summaryrefslogtreecommitdiff
path: root/source3/passdb
AgeCommit message (Collapse)AuthorFilesLines
2002-01-02fixing compile errorGerald Carter1-4/+4
(This used to be commit 999a2f5c847c6a4336df60807e2fb546a2a4894f)
2002-01-02We should be SHLD not LINK when creating shared libraries.Jeremy Allison1-2/+2
Tidyup in passdb.c Jeremy. (This used to be commit 676eea502a1bb2114a6e8055ecaf97ecab2e3a91)
2002-01-02We go to a lot of effort to avoid strcpy() in Samba, but its not much use ifAndrew Bartlett1-12/+12
people start doing using strlen(src) in strncpy() :-) This occured when the talloc based passdb was reverted in favor of a pstring based one. In the talloc version this was fine, becouse the buffer was strlen(src) bytes long. This no longer applies... This doesn't seem to have broken anything, but I'm chasing up an oddity with NT password changing from the last merge. Test & MERGE for 2.2.3 Andrew Bartlett (This used to be commit 673ece2841e8b60966a17ece3591f9f202807332)
2002-01-02Actually enforce the passdb API.Andrew Bartlett4-189/+264
Thou shalt not reference SAM_ACCOUNT members directly - always use pdb_get/pdb_set. This is achived by making the whole of SAM_ACCOUNT have a .private member, where the real members live. This caught a pile of examples, and these have beeen fixed. The pdb_get..() functions are 'const' (have been for some time) and this required a few small changes to constify other functions. I've also added some debugs to the pdb get and set, they can be removed if requested. I've rewritten the copy_id2x_to_sam_pass() functions to use the new passdb interface, but I need the flags info to do it properly. The pdb_free_sam() funciton now blanks out the LM and NT hashes, and as such I have removed many extra 'samr_clear_sam_passwd(smbpass)' calls as a result. Finally, any and all testing is always appriciated - but the basics seem to work. Andrew Bartlett (This used to be commit d3dd28f6c443187b8d820d5a39c7c5b3be2fa95c)
2001-12-31ops, froget to set the values.Simo Sorce1-1/+7
jerry, can you look at theis where we use standard_sub_advanced() fns? I think this structure should be backported to 2.2 because we do not know if the SAM_ACCOUNT strings have enough space to contain the "substituted" string. (Yes, just now we know they are pstrings, but we may change them into alloced one, I'm a strong suported of alloced strings as 1024 bytes are not always enough and are often too much) (This used to be commit 29b3b5e9292805aa65e887755567abd50f74e5cb)
2001-12-31port mods from 2.2Simo Sorce1-3/+36
(This used to be commit f796f18a83cd2fc0988612aa38c794f005efbfaf)
2001-12-31more irix -64 portability fixesAndrew Tridgell1-5/+6
(This used to be commit 65e857b36e170e3ecd78bf6695ae73342e9c04cd)
2001-12-31Make --with-tdbsam compile again, given the new 'am I setting a default' flags.Andrew Bartlett1-4/+4
Andrew Bartlett (This used to be commit 20d7c5d9b9bc0a426897f21b3350933602abdbf1)
2001-12-31removed extern samlogon_userGerald Carter1-6/+0
(This used to be commit a7dc0febe4285b70d3ff5b27505b2681731bfba1)
2001-12-31remove samlogon_userGerald Carter1-10/+1
(This used to be commit a5f4559b2aade54f1c0f717eea21881f482faff2)
2001-12-31some merges from 2.2. Still need to merge in changes from pdb_tdb.cGerald Carter4-143/+239
but it will take more time as I don't want to loose any fixes that are only in HEAD. (This used to be commit efcde5d9d8ce44c0613764504d797be54ba21473)
2001-12-30util_sid.c - respect a const variabile (addedd strdup)Simo Sorce2-23/+48
cli_reg.c - indentation pdb_ldap.c - some checks on init fns parameters pdb_tdb.c - some checks on init fns parameters + make sure we close the db on failure (This used to be commit 49f5cb7a3df6d673f86e6769319aa657e30d8380)
2001-12-30Finally remove these files, which moved (by cvs backend magic) to source/authAndrew Bartlett2-1668/+0
at the start of the month. (This used to be commit 30ef625897cd025e1895c932b55dee027f060413)
2001-12-30pdb_getsampwnuid() merge from 2.2Gerald Carter5-156/+29
(This used to be commit 54cbfc7ebcdf1bd2094407b689b0050f0abfa46f)
2001-12-28removed unused filesGerald Carter4-2320/+0
(This used to be commit c6d867b55273167a0adaeb979062752edeb09549)
2001-12-27moving SAM_ACCOUNT to include a bit field for initializedGerald Carter5-73/+45
members (such as uid and gid). This way we will be able to keep ourselves from writing out default smb.conf settings when the admin doesn't want to, That part is not done yet. Tested compiles with ldap/tdb/smbpasswd. Tested connection with smbpasswd backend. oh...and smbpasswd doesn'y automatically expire accounts after 21 days from the last password change either now. Just ifdef'd out that code in build_sam_account(). Will merge updates into 2.2 as they are necessary. jerry (This used to be commit f0d43791157d8f04a13a07d029f203ad4384d317)
2001-12-14Rafal (mimir) patch for trusts r.Jean-François Micouleau1-6/+20
(This used to be commit c26623671e2b0b2e80c6d6383a99880c4f439f04)
2001-12-13update the ldap support code. it compiles.Jean-François Micouleau1-0/+41
Ignacio you can update your howto ;-) samsync: a small patch to try chaning challenges. J.F. (This used to be commit c99bc305599698f2291efbfe20024355cb2bcde0)
2001-12-06again an intrusive patch:Jean-François Micouleau5-45/+10
- removed the ugly as hell sam_logon_in_ssb variable, I changed a bit the definition of standard_sub_basic() to cope with that. - removed the smb.conf: 'domain admin group' and 'domain guest group' parameters ! We're not playing anymore with the user's group RIDs ! - in get_domain_user_groups(), if the user's gid is a group, put it first in the group RID list. I just have to write an HOWTO now ;-) J.F. (This used to be commit fef52c4b96c987115fb1818c00c2352c67790e50)
2001-12-05Add a couple of extra debugs for the secrets.tdb stuffAndrew Bartlett1-2/+8
(This used to be commit c76c1f6904510d6ecca3453f91433420f22b7bd6)
2001-12-05auto-init secrets.tdbAndrew Tridgell1-0/+5
(This used to be commit aff916e543f1c70aa5fe0fc07dda21e772625097)
2001-12-04added a boolean to the group mapping functions to specify if we need orJean-François Micouleau5-35/+23
not the privileges. Usually we don't need them, so the memory is free early. lib/util_sid.c: added some helper functions to check an SID. passdb/passdb.c: renamed local_lookup_rid() to local_lookup_sid() and pass an RID all the way. If the group doesn't exist on the domain SID, don't return a faked one as it can collide with a builtin one. Some rpc structures have been badly designed, they return only rids and force the client to do subsequent lsa_lookup_sid() on the domain sid and the builtin sid ! rpc_server/srv_util.c: wrote a new version of get_domain_user_groups(). Only the samr code uses it atm. It uses the group mapping code instead of a bloody hard coded crap. The netlogon code will use it too, but I have to do some test first. J.F. (This used to be commit 6c87e96149101995b7d049657d5c26eefef37d8c)
2001-12-04This comment no longer applies.Andrew Bartlett1-1/+0
(This used to be commit 153c4a56b0b5473a1efb208551f36480cdb5d264)
2001-12-03added a tdb to store the account policy informations.Jean-François Micouleau1-3/+11
You can change them with either usermanager->policies->account or from a command prompt on NT/W2K: net accounts /domain we can add a rpc accounts to the net command. As the net_rpc.c is still empty, I did not start. How should I add command to it ? Should I take the rpcclient/cmd_xxx functions and call them from there ? alse changed the SAM_UNK_INFO_3 parser, it's an NTTIME. This one is more for jeremy ;-) J.F. (This used to be commit bc28a8eebd9245ce3004ae4b1a359db51f77bf21)
2001-12-02added mapping of primary gid to rid thru the group mapping code.Jean-François Micouleau5-29/+143
and cleanup and comments in passdb/passdb.c J.F. (This used to be commit 6533339887832ca6dd42d99385c615db7bee3d43)
2001-11-29Changed again how the privilege list is handled in the group mapping code.Jean-François Micouleau1-0/+2
This time it's a PRIVILEGE_SET struct instead of a simple uint32 array. It makes much more sense. Also added a uint32 systemaccount to the GROUP_MAP struct as some privilege showing in USRMGR.EXE are not real privs but a bitmask flag. I guess it's an heritage from NT 3.0 ! I could setup an NT 3.1 box to verify, but I'm too lazy (yes I still have my CDs). Added 3 more LSA calls: SetSystemAccount, AddPrivileges and RemovePrivileges, we can manage all this privilege from UserManager. Time to change the NT_USER_TOKEN struct and add checks in all the rpc functions. Fun, fun, fun. J.F. (This used to be commit 3f0a9ef2b8c626cfa2878394bb7b642342342bf3)
2001-11-28add .po32 files to ignore listHerb Lewis1-1/+2
(This used to be commit 5f625f2877fc5132be3030fc6ea9df4d59ecff05)
2001-11-27unable to open smbpasswd on initial create should only be a warningAndrew Tridgell1-1/+1
(This used to be commit 8712ac84995f8454619245ca111575d4b9769b43)
2001-11-26Ignore *.po files.Tim Potter1-0/+1
(This used to be commit 091f01f34ab0ff7d394811af0d027ea3bad56d0e)
2001-11-25Don't close tdb twice.Volker Lendecke1-1/+0
(This used to be commit 6dda341bc80dc7c4d044df134fc153f646a6a4e9)
2001-11-24added "net join" commandAndrew Tridgell1-3/+33
this completes the first stage of the smbd ADS support (This used to be commit 058a5aee901e6609969ef7e1d482a720a84a4a12)
2001-11-24This is another rather major change to the samba authenticaionAndrew Bartlett1-1/+1
subystem. The particular aim is to modularized the interface - so that we can have arbitrary password back-ends. This code adds one such back-end, a 'winbind' module to authenticate against the winbind_auth_crap functionality. While fully-functional this code is mainly useful as a demonstration, because we don't get back the info3 as we would for direct ntdomain authentication. This commit introduced the new 'auth methods' parameter, in the spirit of the 'auth order' discussed on the lists. It is renamed because not all the methods may be consulted, even if previous methods fail - they may not have a suitable challenge for example. Also, we have a 'local' authentication method, for old-style 'unix if plaintext, sam if encrypted' authentication and a 'guest' module to handle guest logins in a single place. While this current design is not ideal, I feel that it does provide a better infrastructure than the current design, and can be built upon. The following parameters have changed: - use rhosts = This has been replaced by the 'rhosts' authentication method, and can be specified like 'auth methods = guest rhosts' - hosts equiv = This needs both this parameter and an 'auth methods' entry to be effective. (auth methods = guest hostsequiv ....) - plaintext to smbpasswd = This is replaced by specifying 'sam' rather than 'local' in the auth methods. The security = parameter is unchanged, and now provides defaults for the 'auth methods' parameter. The available auth methods are: guest rhosts hostsequiv sam (passdb direct hash access) unix (PAM, crypt() etc) local (the combination of the above, based on encryption) smbserver (old security=server) ntdomain (old security=domain) winbind (use winbind to cache DC connections) Assistance in testing, or the production of new and interesting authentication modules is always appreciated. Andrew Bartlett (This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-24Kill off that crazy copy_sam_passwd(). You simply can't do that if theAndrew Bartlett1-12/+0
structre contains pointers (well not if you intend of free those pointers at some stage) There is no reason (given the new passdb interface) that you can't modify a SAM_ACCOUNT in any case. Andrew Bartlett (This used to be commit e8e73f7f0fcd86c8c2bfe3fc0b44ea2fd6570cc5)
2001-11-23Changed how the privileges are stored in the group mapping code. It's nowJean-François Micouleau1-7/+32
an array of uint32. That's not perfect but that's better. Added more privileges too. Changed the local_lookup_rid/name functions in passdb.c to check if the group is mapped. Makes the LSA rpc calls return correct groups Corrected the return code in the LSA server code enum_sids. Only enumerate well known aliases if they are mapped to real unix groups. Won't confuse user seeing groups not available. Added a short/long view to smbgroupedit. now decoding rpc calls to add/remove privileges to sid. J.F. (This used to be commit f29774e58973f421bfa163c45bfae201a140f28c)
2001-11-17Tidyups when I was doing the big merge...Jeremy Allison1-5/+10
Jeremy. (This used to be commit 9148bb9eaa67de60c3b0b4709a9c05a840c20c66)
2001-11-11Minor updates. A small dose of const.Andrew Bartlett1-1/+1
(This used to be commit 80667cb0dd1a2cdef17711c8580af9f524971cea)
2001-11-11Remove built-in support for clear-text kerberos authentication.Andrew Bartlett1-123/+3
This should remove some confusion from the ./configure, but does not affect the 'real' kerberos support currently residing in smbd/sesssetup.c. This code is vunerable to a spoofed KDC, and is best replaced by --with-pam and the pam_krb5 module. This module includes measures to prevent such spoofing. Andrew Bartlett (This used to be commit 3235880b41ee5dd5ef171195489fb9254f5d89b0)
2001-11-09As pdb_ldap.c does not compile in HEAD anyway, a not-compiled mergeVolker Lendecke1-2/+6
from 2_2. Volker (This used to be commit 7d70b30dbdf06de126b78879fc89708ca335f91e)
2001-11-07Added debug in truncate, fixed warning with gcc3.Jeremy Allison1-2/+1
Jeremy. (This used to be commit 970ec14b4ba1ccf66820384ced8442e1878c09cd)
2001-11-07UGLY HACK to get machines to join tdbsam domains again.Andrew Bartlett1-2/+4
The problem is that we don't use the bitmap field, and so have to guess what feilds to change. NT4 sets the RID to NULL in its reply, (as a no-change value) and we were attempting to set that as a RID. jfm: Can you get me the info on that bitmap, so I can construct a proper fix to all this? Thanks! (This used to be commit 39f9c78d07d7af6abc71b33a6018ac0237608b6a)
2001-11-04Fixup for accounts without a local /etc/passwd entry.Andrew Bartlett1-9/+5
- Now perfectly valid. (This used to be commit be04aad90da341fb1b4ef472f2279aefab972258)
2001-11-01Various post AuthRewrite cleanups, fixups and tidyups.Andrew Bartlett3-12/+8
Zero out some of the plaintext passwords for paranoia Fix up some of the other passdb backends with the change to *uid_t rather than uid_t. Make some of the code in srv_netlog_nt.c clearer, is passing an array around, so pass its lenght in is definition, not as a seperate paramater. Use sizeof() rather than magic numbers, it makes things easier to read. Cope with a PAM authenticated user who is not in /etc/passwd - currently by saying NO_SUCH_USER, but this can change in future. Andrew Bartlett (This used to be commit 514c91b16baca639bb04638042bf9894d881172a)
2001-10-31This is a farily large patch (3300 lines) and reworks most of the AuthRewriteAndrew Bartlett2-16/+71
code. In particular this assists tpot in some of his work, becouse it provides the connection between the authenticaion and the vuid generation. Major Changes: - Fully malloc'ed structures. - Massive rework of the code so that all structures are made and destroyed using malloc and free, rather than hanging around on the stack. - SAM_ACCOUNT unix uids and gids are now pointers to the same, to allow them to be declared 'invalid' without the chance that people might get ROOT by default. - kill off some of the "DOMAIN\user" lookups. These can be readded at a more appropriate place (probably domain_client_validate.c) in the future. They don't belong in session setups. - Massive introduction of DATA_BLOB structures, particularly for passwords. - Use NTLMSSP flags to tell the backend what its getting, rather than magic lenghths. - Fix winbind back up again, but tpot is redoing this soon anyway. - Abstract much of the work in srv_netlog_nt back into auth helper functions. This is a LARGE change, and any assistance is testing it is appriciated. Domain logons are still broken (as far as I can tell) but other functionality seems intact. Needs testing with a wide variety of MS clients. Andrew Bartlett (This used to be commit f70fb819b2f57bd57232b51808345e2319d52f6c)
2001-10-31Small 'const' updates ahead of some AuthRewrite merging.Andrew Bartlett1-5/+5
(This used to be commit 3b5e72bda3263c6bdf81dfface4fae4f06b71032)
2001-10-30Fix up smbpasswd -e/-d so that it doesn't change the password under you anyAndrew Bartlett1-20/+1
more. (Previously it set them to 'XXXX' or similar when only the flags were being changed - a bug I must have introduced when I reworked the passdb end of things a few weeks back.) Adds a new local flag: LOCAL_SET_PASSWORD to specify that the password is actually to be changed. Andrew Bartlett (This used to be commit cea6b6cb228c7e1f0c2d45951590e0d8fb8b315c)
2001-10-29This commit is number 4 of 4.Andrew Bartlett8-185/+128
In particular this commit focuses on: Actually adding the 'const' to the passdb interface, and the flow-on changes. Also kill off the 'disp_info' stuff, as its no longer used. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes introduces a large dose of 'const' to the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username --- This finishes this line of commits off, your tree should now compile again :-) Andrew Bartlett (This used to be commit c95f5aeb9327347674589ae313b75bee3bf8e317)
2001-10-29This commit is number 3 of 4.Andrew Bartlett1-1/+1
In particular this commit focuses on: Changing the Get_Pwnam code so that it can work in a const-enforced environment. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes allow for 'const' in the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username (This used to be commit e7634f81c5116ff4addfb7e495f54b6bb78e8f77)
2001-10-29This commit is number 2 of 4.Andrew Bartlett3-65/+80
In particular this commit focuses on: The guts of the moving about inside passdb. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes allow for the introduction of a large dose of 'const' to the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username passdb/ - Kill off disp_info stuff, it isn't used any more - Kill off support for writing to the old smbpasswd format, it isn't relevent to Samba 3.0 - Move around and modify the pdb_...() helper functions, adding one that sets the last changed time to 'now' and that sets the must change time appropriately. - Remove the ugly forced update of the LCT- value in pdb_smbpasswd. - Remove the implicit modification of the ACB flags when both NT and LM passwords are set. - Removed substation in pdb_getsampwnam output, as a single password change will render them inoperable in any case (they will be substituted and stored) - Added a default RID to the init_sam_from_pw() function, based on our rid algorithm. - Added checks that an smbpasswd stored user has a uid-based RID. - Fail to store tdb based users without a RID lib/ - Change the substituion code to use global_myname if there is no connection (and therefore no called name) at the present time. (This used to be commit 8f607810eb24ed1157bbd2e896c2c167bc34d986)
2001-10-29This commit is number 1 of 4.Andrew Bartlett1-23/+54
In particular this commit focusses on: Adding the new 'pass changed now' helper function. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. (This used to be commit a8971a5448cf6d203b379c3ed01e331d5263c9ee)
2001-10-18Merge the become_XXX -> change_to_XXX fixes from 2.2.2 to HEAD.Jeremy Allison2-2/+2
Ensure make_conection() can only be called as root. Jeremy. (This used to be commit 8d23a7441b4687458ee021bfe8880558506eddba)
generated by cgit (git 2.34.1) at 2024-11-02 13:01:38 +0000