summaryrefslogtreecommitdiff
path: root/source3/rpc_server
AgeCommit message (Collapse)AuthorFilesLines
2004-03-01Ok here it is my latest work on privilegesSimo Sorce4-40/+108
This patch add privilege support for samba Currently it is implemented only for tdbsam backend but estending it to other sam backends is straightforward. I must make a big thank to JFM for his teachings on the matter and the functions at the base of this work. At thye moment only samr_create_user honours SeAddUsersPrivilege and SeMachineAccountPrivilege to permit any user to add machines and/or users to the server. The command "net priv" has been provided to manipulate the privileges database. There are still many things to do (like support in "net rpc vampire") but the working core is here. Feel free to comment/extend on this work. Of course I will deny that any bug may affect this code :-) Simo. This patch adds also my patch about add share command enhancements. (This used to be commit 7a78c3605e203bd8e0d7ae244605f076a5d0b0bc)
2004-02-29Apply my experimental aliases support to HEAD. This will be a bit difficult toVolker Lendecke1-3/+6
merge to 3_0, as the pdb interfaces has changed a bit between the two. This has not been tested too severly (which means it's completely broken ;-), but I want it in for review. Feel free to revert it :-) TODO: make 'net groupmap' a bit more friendly for alias members. Put that stuff into pdb_ldap. Getting the information over to winbind. One plan without linking pdb into winbind would be to fill group_mapping.tdb with the membership information and have that as a cache (or use gencache.tdb?). smbd on a PDC or stand-alone could trigger that itself, the problem is a BDC using LDAP. This needs to do it on a regular basis. The BDC smbd needs to be informed about SAM changes somehow... Volker (This used to be commit 30ef8fe1e85c0ca229b54f3f1595c4330f7191d1)
2004-02-29net_rpc.c: Don't complain if [add|del]mem was successful.Volker Lendecke1-1/+1
srv_samr_nt.c: Correctly report that a user is not member of an alias. Volker (This used to be commit 26d99204b7cbfa8e259f2a8438eadc9ff6be0709)
2004-02-25Do the query part of the previous fix...reset time and duration are set in ↵Jim McDonough1-2/+2
minutes, not seconds. Works from usrmgr. (This used to be commit d02dd0e5f5fae3256b1922c2963e18c8fa36a3e6)
2004-02-25reset time and duration are set in minutes, not seconds. Works from usrmgr.Jim McDonough1-2/+2
(This used to be commit 08a7c9697d49719e4cfb32a06720873c98585f67)
2004-02-19Fixup returns from lookupsids in the same way as lookupnames. Inspired byJeremy Allison1-6/+7
Volkers patch. Jeremy. (This used to be commit aff6bacf0e461322e6e165cb7a6a42f4d976f52b)
2004-02-19comment out server portion of DsEnumerateDomainTrusts() since it causes ↵Gerald Carter2-4/+11
2k/xp clients to fail to join the domain (see comments in srv_netlog_nt.c for details) (This used to be commit 981bd70a56094740daf6d144f7b802370c0d9056)
2004-02-19fixing error in logic when checking flags changed field on user primary ↵Gerald Carter1-28/+28
group sid (This used to be commit c275d8f831490a52bae11698349a6b795d12f924)
2004-02-17Fix based on Volker's code to correctly return code from lsa_lookup_sidsJeremy Allison1-17/+19
on unmapped sids. Jeremy. (This used to be commit 0ac64c8b4d944315cf49e6b183c07396abc7bab3)
2004-02-17Also set alias info for builtins.Volker Lendecke1-1/+2
Volker (This used to be commit 32682cd81485e295720fc65c98669c2e6e5c6043)
2004-02-17In samr_lookup_names Windows does not return WKN_GRP(5) but ALIAS(4) whenVolker Lendecke1-1/+6
you search in BUILTIN. Match that. Volker (This used to be commit 471cf1bf87638953bec4954667bbf8a49c693903)
2004-02-16Cosmetic fix: use sid_is_in_our_domain.Volker Lendecke1-7/+3
Volker (This used to be commit fc0dc0607d03eaefc2a0e3ffe7f1cf3612e73e0c)
2004-01-30Fix up name canonicalization (needed for krb5 keytab support later).Jeremy Allison3-4/+4
Remove source_env handler (no longer used in any codepath). Jeremy. (This used to be commit be60768e64ae2061f220faa3943dcb0588393dbc)
2004-01-26(merge from 3.0)Andrew Bartlett1-2/+2
This adds client-side support for the unicode/SAMR password change scheme. As well as avoiding DOS charset issues, this scheme returns useful error codes, that we can map back via the pam interface. This patch also cleans up the interfaces used for password buffers, to avoid duplication of code. Andrew Bartlett (This used to be commit 8063b8b6c2eb30cb116988e265fb289109d7c348)
2004-01-191. The most part of this patch changed the unknown_3 flag to the now knownSimo Sorce1-98/+176
meaning of fields_present bit mask. Also avoid it being saved in backends (0 is saved where removing the unit32 would have produced a format change). Also add support in samr functions to correctly interpret the flags. Flags still not set properly (eg. still set all flags 0xffffff as previous code), need a tool to test this properly (I',ve done preliminary tests with samba4 rpc torture and it seem to work properly against w2k). 2. Patch for handlig the flag user must change password at next logon in usrmgr based on Jianliang Lu <j.lu@tiesse.com> patch (This used to be commit 78975e9483e64412e436c5dbfe2b71e20b79de29)
2004-01-15Bug 381: check builtin (not local) group SID. Patch from Jianliang Lu ↵Gerald Carter1-1/+1
<j.lu@tiesse.com> (This used to be commit 59cabc5b940990352ebd0ceef8b6e85ac04669c4)
2004-01-13sync HEAD with recent changes in 3.0Gerald Carter1-3/+14
(This used to be commit c98399e3c9d74e19b7c9d806ca8028b48866931e)
2004-01-09fix some warnings from the Sun compiler; also merge some of abartlet's error ↵Gerald Carter1-1/+1
code changes form 3.0 (This used to be commit 2279e98cb81faaf8a4e971fec339955f14c23858)
2004-01-05(merge from 3.0)Andrew Bartlett1-2/+2
Match Win2k, and return NT_STATUS_INVALID_PARAMETER if this parameter is not an account type Andrew Bartlett (This used to be commit 43ee2e0b6a6f95ce2864befeb08b5de2ace41c7c)
2004-01-05(merge from 3.0)Andrew Bartlett1-99/+50
JHT came up with a nasty (broken) torture case in preparing examples for his book. This prompted me to look at the code that reads the unix group list. This code did a lot of name -> uid -> name -> sid translations, which caused problems. Instead, we now do just name -> sid I also cleaned up some interfaces, and client tools. Andrew Bartlett (This used to be commit cc535a6c70d8dcf677322e31b24dec58b23d80f0)
2003-12-16make sure we delete the group mapping before calling the delete group ↵Gerald Carter1-2/+4
script; patch from Jianliang Lu <j.lu@tiesse.com> (This used to be commit 66edeb855e7d7a0bfa20cbe93275c86880bd453d)
2003-12-10Fix UNISTR2 length bug in LsaQueryInfo(3) that cause SID resolution to fail ↵Gerald Carter1-1/+1
on local files on on domain members; bug 875 (This used to be commit a5c5dde1c34ba44f8d9bbb38720a089a6d61806c)
2003-12-10more group lookup access fixes on the neverending bug 281Gerald Carter2-11/+10
(This used to be commit 975ac6f5aa4d8d709733757e4e003f3c551fc9ba)
2003-12-07Merge from 3.0:Andrew Bartlett1-0/+6
source/libsmb/ntlmssp.c: Picked up by the build farm - despite all my efforts, security=server was broken by my NTLM2 commit. This should correctly cause the NTLM2 case not to be negotiated when 'security=server' is in effect. testsuide/build_farm/runlist: Without 'non unix accounts' we can't test security=domain on the build farm. source/rpc_server/srv_samr_nt.c: Match Win2k and return 'invalid parameter' for creating of a new account with account flags of 0. Andrew Bartlett (This used to be commit e97f1eb62ae01b5259d7ecfab9b55b07103379c7)
2003-12-04fix process_incoming_data() to return the number of bytes handled this call ↵Gerald Carter1-1/+3
whether we have a complete pdu or not; fixes bug with multiple pdu request rpc's broken over SMBwriteX calls each (This used to be commit 514acc655d58a660b2a2542ff81a880f1bdfc3f6)
2003-12-04* fix RemoveSidForeignDomain() ; bug 252Gerald Carter3-57/+92
* don't fall back to unmapped UNIX group for get_local_group_from_sid() * remove an extra become/unbecome_root() pair from group enumeration (This used to be commit c0f34b42a6a4af09ae4b76721bc350784d87f686)
2003-11-25Patch for #263 from jpjanosi@us.ibm.com.Jeremy Allison1-1/+2
Jeremy. (This used to be commit 6543bca0cbf6030d2400e30bb7491237d9c818f8)
2003-11-24more access fixes for group enumeration in LDAP; bug 281Gerald Carter3-8/+24
(This used to be commit c4ce92e80688fe7fd4b2fde2c31e94baf3e4dca0)
2003-11-23Merge from 3.0:Andrew Bartlett1-9/+6
Add support for variable-length session keys in our client code. This means that we now support 'net rpc join' with KRB5 (des based) logins. Now, you need to hack 'net' to do that, but the principal is important... When we add kerberos to 'net rpc', it should be possible to still do user management and the like over RPC. - Add server-side support for variable-length session keys (as used by DES based krb5 logins). Andrew Bartlett (This used to be commit 1287cf5f921327c9ea758de46220c4e2dedc485c)
2003-11-22(merge from 3.0)Andrew Bartlett4-13/+42
Changes all over the shop, but all towards: - NTLM2 support in the server - KEY_EXCH support in the server - variable length session keys. In detail: - NTLM2 is an extension of NTLMv1, that is compatible with existing domain controllers (unlike NTLMv2, which requires a DC upgrade). * This is known as 'NTLMv2 session security' * (This is not yet implemented on the RPC pipes however, so there may well still be issues for PDC setups, particuarly around password changes. We do not fully understand the sign/seal implications of NTLM2 on RPC pipes.) This requires modifications to our authentication subsystem, as we must handle the 'challege' input into the challenge-response algorithm being changed. This also needs to be turned off for 'security=server', which does not support this. - KEY_EXCH is another 'security' mechanism, whereby the session key actually used by the server is sent by the client, rather than being the shared-secret directly or indirectly. - As both these methods change the session key, the auth subsystem needed to be changed, to 'override' session keys provided by the backend. - There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation. - The 'names blob' in NTLMSSP is always in unicode - never in ascii. Don't make an ascii version ever. - The other big change is to allow variable length session keys. We have always assumed that session keys are 16 bytes long - and padded to this length if shorter. However, Kerberos session keys are 8 bytes long, when the krb5 login uses DES. * This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. * - Add better DEBUG() messages to ntlm_auth, warning administrators of misconfigurations that prevent access to the privileged pipe. This should help reduce some of the 'it just doesn't work' issues. - Fix data_blob_talloc() to behave the same way data_blob() does when passed a NULL data pointer. (just allocate) REMEMBER to make clean after this commit - I have changed plenty of data structures... Andrew Bartlett (This used to be commit 57a895aaabacc0c9147344d097d333793b77c947)
2003-11-19Correct fix for '$' termination test.Jeremy Allison1-2/+1
Jeremy. (This used to be commit b93e44e01edb432e11b9ad6aeb4d4eea0f7fa433)
2003-11-18Fix to correct checking of '$' name termination.Rafal Szczesniak1-1/+1
Patch by metze. rafal (This used to be commit 7191186fc64eb0b8092a2f6f1e89b6b6a6df7627)
2003-11-17* make sure we only enumerate group mapping entriesGerald Carter1-135/+44
(not /etc/group) even when doing local aliases * remove "hide local users" parameter; we have this behavior built into 3.0 (This used to be commit 3b75e862dfba42c95e2279c300c06bb981f52993)
2003-11-09Merge from 3.0:Andrew Bartlett1-6/+0
source/passdb/pdb_get_set.c: I agree with vl's #if 0 here, and am not quite sure what I was thinking with regard to the original code. Let's keep samba simple, and just remove it. source/rpc_server/srv_netlog_nt.c: Remove compleatly wrong comments. (There were correct, 2 years ago...) source/intl/lang_tdb.c: Add newline to debug message Andrew Bartlett (This used to be commit 2a8dbe03690b60f3d9c83de3cf6ce873aa0657bc)
2003-11-07* only install swat html files onceGerald Carter1-3/+17
* revert the change that prevent the guest account from being added to a passdb backend since it broke the build farm. * apply patch from Alex Deiter to fix the "smbldap_open: cannot access when not root error" messages when looking up group information (bug 281) (This used to be commit 20bd309239199d85accb2b7aac6d4dd73e414f85)
2003-11-07Handle munged dial string. Patch from Aur?lien Degr?mont <adegremont@idealx.com>Jeremy Allison2-11/+86
with memory leak fixes by me. Jeremy. (This used to be commit daceed37387c517b3f0ab9c173f419215e3d676b)
2003-11-05Merge of 64-bit printf warning fixes.Tim Potter2-3/+3
(This used to be commit a6cc763333943bc6e360bb7e78cf9bfb1bc936e8)
2003-10-30Another round of GUID->struct uuid.Jim McDonough1-3/+3
Takes care of the lsass pipe (This used to be commit 3dca3efa4b427fa3094a8cd392fe5744b5f6f6a8)
2003-10-30First round of merging various UUID structures.Jim McDonough3-5/+6
This eliminates RPC_UUID. It creates the following struct: struct uuid { uint32 time_low; uint16 time_mid; uint16 time_hi_and_version; uint8 clock_seq[2]; uint8 node[6]; }; which replaces RPC_UUID and various random struct uuid definitions and a flat version: #define UUID_FLAT_SIZE 16 typedef struct uuid_flat { uint8 info[UUID_FLAT_SIZE]; } UUID_FLAT; which pretty much looks like GUID (which I will start eliminating). I want us to use the FLAT one only on the wire (perhaps in files, too?), and I want it to be obvious to the coder that it is the FLAT version. This leaves a couple of compiler warnings, where GUID isn't completely replaced by FLAT_UUID yet...I'll get to those soon. (This used to be commit 1532b5d2e3c61df232b16394acedf6eac387588b)
2003-10-28Fix for bug #667. DFS filenames can now have arbitrary case.Jeremy Allison1-19/+39
Jeremy. (This used to be commit cbefb5c4f983ca49fcc563111d8704d3770daf81)
2003-10-21Patch from Stefan Metzmacher <metze@metzemix.de> to fix signing problemsJeremy Allison1-1/+2
when reverse connecting back to a client for printer notify. Jeremy. (This used to be commit 7fde193efeb856ec325d5d563f1e710c45dc65d7)
2003-10-21Add server side support for epmapper pipe. Currently only does a fixedJim McDonough3-0/+161
mapping, but this is the base for changes to come. (This used to be commit 73882e970a3aea1c3c9f34779b4220bbf28f6dad)
2003-10-17* fix some compile warnings in the gums codeGerald Carter2-1/+50
* add server support for DsEnumerateDomainTrusts() (This used to be commit 06bacf6e3434db5bd09b48f84206441712e69a63)
2003-10-06split some security related functions in their own files.Simo Sorce2-36/+36
(no need to include all of smbd files to use some basic sec functions) also minor compile fixes (This used to be commit 66074d3b097d8cf2a231bf08c7f4db62da68189d)
2003-10-02Portability fix from schmitz@hp.com (Joachim Schmitz) for bug #548.Jeremy Allison1-1/+1
Jeremy. (This used to be commit a0828a2a1ce04075f0a7cb4a201cea0781998237)
2003-10-01commit sign only patch from Andrew; bug 167; tested using 2k & XP ↵Gerald Carter1-11/+19
clientspreviously joined to the Samba domain (This used to be commit 9d2e585e5e6f9066c6901aa8d8308734f8667296)
2003-09-29Merge from 3.0:Tim Potter5-68/+58
>Fix for #480. Change the interface for init_unistr2 to not take a length >but a flags field. We were assuming that 2*strlen(mb_string) == length of ucs2-le string. >This is not the case. Count it after conversion. >Jeremy. (This used to be commit e2ab9e54cd0ec0002175cf18ff364f4aebaf85a0)
2003-09-19Ensure that dup_sec_desc copies the 'type' field correctly. This causedJeremy Allison3-6/+6
me to expose a type arguement to make_sec_desc(). We weren't copying the SE_DESC_DACL_AUTO_INHERITED flag which could cause errors on auto inherited checks. Jeremy. (This used to be commit 546b2271c08735ac1049a453abac996d794aa364)
2003-09-18The "unknown_5" 32 bit field in the user structs is actually 2 16-bitJeremy Allison1-8/+18
fields, bad_password_count and logon_count. Ensure this is stored/fetched in the various SAMs. As it replaces the unknown_5 field this fits exactly into the tdb SAM without any binary problems. It also is added to the LDAP SAM as two extra attributes. It breaks compatibility with the experimental SAMs xml and mysql. The maintainers of these SAMs must fix them so upgrades like this can be done transparently. I will insist on the "experimental" status until this is solved. Jeremy. (This used to be commit 71ecd10181cd35313b79f618c2928c2f45424812)
2003-09-15Merge from Samba 3.0:Tim Potter1-1/+1
>Patch from Gregory Hinton Nietsky <gregory@networksentry.co.za>, >ensure the desired access is read from the incoming RPC request. >Jeremy. (This used to be commit a556637d0bc56aeb980c422c4d1da44311956c3b)
generated by cgit (git 2.34.1) at 2024-12-23 00:21:26 +0000