Age | Commit message (Collapse) | Author | Files | Lines |
|
(This used to be commit 97eb3a121d33200ee7559b2413d6252efc04ebaf)
|
|
the passdb) and RIDs not in the passdb, due to being NIS users etc.
The main fix here is to add become_root()/unbecome_root() at critical places.
This (finally) fixes the bug where you could not see local users's names
in a file's security properties as non-root. Tested.
The similar bug in uid_to_sid is also fixed, but is not (yet) Tested.
Andrew Bartlett
(This used to be commit 79327a305e20d78ab5ca21d01c39b5f49dc0d632)
|
|
WARNING: if you relied on these logic flaws, you will need to manually
edit your ldap backend (for things like account expries etc).
Now correctly retunes the information needed for 'must change at next login'
support.
(This used to be commit 26842f1ac051b030c1295b68244a1f9007d4eefb)
|
|
Jeremy.
(This used to be commit 28ef07424f19652fdfa4ee79f1c69e0004fa39fe)
|
|
Some reformatting and spelling fixes.
(This used to be commit a0f7bbad11a0c0f1ecd930626289c5ff493b0f1d)
|
|
overwriting an old MACHINE.SID sid.
Jeremy.
(This used to be commit 896d4fac98460778f72378b084a76d5aab11462e)
|
|
dlopen & friends into configure.in. This should help building on *BSD
where dl*** calls are in libc.
Jeremy
(This used to be commit ac1baba35d7a399bf800ced49a4384e39955e3eb)
|
|
- Fix warnings in loadparm.c
- Remove the unused 'passdb modules path' paramater
- Make pdb_ldap use $ termination rather than the workstation trust account
flag becouse some 'machine' accounts appear as normal accounts at creation
time. Also covers domains etc.
Andrew Bartlett
(This used to be commit 8c82a3daf777bcd4cd4388d30222e370fe800819)
|
|
(This used to be commit 438f028fc45ee6c5b12fa960beabea4b5fdcff38)
|
|
fails.
Andrew Bartlett
(This used to be commit 56009ffbaa00259d15f286248a7ab73c55371819)
|
|
(This used to be commit 520c8626dc238a1e338635981d1b41950f2219b6)
|
|
should chose the next available RID. For smbpasswd it just means using the algorithm, but other backends can do somthing more useful.
Andrew Bartlett
(This used to be commit 0f0f87e6c31b468368c5a4729db892622e616cac)
|
|
we still need to free gid<->rid mapping and few other stuff
(This used to be commit aa4b6f8181f34196a28951264dd8b631a5deef7f)
|
|
fixed tdbsam memory corruption (and segfault)
reducing calls to pdb_uid_to_user_rid and countrary to 0 to move to a non alghoritmic rid allocation with some passdb modules.
(This used to be commit 9836af7cd623357feaec07bc49cfb78f0aa01fc3)
|
|
(This used to be commit 724390a8daabbecd236960562e0a50f62c6904f1)
|
|
(This used to be commit 1f007d3ed41c1b71a89fa6be7d173e67e927c302)
|
|
(This used to be commit 764b99a3906d6299650f984860a586f37b18326d)
|
|
Jeremy.
(This used to be commit d08cbcbc5d4fc3ec9554145de6b0b0a64dfbb8d1)
|
|
Jeremy.
(This used to be commit 45bf5f6c050bbe69209a5c80141ef8e54354f5ea)
|
|
and the machine name are identical.
Jeremy.
(This used to be commit 87e6b08964d13d6613342c9be21871a2e776e2e6)
|
|
rather than MACHINE.SID. We try to load MACHINE.SID only if we can't
fetch the SID from secrets.tdb
This also fixes the value of global_sam_sid for the DC/non-DC case
(This used to be commit bcd018f07c2e2c0aabdb4574d199d7f5f199a264)
|
|
names
(This used to be commit 4cb7b6954b96e6964743e65413e122f7b4d39052)
|
|
(This used to be commit d4d2f3bd8922aa88f4940e5079f7157ea674b317)
|
|
without a unix account.
(This used to be commit 2fdd601f2efaf3515f0e4c30fa176651eb4bb387)
|
|
The main change here is to move ldap into the new pluggable passdb subsystem
and to take the LDAP location as a 'location' paramter on the 'passdb backend'
line in the smb.conf. This is an LDAP URL, parsed by OpenLDAP where supported,
and by hand where it isn't.
It also adds the ldap user suffix and ldap machine suffix smb.conf options,
so that machines added to the LDAP dir don't get mixed in with people.
Non-unix account support is also added. This means that machines don't need to
be in /etc/passwd or in nss_ldap's scope.
This code has stood up well under my production environment, so it relitivly
well tested.
I'm commiting this now becouse others have shown interest in using it, and
there is no point 'hording' the code :-).
Andrew Bartlett
(This used to be commit cd5234d7dd7309d88944b83d807c1f1c2ca0460a)
|
|
working.
(This used to be commit 4ecc170dcb84522135ddefb5f424cc756051a6d3)
|
|
(This used to be commit 5b28a7c59c392c6352cb8915a13806ca772d8cac)
|
|
Rafal Szczesniak <mimir@diament.ists.pwr.wroc.pl>
This adds the 'net' tools to manipulate the trusted domains.
Andrew Bartlett
(This used to be commit 770c8a31d9804d3339ffa0de8b5072a5c7eb02df)
|
|
you to join a 2nd domain then leave the old domain rather than the other way
around
(This used to be commit b26b6aef64e1042c9867a13761ded0c3c6f9670f)
|
|
This allow the user to select
'passdb backend = plugin : /path/to/plugin.so : pluging args'
And load any arbitary plugin. Apparently Jelmer has a mysql plugin in the
works - hence this patch.
We probably need to rework the interface a bit before 3.0 (add versioning of
some kind) but this is a good start.
Andrew Bartlett
(This used to be commit d6d18b70f0c377344b0b3d9df5a11d209793bfe0)
|
|
(This used to be commit 8bb2a7446ed69020086aaedf2889795dd38ef9d4)
|
|
/etc/passwd) and replace them with a version that works. Unfortunetly HEAD and
2.2 have different passdb interfaces and different local_password_change
functions...
Andrew Bartlett
(This used to be commit 86d5326d0dc6a070dfeb24a5306a2b4404bfc0f1)
|
|
Changed "SMB/Netbios" to "SMB/CIFS" in file header.
(This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
|
|
entry in /etc/passwd.
There are still differences in the local_password_change function. I'm
not sure which was the latest so I didn't change any thing else. Someone
needs to take a look and sync these up.
(This used to be commit 539b025397e569796f2349d33438c2be469c8c69)
|
|
- Rework the name -> sid lookup function to always try local lookup first (for
local domain names) before trying winbind. This seems to eliminate my winbind
feedback loop problems. (I don't use winbind for nsswitch, where there are
almost certainly further issues).
Andrew Bartlett
(This used to be commit 25cadce67bc8effd4248ab993ae78e1d8511d994)
|
|
make its use clearer.
(This used to be commit d1ea20cc2392f8ba4ac4241f9b5ec14489e49147)
|
|
(This used to be commit 8ffc024ebc73dee32a9dfc1873e824c996205475)
|
|
(This used to be commit 3db417c2ebfda0d5872dee39e36edc4fb6299b9a)
|
|
Modules now name themselves, which should allow for sane behaviour when we get
an 'extern' passdb module (which in turn loads a .so).
Fix up tdbsam for non-unix-accounts. Not sure if this fixes idra's bug, but
its a start...
Andrew Bartlett
(This used to be commit 7d576d89d7b4a7b95e87a844568d7d7cd89f0542)
|
|
idra has promised not to revert these this time :-)
(This used to be commit f556ad67e82518f5a024ffe9184ff9430ab5c541)
|
|
same reason as per pdb_tdb.c
there isn't (and will never be probably) another call to any getpw* fn,
let's use getpwnam_alloc only when needed.
(This used to be commit f12361b1327306e6a3fcf8ff138413ad9a6c69a3)
|
|
(This used to be commit 57a145bff6b382e6dc9a9af96451175d81462c8d)
|
|
(This used to be commit 7f7a15e09a53a03dd423d40201f037f8da049cd7)
|
|
We are not going to reuse any getpw* call, so the extra alloc,copy and free
only uses extra memory and extra cpu time for nothing.
(This used to be commit 5c0bb0487bec00df494b72b64ddf274f42bfefea)
|
|
(This used to be commit 59905d44e51d83f2d4a7b6844e0ae764e0b35c0c)
|
|
Andrew Bartlett
(This used to be commit a96503475d9c1d91c2dfcdebb4f60183432d9aff)
|
|
(This used to be commit e8a891354d307b2352eac375b9be02d7616cdb61)
|
|
Samba now features a pluggable passdb interface, along the same lines as the
one in use in the auth subsystem. In this case, only one backend may be active
at a time by the 'normal' interface, and only one backend per passdb_context is
permitted outside that.
This pluggable interface is designed to allow any number of passdb backends to
be compiled in, with the selection at runtime. The 'passdb backend' paramater
has been created (and documented!) to support this.
As such, configure has been modfied to allow (for example) --with-ldap and the
old smbpasswd to be selected at the same time.
This patch also introduces two new backends: smbpasswd_nua and tdbsam_nua.
These two backends accept 'non unix accounts', where the user does *not* exist
in /etc/passwd. These accounts' don't have UIDs in the unix sense, but to
avoid conflicts in the algroitmic mapping of RIDs, they use the values
specified in the 'non unix account range' paramter - in the same way as the
winbind ranges are specifed.
While I was at it, I cleaned up some of the code in pdb_tdb (code copied
directly from smbpasswd and not really considered properly). Most of this was
to do with % macro expansion on stored data. It isn't easy to get the macros
into the tdb, and the first password change will 'expand' them. tdbsam needs
to use a similar system to pdb_ldap in this regard.
This patch only makes minor adjustments to pdb_nisplus and pdb_ldap, becouse I
don't have the test facilities for these. I plan to incoroprate at least
pdb_ldap into this scheme after consultation with Jerry.
Each (converted) passdb module now no longer has any 'static' variables, and
only exports 1 init function outside its .c file.
The non-unix-account support in this patch has been proven! It is now possible
to join a win2k machine to a Samba PDC without an account in /etc/passwd!
Other changes:
Minor interface adjustments:
pdb_delete_sam_account() now takes a SAM_ACCOUNT, not a char*.
pdb_update_sam_account() no longer takes the 'override' argument that was being
ignored so often (every other passdb backend). Extra checks have been added in
some places.
Minor code changes:
smbpasswd no longer attempts to initialise the passdb at startup, this is
now done on first use.
pdbedit has lost some of its 'machine account' logic, as this behaviour is now
controlled by the passdb subsystem directly.
The samr subsystem no longer calls 'local password change', but does the pdb
interactions directly. This allow the ACB_ flags specifed to be transferred
direct to the backend, without interference.
Doco:
I've updated the doco to reflect some of the changes, and removed some paramters
no longer applicable to HEAD.
(This used to be commit ff354c99c585068af6dc1ff35a1f109a806b326b)
|
|
This time its the pdb_getsampwuid() function - which was only being used by the
SAMR rpc subsystem to gain a 'user session key'. This 'user session key' is
actually generated at login time, and the other changes here simply move that
data around.
This also means that (when I check some details) we will be able to use the
user session key, even when we are not actually the DC, becouse its one of the
components of the info3 struct returned on logon.
Andrew Bartlett
(This used to be commit 799ac01fe08a338e4e94289f5d6767ebf905c1fa)
|
|
conversion across to the pdb_set...() interface.
Now we only set strings that are non-null. This allows Win2k to join the
domain again, particularly when using tdbsam.
Andrew Bartlett
(This used to be commit 6d0b3d051f8f74ea6235173a89e96f5934aff4f3)
|