summaryrefslogtreecommitdiff
path: root/source3/libsmb/pwd_cache.c
AgeCommit message (Collapse)AuthorFilesLines
2004-01-05Correctly handle per-pipe NTLMSSP inside a NULL session. Previously weAndrew Bartlett1-2/+8
would attempt to supply a password to the 'inside' NTLMSSP, which the remote side naturally rejected. Andrew Bartlett (This used to be commit da408e0d5aa29ca1505c2fd96b32deae9ed940c4)
2003-07-14Jeremy requested that I get my NTLMSSP patch into CVS. He didn't requestAndrew Bartlett1-11/+3
the schannel code, but I've included that anyway. :-) This patch revives the client-side NTLMSSP support for RPC named pipes in Samba, and cleans up the client and server schannel code. The use of the new code is enabled by the 'sign', 'seal' and 'schannel' commands in rpcclient. The aim was to prove that our separate NTLMSSP client library actually implements NTLMSSP signing and sealing as per Microsoft's NTLMv1 implementation, in the hope that knowing this will assist us in correctly implementing NTLMSSP signing for SMB packets. (Still not yet functional) This patch replaces the NTLMSSP implementation in rpc_client/cli_pipe.c with calls to libsmb/ntlmssp.c. In the process, we have gained the ability to use the more secure NT password, and the ability to sign-only, instead of having to seal the pipe connection. (Previously we were limited to sealing, and could only use the LM-password derived key). Our new client-side NTLMSSP code also needed alteration to cope with our comparatively simple server-side implementation. A future step is to replace it with calls to the same NTLMSSP library. Also included in this patch is the schannel 'sign only' patch I submitted to the team earlier. While not enabled (and not functional, at this stage) the work in this patch makes the code paths *much* easier to follow. I have also included similar hooks in rpccleint to allow the use of schannel on *any* pipe. rpcclient now defaults to not using schannel (or any other extra per-pipe authenticiation) for any connection. The 'schannel' command enables schannel for all pipes until disabled. This code is also much more secure than the previous code, as changes to our cli_pipe routines ensure that the authentication footer cannot be removed by an attacker, and more error states are correctly handled. (The same needs to be done to our server) Andrew Bartlett (This used to be commit 5472ddc9eaf4e79c5b2e1c8ee8c7f190dc285f19)
2002-11-12Removed global_myworkgroup, global_myname, global_myscope. Added liberalJeremy Allison1-12/+2
dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy. (This used to be commit f755711df8f74f9b8e8c1a2b0d07d02a931eeb89)
2002-07-15updated the 3.0 branch from the head branch - ready for alpha18Andrew Tridgell1-118/+19
(This used to be commit 03ac082dcb375b6f3ca3d810a6a6367542bc23ce)
2002-01-30Removed version number from file header.Tim Potter1-2/+1
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2001-12-04Add 'net rpc join' to match the ADS equiv.Andrew Bartlett1-0/+2
This kills off the offending code in smbpasswd -j -Uab%c In the process we have changed from unsing compelatly random passwords to random, 15 char ascii strings. While this does produce a decrese in entropy, it is still vastly greater than we need, considering the application. In the meantime this allows us to actually *type* the machine account password duruign debugging. This code also adds a 'check' step to the join, confirming that the stored password does indeed do somthing of value :-) Andrew Bartlett (This used to be commit c0b7ee6ee547dc7ff798eaf8cb63fbe344073029)
2001-11-15Tidyup formatting a bit (spaces->tabs) whilst reading new code to understandJeremy Allison1-46/+34
connection caching. Getting ready for back-merge to 2.2.3. Jeremy. (This used to be commit 5e8df83ba9924adf9df6827c06ed1a2adbe36edf)
2001-11-03Added NT_USER_TOKEN into server_info to fix extra groups problem.Jeremy Allison1-13/+3
Got "medieval on our ass" about const warnings (as many as I could :-). Jeremy. (This used to be commit ee5e7ca547eff016818ba5c43b8ea0c9fa69b808)
2001-10-02Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter1-3/+0
(This used to be commit 2d0922b0eabfdc0aaf1d0797482fef47ed7fde8e)
2001-07-04The big character set handling changeover!Andrew Tridgell1-10/+4
This commit gets rid of all our old codepage handling and replaces it with iconv. All internal strings in Samba are now in "unix" charset, which may be multi-byte. See internals.doc and my posting to samba-technical for a more complete explanation. (This used to be commit debb471267960e56005a741817ebd227ecfc512a)
2001-03-14set of changes in the beginning of bringing rpcclient changesGerald Carter1-0/+10
back to working order. The main change is that the cli_*() RPC functions from libsmb/*.c now should accept a struct cli_state*. The reason for this is that rpcclient should establish the connection to the server at startup so that it is not necessary to keep the clear test or password hash in memory for each command. enumports and enumprinters now works as well. lsa* functions have been tested. SAMR calls may or may not work (one of the core dumps I know), but it compiles :-) jerry (This used to be commit d98ac8852ae6b39b6fcff92c346ba56d9e63c518)
2000-07-03first pass at merging rpcclient from TNG to HEAD. You can get aGerald Carter1-0/+9
semi-connection and a rpcclient prompt, but no functionality there yet. Will be a few more days on that. These files changed only with the addition of some support functions from TNG --jerry (This used to be commit a04ea15f723e559db3c60bed03318cc7be851f69)
2000-05-10lib/util_unistr.c:Jeremy Allison1-48/+0
libsmb/clilist.c: rpc_server/srv_spoolss_nt.c: smbd/trans2.c: Changed unistr_to_ascii to unistr_to_dos - do codepage conversion. msdfs/msdfs.c: Removed stub unistr_to_dos. libsmb/pwd_cache.c: Removed obfuscation functions as they don't do anything and don't add any security. Jeremy. (This used to be commit 1ed146467e764e6a81d8f78cd58fb5765ebf5d21)
2000-01-03simple mods to add msrpc pipe redirection. default behaviour: fall backLuke Leighton1-0/+54
to using internal msrpc code in smbd. (This used to be commit 8976e26d46cb991710bc77463f7f928ac00dd4d8)
1999-12-13first pass at updating head branch to be to be the same as the SAMBA_2_0 branchAndrew Tridgell1-187/+30
(This used to be commit 453a822a76780063dff23526c35408866d0c0154)
1999-12-03argh! smb-agent redirection client reusage is a nightmare!Luke Leighton1-0/+10
moved smb-agent over to a single-process model instead of fork() in order to reuse client connections. except, of course, you can't do a select() on the same socket connections! argh! (This used to be commit e9e5a34de8e8f9a69e817aceb8c16284334d4642)
1999-12-03cool! a unix socket smb redirector. code based on smbfilter andLuke Leighton1-0/+8
ideas from ssh-agent. the intent is to be able to share smb sessions using cli_net_use_add() across multiple processes, where one process knows the target server name, user name and domain, but not the smb password. (This used to be commit 294b653f2e9cdc1864ec638ae8b4300df25723cf)
1999-12-02clearing up connection-related stuff. password credentials were messingLuke Leighton1-9/+1
up. added a complicated prompt which i don't like, but it tells you domain\user@hostname$ (This used to be commit 338d08f69b0eeefa0f3f2c0217ef17ea3e815e1f)
1999-12-011) when no domain used in ntlogin test command, should use default oneLuke Leighton1-6/+57
from previous lsaquery command. over-ridden from DOMAIN\username 2) initialisation of cli_state is a little more specific: sets use_ntlmv2 to Auto. this can always be over-ridden. 3) fixed reusage of ntlmssp_cli_flgs which was being a pain 4) added pwd_compare() function then fixed bug in cli_use where NULL domain name was making connections multiply unfruitfully 5) type-casting of mallocs and Reallocs that cause ansi-c compilers to bitch (This used to be commit 301a6efaf67ddc96e6dcfd21b45a82863ff8f39a)
1999-11-29this is going to sound _really_ weird, ok, but i had to implementLuke Leighton1-3/+3
equivalents of NetUseAdd and NetUseDel! (This used to be commit 86f4b1d3cc3887c4bb7bd6433f5f932f7db1b88e)
1999-11-21implement server-side generation of NTLMv2 session key. YESSS :-)Luke Leighton1-14/+3
(This used to be commit 1092b4f6fbdf3770c0dab756b982a562def1738e)
1999-11-21you know what? this sort of thing makes me laugh. hmm, what functionsLuke Leighton1-1/+32
have we got. and what data do we have. hmm.. i wonder what the NTLMv2 user session key can be... hmmm... weell.... there's some hidden data here, generated from the user password that doesn't go over-the-wire, so that's _got_ to be involved. and... that bit of data took a lot of computation to produce, so it's probably _also_ involved... and md4 no, md5? no, how about hmac_md5 yes let's try that one (the other's didn't work) oh goodie, it worked! i love it when this sort of thing happens. took all of fifteen minutes to guess it. tried concatenating client and server challenges. tried concatenating _random_ bits of client and server challenges. tried md5 of the above. tried hmac_md5 of the above. eventually, it boils down to this: kr = MD4(NT#,username,domainname) hmacntchal=hmac_md5(kr, nt server challenge) sess_key = hmac_md5(kr, hmacntchal); (This used to be commit ab174759cd210fe1be888d0c589a5b2669f7ff1e)
1999-10-07- added rudimentary CAP_UNICODE support because i thought it was part ofLuke Leighton1-0/+21
a problem i was having. - added rudimentary CAP_STATUS32 support for same reason. - added hard-coded, copy-the-same-data-from-over-the-wire version of CAP_EXTENDED_SECURITY, which is a security-blob to encapsulate GSSAPI which encodes SPNEGO which is used to negotiate Kerberos or NTLMSSP. i have implemented NTLMSSP which negotiates NTLMv1 or NTLMv2 and 40-bit or 128-bit etc. i have implemented NTLMv1 / 40-bit. *whew*. (This used to be commit e5b80bd2f76fda70e41e4a9007eb035dab92ed8e)
1999-06-29improving authentication code (tidyup).Luke Leighton1-10/+72
(This used to be commit ab1a6aa42db5217f025941fb5107436556bc23b7)
1998-10-14dce/rpcLuke Leighton1-1/+1
(This used to be commit 69f5f9f88935de1f63ffc9aa19c0629b395e66e6)
1998-10-08dce/rpcLuke Leighton1-4/+16
(This used to be commit 62fdeef1b79c5c4c9bf0e860881651711bb80b9a)
1998-09-28Changes to test in configure if capabilities are enabled on a system.Jeremy Allison1-5/+4
Changes to get Samba to compile cleanly with the IRIX compiler with the options : -fullwarn -woff 1209,1174 (the -woff options are to turn off warnings about unused function parameters and controlling loop expressions being constants). Split prototype generation as we hit a limit in IRIX nawk. Removed "." code in smbd/filename.c (yet again :-). Jeremy. (This used to be commit e0567433bd72aec17bf5a54cc292701095d25f09)
1998-09-25added rpcclient programLuke Leighton1-0/+236
(This used to be commit aa38f39d67fade4dfd7badb7a9b39c833a1dd1ca)
generated by cgit (git 2.34.1) at 2024-12-19 20:14:51 +0000