2 Unix SMB/CIFS implementation.
3 SMB client password change routine
4 Copyright (C) Andrew Tridgell 1994-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "../librpc/gen_ndr/ndr_samr.h"
22 #include "rpc_client/cli_pipe.h"
23 #include "rpc_client/cli_samr.h"
24 #include "libsmb/libsmb.h"
25 #include "libsmb/clirap.h"
26 #include "libsmb/nmblib.h"
27 #include "../libcli/smb/smbXcli_base.h"
29 /*************************************************************
30 Change a password on a remote machine using IPC calls.
31 *************************************************************/
33 NTSTATUS
remote_password_change(const char *remote_machine
, const char *user_name
,
34 const char *old_passwd
, const char *new_passwd
,
37 struct cli_state
*cli
= NULL
;
38 struct rpc_pipe_client
*pipe_hnd
= NULL
;
39 char *user
, *domain
, *p
;
42 bool pass_must_change
= False
;
44 user
= talloc_strdup(talloc_tos(), user_name
);
45 SMB_ASSERT(user
!= NULL
);
46 domain
= talloc_strdup(talloc_tos(), "");
47 SMB_ASSERT(domain
!= NULL
);
49 /* allow usernames of the form domain\\user or domain/user */
50 if ((p
= strchr_m(user
,'\\')) || (p
= strchr_m(user
,'/')) ||
51 (p
= strchr_m(user
,*lp_winbind_separator()))) {
59 result
= cli_connect_nb(remote_machine
, NULL
, 0, 0x20, NULL
,
60 SMB_SIGNING_DEFAULT
, 0, &cli
);
61 if (!NT_STATUS_IS_OK(result
)) {
62 if (asprintf(err_str
, "Unable to connect to SMB server on "
63 "machine %s. Error was : %s.\n",
64 remote_machine
, nt_errstr(result
))==-1) {
70 result
= smbXcli_negprot(cli
->conn
, cli
->timeout
, PROTOCOL_CORE
,
73 if (!NT_STATUS_IS_OK(result
)) {
74 if (asprintf(err_str
, "machine %s rejected the negotiate "
75 "protocol. Error was : %s.\n",
76 remote_machine
, nt_errstr(result
)) == -1) {
83 /* Given things like SMB signing, restrict anonymous and the like,
84 try an authenticated connection first */
85 result
= cli_session_setup(cli
, user_name
,
86 old_passwd
, strlen(old_passwd
)+1,
87 old_passwd
, strlen(old_passwd
)+1, "");
89 if (!NT_STATUS_IS_OK(result
)) {
91 /* Password must change or Password expired are the only valid
92 * error conditions here from where we can proceed, the rest like
93 * account locked out or logon failure will lead to errors later
96 if (!NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_MUST_CHANGE
) &&
97 !NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_EXPIRED
)) {
98 if (asprintf(err_str
, "Could not connect to machine %s: "
99 "%s\n", remote_machine
, nt_errstr(result
)) == -1) {
106 pass_must_change
= True
;
109 * We should connect as the anonymous user here, in case
110 * the server has "must change password" checked...
111 * Thanks to <Nicholas.S.Jenkins@cdc.com> for this fix.
114 result
= cli_session_setup(cli
, "", "", 0, "", 0, "");
116 if (!NT_STATUS_IS_OK(result
)) {
117 if (asprintf(err_str
, "machine %s rejected the session "
118 "setup. Error was : %s.\n",
119 remote_machine
, nt_errstr(result
)) == -1) {
127 result
= cli_tree_connect(cli
, "IPC$", "IPC", "", 1);
128 if (!NT_STATUS_IS_OK(result
)) {
129 if (asprintf(err_str
, "machine %s rejected the tconX on the "
130 "IPC$ share. Error was : %s.\n",
131 remote_machine
, nt_errstr(result
))) {
138 /* Try not to give the password away too easily */
140 if (!pass_must_change
) {
141 result
= cli_rpc_pipe_open_generic_auth(cli
,
144 CRED_DONT_USE_KERBEROS
,
145 DCERPC_AUTH_TYPE_NTLMSSP
,
146 DCERPC_AUTH_LEVEL_PRIVACY
,
153 * If the user password must be changed the ntlmssp bind will
154 * fail the same way as the session setup above did. The
155 * difference ist that with a pipe bind we don't get a good
156 * error message, the result will be that the rpc call below
157 * will just fail. So we do it anonymously, there's no other
160 result
= cli_rpc_pipe_open_noauth(
161 cli
, &ndr_table_samr
, &pipe_hnd
);
164 if (!NT_STATUS_IS_OK(result
)) {
165 if (lp_client_lanman_auth()) {
166 /* Use the old RAP method. */
167 if (!cli_oem_change_password(cli
, user_name
, new_passwd
, old_passwd
)) {
168 result
= cli_nt_error(cli
);
169 if (asprintf(err_str
, "machine %s rejected the "
170 "password change: Error was : %s.\n",
171 remote_machine
, nt_errstr(result
)) == -1) {
178 if (asprintf(err_str
, "SAMR connection to machine %s "
179 "failed. Error was %s, but LANMAN password "
180 "changes are disabled\n",
181 remote_machine
, nt_errstr(result
)) == -1) {
189 result
= rpccli_samr_chgpasswd_user2(pipe_hnd
, talloc_tos(),
190 user_name
, new_passwd
, old_passwd
);
191 if (NT_STATUS_IS_OK(result
)) {
192 /* Great - it all worked! */
196 } else if (!(NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
)
197 || NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
))) {
198 /* it failed, but for reasons such as wrong password, too short etc ... */
200 if (asprintf(err_str
, "machine %s rejected the password change: "
202 remote_machine
, get_friendly_nt_error_msg(result
)) == -1) {
209 /* OK, that failed, so try again... */
210 TALLOC_FREE(pipe_hnd
);
212 /* Try anonymous NTLMSSP... */
213 result
= NT_STATUS_UNSUCCESSFUL
;
215 /* OK, this is ugly, but... try an anonymous pipe. */
216 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_samr
,
219 if ( NT_STATUS_IS_OK(result
) &&
220 (NT_STATUS_IS_OK(result
= rpccli_samr_chgpasswd_user2(
221 pipe_hnd
, talloc_tos(), user_name
,
222 new_passwd
, old_passwd
)))) {
223 /* Great - it all worked! */
227 if (!(NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
)
228 || NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
))) {
229 /* it failed, but again it was due to things like new password too short */
231 if (asprintf(err_str
, "machine %s rejected the "
232 "(anonymous) password change: Error was : "
233 "%s.\n", remote_machine
,
234 get_friendly_nt_error_msg(result
)) == -1) {
241 /* We have failed to change the user's password, and we think the server
242 just might not support SAMR password changes, so fall back */
244 if (lp_client_lanman_auth()) {
245 /* Use the old RAP method. */
246 if (cli_oem_change_password(cli
, user_name
, new_passwd
, old_passwd
)) {
247 /* SAMR failed, but the old LanMan protocol worked! */
253 result
= cli_nt_error(cli
);
254 if (asprintf(err_str
, "machine %s rejected the password "
255 "change: Error was : %s.\n",
256 remote_machine
, nt_errstr(result
)) == -1) {
262 if (asprintf(err_str
, "SAMR connection to machine %s "
263 "failed. Error was %s, but LANMAN password "
264 "changes are disabled\n",
265 nt_errstr(result
), remote_machine
) == -1) {
269 return NT_STATUS_UNSUCCESSFUL
;