/* Unix SMB/Netbios implementation. Version 1.9. Samba Web Administration Tool Copyright (C) Andrew Tridgell 1997-1998 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ #ifdef SYSLOG #undef SYSLOG #endif #include "includes.h" #include "smb.h" #define GLOBALS_SNUM -1 static pstring servicesf = CONFIGFILE; /* * Password Management Globals */ char user[] = "username"; char old_pswd[] = "old_passwd"; char new_pswd[] = "new_passwd"; char new2_pswd[] = "new2_passwd"; char chg_passwd_flag[] = "chg_passwd_flag"; char add_user_flag[] = "add_user_flag"; char disable_user_flag[] = "disable_user_flag"; /* we need these because we link to locking*.o */ void become_root(BOOL save_dir) {} void unbecome_root(BOOL restore_dir) {} /* We need this because we link to password.o */ BOOL change_oem_password(struct smb_passwd *smbpw, char *new_passwd, BOOL override) {return False;} /**************************************************************************** ****************************************************************************/ static int enum_index(int value, struct enum_list *enumlist) { int i; for (i=0;enumlist[i].name;i++) if (value == enumlist[i].value) break; return(i); } static char *fix_backslash(char *str) { static char newstring[1024]; char *p = newstring; while (*str) { if (*str == '\\') {*p++ = '\\';*p++ = '\\';} else *p++ = *str; ++str; } *p = '\0'; return newstring; } static char *stripspace(char *str) { static char newstring[1024]; char *p = newstring; while (*str) { if (*str != ' ') *p++ = *str; ++str; } *p = '\0'; return newstring; } static char *make_parm_name(char *label) { static char parmname[1024]; char *p = parmname; while (*label) { if (*label == ' ') *p++ = '_'; else *p++ = *label; ++label; } *p = '\0'; return parmname; } /**************************************************************************** include a lump of html in a page ****************************************************************************/ static int include_html(char *fname) { FILE *f = fopen(fname,"r"); char buf[1024]; int ret; if (!f) { printf("ERROR: Can't open %s\n", fname); return 0; } while (!feof(f)) { ret = fread(buf, 1, sizeof(buf), f); if (ret <= 0) break; fwrite(buf, 1, ret, stdout); } fclose(f); return 1; } /**************************************************************************** start the page with standard stuff ****************************************************************************/ static void print_header(void) { if (!cgi_waspost()) { printf("Expires: 0\r\n"); } printf("Content-type: text/html\r\n\r\n"); if (!include_html("include/header.html")) { printf("\n"); printf("\n
\n\n",
servicesf);
}
}
/****************************************************************************
spit out the html for a link with an image
****************************************************************************/
static void image_link(char *name,char *hlink, char *src)
{
printf("\n",
cgi_baseurl(), hlink, src, name);
}
/****************************************************************************
display the main navigation controls at the top of each page along
with a title
****************************************************************************/
static void show_main_buttons(void)
{
image_link("Home", "", "images/home.gif");
/* Root gets full functionality */
if ( is_root() == True) {
image_link("Globals", "globals", "images/globals.gif");
image_link("Shares", "shares", "images/shares.gif");
image_link("Printers", "printers", "images/printers.gif");
image_link("Status", "status", "images/status.gif");
image_link("View Config", "viewconfig","images/viewconfig.gif");
}
/* Everyone gets this functionality */
image_link("Password Management", "passwd", "images/passwd.gif");
printf("
SIGPIPE caught\n"); } /**************************************************************************** create 2 pipes and use them to feed the smbpasswd program ****************************************************************************/ static BOOL talk_to_smbpasswd(char *old, char *new) { int i, n, fd1[2], fd2[2]; pid_t pid; BOOL rslt; char line[MAX_STRINGLEN + 2]; /* one for newline, one for null */ if (signal(SIGPIPE, sig_pipe) == SIG_ERR) { printf("
signal error"); } if ((pipe(fd1) < 0) || (pipe(fd2) < 0)) { printf("
pipe error"); } if ((pid = fork()) < 0) { printf("
fork error"); } /* * Create this relationship with the pipes between the parent and * the child as detailed below. * * parent -> fd1[1] -- fd1[0] -> child * parent <- fd2[0] -- fd2[1] <- child * * fd1[0] is turned into child's stdin * fd2[1] is turned into child's stdout * fd2[1] is also turned into child's stderr * */ else if (pid > 0) { /* parent */ int to_child = fd1[1]; int from_child = fd2[0]; int wstat; close(fd1[0]); /* parent doesn't need input side of pipe fd1 */ close(fd2[1]); /* parent doesn't need output side of pipe fd2 */ /* * smbpasswd doesn't require any input to disable a user */ if (cgi_variable(disable_user_flag)) { /* * smbpasswd requires a regular old user to send their old password */ if ( is_root() == False) { n = (strlen(old) <= (MAX_STRINGLEN)) ? strlen(old) : (MAX_STRINGLEN); strncpy( line, old, n); line[n] = '\n'; n++; /* add carriage return */ line[n] = 0; /* add null terminator, for debug */ if (write( to_child, line, n) != n) { printf("
error on write to child"); } } /* * smbpasswd requires that the new password be sent to it twice */ for( i=0; i<2; i++) { n = (strlen(new) <= (MAX_STRINGLEN)) ? strlen(new) : (MAX_STRINGLEN); strncpy( line, new, n); line[n] = '\n'; n++; /* add carriage return */ line[n] = 0; /* add null terminator, for debug */ if (write( to_child, line, n) != n) { printf("
error on write to child"); break; } } } /* * Wait for smbpasswd to finish */ if (sys_waitpid(pid, &wstat, 0) < 0) { printf("
problem waiting"); } /* * Read the answer from the add program */ memset( line, '\0', sizeof(line)); if ((n = read( from_child, line, MAX_STRINGLEN)) < 0) { printf("
error on read from child"); } /* * Write the response from smbpasswd to user, if all is well * line[] should be just a null terminated line. We could * check for the null line and not print anything, but we * really should be checking the exit code if we want to be * sure. */ line[n] = 0; /* null terminate */ printf("
%s\n",line); close(to_child); close(from_child); if (line[0] == '\0') { rslt = True; /* All ok */ } else { rslt = False; /* Something didn't work */ } } else { /* child */ int from_parent = fd1[0]; int to_parent = fd2[1]; close(fd1[1]); /* child doesn't need output side of pipe fd1 */ close(fd2[0]); /* child doesn't need input side of pipe fd2 */ /* * Turn the from_parent pipe into the childs stdin */ if (from_parent != STDIN_FILENO) { if (dup2( from_parent, STDIN_FILENO) != STDIN_FILENO) { printf("
dup2 error of stdin"); } close( from_parent); } /* * Turn the to_parent pipe into the childs stdout */ if (to_parent != STDOUT_FILENO) { if (dup2( to_parent, STDOUT_FILENO) != STDOUT_FILENO) { printf("
dup2 error of stdout"); } close( to_parent); } /* * Make the childs stderr the to_parent pipe also */ if (dup2( STDOUT_FILENO, STDERR_FILENO) != STDERR_FILENO) { printf("
dup2 error of stdout"); } /* Root can do more */ if (is_root() == True) { if (cgi_variable(add_user_flag)) { /* * Add a user */ if (execl(SMB_PASSWD_PROGRAM, "smbpasswd", "-s", "-a", cgi_variable(user), (char *) 0) < 0) { printf("
execl error of smbpasswd"); } } else if (cgi_variable(disable_user_flag)) { /* * Disable a user */ if (execl(SMB_PASSWD_PROGRAM, "smbpasswd", "-s", "-d", cgi_variable(user), (char *) 0) < 0) { printf("
execl error of smbpasswd"); } } else { /* * Change a users password */ if (execl(SMB_PASSWD_PROGRAM, "smbpasswd", "-s", cgi_variable(user), (char *) 0) < 0) { printf("
execl error of smbpasswd"); } } } else { /* * Ordinary users can change any users passwd if they know the old passwd */ if (execl(SMB_PASSWD_PROGRAM, "smbpasswd", "-s", (char *) 0) < 0) { printf("
execl error of smbpasswd"); } } } return(rslt); } /**************************************************************************** become the specified uid ****************************************************************************/ static BOOL become_uid(uid_t uid) { #ifdef HAVE_TRAPDOOR_UID #ifdef HAVE_SETUIDX /* AIX3 has setuidx which is NOT a trapoor function (tridge) */ if (setuidx(ID_EFFECTIVE, uid) != 0) { if (seteuid(uid) != 0) { printf("
Can't set uid %d (setuidx)\n", (int)uid); return False; } } #endif #endif #ifdef HAVE_SETRESUID if (setresuid(-1,uid,-1) != 0) #else if ((seteuid(uid) != 0) && (setuid(uid) != 0)) #endif { printf("
Couldn't set uid %d currently set to (uid %d, euid %d)\n", (int)uid,(int)getuid(), (int)geteuid()); if (uid > (uid_t)32000) { printf("
Looks like your OS doesn't like high uid values - try using a different account\n"); } return(False); } if (((uid == (uid_t)-1) || ((sizeof(uid_t) == 2) && (uid == 65535))) && (geteuid() != uid)) { printf("
Invalid uid -1. perhaps you have a account with uid 65535?\n"); return(False); } return(True); } /**************************************************************************** become the specified gid ****************************************************************************/ static BOOL become_gid(gid_t gid) { #ifdef HAVE_SETRESUID if (setresgid(-1,gid,-1) != 0) #else if (setgid(gid) != 0) #endif { printf("
Couldn't set gid %d currently set to (gid %d, egid %d)\n", (int)gid,(int)getgid(),(int)getegid()); if (gid > 32000) { printf("
Looks like your OS doesn't like high gid values - try using a different account\n"); } return(False); } return(True); } /**************************************************************************** become the specified uid and gid ****************************************************************************/ static BOOL become_id(uid_t uid,gid_t gid) { return(become_gid(gid) && become_uid(uid)); } /**************************************************************************** do the stuff required to add or change a password ****************************************************************************/ static void chg_passwd(void) { char *s; struct passwd *pass = NULL; BOOL rslt; /* Make sure users name has been specified */ if (strlen(cgi_variable(user)) == 0) { printf("
Must specify \"User Name\" \n"); return; } /* * smbpasswd doesn't require anything but the users name to disable the user, * so if that's what we're doing, skip the rest of the checks */ if (!cgi_variable(disable_user_flag)) { /* If current user is not root, make sure old password has been specified */ if ((is_root() == False) && (strlen( cgi_variable(old_pswd)) <= 0)) { printf("
Must specify \"Old Password\" \n"); return; } /* Make sure new passwords have been specified */ if ((strlen( cgi_variable(new_pswd )) <= 0) || (strlen( cgi_variable(new2_pswd)) <= 0)) { printf("
Must specify \"New, and Re-typed Passwords\" \n"); return; } /* Make sure new passwords was typed correctly twice */ if (strcmp(cgi_variable(new_pswd), cgi_variable(new2_pswd)) != 0) { printf("
Re-typed password didn't match new password\n"); return; } } /* Get the UID/GID of the user, and become that user */ if (is_root() == False) { pass = Get_Pwnam(cgi_variable(user),True); if (pass == NULL) { printf("
User uid unknown \n"); } else { if (become_id(pass->pw_uid, pass->pw_gid) == False) { printf("
uid/gid set failed \n"); return; } } } #ifndef SWAT_DEBUG if (pass) printf("
User uid %d gid %d \n", pass->pw_uid, pass->pw_gid); printf("
Processes uid %d, euid %d, gid %d, egid %d \n",getuid(),geteuid(),getgid(),getegid()); printf("
User Name %s \n", cgi_variable(user)); printf("
Old passwd %s \n", cgi_variable(old_pswd) ? cgi_variable(old_pswd):""); printf("
New passwd %s \n", cgi_variable(new_pswd)); printf("
Re-typed New passwd %s \n", cgi_variable(new2_pswd)); printf("
flags '%s', '%s', '%s' \n", (cgi_variable( chg_passwd_flag) ? cgi_variable( chg_passwd_flag) : ""), (cgi_variable( add_user_flag) ? cgi_variable( add_user_flag) : ""), (cgi_variable( disable_user_flag) ? cgi_variable( disable_user_flag) : "")); #endif /* SWAT_DEBUG */ rslt = talk_to_smbpasswd( cgi_variable(old_pswd), cgi_variable(new_pswd)); if (is_root() == False) { if (rslt == True) { printf("
The passwd for '%s' has been changed. \n",cgi_variable(user)); } else { printf("
The passwd for '%s' has NOT been changed. \n",cgi_variable(user)); } } return; } /**************************************************************************** display a password editing page ****************************************************************************/ static void passwd_page(void) { char *new_name; int i; printf("