summaryrefslogtreecommitdiff
path: root/source3/auth
AgeCommit message (Collapse)AuthorFilesLines
2001-10-02Fixed up the change password bug when not using PAM.Jeremy Allison1-2/+2
The problem is we were trying to use mask_match as a generic wildcard matcher for UNIX strings (like the password prompts). We can't do that - we need a unix_wild_match (re-added into lib/util.c) as the ms_fnmatch semantics for empty strings are completely wrong. This caused partial reads to be accepted as correct passwd change responses when they were not.... Also added paranioa test to stop passwd change being done as root with no %u in the passwd program string. Jeremy. (This used to be commit 9333bbeb7627c8b21a3eaeae1683c34e17d14bf0)
2001-10-02Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter9-33/+1
(This used to be commit 2d0922b0eabfdc0aaf1d0797482fef47ed7fde8e)
2001-10-01honor the ACB_PWNOEXP flag in smbpasswdAndrew Tridgell1-2/+1
(This used to be commit 70b7c900c907c4620faa7d82845296298b3820ff)
2001-10-01- fix handling of 0 last_change_time and must_change_timeAndrew Tridgell1-31/+32
- move the arbitrary 21 day timeout to local.h (This used to be commit 11075f543470c3283accce0246d0b2983420695a)
2001-09-29Fix up a number of intertwined issues:Andrew Bartlett3-10/+30
The big one is a global change to allow us to NULLify the free'ed pointer to a former passdb object. This was done to allow idra's SAFE_FREE() macro to do its magic, and to satisfy the input test in pdb_init_sam() for a NULL pointer to start with. This NULL pointer test was what was breaking the adding of accounts up until now, and this code has been reworked to avoid duplicating work - I hope this will avoid a similar mess-up in future. Finally, I fixed a few nasty bugs where the pdb_ fuctions's return codes were being ignored. Some of these functions malloc() and are permitted to fail. Also, this caught a nasty bug where pdb_set_lanman_password(sam, NULL) acheived precisely didilly-squat, just returning False. Now that we check the returns this bug was spotted. This could allow different LM and NT passwords. - the pdbedit code needs to start checking these too, but I havn't had a chance to fix it. I have also fixed up where some of the password changing code was using the pdb_set functions to store *internal* data. I assume this is from a previous lot of mass conversion work... Most likally (and going on past experience) I have missed somthing, probably in the LanMan password change code which I havn't yet been able to test, but this lot is in much better shape than it was before. If all this is too much to swallow (particularly for 2.2.2) then just adding a sam_pass = NULL to the particular line of passdb.c should do the trick for the ovbious bug. Andrew Bartlett (This used to be commit 762c8758a7869809d89b4da9c2a5249678942930)
2001-09-26Process the workstation trust account code INSIDE the authenticaion subsystem,Andrew Bartlett1-5/+20
just like any other logon. Matching code removal in reply.c to follow. Andrew Bartlett (This used to be commit da4873d889928e9bd88e736e26e4e77e87bcd931)
2001-09-26Rearrange the order of the checks in auth_smbpasswd.c, always check passwordsAndrew Bartlett1-73/+111
first. Add password expiry and 'must change before first logon' support. - This requires that the passdb be up to the job to supply the info. (This used to be commit 53c1c5091ea4e3ccc294f8b6f132be78c11c431f)
2001-09-20Move pass_check.c over to NTSTATUS, allowing full NTSTATUS from PAM to wire!Andrew Bartlett2-83/+121
Add the ability for swat to run in non-root-mode (ie non-root from inetd). - we still need some of the am_root() calls fixed however. (This used to be commit 2c2317c56ee13abdbdbc866363c3b52dab826e3c)
2001-09-20We are not meant to touch the username, so use the pass->pw_name output ratherAndrew Bartlett1-6/+6
than Get_Pwnam(user, True). (This used to be commit bf81f0021328da97afe58cc17317b15ec1b3cc96)
2001-09-20Fix for MiXed and UPPER case usernames with plaintext PAM passwords.Andrew Bartlett1-1/+1
(This used to be commit ba1b411f556bfac8b953c44c81257c7d8fb9817d)
2001-09-20Revert this one: The NTLMv2 checks need the original username as foundAndrew Bartlett1-1/+1
on the wire. (This used to be commit 7c9ae76b3ff4f1ba88ddad570648f32f99e38944)
2001-09-19- Fix up to use sampass->username insted of user_info->smb_usernameAndrew Bartlett1-7/+7
- Fix initial lookup to use the mapped username. (This used to be commit 162b88e2313dbcf0b95300b8f18a3e9b6b6b29bd)
2001-09-19Remove the ugly hacks to get around the Get_Pwnam() calls in pass_check.c byAndrew Bartlett2-9/+16
simply not doing Get_Pwnam() calls in pass_check.c We now make *one* sys_getpnam() call in cgi.c and we always call PAM no matter what it returns. We also no longer run the password cracker for these logins. The truly parinod will note the slight difference in call paths, in that we only call crypt for valid password structs (if not --with-pam). The truly parinoid don't run SWAT either, so I don't think this is an issue. Andrew Bartlett (This used to be commit 9020d884935243f28c19cedc88f076f0709e12cb)
2001-09-17move to SAFE_FREE()Simo Sorce2-3/+3
(This used to be commit a95943fde0ad89ae3f2deca2f7ba9cb5ab612b74)
2001-09-17move to SAFE_FREE()Simo Sorce1-12/+9
(This used to be commit 64d35e94fe6f7e56353b286162f670c8595a90e6)
2001-09-16Fix up workstaion and kickoff time checks, moved to auth_smbpasswd.c whereAndrew Bartlett2-13/+55
they can have general effect. Fixed up workstaion support in the rest of samba, so that we can do these checks. Pass through the workstation for cli_net_logon(), if supplied. (This used to be commit 7f04a139b2ee34b4c282590509cdf21395815a7a)
2001-09-14Now that we always get back an NTSTATUS code actually pass it on to theAndrew Bartlett2-17/+5
auth subsytem. Also kill off the (unneeded) wrapper fuction. Andrew Bartlett (This used to be commit 96f06b490ac5e9fd86debccf8d41675fa41f7726)
2001-09-12Some patches to authentication:Tim Potter4-17/+26
- the usersupplied_info now contains a smb_username (as it comes across on the wire) and a unix_username (after being passed through mapping functions) - when doing security={server,domain} use the smb_username, otherwise use the unix_username (This used to be commit d34fd8ec0716127c7a68eeb8e77d1ae8cc07b547)
2001-09-10made a couple of local fns staticAndrew Tridgell1-1/+1
(This used to be commit f0851202a852bed28fbd2446b44ce2b977ddacd8)
2001-09-04cope with pam being offAndrew Tridgell1-1/+1
(This used to be commit 5f6e7bbce76c85571ee10a3f8b5bbbd0beadb632)
2001-09-04the next stage in the NTSTATUS/WERROR change. smbd and nmbd now compile, but ↵Andrew Tridgell9-44/+44
the client code still needs some work (This used to be commit dcd6e735f709a9231860ceb9682db40ff26c9a66)
2001-08-30Fixed silly typo.Jeremy Allison1-3/+3
Jeremy. (This used to be commit 6ee2b41429e43f6a9a58eba3cb01b952be3d5ca5)
2001-08-30Fix from Paul Green to set correct lengths.Jeremy Allison1-3/+3
Jeremy. (This used to be commit 52b9b6d519c38b2a3e524d098a09fb996e8a2047)
2001-08-27converted another bunch of stuff to NTSTATUSAndrew Tridgell8-27/+27
(This used to be commit 1d36250e338ae0ff9fbbf86019809205dd97d05e)
2001-08-27started converting NTSTATUS to be a structure on systems with gcc in order ↵Andrew Tridgell1-8/+9
to make it type incompatible with BOOL so we catch errors sooner. This has already found a number of bugs (This used to be commit 1b778bc7d22efff3f90dc450eb12baa1241cf68f)
2001-08-24get rid of compiler warningsHerb Lewis3-8/+8
(This used to be commit 0768991d04ea03e774ca8662c9cae5e1951b88e0)
2001-08-24Fixed incorrect debug.Tim Potter1-4/+1
(This used to be commit cec051cf5fb93d9f45eca3f9cf462f78a7d7040d)
2001-08-23Fix up some unused variables and functions, fix up formattingAndrew Bartlett1-1/+0
(This used to be commit bfce4ba7b6db261d981a60a7e262f2f690355f5c)
2001-08-21Add a new option to disable our paranoid server check.Andrew Bartlett1-1/+1
Defaults to ON, ie checking (This used to be commit bd3010263be24425206587abfdb41164089e2157)
2001-08-20Add comment to clarify why we call this twice.Andrew Bartlett1-0/+2
(This used to be commit afece03d023b2905c27e147516b61487a7503028)
2001-08-20two fixes for NT clients -> share level Samba serverAndrew Tridgell1-1/+2
(This used to be commit a25911d58c752350b62b205cfb0d6fc5b1c90cef)
2001-08-17smbd/auth_server: Doco, we want to use cli_nt_error here soonAndrew Bartlett1-0/+1
smbd/password.c: We don't use globals here anymore smbd/reply.c: Tidyness, global_myworkgroup must die! smbd/service.c: Move some of the make_connection code into a helper function. (This used to be commit 15c87e404fcaff9e360a40b8b673938c6e611daf)
2001-08-17Style cleanup for the last vuid change.Andrew Bartlett1-5/+8
Style, doco and DEBUG() fixes for auth_smbpasswd.c (In particular for the account control call). Andrew Bartlett (This used to be commit 3d91c119420973d7dd1af416a1e26efa113dc626)
2001-08-12This patch does a number of things, mostly smaller than they look :-)Andrew Bartlett5-420/+153
In particuar, it moves the domain_client_validate stuff out of auth_domain.c to somwhere where they (I hope) they can be shared with winbind better. (This may need some work) The main purpose of this patch was however to improve some of the internal documentation and to correctly place become_root()/unbecome_root() calls within the code. Finally this patch moves some more of auth.c into other files, auth_unix.c in this case. Andrew Bartlett (This used to be commit ea1c547ac880def29f150de2172c95213509350e)
2001-08-10Use the new client error api.Tim Potter1-1/+1
(This used to be commit 688da3c41dd944f7f69083518d25e9edbc55406f)
2001-08-09a few cleanups while mergeing the passdb code into 2.2Gerald Carter1-1/+1
(This used to be commit ef01739708479c43f529c646dd136ee5670b08f9)
2001-08-06Record the NT_STATUS constant rather than its number in the logfilesAndrew Bartlett1-1/+2
Fix typo in lmhosts manpage (This used to be commit 9fff946cf113b4858b730f5ba644d5648ba95027)
2001-08-03This is the fix for the PAM bug I probably introduced in the previous commit,Andrew Bartlett1-0/+3
which I will confirm once I can find a box it would break on in the first place. (this is the pam accounts as nobody thing we had with 2.2.0) Andrew Bartlett (This used to be commit 9746ad12bd2d310e5c255c7ea491b87170b807af)
2001-08-03This is my 'Authentication Rewrite' version 1.01, mostly as submitted toAndrew Bartlett6-0/+1471
samba-technical a few weeks ago. The idea here is to standardize the checking of user names and passwords, thereby ensuring that all authtentications pass the same standards. The interface currently implemented in as nt_status = check_password(user_info, server_info) where user_info contains (mostly) the authentication data, and server_info contains things like the user-id they got, and their resolved user name. The current ugliness with the way the structures are created will be killed the next revision, when they will be created and malloced by creator functions. This patch also includes the first implementation of NTLMv2 in HEAD, but which needs some more testing. We also add a hack to allow plaintext passwords to be compared with smbpasswd, not the system password database. Finally, this patch probably reintroduces the PAM accounts bug we had in 2.2.0, I'll fix that once this hits the tree. (I've just finished testing it on a wide variety of platforms, so I want to get this patch in). (This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
2001-07-23Fix case insensitive password change code.Jeremy Allison1-4/+2
Fixed crash bug with un-zeroed talloced memory. Jeremy. (This used to be commit eea1c30df246e081e672d7132345d0fd35ad9841)
2001-07-08This removes unused paramaters from various authtication functions, and shouldAndrew Bartlett1-7/+2
not change behaviour. This should make my later diffs smaller, where I actualy start cleaning up this mess... Andrew Bartlett (This used to be commit 04f090c224bb7ac3b53c430a591fce1fc939a81c)
2001-07-06Password changing via PAM works now. DONT CHANGE THIS UNLESS YOU RE-TEST !!!!!!Jeremy Allison1-2/+19
Jeremy. (This used to be commit 79574c07ed5de7194a17c9ee8d189370d8e42bcc)
2001-06-25Added Andrew's pam password change stuff. Needs some testing but looks good !Jeremy Allison1-44/+140
Jeremy. (This used to be commit e94957d548745649ce04423dc6f16bbe3dd4f869)
2001-05-09Fixed up the oldpw prompts. Made the matching case insensitive.Jeremy Allison1-5/+24
Jeremy. (This used to be commit 70bdf8e76135e96fabcedeffbfd5892a564985e0)
2001-05-02Had to add a "pam password change" parameter (defaults to "off") and inlinedJeremy Allison1-10/+11
the pam password change code to ensure that existing and working password chat scripts don't break with 2.2.1. PAM password changing has to be explicitly requested. Allowed wildcards in pam password change matching (matches password chat script matching). Had to add const (sorry Tim :-) to ms_fnmatch() to stop warnings. Don't worry - the const changes are isolated and don't cause any other warnings :-). Jeremy. (This used to be commit 47b4d82536c09bffe3a0d9917fa31d935f1be7d8)
2001-05-01Runtime check for broken PAM systems with no appdata_ptr support. ThisJeremy Allison1-2/+22
should eventually be an autoconf test with a #ifdef workaround. I *HATE* pam :-). Jeremy. (This used to be commit 52a9226a5aaa769e960619c2bd0a561dd9b0493d)
2001-05-01Stop coredump on pam password change with pam_pwdb.so module on error.Jeremy Allison1-1/+5
Jeremy. (This used to be commit d9b960b4a5997e4cd09e3da9ea4754cbae1e29b3)
2001-05-01Added Andrew Bartlett's fixes to my changes to his original patch (at theJeremy Allison2-3/+3
court of king caractacus, was just passing by... :-). Jeremy. (This used to be commit acc3e7a057ad7fb0c2fb1cafff0c623ec0524d04)
2001-05-01Allow pam code to compile on Solaris (which doesn't have ↵Jeremy Allison1-0/+5
PAM_AUTHTOK_RECOVER_ERR). Jeremy. (This used to be commit 6b2dd14205a4170c11067c4f851db11ab9154fce)
2001-04-30Fixing consts in pam code.Jeremy Allison1-2/+2
Jeremy. (This used to be commit c4d3df4f145dc28d1b285fad64c787cebb613e70)
generated by cgit (git 2.34.1) at 2024-12-22 23:22:53 +0000