summaryrefslogtreecommitdiff
path: root/source3/auth/auth_sam.c
AgeCommit message (Collapse)AuthorFilesLines
2010-04-11s3: Move check_sam_security to auth/check_sam.cVolker Lendecke1-485/+0
2010-04-11s3: Make check_sam_security publicVolker Lendecke1-20/+28
2010-04-11s3: Replace "auth_context" by "challenge" in need_to_increment_bad_pw_count argsVolker Lendecke1-5/+5
2010-04-11s3: Replace "auth_context" by "challenge" in sam_password_ok argsVolker Lendecke1-7/+10
2010-04-11s3: Remove the make_auth_methods routineVolker Lendecke1-6/+14
This was just TALLOC_ZERO_P
2010-01-14s3:auth: fix account unlock regression introduced with fix for bug #4347Michael Adam1-7/+5
By an oversight, the patchset for #4347 made the unlocking of a locked account after the lockout duration ineffective. Thanks to Björn for finding this! Michael
2010-01-12s3:auth: add comment to nulling out stolen sampassMichael Adam1-0/+4
Adding this comment makes me think, I could also have changed make_server_info_sam() talloc_move instead of talloc_steal, but that would have changed the signature... Well the comment is a first step. :-) Michael
2010-01-10s3: Remove the typedef for "auth_serversupplied_info"Volker Lendecke1-2/+2
2010-01-10s3: Remove the typedef for "auth_usersupplied_info"Volker Lendecke1-5/+5
2010-01-07s3:auth: don't update the bad pw count if pw is among last 2 history entriesMichael Adam1-1/+73
This conforms to the behaviour of Windows 2003: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/bpactlck.mspx This is supposed to fixes Bug #4347 . Michael
2010-01-07s3:auth:check_sam_security: introduce a bool var to control pad_pw_count ↵Michael Adam1-1/+7
incrementation This is a preparatory patch for the last part in fixing bug #4347 . Michael
2010-01-07s3:auth:check_sam_security: improve calling and logging of ↵Michael Adam1-4/+16
pdb_update_sam_account Log what went wrongl, and also call pdb_update_sam_account inside become_root/unbecome_root: do the logging outside. Michael
2010-01-07s3:auth:check_sam_security: fix a leading tab/ws mixupMichael Adam1-1/+1
Michael
2010-01-07s3:auth:check_sam_security: create (and use) a common exit pointMichael Adam1-11/+7
for use after sam_password_ok() has been called. Michael
2010-01-07s3:auth:check_sam_security: null out sampass after it has been stolen.Michael Adam1-0/+1
So that a later talloc_free would not harm. I could have used talloc_move instead of talloc steal in make_server_info_sam(), but this would have required a change of the signature. Michael
2010-01-07s3:auth:sam_password_ok: take username, acct_ctrl and nt/lm hashes, not sampassMichael Adam1-14/+20
This is in preparation to extending check_sam_security to also check against the password history before updating the bad password count. This way, sam_password_ok can more easily be reused for that purpose. Michael
2010-01-07s3:auth: use data_blob_null instead of data_blob(NULL, 0) in sam_password_ok()Michael Adam1-2/+2
This way it is more explicit that there is no allocated data here that may leak. Michael
2010-01-07s3:auth:sam_password_ok: fix allocation of a data blob.Michael Adam1-1/+1
data_blob(mem_ctx, 16) does not use mem_ctx as a talloc ctx but copies 16 bytes from mem_ctx into the newly allocated data blob. This can not have been intentional. A blank uint8_t array of length 16 is allocated by passing NULL instead of mem_ctx. And using data_blob_talloc(mem_ctx, NULL, 16) adds the allocated blank 16 byte array to mem_ctx - so this is what must have been intended. Michael
2010-01-07s3:auth:sam_password_ok: enhance readability (imho) by adding some pointersMichael Adam1-17/+24
and removing bool variables and several checks. Michael
2010-01-07s3:check_sam_security: untangle assignment from statementMichael Adam1-1/+2
Michael
2009-12-07s3:auth: Fix typo in debug message.Karolin Seeger1-2/+2
Karolin
2009-07-16Tidyup prompted by #6554 - Wrong deallocation in sam_account_ok.Jeremy Allison1-2/+3
Jeremy.
2009-04-19s3:auth Fix segfault: Always initialise returned session keysAndrew Bartlett1-1/+3
2009-04-14Make Samba3 use the new common libcli/auth codeAndrew Bartlett1-8/+42
This is particuarly in the netlogon client (but not server at this stage)
2009-04-14Rework Samba3 to use new libcli/auth code (partial)Andrew Bartlett1-0/+1
This commit is mostly to cope with the removal of SamOemHash (replaced by arcfour_crypt()) and other collisions (such as changed function arguments compared to Samba3). We still provide creds_hash3 until Samba3 uses the credentials code in netlogon server Andrew Bartlett
2009-02-10Fix some nonempty blank linesVolker Lendecke1-9/+9
2008-10-11Cope with changed signature of http_timestring().Jelmer Vernooij1-1/+1
2008-06-24Fix bug #5555. Don't return NT_STATUS_PASSWORD_MUST_CHANGE error on machine ↵Jeremy Allison1-2/+3
account logon. Jeremy. (This used to be commit 10da498a2349bf5944183adf5a9284eafa2b8b74)
2008-05-07Rename server_info->was_mapped to server_info->nss_tokenVolker Lendecke1-1/+1
"nss_token" from my point of view much better reflects what this flag actually represents (This used to be commit b121a5acb2ef0bb3067d953b028696175432f10d)
2008-03-20Fix crash bug in check_sam_security() when make_server_info_sam() did aGünther Deschner1-1/+0
talloc_steal and talloc_free on the sam account already. Guenther (This used to be commit dbc7237a8a566f3e86bd6e4b48593b93c5bfb94e)
2008-02-05Fix typo.Karolin Seeger1-1/+1
Karolin (This used to be commit 906e19bad40ba0c0a473ec2601e9eb0fff169f83)
2007-12-07Remove next_token - all uses must now be next_token_talloc.Jeremy Allison1-7/+8
No more temptations to use static length strings. Jeremy. (This used to be commit ec003f39369910dee852b7cafb883ddaa321c2de)
2007-10-18RIP BOOL. Convert BOOL -> bool. I found a few interestingJeremy Allison1-5/+5
bugs in various places whilst doing this (places that assumed BOOL == int). I also need to fix the Samba4 pidl generation (next checkin). Jeremy. (This used to be commit f35a266b3cbb3e5fa6a86be60f34fe340a3ca71f)
2007-10-10r25401: BUG 4982: Don't delete lanman hashes on invalid logins whenGerald Carter1-4/+6
using the "lanman auth = no". Tested by Guenter Kukkukk. (This used to be commit 611fdd95a583ebd22ffa17e2f39c5a1bb0936c63)
2007-10-10r23784: use the GPLv3 boilerplate as recommended by the FSF and the license textAndrew Tridgell1-2/+1
(This used to be commit b0132e94fc5fef936aa766fb99a306b3628e9f07)
2007-10-10r23779: Change from v2 or later to v3 or later.Jeremy Allison1-1/+1
Jeremy. (This used to be commit 407e6e695b8366369b7c76af1ff76869b45347b3)
2007-10-10r23358: Fix from Justin Maggard <jmaggard@infrant.com> - ensure we don'tJeremy Allison1-1/+1
expire a password if it's explicitly set as ACB_PWNOTREQ. Jeremy. (This used to be commit 2ea5a6bd334e31201aa6f93f5c51e42924d36ebd)
2007-10-10r22844: Introduce const DATA_BLOB data_blob_null = { NULL, 0, NULL }; andVolker Lendecke1-2/+2
replace all data_blob(NULL, 0) calls. (This used to be commit 3d3d61687ef00181f4f04e001d42181d93ac931e)
2007-10-10r22022: - Clarify the commentsAndrew Bartlett1-2/+2
- make sure never to free an uninitialised variable - ensure to free result on getpwnam_alloc failure Andrew Bartlett (This used to be commit 5fe3328e66661371182cc1c3b6e239797c3b4f93)
2007-10-10r22020: Make it more clear that both the vuser struct and it's contents areAndrew Bartlett1-1/+1
talloc_free()'ed at the end of a session. Rework the passwd cache code to use talloc_unlink and talloc_reference, to more carefully manage the cache. Andrew Bartlett (This used to be commit e3e0ec25e67308de314aa61852905ee42aa2c8fe)
2007-10-10r19058: Implement "user cannot change password", and complete "user must changeJim McDonough1-1/+1
password at next logon" code. The "password last set time" of zero now means "user must change password", because that's how windows seems to use it. The "can change" and "must change" times are now calculated based on the "last set" time and policies. We use the "can change" field now to indicate that a user cannot change a password by putting MAX_TIME_T in it (so long as "last set" time isn't zero). Based on this, we set the password-can-change bit in the faked secdesc. (This used to be commit 21abbeaee9b7f7cff1d34d048463c30cda44a2e3)
2007-10-10r16230: Fix Klocwork #861 and others. localtime and asctimeJeremy Allison1-3/+18
can return NULL. Ensure we check all returns correctly. Jeremy. (This used to be commit 6c61dc8ed6d84f310ef391fb7700e93ef42c4afc)
2007-10-10r16204: Fix Klocwork # 14Volker Lendecke1-3/+5
localtime() can return NULL. Volker (This used to be commit 07c5dcb8633e6fadb596dc5a22d8d31b2e16a3ef)
2007-10-10r15476: Transfer the was_mapped flag from user_info to server_info also in ↵Volker Lendecke1-0/+2
auth_sam and auth_domain. Thanks for Simo to point this out. Volker (This used to be commit 293b89dfb109d6e220ced433f025cf987aa1f500)
2007-10-10r15088: Remove all time() and gettimeofday() calls out of the mainlineJeremy Allison1-3/+1
packet processing code. Only do these when needed (ie. in the idle timeout code). We drop an unneccessary global here too. Jeremy. (This used to be commit 8272a5ab0605fcf95527143c4f909aa1008e5b94)
2007-10-10r13711: * Correctly handle acb_info/acct_flags as uint32 not as uint16.Günther Deschner1-2/+2
* Fix a couple of related parsing issues. * in the info3 reply in a samlogon, return the ACB-flags (instead of returning zero) Guenther (This used to be commit 5b89e8bc24f0fdc8b52d5c9e849aba723df34ea7)
2007-10-10r13590: * replace all pdb_init_sam[_talloc]() calls with samu_new()Gerald Carter1-2/+3
* replace all pdb_{init,fill}_sam_pw() calls with samu_set_unix() (This used to be commit 6f1afa4acc93a07d0ee9940822d7715acaae634f)
2007-10-10r13576: This is the beginnings of moving the SAM_ACCOUNT data structureGerald Carter1-9/+9
to make full use of the new talloc() interface. Discussed with Volker and Jeremy. * remove the internal mem_ctx and simply use the talloc() structure as the context. * replace the internal free_fn() with a talloc_destructor() function * remove the unnecessary private nested structure * rename SAM_ACCOUNT to 'struct samu' to indicate the current an upcoming changes. Groups will most likely be replaced with a 'struct samg' in the future. Note that there are now passbd API changes. And for the most part, the wrapper functions remain the same. While this code has been tested on tdb and ldap based Samba PDC's as well as Samba member servers, there are probably still some bugs. The code also needs more testing under valgrind to ensure it's not leaking memory. But it's a start...... (This used to be commit 19b7593972480540283c5bf02c02e5ecd8d2c3f0)
2007-10-10r13541: we have to wrap pen_enum_group_memberships() in become/unbecome_root()Gerald Carter1-1/+5
blocks. This fixes the problem I had with missing groups in the net_samlogon() reply from a Samba PDC. (This used to be commit 06b83fe35048c84dfd68be2ee656317c51e89bce)
2007-10-10r13316: Let the carnage begin....Gerald Carter1-17/+26
Sync with trunk as off r13315 (This used to be commit 17e63ac4ed8325c0d44fe62b2442449f3298559f)
generated by cgit (git 2.34.1) at 2024-11-09 22:09:30 +0000