Age | Commit message (Collapse) | Author | Files | Lines |
|
structure-memcpy for DATA_BLOB parameters to using a pointer to that DATA_BLOB.
auth_sam calls some of these functions, so I've cleaned it all up to use this
format now.
Also clean up some debug statements to make them easier to read.
Andrew Bartlett
(This used to be commit 0c355c274a6ac084e4bf15a15613dfc007d6c5fc)
|
|
LMv2 response less than 24 bytes is just silly.
Andrew Bartlett
(This used to be commit b4ecdb2e582376d2713f81e8e32a668014905d70)
|
|
important once we start doing schannel, as there would be a lot more
roundtrips for the second PIPE open and bind. With this patch logging
in to a member server is a matter of two (three if you count the
ack...) packets between us and the DC.
Volker
(This used to be commit 5b3cb7725a974629d0bd8b707bc2940c36b8745e)
|
|
(This used to be commit dbe36b4c43dceddea9f14161c6cf7b34709287c8)
|
|
function. Patch by metze with some minor modifications.
(This used to be commit bc4b51bcb2daa7271c884cb83bf8bdba6d3a9b6d)
|
|
(This used to be commit 456eb5d05a442ee380cfa756be54619b1d68fa48)
|
|
- better error codes than NT_STATUS_UNSUCCESSFUL for domain logon errors
- make auth_winbind load the ntdomain module if winbind isn't there.
- use new trusted domains cache to determine if the domain is valid.
Andrew Bartlett
(This used to be commit ec8d6524c6b0c70927a2b57aab71d9e3a7f8a150)
|
|
This allows us to join as a BDC, without appearing on the network as one
until we have the database replicated, and the admin changes the configuration.
This also change the SID retreval order from secrets.tdb, so we no longer
require a 'net rpc getsid' - the sid fetch during the domain join is sufficient.
Also minor fixes to 'net'.
Andrew Bartlett
(This used to be commit 876e00fd112e4aaf7519eec27f382eb99ec7562a)
|
|
(This used to be commit c7a1de090db35835be1a1623bfc80c04065c5dd9)
|
|
(This used to be commit 738a2b055a0757002e8cdcbf744c8663e0e26bc2)
|
|
NTLM Authentication:
- Add a 'privileged' mode to Winbindd. This is achieved by means of a directory
under lockdir, that the admin can change the group access for.
- This mode is now required to access with 'CRAP' authentication feature.
- This *will* break the current SQUID helper, so I've fixed up our ntlm_auth
replacement:
- Update our NTLMSSP code to cope with 'datagram' mode, where we don't get a
challenge.
- Use this to make our ntlm_auth utility suitable for use in current Squid 2.5
servers.
- Tested - works for Win2k clients, but not Win9X at present. NTLMSSP updates
are needed.
- Now uses fgets(), not x_fgets() to cope with Squid environment (I think
somthing to do with non-blocking stdin).
- Add much more robust connection code to wb_common.c - it will not connect to
a server of a different protocol version, and it will automatically try and
reconnect to the 'privileged' pipe if possible.
- This could help with 'privileged' idmap operations etc in future.
- Add a generic HEX encode routine to util_str.c,
- fix a small line of dodgy C in StrnCpy_fn()
- Correctly pull our 'session key' out of the info3 from th the DC. This is
used in both the auth code, and in for export over the winbind pipe to
ntlm_auth.
- Given the user's challenge/response and access to the privileged pipe,
allow external access to the 'session key'. To be used for MSCHAPv2
integration.
Andrew Bartlett
(This used to be commit ec071ca3dcbd3881dc08e6a8d7ac2ff0bcd57664)
|
|
(This used to be commit 051b33e98f94ad09b4d8816a88e78715e7dc2a5e)
|
|
'set_local_machine_name' so that the client can't change it from under us.
(.NET RC2 and WinXP install calls the machine 'machinename' during NTLMSSP
on the domain join).
Andrew Bartlett
(This used to be commit 4c7163e7c2cc09bd95faa05156ee480957a7a4d8)
|
|
(This used to be commit 7a2566f2e922191e691b6dafb1a09e22913cccd6)
|
|
(This used to be commit 04a5cbc8964386774acdca759b4cfaded068c8f2)
|
|
- user_ok() and user_in_group() now take a list of groups, instead of
looking for the user in the members of all groups.
- The 'server_info' returned from the authentication is now kept around
- in future we won't copy the sesion key, username etc, we will just
referece them directly.
- rhosts upgraded to use the SAM if possible, otherwise fake up based on
getpwnam().
- auth_util code to deal with groups upgraded to deal with non-winbind domain
members again.
Andrew Bartlett
(This used to be commit 74b5436c75114170ce7c780c19226103d0df9060)
|
|
interop with clients not in our domain.
Andrew Bartlett
(This used to be commit 6aa3aba3db604d481dc96c3befe066938cb1b0f3)
|
|
Needed to move to disk based i/o later.
Jeremy.
(This used to be commit a823fee5b41a5b6cd4ef05aa1f85f7725bd272a5)
|
|
- use safe_strcpy() instead of pstrcpy() for malloc()ed strings
- CUPS: a failure in an attempt to automaticly add a printer is not level 0 stuff.
- Fix up a possible Realloc() failure segfault
Andrew Bartlett
(This used to be commit c1cfc296c2efdb2b5972202146e80f0e3b6a3da4)
|
|
Andrew Bartlett
(This used to be commit 830de56bf2f47412acfebf6c6353ab4b98c8517e)
|
|
- NTLMSSP over SPENGO (sesssion-setup-and-x) cleanup and code refactor.
- also consequential changes to the NTLMSSP and SPNEGO parsing functions
- and the client code that uses the same functions
- Add ntlm_auth, a NTLMSSP authentication interface for use by applications
like Squid and Apache.
- also consquential changes to use common code for base64 encode/decode.
- Winbind changes to support ntlm_auth (I don't want this program to need
to read smb.conf, instead getting all it's details over the pipe).
- nmbd changes for fstrcat() instead of fstrcpy().
Andrew Bartlett
(This used to be commit fbb46da79cf322570a7e3318100c304bbf33409e)
|
|
used to be commit b741abd496621586040081c04674ae53cb5db47c)
|
|
of the SWAT code, and adding a base64 encoder.
The main purpose of this patch is to add NTLMSSP support to 'ntlm_auth', for
use with Squid. Unfortunetly the squid side doesn't quite support what we need
yet.
Changes to winbind to get us the info we need, and a couple of consequential
changes/cleanups in the rest of the code.
Andrew Bartlett
(This used to be commit fe50ca8f54ded2e119bde08831785fbe0db2ee99)
|
|
challenge in the NTLMSSP context.
Andrew Bartlett
(This used to be commit ba13e058d4533b1ffba723b9e98e95090ad63d85)
|
|
- fix a crash when a second NTLMSSP session tried to free the first
- fix a crash due to some NULL pointers in the Add Printer Wizard (or read
printer code too it appears). As far as I can tell it's just that the
GUID just might not exist.
Andrew Bartlett
(This used to be commit 51b1413056b0d001076ff47a755eb35baa2d9e6d)
|
|
Andrew Bartlett
(This used to be commit 2a1adb8f81d8966e8919fffb9b4c69f3e6acd44f)
|
|
Jeremy.
(This used to be commit faf443e5198e270f1a60d7a0939074efca750a94)
|
|
Jeremy
(This used to be commit 67a0b30f50aa323185cbcf3a9d39804239222480)
|
|
last changed at '0'.
We need to actually change this password sometime...
Andrew Bartlett
(This used to be commit 740bf439d2d1512127c873cf0e57697161d6566b)
|
|
Controller. As we have had a number of attempts at this over the last little
while, I need to get my test rig going, and give this whole area a poke...
Meanwhile, if you want to use this, just adjust your 'auth methods' line to use
samstrict_dc...
Andrew Bartlett
(This used to be commit 18e598ec24493026008fcfe486057555b8832108)
|
|
This tries to extract our server-side code out of sessetup.c, and into a more
general lib. I hope this is only a temporay resting place - I indend to
refactor it again into an auth-subsystem independent lib, using callbacks.
Move some of our our NTLMSSP #defines into a new file, and add two that I found
in the COMsource docs - we seem to have a double-up, but I've verified from
traces that the NTLMSSP_TARGET_TYPE_{DOMAIN,SERVER} is real.
This code also copes with ASCII clients - not that we will ever see any here,
but I hope to use this for HTTP, were we can get them. Win2k authenticates
fine under forced ASCII, btw.
Tested with Win2k, NTLMv2 and Samba's smbclient.
Andrew Bartlett
(This used to be commit b6641badcbb2fb3bfec9d00a6466318203ea33e1)
|
|
Realloc()ed, causing it to fail.
Big thanks to Sandor Sonfeld <sonf@linuxmail.org> for the debug, stack and
valgrind traces!
Andrew Bartlett
(This used to be commit 7abca6d281da6388899f78e3440d7ce37bf2094e)
|
|
(signed/unsigned mixup).
Andrew Bartlett
(This used to be commit f42cf0783fa3aeddc4992021df9ee6f3b1aa58f3)
|
|
Andrew Bartlett
(This used to be commit 32a1802a99a51b033eee034d3d2ce5cf409441dc)
|
|
routines). In particular, we now better support the NT# in LM feild, and the
LMv2 password scheme. (LMv2 is basicly NTLMv2 capped at 24 bytes, slightly
more secure, and in the LM feild for compatiblity).
Thanks to the Samba-TNG team and Luke Leighton for various descriptions of this
algorithm, and to MS for a solution that seems to actually make sense for once
:-).
Andrew Bartlett
(This used to be commit 5c2e34b5b6a2241b8d2fd68458eb73bb65ade6fd)
|
|
may not be to our PDC (might be BDC, or trusted DC).
Andrew Bartlett
(This used to be commit 610be8d483f335226386f92b5e85ddeb07846d41)
|
|
static 'unix' string, so we don't need a second pdb specific version.
Andrew Bartlett
(This used to be commit 91ca4771c6b834747b06fff21822a14e929de2c1)
|
|
warnings. (Adds a lot of const).
Andrew Bartlett
(This used to be commit 3a7458f9472432ef12c43008414925fd1ce8ea0c)
|
|
don't need a second just for pdb.
Also, remove magic 'is lp_guest_account' test - the magic RID should be
up to the passdb backend to set.
Andrew Bartlett
(This used to be commit f71c8338d35a2e8c73c3d8006ea6858cb522c715)
|
|
This patch makes Samba compile cleanly with -Wwrite-strings.
- That is, all string literals are marked as 'const'. These strings are
always read only, this just marks them as such for passing to other functions.
What is most supprising is that I didn't need to change more than a few lines of code (all
in 'net', which got a small cleanup of net.h and extern variables). The rest
is just adding a lot of 'const'.
As far as I can tell, I have not added any new warnings - apart from making all
of tdbutil.c's function const (so they warn for adding that const string to
struct).
Andrew Bartlett
(This used to be commit 92a777d0eaa4fb3a1c7835816f93c6bdd456816d)
|
|
Jeremy.
(This used to be commit aa8439a49ec4b9f433745fefa1e769e45398f4df)
|
|
Jeremy.
(This used to be commit 784d15761c3271bfd602866f8f9f880dac77671c)
|
|
named. Ensure we can query them.
Jeremy.
(This used to be commit 842e08e52a665ae678eea239759bb2de1a0d7b33)
|
|
named. Ensure we can query them.
Jeremy.
(This used to be commit 09a218a9f6fb0bd922940467bf8500eb4f1bcf84)
|
|
server = DC1 *
(This used to be commit f49de4c5176bf635ac080e082fda412066b466c8)
|
|
server = DC1 *
(This used to be commit 6b18ca9511ddcf1718f222af3f61491d1e5f3b60)
|
|
Jeremy.
(This used to be commit ff3a8d37289216a2cb808406044a7abef1e564d0)
|
|
Jeremy.
(This used to be commit ec4ed45563f9d8e25fcfd88840944a90b3139c3e)
|
|
(This used to be commit 7d099e9a5b7164e8cdbdb93d8c4527f02c8bdefd)
|
|
should actual functional differences between HEAD and 3.0.
- Mostly reformatting
- Removal of unecessary #include "smb.h"
- Merge of dyn_DRIVERFILE removal
- Silly bug fix for python code
(This used to be commit d3998307adc50ba50defe610cb656c73799ae3b9)
|