source/lib/account_pol.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  account policy storage
   4  *  Copyright (C) Jean François Micouleau      1998-2001.
   5  *  Copyright (C) Andrew Bartlett              2002
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 2 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, write to the Free Software
  19  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20  */
  21
  22 #include "includes.h"
  23 static TDB_CONTEXT *tdb;
  24
  25 #define DATABASE_VERSION 2
  26
  27 extern DOM_SID global_sid_World;
  28 extern DOM_SID global_sid_Builtin_Administrators;
  29 extern DOM_SID global_sid_Builtin_Account_Operators;
  30 extern DOM_SID global_sid_Builtin_Server_Operators;
  31 extern DOM_SID global_sid_Builtin_Print_Operators;
  32 extern DOM_SID global_sid_Builtin_Backup_Operators;
  33
  34
  35 /****************************************************************************
  36  Set default for a field if it is empty
  37 ****************************************************************************/
  38
  39 static void set_default_on_empty(int field, uint32 value)
  40 {
  41         if (account_policy_get(field, NULL))
  42                 return;
  43         account_policy_set(field, value);
  44         return;
  45 }
  46
  47 /****************************************************************************
  48  Open the account policy tdb.
  49 ****************************************************************************/
  50
  51 BOOL init_account_policy(void)
  52 {
  53         const char *vstring = "INFO/version";
  54         uint32 version;
  55
  56         if (tdb)
  57                 return True;
  58         tdb = tdb_open_log(lock_path("account_policy.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
  59         if (!tdb) {
  60                 DEBUG(0,("Failed to open account policy database\n"));
  61                 return False;
  62         }
  63
  64         /* handle a Samba upgrade */
  65         tdb_lock_bystring(tdb, vstring,0);
  66         if (!tdb_fetch_uint32(tdb, vstring, &version) || version != DATABASE_VERSION) {
  67                 tdb_store_uint32(tdb, vstring, DATABASE_VERSION);
  68
  69                 set_default_on_empty(
  70                         AP_MIN_PASSWORD_LEN,
  71                         MINPASSWDLENGTH);/* 5 chars minimum             */
  72                 set_default_on_empty(
  73                         AP_PASSWORD_HISTORY,
  74                         0);             /* don't keep any old password  */
  75                 set_default_on_empty(
  76                         AP_USER_MUST_LOGON_TO_CHG_PASS,
  77                         0);             /* don't force user to logon    */
  78                 set_default_on_empty(
  79                         AP_MAX_PASSWORD_AGE,
  80                         (uint32)-1);    /* don't expire                 */
  81                 set_default_on_empty(
  82                         AP_MIN_PASSWORD_AGE,
  83                         0);             /* 0 days                      */
  84                 set_default_on_empty(
  85                         AP_LOCK_ACCOUNT_DURATION,
  86                         30);            /* lockout for 30 minutes      */
  87                 set_default_on_empty(
  88                         AP_RESET_COUNT_TIME,
  89                         30);            /* reset after 30 minutes      */
  90                 set_default_on_empty(
  91                         AP_BAD_ATTEMPT_LOCKOUT,
  92                         0);             /* don't lockout               */
  93                 set_default_on_empty(
  94                         AP_TIME_TO_LOGOUT,
  95                         -1);            /* don't force logout          */
  96                 set_default_on_empty(
  97                         AP_REFUSE_MACHINE_PW_CHANGE,
  98                         0);             /* allow machine pw changes    */
  99         }
 100         tdb_unlock_bystring(tdb, vstring);
 101
 102         /* These exist by default on NT4 in [HKLM\SECURITY\Policy\Accounts] */
 103
 104         privilege_create_account( &global_sid_World );
 105         privilege_create_account( &global_sid_Builtin_Administrators );
 106         privilege_create_account( &global_sid_Builtin_Account_Operators );
 107         privilege_create_account( &global_sid_Builtin_Server_Operators );
 108         privilege_create_account( &global_sid_Builtin_Print_Operators );
 109         privilege_create_account( &global_sid_Builtin_Backup_Operators );
 110
 111         return True;
 112 }
 113
 114 static const struct {
 115         int field;
 116         const char *string;
 117 } account_policy_names[] = {
 118         {AP_MIN_PASSWORD_LEN, "min password length"},
 119         {AP_PASSWORD_HISTORY, "password history"},
 120         {AP_USER_MUST_LOGON_TO_CHG_PASS, "user must logon to change password"},
 121         {AP_MAX_PASSWORD_AGE, "maximum password age"},
 122         {AP_MIN_PASSWORD_AGE,"minimum password age"},
 123         {AP_LOCK_ACCOUNT_DURATION, "lockout duration"},
 124         {AP_RESET_COUNT_TIME, "reset count minutes"},
 125         {AP_BAD_ATTEMPT_LOCKOUT, "bad lockout attempt"},
 126         {AP_TIME_TO_LOGOUT, "disconnect time"},
 127         {AP_REFUSE_MACHINE_PW_CHANGE, "refuse machine password change"},
 128         {0, NULL}
 129 };
 130
 131 char *account_policy_names_list(void)
 132 {
 133         char *nl, *p;
 134         int i;
 135         size_t len = 0;
 136
 137         for (i=0; account_policy_names[i].string; i++) {
 138                 len += strlen(account_policy_names[i].string) + 1;
 139         }
 140         len++;
 141         nl = SMB_MALLOC(len);
 142         if (!nl) {
 143                 return NULL;
 144         }
 145         p = nl;
 146         for (i=0; account_policy_names[i].string; i++) {
 147                 memcpy(p, account_policy_names[i].string, strlen(account_policy_names[i].string) + 1);
 148                 p[strlen(account_policy_names[i].string)] = '\n';
 149                 p += strlen(account_policy_names[i].string) + 1;
 150         }
 151         *p = '\0';
 152         return nl;
 153 }
 154
 155 /****************************************************************************
 156 Get the account policy name as a string from its #define'ed number
 157 ****************************************************************************/
 158
 159 static const char *decode_account_policy_name(int field)
 160 {
 161         int i;
 162         for (i=0; account_policy_names[i].string; i++) {
 163                 if (field == account_policy_names[i].field)
 164                         return account_policy_names[i].string;
 165         }
 166         return NULL;
 167
 168 }
 169
 170 /****************************************************************************
 171 Get the account policy name as a string from its #define'ed number
 172 ****************************************************************************/
 173
 174 int account_policy_name_to_fieldnum(const char *name)
 175 {
 176         int i;
 177         for (i=0; account_policy_names[i].string; i++) {
 178                 if (strcmp(name, account_policy_names[i].string) == 0)
 179                         return account_policy_names[i].field;
 180         }
 181         return 0;
 182
 183 }
 184
 185 /****************************************************************************
 186 ****************************************************************************/
 187
 188 BOOL account_policy_get(int field, uint32 *value)
 189 {
 190         fstring name;
 191         uint32 regval;
 192
 193         if(!init_account_policy())return False;
 194
 195         if (value)
 196                 *value = 0;
 197
 198         fstrcpy(name, decode_account_policy_name(field));
 199         if (!*name) {
 200                 DEBUG(1, ("account_policy_get: Field %d is not a valid account policy type!  Cannot get, returning 0.\n", field));
 201                 return False;
 202         }
 203         if (!tdb_fetch_uint32(tdb, name, &regval)) {
 204                 DEBUG(1, ("account_policy_get: tdb_fetch_uint32 failed for field %d (%s), returning 0\n", field, name));
 205                 return False;
 206         }
 207         if (value)
 208                 *value = regval;
 209
 210         DEBUG(10,("account_policy_get: %s:%d\n", name, regval));
 211         return True;
 212 }
 213
 214
 215 /****************************************************************************
 216 ****************************************************************************/
 217 BOOL account_policy_set(int field, uint32 value)
 218 {
 219         fstring name;
 220
 221         if(!init_account_policy())return False;
 222
 223         fstrcpy(name, decode_account_policy_name(field));
 224         if (!*name) {
 225                 DEBUG(1, ("Field %d is not a valid account policy type!  Cannot set.\n", field));
 226                 return False;
 227         }
 228
 229         if (!tdb_store_uint32(tdb, name, value)) {
 230                 DEBUG(1, ("tdb_store_uint32 failed for field %d (%s) on value %u", field, name, value));
 231                 return False;
 232         }
 233
 234         DEBUG(10,("account_policy_set: %s:%d\n", name, value));
 235
 236         return True;
 237 }
 238
 239 /****************************************************************************
 240 ****************************************************************************/
 241
 242 TDB_CONTEXT *get_account_pol_tdb( void )
 243 {
 244
 245         if ( !tdb ) {
 246                 if ( !init_account_policy() )
 247                         return NULL;
 248         }
 249
 250         return tdb;
 251 }
 252