to best fill in parms retrieveing a struct passwd info
* except in case USER_INFO_DONT_CHECK_UNIX_ACCOUNT is set
*/
static NTSTATUS authunix_make_server_info(TALLOC_CTX *mem_ctx,
const struct auth_usersupplied_info *user_info,
+ struct passwd *pwd,
struct auth_serversupplied_info **_server_info)
{
struct auth_serversupplied_info *server_info;
+ NTSTATUS status;
- server_info = talloc(mem_ctx, struct auth_serversupplied_info);
- NT_STATUS_HAVE_NO_MEMORY(server_info);
-
- server_info->authenticated = True;
-
- server_info->account_name = talloc_strdup(server_info, talloc_strdup(mem_ctx, user_info->mapped.account_name));
- NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
-
- server_info->domain_name = talloc_strdup(server_info, talloc_strdup(mem_ctx, "unix"));
- NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
-
+ /* This is a real, real hack */
+ if (pwd->pw_uid == 0) {
+ status = auth_system_server_info(mem_ctx, &server_info);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
- /* is this correct? */
- server_info->account_sid = NULL;
- server_info->primary_group_sid = NULL;
- server_info->n_domain_groups = 0;
- server_info->domain_groups = NULL;
+ server_info->account_name = talloc_steal(server_info, pwd->pw_name);
+ NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+
+ server_info->domain_name = talloc_strdup(server_info, "unix");
+ NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+ } else {
+ server_info = talloc(mem_ctx, struct auth_serversupplied_info);
+ NT_STATUS_HAVE_NO_MEMORY(server_info);
+
+ server_info->authenticated = True;
+
+ server_info->account_name = talloc_steal(server_info, pwd->pw_name);
+ NT_STATUS_HAVE_NO_MEMORY(server_info->account_name);
+
+ server_info->domain_name = talloc_strdup(server_info, "unix");
+ NT_STATUS_HAVE_NO_MEMORY(server_info->domain_name);
+
+ /* This isn't in any way correct.. */
+ server_info->account_sid = NULL;
+ server_info->primary_group_sid = NULL;
+ server_info->n_domain_groups = 0;
+ server_info->domain_groups = NULL;
+ }
server_info->user_session_key = data_blob(NULL,0);
server_info->lm_session_key = data_blob(NULL,0);
- server_info->full_name = talloc_strdup(server_info, "");
+ server_info->full_name = talloc_steal(server_info, pwd->pw_gecos);
NT_STATUS_HAVE_NO_MEMORY(server_info->full_name);
server_info->logon_script = talloc_strdup(server_info, "");
NT_STATUS_HAVE_NO_MEMORY(server_info->logon_script);
@@ -79,6 +95,44 @@ static NTSTATUS authunix_make_server_info(TALLOC_CTX *mem_ctx,
return NT_STATUS_OK;
}
+static NTSTATUS talloc_getpwnam(TALLOC_CTX *ctx, const char *username, struct passwd **pws)
+{
+ struct passwd *ret;
+ struct passwd *from;
+
+ *pws = NULL;
+
+ ret = talloc(ctx, struct passwd);
+ NT_STATUS_HAVE_NO_MEMORY(ret);
+
+ from = getpwnam(username);
+ if (!from) {
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ ret->pw_name = talloc_strdup(ctx, from->pw_name);
+ NT_STATUS_HAVE_NO_MEMORY(ret->pw_name);
+
+ ret->pw_passwd = talloc_strdup(ctx, from->pw_passwd);
+ NT_STATUS_HAVE_NO_MEMORY(ret->pw_passwd);
+
+ ret->pw_uid = from->pw_uid;
+ ret->pw_gid = from->pw_gid;
+ ret->pw_gecos = talloc_strdup(ctx, from->pw_gecos);
+ NT_STATUS_HAVE_NO_MEMORY(ret->pw_gecos);
+
+ ret->pw_dir = talloc_strdup(ctx, from->pw_dir);
+ NT_STATUS_HAVE_NO_MEMORY(ret->pw_dir);
+
+ ret->pw_shell = talloc_strdup(ctx, from->pw_shell);
+ NT_STATUS_HAVE_NO_MEMORY(ret->pw_shell);
+
+ *pws = ret;
+
+ return NT_STATUS_OK;
+}
+
+
#ifdef HAVE_SECURITY_PAM_APPL_H
#include <security/pam_appl.h>
@@ -367,7 +421,7 @@ static NTSTATUS smb_pam_setcred(pam_handle_t *pamh, const char * user)
return pam_to_nt_status(pam_error);
}
-static NTSTATUS check_unix_password(TALLOC_CTX *ctx, const struct auth_usersupplied_info *user_info)
+static NTSTATUS check_unix_password(TALLOC_CTX *ctx, const struct auth_usersupplied_info *user_info, struct passwd **pws)
{
struct smb_pam_user_info *info;
struct pam_conv *pamconv;
@@ -395,9 +449,8 @@ static NTSTATUS check_unix_password(TALLOC_CTX *ctx, const struct auth_usersuppl
* if true set up a crack name routine.
*/
- nt_status = smb_pam_start(&pamh, user_info->mapped.account_name, user_info->remote_host, pamconv);
+ nt_status = smb_pam_start(&pamh, user_info->mapped.account_name, user_info->remote_host ? user_info->remote_host->addr : NULL, pamconv);
if (!NT_STATUS_IS_OK(nt_status)) {
- smb_pam_end(pamh);
return nt_status;
}
@@ -423,48 +476,16 @@ static NTSTATUS check_unix_password(TALLOC_CTX *ctx, const struct auth_usersuppl
}
smb_pam_end(pamh);
- return NT_STATUS_OK;
-}
-
-#else
-
-static NTSTATUS talloc_getpwnam(TALLOC_CTX *ctx, char *username, struct passwd **pws)
-{
- struct passwd *ret;
- struct passwd *from;
-
- *pws = NULL;
-
- ret = talloc(ctx, struct passwd);
- NT_STATUS_HAVE_NO_MEMORY(ret);
- from = getpwnam(username);
- if (!from) {
- return NT_STATUS_NO_SUCH_USER;
+ nt_status = talloc_getpwnam(ctx, user_info->mapped.account_name, pws);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ return nt_status;
}
- ret->pw_name = talloc_strdup(ctx, from->pw_name);
- NT_STATUS_HAVE_NO_MEMORY(ret->pw_name);
-
- ret->pw_passwd = talloc_strdup(ctx, from->pw_passwd);
- NT_STATUS_HAVE_NO_MEMORY(ret->pw_passwd);
-
- ret->pw_uid = from->pw_uid;
- ret->pw_gid = from->pw_gid;
- ret->pw_gecos = talloc_strdup(ctx, from->pw_gecos);
- NT_STATUS_HAVE_NO_MEMORY(ret->pw_gecos);
-
- ret->pw_dir = talloc_strdup(ctx, from->pw_dir);
- NT_STATUS_HAVE_NO_MEMORY(ret->pw_dir);
-
- ret->pw_shell = talloc_strdup(ctx, from->pw_shell);
- NT_STATUS_HAVE_NO_MEMORY(ret->pw_shell);
-
- *pws = ret;
-
- return NT_STATUS_OK;
+ return NT_STATUS_OK;
}
+#else
/****************************************************************************
core of password checking routine
@@ -563,7 +584,7 @@ static NTSTATUS password_check(const char *username, const char *password,
#endif /* HAVE_BIGCRYPT && HAVE_CRYPT && USE_BOTH_CRYPT_CALLS */
}
-static NTSTATUS check_unix_password(TALLOC_CTX *ctx, const struct auth_usersupplied_info *user_info)
+static NTSTATUS check_unix_password(TALLOC_CTX *ctx, const struct auth_usersupplied_info *user_info, struct passwd **ret_passwd)
{
char *username;
char *password;
@@ -574,6 +595,8 @@ static NTSTATUS check_unix_password(TALLOC_CTX *ctx, const struct auth_usersuppl
NTSTATUS nt_status;
int level = lp_passwordlevel();
+ *ret_passwd = NULL;
+
username = talloc_strdup(ctx, user_info->mapped.account_name);
password = talloc_strdup(ctx, user_info->password.plaintext);
@@ -679,13 +702,15 @@ static NTSTATUS check_unix_password(TALLOC_CTX *ctx, const struct auth_usersuppl
}
if (password == NULL) {
DEBUG(3, ("Allowing access to %s with null password\n", username));
+ *ret_passwd = pwd;
return NT_STATUS_OK;
}
}
/* try it as it came to us */
nt_status = password_check(username, password, crypted, salt);
- if NT_STATUS_IS_OK(nt_status) {
+ if (NT_STATUS_IS_OK(nt_status)) {
+ *ret_passwd = pwd;
return nt_status;
}
else if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_WRONG_PASSWORD)) {
@@ -714,6 +739,7 @@ static NTSTATUS check_unix_password(TALLOC_CTX *ctx, const struct auth_usersuppl
strlower(pwcopy);
nt_status = password_check(username, pwcopy, crypted, salt);
if NT_STATUS_IS_OK(nt_status) {
+ *ret_passwd = pwd;
return nt_status;
}
}
@@ -728,6 +754,7 @@ static NTSTATUS check_unix_password(TALLOC_CTX *ctx, const struct auth_usersuppl
#if 0
if (NT_STATUS_IS_OK(nt_status = string_combinations(pwcopy, password_check, level))) {
+ *ret_passwd = pwd;
return nt_status;
}
#endif
@@ -747,6 +774,7 @@ static NTSTATUS authunix_check_password(struct auth_method_context *ctx,
{
TALLOC_CTX *check_ctx;
NTSTATUS nt_status;
+ struct passwd *pwd;
if (! user_info->mapped.account_name || ! *user_info->mapped.account_name) {
/* 'not for me' */
@@ -762,13 +790,13 @@ static NTSTATUS authunix_check_password(struct auth_method_context *ctx,
return NT_STATUS_NO_MEMORY;
}
- nt_status = check_unix_password(check_ctx, user_info);
+ nt_status = check_unix_password(check_ctx, user_info, &pwd);
if ( ! NT_STATUS_IS_OK(nt_status)) {
talloc_free(check_ctx);
return nt_status;
}
- nt_status = authunix_make_server_info(mem_ctx, user_info, server_info);
+ nt_status = authunix_make_server_info(mem_ctx, user_info, pwd, server_info);
if ( ! NT_STATUS_IS_OK(nt_status)) {
talloc_free(check_ctx);
return nt_status;
diff --git a/source4/auth/auth_util.c b/source4/auth/auth_util.c
index 5660787ee8..d068f56775 100644
--- a/source4/auth/auth_util.c
+++ b/source4/auth/auth_util.c
@@ -491,7 +491,7 @@ NTSTATUS auth_system_server_info(TALLOC_CTX *mem_ctx, struct auth_serversupplied
server_info->acct_flags = ACB_NORMAL;
- server_info->authenticated = False;
+ server_info->authenticated = True;
*_server_info = server_info;
generated by cgit (git 2.34.1) at 2024-12-25 18:37:32 +0000