2 * Unix SMB/CIFS implementation.
3 * account policy storage
4 * Copyright (C) Jean François Micouleau 1998-2001.
5 * Copyright (C) Andrew Bartlett 2002
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 static TDB_CONTEXT
*tdb
;
25 #define DATABASE_VERSION 2
27 /****************************************************************************
28 Set default for a field if it is empty
29 ****************************************************************************/
31 static void set_default_on_empty(int field
, uint32 value
)
33 if (account_policy_get(field
, NULL
))
35 account_policy_set(field
, value
);
39 /****************************************************************************
40 Open the account policy tdb.
41 ****************************************************************************/
43 BOOL
init_account_policy(void)
45 const char *vstring
= "INFO/version";
50 tdb
= tdb_open_log(lock_path("account_policy.tdb"), 0, TDB_DEFAULT
, O_RDWR
|O_CREAT
, 0600);
52 DEBUG(0,("Failed to open account policy database\n"));
56 /* handle a Samba upgrade */
57 tdb_lock_bystring(tdb
, vstring
,0);
58 if (!tdb_fetch_uint32(tdb
, vstring
, &version
) || version
!= DATABASE_VERSION
) {
59 tdb_store_uint32(tdb
, vstring
, DATABASE_VERSION
);
63 MINPASSWDLENGTH
);/* 5 chars minimum */
66 0); /* don't keep any old password */
68 AP_USER_MUST_LOGON_TO_CHG_PASS
,
69 0); /* don't force user to logon */
72 (uint32
)-1); /* don't expire */
77 AP_LOCK_ACCOUNT_DURATION
,
78 30); /* lockout for 30 minutes */
81 30); /* reset after 30 minutes */
83 AP_BAD_ATTEMPT_LOCKOUT
,
84 0); /* don't lockout */
87 -1); /* don't force logout */
89 AP_REFUSE_MACHINE_PW_CHANGE
,
90 0); /* allow machine pw changes */
92 tdb_unlock_bystring(tdb
, vstring
);
94 /* These exist by default on NT4 in [HKLM\SECURITY\Policy\Accounts] */
96 privilege_create_account( &global_sid_World
);
97 privilege_create_account( &global_sid_Builtin_Administrators
);
98 privilege_create_account( &global_sid_Builtin_Account_Operators
);
99 privilege_create_account( &global_sid_Builtin_Server_Operators
);
100 privilege_create_account( &global_sid_Builtin_Print_Operators
);
101 privilege_create_account( &global_sid_Builtin_Backup_Operators
);
106 static const struct {
109 } account_policy_names
[] = {
110 {AP_MIN_PASSWORD_LEN
, "min password length"},
111 {AP_PASSWORD_HISTORY
, "password history"},
112 {AP_USER_MUST_LOGON_TO_CHG_PASS
, "user must logon to change password"},
113 {AP_MAX_PASSWORD_AGE
, "maximum password age"},
114 {AP_MIN_PASSWORD_AGE
,"minimum password age"},
115 {AP_LOCK_ACCOUNT_DURATION
, "lockout duration"},
116 {AP_RESET_COUNT_TIME
, "reset count minutes"},
117 {AP_BAD_ATTEMPT_LOCKOUT
, "bad lockout attempt"},
118 {AP_TIME_TO_LOGOUT
, "disconnect time"},
119 {AP_REFUSE_MACHINE_PW_CHANGE
, "refuse machine password change"},
123 char *account_policy_names_list(void)
129 for (i
=0; account_policy_names
[i
].string
; i
++) {
130 len
+= strlen(account_policy_names
[i
].string
) + 1;
133 nl
= SMB_MALLOC(len
);
138 for (i
=0; account_policy_names
[i
].string
; i
++) {
139 memcpy(p
, account_policy_names
[i
].string
, strlen(account_policy_names
[i
].string
) + 1);
140 p
[strlen(account_policy_names
[i
].string
)] = '\n';
141 p
+= strlen(account_policy_names
[i
].string
) + 1;
147 /****************************************************************************
148 Get the account policy name as a string from its #define'ed number
149 ****************************************************************************/
151 static const char *decode_account_policy_name(int field
)
154 for (i
=0; account_policy_names
[i
].string
; i
++) {
155 if (field
== account_policy_names
[i
].field
)
156 return account_policy_names
[i
].string
;
162 /****************************************************************************
163 Get the account policy name as a string from its #define'ed number
164 ****************************************************************************/
166 int account_policy_name_to_fieldnum(const char *name
)
169 for (i
=0; account_policy_names
[i
].string
; i
++) {
170 if (strcmp(name
, account_policy_names
[i
].string
) == 0)
171 return account_policy_names
[i
].field
;
177 /****************************************************************************
178 ****************************************************************************/
180 BOOL
account_policy_get(int field
, uint32
*value
)
185 if(!init_account_policy())return False
;
190 fstrcpy(name
, decode_account_policy_name(field
));
192 DEBUG(1, ("account_policy_get: Field %d is not a valid account policy type! Cannot get, returning 0.\n", field
));
195 if (!tdb_fetch_uint32(tdb
, name
, ®val
)) {
196 DEBUG(1, ("account_policy_get: tdb_fetch_uint32 failed for field %d (%s), returning 0\n", field
, name
));
202 DEBUG(10,("account_policy_get: %s:%d\n", name
, regval
));
207 /****************************************************************************
208 ****************************************************************************/
209 BOOL
account_policy_set(int field
, uint32 value
)
213 if(!init_account_policy())return False
;
215 fstrcpy(name
, decode_account_policy_name(field
));
217 DEBUG(1, ("Field %d is not a valid account policy type! Cannot set.\n", field
));
221 if (!tdb_store_uint32(tdb
, name
, value
)) {
222 DEBUG(1, ("tdb_store_uint32 failed for field %d (%s) on value %u", field
, name
, value
));
226 DEBUG(10,("account_policy_set: %s:%d\n", name
, value
));
231 /****************************************************************************
232 ****************************************************************************/
234 TDB_CONTEXT
*get_account_pol_tdb( void )
238 if ( !init_account_policy() )