summaryrefslogtreecommitdiff
path: root/source3/auth
AgeCommit message (Collapse)AuthorFilesLines
2003-11-22(merge from 3.0)Andrew Bartlett4-30/+142
Changes all over the shop, but all towards: - NTLM2 support in the server - KEY_EXCH support in the server - variable length session keys. In detail: - NTLM2 is an extension of NTLMv1, that is compatible with existing domain controllers (unlike NTLMv2, which requires a DC upgrade). * This is known as 'NTLMv2 session security' * (This is not yet implemented on the RPC pipes however, so there may well still be issues for PDC setups, particuarly around password changes. We do not fully understand the sign/seal implications of NTLM2 on RPC pipes.) This requires modifications to our authentication subsystem, as we must handle the 'challege' input into the challenge-response algorithm being changed. This also needs to be turned off for 'security=server', which does not support this. - KEY_EXCH is another 'security' mechanism, whereby the session key actually used by the server is sent by the client, rather than being the shared-secret directly or indirectly. - As both these methods change the session key, the auth subsystem needed to be changed, to 'override' session keys provided by the backend. - There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation. - The 'names blob' in NTLMSSP is always in unicode - never in ascii. Don't make an ascii version ever. - The other big change is to allow variable length session keys. We have always assumed that session keys are 16 bytes long - and padded to this length if shorter. However, Kerberos session keys are 8 bytes long, when the krb5 login uses DES. * This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. * - Add better DEBUG() messages to ntlm_auth, warning administrators of misconfigurations that prevent access to the privileged pipe. This should help reduce some of the 'it just doesn't work' issues. - Fix data_blob_talloc() to behave the same way data_blob() does when passed a NULL data pointer. (just allocate) REMEMBER to make clean after this commit - I have changed plenty of data structures... Andrew Bartlett (This used to be commit 57a895aaabacc0c9147344d097d333793b77c947)
2003-11-10Patch from Andrew Bartlett <abartlet@samba.org> for security=server coreJeremy Allison1-6/+8
dump if server goes away. Jeremy. (This used to be commit a646cb60a24498451d379967a1da272fcd40875f)
2003-11-09From 3_0:Volker Lendecke1-0/+1
Skip over the winbind separator when looking up a user. Volker (This used to be commit efe36a44d3d35f2bbb3381916dfdfda80560b67c)
2003-11-06run krb5 logins through the username map if the winbindd lookup fails; bug 698Gerald Carter1-4/+9
(This used to be commit f7798571178d18aae9c0be5f437838222bfc25b9)
2003-10-24Andrew Bartlett patch to cope with Exchange 5.5 cleartext pop password auth.Jeremy Allison1-0/+16
Jeremy. (This used to be commit 2d09d8c9d973f5f414d31f749db12328ff315de7)
2003-10-22Put strcasecmp/strncasecmp on the banned list (except for needed callsJeremy Allison1-1/+1
in iconv.c and nsswitch/). Using them means you're not thinking about multibyte at all and I really want to discourage that. Jeremy. (This used to be commit 5c050a735f86927c7ef2a98b6f3a56abe39e4674)
2003-10-20more 2.2.x compatibility fixes - allow user looksup in the kerb5Gerald Carter1-1/+25
sesssetup to fall back to 'user' instaed of failing is REA.LM\user doesn't exist. also fix include line in smb_acls.h as requested by metze (This used to be commit 5ccf6baad7ffb1f992aaf24b41ef5c83362cf613)
2003-10-07make sure to call get_user_groups() with the full winbindd name for a user ↵Gerald Carter2-11/+22
if he;she has one; bug 406 (This used to be commit 19925e3a04f421f4dcc469b701f3cc51ef98ac2c)
2003-09-09sync 3.0 into HEAD for the last timeGerald Carter7-108/+128
(This used to be commit c17a7dc9a190156a069da3e861c18fd3f81224ad)
2003-08-02port latest changes from SAMBA_3_0 treeSimo Sorce5-14/+13
(This used to be commit 3101c236b8241dc0183995ffceed551876427de4)
2003-07-16trying to get HEAD building again. If you want the codeGerald Carter11-518/+498
prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE (This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad)
2003-05-28Spelling.Tim Potter1-1/+1
(This used to be commit e063c95bd5609e6aeade2d88e5cd9286d033971c)
2003-05-27volker's fix for crash when my_private_data == NULLGerald Carter1-2/+8
(This used to be commit 63bb1e21ebac68f904c01fb58ac7c06a9bcb8ab0)
2003-05-26Correctly initialize winbind auth method.Volker Lendecke1-0/+3
(This used to be commit 55cdb6b87850b483939a5d3edcd5be80be6f7493)
2003-05-15Patch from Luke Howard <lukeh@PADL.COM> that fixes some weird handling ofJelmer Vernooij1-9/+17
modules in auth/ (This used to be commit 3d804efe76335cd09640a82c0326dbf3eb83fe04)
2003-05-14spellingTim Potter1-2/+2
(This used to be commit 249a6974702d050644d6d61f33f0034ce2a689ee)
2003-05-01*id_to_*id call reshape to return NTSTATUS errorsSimo Sorce2-12/+14
plus internal fixes 1st stage (This used to be commit 6d036761e565bc93964bb3c939d5b7d78d5778a3)
2003-05-01Use ints for the version numbers in the smb_register_*() functions (patch by ↵Jelmer Vernooij1-1/+1
metze) (This used to be commit 3895571eeef81db7ce4c71e85b0be5c235b16efd)
2003-04-29This is a nice rewrite:Simo Sorce2-18/+18
SAM_ACCOUNT does not have anymore uid and gid fields all the code that used them has been fixed to use the proper idmap calls fix to idmap_tdb for first time idmap.tdb initialization. auth_serversupplied_info structure has now an uid and gid field few other fixes to make the system behave correctly with idmap tested only with tdbsam, but smbpasswd and nisplus should be ok have not tested ldap ! (This used to be commit 6a6f6032467e55aa9b76390e035623976477ba42)
2003-04-28Use NTSTATUS as return value for smb_register_*() functions and init_module()Jelmer Vernooij8-36/+43
function. Patch by metze with some minor modifications. (This used to be commit f4576757d1d52a8f1b96894c869bb76450003fd1)
2003-04-28Merge compile warning fixes from 3.0Andrew Bartlett1-1/+1
(This used to be commit c0903951a144b1f0502e77437ea166d7a26393ba)
2003-04-16Add some static and #ifdef DEVELOPERAndrew Bartlett1-3/+5
(This used to be commit 3bdbd320b001ea5881573f6c6a4c2259a60e2bb3)
2003-04-16Store the type of 'sec channel' that we establish to the DC. If we are aAndrew Bartlett1-2/+8
workstation, we have to use the workstation type, if we have a BDC account, we must use the BDC type - even if we are pretending to be a workstation at the moment. Also actually store and retreive the last change time, so we can do periodic password changes again (for RPC at least). And finally, a couple of minor fixes to 'net'. Andrew Bartlett (This used to be commit 6e6b7b79edae3efd0197651e9a8ce6775c001cf2)
2003-04-16Cause the winbind auth module to call the ntdomain module if winbind is notAndrew Bartlett2-42/+65
running. This causes Samba not to contact the NT domain controller if Winbind is there, but the user had the wrong password. Andrew Bartlett (This used to be commit 119a1c276a05d0017f39cc0b7118f12a4f51886e)
2003-04-07We never actually got an 'ads' auth module, so don't send the auth subsystemAndrew Bartlett1-1/+1
off on a wild probing spree looking for it. Andrew Bartlett (This used to be commit 7c7c5594b3dfd460d09bccd409ccbf64c6b42338)
2003-04-05some more idmapping :)Simo Sorce1-5/+7
(This used to be commit 5ac94535d7b7ce0cc0d44b9a77d6e42ddfd0cd26)
2003-04-02Map a useless error code to a useful one...Andrew Bartlett1-0/+5
(This used to be commit 1afb2695a020424d014c4dee9c6a73620281aaa8)
2003-03-25- Support building all auth modules as .so'sJelmer Vernooij1-1/+1
- Change 2 variable names to avoid conflicts (patch by Stephan Kulow <coolo@kde.org>) (This used to be commit 71b05cd14ae6df8340730e7bad1c783dc278c5d3)
2003-03-25Make auth.c compile again. I'm not sure what this does though...Volker Lendecke1-2/+3
Volker (This used to be commit 8e3f300f21e23b7e6b68ddcc45d581a962cd8aa4)
2003-03-24- Add support to auth/ for the new modules systemJelmer Vernooij8-81/+103
- Quite some small fixes (also fixes the build) (This used to be commit 3defbd5e0633acfa4631531b49601c7706072d86)
2003-03-23Fix compile.Andrew Bartlett1-2/+2
(This used to be commit 6fbee12a8170e0bce4e94806105786b38160ada5)
2003-03-23NTLM Authentication:Andrew Bartlett2-7/+3
- Add a 'privileged' mode to Winbindd. This is achieved by means of a directory under lockdir, that the admin can change the group access for. - This mode is now required to access with 'CRAP' authentication feature. - This *will* break the current SQUID helper, so I've fixed up our ntlm_auth replacement: - Update our NTLMSSP code to cope with 'datagram' mode, where we don't get a challenge. - Use this to make our ntlm_auth utility suitable for use in current Squid 2.5 servers. - Tested - works for Win2k clients, but not Win9X at present. NTLMSSP updates are needed. - Now uses fgets(), not x_fgets() to cope with Squid environment (I think somthing to do with non-blocking stdin). - Add much more robust connection code to wb_common.c - it will not connect to a server of a different protocol version, and it will automatically try and reconnect to the 'privileged' pipe if possible. - This could help with 'privileged' idmap operations etc in future. - Add a generic HEX encode routine to util_str.c, - fix a small line of dodgy C in StrnCpy_fn() - Correctly pull our 'session key' out of the info3 from th the DC. This is used in both the auth code, and in for export over the winbind pipe to ntlm_auth. - Given the user's challenge/response and access to the privileged pipe, allow external access to the 'session key'. To be used for MSCHAPv2 integration. Andrew Bartlett (This used to be commit dcdc75ebd89f504a0f6e3a3bc5b43298858d276b)
2003-03-19Fix some comment typosJelmer Vernooij1-2/+2
(This used to be commit 41ea416adbc074f3a34b66c18ed63c7d44ea28fc)
2003-03-15Now that mimir has done the grunt work, I'll fix up the commentAndrew Bartlett1-4/+1
(This used to be commit 7154fe10969a34b97ddc8321bfb5271b8e6d4795)
2003-03-14Extending code to work both in case of domain membershipRafal Szczesniak1-1/+1
and domain controller respecting interdomain trust relationships. In the latter case we need to find DC of remote domain instead of ours. In the former 'domain' is our domain name. Rafal (This used to be commit 0cd45d5d3b3e3ec5a589c3ee9f0e369901eefe8f)
2003-03-14Fresh meat in trusted domains code:Rafal Szczesniak1-20/+6
- packing/unpacking utility functions for trusted domain password struct; can be used to prepare buffer to store in secrets.tdb or (soon) passdb backend - similiar functions for DOM_SID - respectively modified secrets_(fetch|store) routines - new auth mapping code utilising introduced is_trusted_domain function - added tdb (un)packing of single bytes Rafal (This used to be commit 5281ee7e84421b9be746aed2f1718ceaf2a2fe3d)
2003-03-08Make sure that the 'remote' machine name can only be set once. For some weirdAndrew Bartlett1-1/+1
reason, during a Win2003 installation, when you select 'domain join' it sends one machine name in the name exchange, and litraly 'machinename' during the NTLMSSP login. Also fix up winbindd's logfile handling, so that it matches smbd and nmbd. (This helps me, by seperating the logs by pid). Andrew Bartlett (This used to be commit afe5a3832f79131fb74461577f1db0e5e8bf4b6d)
2003-02-28Doxygen janitor: rpc_resolve_dc parameter is spelled "trust_passwd"Martin Pool1-1/+1
(This used to be commit 9dbc3dcfe0bccf1f76930ae86970b48ba5ed1e91)
2003-02-28Doxygen janitor: check_domain_match parameter is spelledMartin Pool1-2/+2
"auth_context". (This used to be commit 571c3ce19344276aac1af56d2f69fcc5523f36eb)
2003-02-22Make sure we set the error code to indicate failure...Andrew Bartlett1-2/+11
Andrew Bartlett (This used to be commit 5a472e2a3cffe175ac4341e19c153a931505a2e8)
2003-02-22See if I can make this look slightly like C. It compiled locally, honest...Andrew Bartlett1-3/+4
Andrew Bartlett (This used to be commit cfc4cc776899da92a5c9a17f0ea36c7cb65d7a80)
2003-02-22First check if the user is in the passdb, then check Get_Pwnam().Andrew Bartlett2-31/+61
We check passdb becouse the user might have things like a logon script set, but we have to check the passdb becouse the user might not be in smbpasswd at all. This is in preperation for the removal of unixsam as an assuption. Andrew Bartlett (This used to be commit 61e3e2695860c58f9b0e8d1856972318666682c8)
2003-02-20For a number of months now, support for being a domain member without alsoAndrew Bartlett1-25/+14
running winbind has been broken. This fixes that, by removing assumptions about being able to call sid_to_uid() at will. This whole area needs revising when we get groups into the PDB. Andrew Bartlett (This used to be commit 980eda74b7df347c38b567ce976197826963324a)
2003-02-17If we didn't make the server_info correctly, then don't segfault trying toAndrew Bartlett1-1/+3
set the 'guest' bit. Andrew Bartlett (This used to be commit 960c53bf952de4431da4e90da035fcfbe98f1bd7)
2003-02-16Add the 'session key' output of the NTLMSSP exchange to the cli struct, soAndrew Bartlett2-3/+23
it can be used for 'net rpc join'. Also fix a bug in our server-side NTLMSSP code - a client without any domain trust links to us may calculate the NTLMv2 response with "" as the domain. Andrew Bartlett (This used to be commit ddaa42423bc952e59b95362f5f5aa7cca10d1ad4)
2003-02-14Ensure that only parse_prs.c access internal members of the prs_struct.Jeremy Allison1-2/+2
Needed to move to disk based i/o later. Jeremy. (This used to be commit 4c3ee228fcdb089eaeead95e79532a9cf6cb0de6)
2003-02-10Some cleanups:Andrew Bartlett4-5/+12
- Don't use pstrcpy into an allocated string - use safe_strcpy() directly instead. - Keep a copy of the 'server_info' attached to the vuid. In future use this for things like the session key, homedir and full name instead of current copies. - Try to avoid memory leak/segfault on Realloc failure - clear up #endif comments Andrew Bartlett (This used to be commit 162477bb086827950b6cb71afa9bef62c2753c2e)
2003-02-04Actually checking both the account and password tests would be a good idea...Andrew Bartlett1-2/+2
Andrew Bartlett (This used to be commit 49640635b15f53be6bb28d3d79255abe10c207dd)
2003-01-16Updates to the NTLMSSP code again - moving the base64 decode fuctionality outAndrew Bartlett1-4/+5
of the SWAT code, and adding a base64 encoder. The main purpose of this patch is to add NTLMSSP support to 'ntlm_auth', for use with Squid. Unfortunetly the squid side doesn't quite support what we need yet. Changes to winbind to get us the info we need, and a couple of consequential changes/cleanups in the rest of the code. Andrew Bartlett (This used to be commit fe50ca8f54ded2e119bde08831785fbe0db2ee99)
2003-01-15Missed auth_ntlmssp.c in last night's checkin. Also keep track of the currentAndrew Bartlett1-225/+78
challenge in the NTLMSSP context. Andrew Bartlett (This used to be commit ba13e058d4533b1ffba723b9e98e95090ad63d85)
generated by cgit (git 2.34.1) at 2024-11-05 04:08:06 +0000