1 /* Unix NT password database implementation, version 0.7.5.
3 * This program is free software; you can redistribute it and/or modify it under
4 * the terms of the GNU General Public License as published by the Free
5 * Software Foundation; either version 3 of the License, or (at your option)
8 * This program is distributed in the hope that it will be useful, but WITHOUT
9 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
10 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
13 * You should have received a copy of the GNU General Public License along with
14 * this program; if not, see <http://www.gnu.org/licenses/>.
17 /* indicate the following groups are defined */
21 #include "lib/util/debug.h"
25 /* This is only used in the Sun implementation. */
26 #if defined(HAVE_SECURITY_PAM_APPL_H)
27 #include <security/pam_appl.h>
28 #elif defined(HAVE_PAM_PAM_APPL_H)
29 #include <pam/pam_appl.h>
34 #if defined(HAVE_SECURITY_PAM_MODULES_H)
35 #include <security/pam_modules.h>
36 #elif defined(HAVE_PAM_PAM_MODULES_H)
37 #include <pam/pam_modules.h>
44 static void ret_data_cleanup(pam_handle_t
*pamh
, void *data
, int error_status
)
51 /* Restore application signal handler */ \
52 CatchSignal(SIGPIPE, oldsig_handler); \
56 "smb_setcred_return", \
64 static int _smb_add_user(pam_handle_t
*pamh
, unsigned int ctrl
,
65 const char *name
, struct samu
*sampass
, bool exist
);
69 * pam_sm_authenticate() authenticates users against the samba password file.
71 * First, obtain the password from the user. Then use a
72 * routine in 'support.c' to authenticate the user.
75 #define _SMB_AUTHTOK "-SMB-PASS"
77 int pam_sm_authenticate(pam_handle_t
*pamh
, int flags
,
78 int argc
, const char **argv
)
81 int retval
, *ret_data
= NULL
;
82 struct samu
*sampass
= NULL
;
84 void (*oldsig_handler
)(int) = NULL
;
86 TALLOC_CTX
*frame
= talloc_stackframe();
88 /* Points to memory managed by the PAM library. Do not free. */
91 /* Samba initialization. */
92 load_case_tables_library();
94 ctrl
= set_ctrl(pamh
, flags
, argc
, argv
);
96 /* Get a few bytes so we can pass our return value to
98 ret_data
= SMB_MALLOC_P(int);
100 /* we need to do this before we call AUTH_RETURN */
101 /* Getting into places that might use LDAP -- protect the app
102 from a SIGPIPE it's not expecting */
103 oldsig_handler
= CatchSignal(SIGPIPE
, SIG_IGN
);
105 /* get the username */
106 retval
= pam_get_user( pamh
, &name
, "Username: " );
107 if ( retval
!= PAM_SUCCESS
) {
108 if (on( SMB_DEBUG
, ctrl
)) {
109 _log_err(pamh
, LOG_DEBUG
, "auth: could not identify user");
113 if (on( SMB_DEBUG
, ctrl
)) {
114 _log_err(pamh
, LOG_DEBUG
, "username [%s] obtained", name
);
117 if (geteuid() != 0) {
118 _log_err(pamh
, LOG_DEBUG
, "Cannot access samba password database, not running as root.");
119 retval
= PAM_AUTHINFO_UNAVAIL
;
123 if (!initialize_password_db(True
, NULL
)) {
124 _log_err(pamh
, LOG_ALERT
, "Cannot access samba password database" );
125 retval
= PAM_AUTHINFO_UNAVAIL
;
129 sampass
= samu_new( NULL
);
131 _log_err(pamh
, LOG_ALERT
, "Cannot talloc a samu struct" );
132 retval
= nt_status_to_pam(NT_STATUS_NO_MEMORY
);
136 found
= pdb_getsampwnam( sampass
, name
);
138 if (on( SMB_MIGRATE
, ctrl
)) {
139 retval
= _smb_add_user(pamh
, ctrl
, name
, sampass
, found
);
140 TALLOC_FREE(sampass
);
145 _log_err(pamh
, LOG_ALERT
, "Failed to find entry for user %s.", name
);
146 retval
= PAM_USER_UNKNOWN
;
147 TALLOC_FREE(sampass
);
152 /* if this user does not have a password... */
154 if (_smb_blankpasswd( ctrl
, sampass
)) {
155 TALLOC_FREE(sampass
);
156 retval
= PAM_SUCCESS
;
160 /* get this user's authentication token */
162 retval
= _smb_read_password(pamh
, ctrl
, NULL
, "Password: ", NULL
, _SMB_AUTHTOK
, &p
);
163 if (retval
!= PAM_SUCCESS
) {
164 _log_err(pamh
,LOG_CRIT
, "auth: no password provided for [%s]", name
);
165 TALLOC_FREE(sampass
);
169 /* verify the password of this user */
171 retval
= _smb_verify_password( pamh
, sampass
, p
, ctrl
);
172 TALLOC_FREE(sampass
);
178 * This function is for setting samba credentials. If anyone comes up
179 * with any credentials they think should be set, let me know.
182 int pam_sm_setcred(pam_handle_t
*pamh
, int flags
,
183 int argc
, const char **argv
)
185 int retval
, *pretval
= NULL
;
187 retval
= PAM_SUCCESS
;
189 _pam_get_data(pamh
, "smb_setcred_return", &pretval
);
194 pam_set_data(pamh
, "smb_setcred_return", NULL
, NULL
);
199 /* Helper function for adding a user to the db. */
200 static int _smb_add_user(pam_handle_t
*pamh
, unsigned int ctrl
,
201 const char *name
, struct samu
*sampass
, bool exist
)
203 char *err_str
= NULL
;
204 char *msg_str
= NULL
;
205 const char *pass
= NULL
;
207 TALLOC_CTX
*frame
= talloc_stackframe();
209 /* Get the authtok; if we don't have one, silently fail. */
210 retval
= _pam_get_item( pamh
, PAM_AUTHTOK
, &pass
);
212 if (retval
!= PAM_SUCCESS
) {
213 _log_err(pamh
, LOG_ALERT
214 , "pam_get_item returned error to pam_sm_authenticate" );
216 return PAM_AUTHTOK_RECOVER_ERR
;
219 /* Add the user to the db if they aren't already there. */
221 retval
= NT_STATUS_IS_OK(local_password_change(name
, LOCAL_ADD_USER
|LOCAL_SET_PASSWORD
,
222 pass
, &err_str
, &msg_str
));
223 if (!retval
&& err_str
) {
224 make_remark(pamh
, ctrl
, PAM_ERROR_MSG
, err_str
);
225 } else if (msg_str
) {
226 make_remark(pamh
, ctrl
, PAM_TEXT_INFO
, msg_str
);
235 /* mimick 'update encrypted' as long as the 'no pw req' flag is not set */
236 if ( pdb_get_acct_ctrl(sampass
) & ~ACB_PWNOTREQ
) {
237 retval
= NT_STATUS_IS_OK(local_password_change(name
, LOCAL_SET_PASSWORD
,
238 pass
, &err_str
, &msg_str
));
239 if (!retval
&& err_str
) {
240 make_remark(pamh
, ctrl
, PAM_ERROR_MSG
, err_str
);
241 } else if (msg_str
) {
242 make_remark(pamh
, ctrl
, PAM_TEXT_INFO
, msg_str
);
254 /* static module data */
256 struct pam_module _pam_smbpass_auth_modstruct
= {