source3/pam_smbpass/pam_smb_passwd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Use PAM to update user passwords in the local SAM
   4    Copyright (C) Steve Langasek         1998-2003
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18
  19 */
  20
  21 /* indicate the following groups are defined */
  22 #define PAM_SM_PASSWORD
  23
  24 #include "includes.h"
  25
  26 /* This is only used in the Sun implementation.  FIXME: we really
  27    want a define here that distinguishes between the Solaris PAM
  28    and others (including FreeBSD). */
  29
  30 #ifndef LINUX
  31 #if defined(HAVE_SECURITY_PAM_APPL_H)
  32 #include <security/pam_appl.h>
  33 #elif defined(HAVE_PAM_PAM_APPL_H)
  34 #include <pam/pam_appl.h>
  35 #endif
  36 #endif
  37
  38 #if defined(HAVE_SECURITY_PAM_MODULES_H)
  39 #include <security/pam_modules.h>
  40 #elif defined(HAVE_PAM_PAM_MODULES_H)
  41 #include <pam/pam_modules.h>
  42 #endif
  43
  44 #include "general.h"
  45
  46 #include "support.h"
  47
  48 static int smb_update_db( pam_handle_t *pamh, int ctrl, const char *user,  const char *pass_new )
  49 {
  50         int retval;
  51         char *err_str = NULL;
  52         char *msg_str = NULL;
  53
  54         retval = NT_STATUS_IS_OK(local_password_change(user, LOCAL_SET_PASSWORD, pass_new,
  55                                         &err_str,
  56                                         &msg_str));
  57
  58         if (!retval) {
  59                 if (err_str) {
  60                         make_remark(pamh, ctrl, PAM_ERROR_MSG, err_str );
  61                 }
  62
  63                 /* FIXME: what value is appropriate here? */
  64                 retval = PAM_AUTHTOK_ERR;
  65         } else {
  66                 if (msg_str) {
  67                         make_remark(pamh, ctrl, PAM_TEXT_INFO, msg_str );
  68                 }
  69                 retval = PAM_SUCCESS;
  70         }
  71
  72         SAFE_FREE(err_str);
  73         SAFE_FREE(msg_str);
  74         return retval;
  75 }
  76
  77
  78 /* data tokens */
  79
  80 #define _SMB_OLD_AUTHTOK  "-SMB-OLD-PASS"
  81 #define _SMB_NEW_AUTHTOK  "-SMB-NEW-PASS"
  82
  83 /*
  84  * FUNCTION: pam_sm_chauthtok()
  85  *
  86  * This function is called twice by the PAM library, once with
  87  * PAM_PRELIM_CHECK set, and then again with PAM_UPDATE_AUTHTOK set.  With
  88  * Linux-PAM, these two passes generally involve first checking the old
  89  * token and then changing the token.  This is what we do here.
  90  *
  91  * Having obtained a new password. The function updates the
  92  * SMB_PASSWD_FILE file (normally, $(LIBDIR)/smbpasswd).
  93  */
  94
  95 int pam_sm_chauthtok(pam_handle_t *pamh, int flags,
  96                      int argc, const char **argv)
  97 {
  98     unsigned int ctrl;
  99     int retval;
 100
 101     struct samu *sampass = NULL;
 102     void (*oldsig_handler)(int);
 103     const char *user;
 104     char *pass_old = NULL;
 105     char *pass_new = NULL;
 106     TALLOC_CTX *frame = talloc_stackframe();
 107
 108     /* Samba initialization. */
 109     load_case_tables_library();
 110
 111     ctrl = set_ctrl(pamh, flags, argc, argv);
 112
 113     /*
 114      * First get the name of a user.  No need to do anything if we can't
 115      * determine this.
 116      */
 117
 118     retval = pam_get_user( pamh, &user, "Username: " );
 119     if (retval != PAM_SUCCESS) {
 120         if (on( SMB_DEBUG, ctrl )) {
 121             _log_err(pamh, LOG_DEBUG, "password: could not identify user");
 122         }
 123         TALLOC_FREE(frame);
 124         return retval;
 125     }
 126     if (on( SMB_DEBUG, ctrl )) {
 127         _log_err(pamh, LOG_DEBUG, "username [%s] obtained", user);
 128     }
 129
 130     if (geteuid() != 0) {
 131         _log_err(pamh, LOG_DEBUG, "Cannot access samba password database, not running as root.");
 132         TALLOC_FREE(frame);
 133         return PAM_AUTHINFO_UNAVAIL;
 134     }
 135
 136     /* Getting into places that might use LDAP -- protect the app
 137        from a SIGPIPE it's not expecting */
 138     oldsig_handler = CatchSignal(SIGPIPE, SIG_IGN);
 139
 140     if (!initialize_password_db(False, NULL)) {
 141       _log_err(pamh, LOG_ALERT, "Cannot access samba password database" );
 142         CatchSignal(SIGPIPE, oldsig_handler);
 143         TALLOC_FREE(frame);
 144         return PAM_AUTHINFO_UNAVAIL;
 145     }
 146
 147     /* obtain user record */
 148     if ( !(sampass = samu_new( NULL )) ) {
 149         CatchSignal(SIGPIPE, oldsig_handler);
 150         TALLOC_FREE(frame);
 151         return nt_status_to_pam(NT_STATUS_NO_MEMORY);
 152     }
 153
 154     if (!pdb_getsampwnam(sampass,user)) {
 155         _log_err(pamh, LOG_ALERT, "Failed to find entry for user %s.", user);
 156         CatchSignal(SIGPIPE, oldsig_handler);
 157         TALLOC_FREE(frame);
 158         return PAM_USER_UNKNOWN;
 159     }
 160     if (on( SMB_DEBUG, ctrl )) {
 161         _log_err(pamh, LOG_DEBUG, "Located account for %s", user);
 162     }
 163
 164     if (flags & PAM_PRELIM_CHECK) {
 165         /*
 166          * obtain and verify the current password (OLDAUTHTOK) for
 167          * the user.
 168          */
 169
 170         char *Announce;
 171
 172         if (_smb_blankpasswd( ctrl, sampass )) {
 173
 174             TALLOC_FREE(sampass);
 175             CatchSignal(SIGPIPE, oldsig_handler);
 176             TALLOC_FREE(frame);
 177             return PAM_SUCCESS;
 178         }
 179
 180         /* Password change by root, or for an expired token, doesn't
 181            require authentication.  Is this a good choice? */
 182         if (getuid() != 0 && !(flags & PAM_CHANGE_EXPIRED_AUTHTOK)) {
 183
 184             /* tell user what is happening */
 185                 if (asprintf(&Announce, "Changing password for %s", user) == -1) {
 186                         _log_err(pamh, LOG_CRIT, "password: out of memory");
 187                         TALLOC_FREE(sampass);
 188                         CatchSignal(SIGPIPE, oldsig_handler);
 189                         TALLOC_FREE(frame);
 190                         return PAM_BUF_ERR;
 191                 }
 192
 193             set( SMB__OLD_PASSWD, ctrl );
 194             retval = _smb_read_password( pamh, ctrl, Announce, "Current SMB password: ",
 195                                          NULL, _SMB_OLD_AUTHTOK, &pass_old );
 196             SAFE_FREE( Announce );
 197
 198             if (retval != PAM_SUCCESS) {
 199                 _log_err(pamh, LOG_NOTICE,
 200                          "password - (old) token not obtained");
 201                 TALLOC_FREE(sampass);
 202                 CatchSignal(SIGPIPE, oldsig_handler);
 203                 TALLOC_FREE(frame);
 204                 return retval;
 205             }
 206
 207             /* verify that this is the password for this user */
 208
 209             retval = _smb_verify_password( pamh, sampass, pass_old, ctrl );
 210
 211         } else {
 212             pass_old = NULL;
 213             retval = PAM_SUCCESS;           /* root doesn't have to */
 214         }
 215
 216         pass_old = NULL;
 217         TALLOC_FREE(sampass);
 218         CatchSignal(SIGPIPE, oldsig_handler);
 219         TALLOC_FREE(frame);
 220         return retval;
 221
 222     } else if (flags & PAM_UPDATE_AUTHTOK) {
 223
 224         /*
 225          * obtain the proposed password
 226          */
 227
 228         /*
 229          * get the old token back. NULL was ok only if root [at this
 230          * point we assume that this has already been enforced on a
 231          * previous call to this function].
 232          */
 233
 234         if (off( SMB_NOT_SET_PASS, ctrl )) {
 235             retval = _pam_get_item( pamh, PAM_OLDAUTHTOK,
 236                                    &pass_old );
 237         } else {
 238             retval = _pam_get_data( pamh, _SMB_OLD_AUTHTOK,
 239                                    &pass_old );
 240             if (retval == PAM_NO_MODULE_DATA) {
 241                 pass_old = NULL;
 242                 retval = PAM_SUCCESS;
 243             }
 244         }
 245
 246         if (retval != PAM_SUCCESS) {
 247             _log_err(pamh, LOG_NOTICE, "password: user not authenticated");
 248             TALLOC_FREE(sampass);
 249             CatchSignal(SIGPIPE, oldsig_handler);
 250             TALLOC_FREE(frame);
 251             return retval;
 252         }
 253
 254         /*
 255          * use_authtok is to force the use of a previously entered
 256          * password -- needed for pluggable password strength checking
 257          * or other module stacking
 258          */
 259
 260         if (on( SMB_USE_AUTHTOK, ctrl )) {
 261             set( SMB_USE_FIRST_PASS, ctrl );
 262         }
 263
 264         retval = _smb_read_password( pamh, ctrl
 265                                       , NULL
 266                                       , "Enter new SMB password: "
 267                                       , "Retype new SMB password: "
 268                                       , _SMB_NEW_AUTHTOK
 269                                       , &pass_new );
 270
 271         if (retval != PAM_SUCCESS) {
 272             if (on( SMB_DEBUG, ctrl )) {
 273                 _log_err(pamh, LOG_ALERT,
 274                          "password: new password not obtained");
 275             }
 276             pass_old = NULL;                               /* tidy up */
 277             TALLOC_FREE(sampass);
 278             CatchSignal(SIGPIPE, oldsig_handler);
 279             TALLOC_FREE(frame);
 280             return retval;
 281         }
 282
 283         /*
 284          * At this point we know who the user is and what they
 285          * propose as their new password. Verify that the new
 286          * password is acceptable.
 287          */
 288
 289         if (pass_new[0] == '\0') {     /* "\0" password = NULL */
 290             pass_new = NULL;
 291         }
 292
 293         retval = _pam_smb_approve_pass(pamh, ctrl, pass_old, pass_new);
 294
 295         if (retval != PAM_SUCCESS) {
 296             _log_err(pamh, LOG_NOTICE, "new password not acceptable");
 297             pass_new = pass_old = NULL;               /* tidy up */
 298             TALLOC_FREE(sampass);
 299             CatchSignal(SIGPIPE, oldsig_handler);
 300             TALLOC_FREE(frame);
 301             return retval;
 302         }
 303
 304         /*
 305          * By reaching here we have approved the passwords and must now
 306          * rebuild the smb password file.
 307          */
 308
 309         /* update the password database */
 310
 311         retval = smb_update_db(pamh, ctrl, user, pass_new);
 312         if (retval == PAM_SUCCESS) {
 313             uid_t uid;
 314
 315             /* password updated */
 316                 if (!sid_to_uid(pdb_get_user_sid(sampass), &uid)) {
 317                         _log_err(pamh, LOG_NOTICE,
 318                                  "Unable to get uid for user %s",
 319                                 pdb_get_username(sampass));
 320                         _log_err(pamh, LOG_NOTICE, "password for (%s) changed by (%s/%d)",
 321                                 user, uidtoname(getuid()), getuid());
 322                 } else {
 323                         _log_err(pamh, LOG_NOTICE, "password for (%s/%d) changed by (%s/%d)",
 324                                 user, uid, uidtoname(getuid()), getuid());
 325                 }
 326         } else {
 327                 _log_err(pamh, LOG_ERR, "password change failed for user %s", user);
 328         }
 329
 330         pass_old = pass_new = NULL;
 331         if (sampass) {
 332                 TALLOC_FREE(sampass);
 333                 sampass = NULL;
 334         }
 335
 336     } else {            /* something has broken with the library */
 337
 338         _log_err(pamh, LOG_ALERT, "password received unknown request");
 339         retval = PAM_ABORT;
 340
 341     }
 342
 343     if (sampass) {
 344         TALLOC_FREE(sampass);
 345         sampass = NULL;
 346     }
 347
 348     TALLOC_FREE(sampass);
 349     CatchSignal(SIGPIPE, oldsig_handler);
 350     TALLOC_FREE(frame);
 351     return retval;
 352 }
 353
 354 /* static module data */
 355 #ifdef PAM_STATIC
 356 struct pam_module _pam_smbpass_passwd_modstruct = {
 357      "pam_smbpass",
 358      NULL,
 359      NULL,
 360      NULL,
 361      NULL,
 362      NULL,
 363      pam_sm_chauthtok
 364 };
 365 #endif
 366