source/nsswitch/wbinfo.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 2.0
   4
   5    Winbind status program.
   6
   7    Copyright (C) Tim Potter 2000
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26 #include "debug.h"
  27
  28 /* Prototypes from common.h */
  29
  30 NSS_STATUS winbindd_request(int req_type,
  31                             struct winbindd_request *request,
  32                             struct winbindd_response *response);
  33
  34 /* List groups a user is a member of */
  35
  36 static BOOL wbinfo_get_usergroups(char *user)
  37 {
  38         struct winbindd_request request;
  39         struct winbindd_response response;
  40         NSS_STATUS result;
  41         int i;
  42
  43         ZERO_STRUCT(response);
  44
  45         /* Send request */
  46
  47         fstrcpy(request.data.username, user);
  48
  49         result = winbindd_request(WINBINDD_GETGROUPS, &request, &response);
  50
  51         if (result != NSS_STATUS_SUCCESS) {
  52                 return False;
  53         }
  54
  55         for (i = 0; i < response.data.num_entries; i++) {
  56                 printf("%d\n", (int)((gid_t *)response.extra_data)[i]);
  57         }
  58
  59         return True;
  60 }
  61
  62 /* Convert NetBIOS name to IP */
  63
  64 static BOOL wbinfo_wins_byname(char *name)
  65 {
  66         struct winbindd_request request;
  67         struct winbindd_response response;
  68
  69         ZERO_STRUCT(request);
  70         ZERO_STRUCT(response);
  71
  72         /* Send request */
  73
  74         fstrcpy(request.data.name, name);
  75         if (winbindd_request(WINBINDD_WINS_BYNAME, &request, &response) !=
  76             NSS_STATUS_SUCCESS) {
  77                 return False;
  78         }
  79
  80         /* Display response */
  81
  82         printf("%s\n", response.data.name.name);
  83
  84         return True;
  85 }
  86
  87 /* Convert IP to NetBIOS name */
  88
  89 static BOOL wbinfo_wins_byip(char *ip)
  90 {
  91         struct winbindd_request request;
  92         struct winbindd_response response;
  93
  94         ZERO_STRUCT(request);
  95         ZERO_STRUCT(response);
  96
  97         /* Send request */
  98
  99         fstrcpy(request.data.name, ip);
 100         if (winbindd_request(WINBINDD_WINS_BYIP, &request, &response) !=
 101             NSS_STATUS_SUCCESS) {
 102                 return False;
 103         }
 104
 105         /* Display response */
 106
 107         printf("%s\n", response.data.name.name);
 108
 109         return True;
 110 }
 111
 112 /* List trusted domains */
 113
 114 static BOOL wbinfo_list_domains(void)
 115 {
 116         struct winbindd_response response;
 117         fstring name;
 118
 119         ZERO_STRUCT(response);
 120
 121         /* Send request */
 122
 123         if (winbindd_request(WINBINDD_LIST_TRUSTDOM, NULL, &response) !=
 124             NSS_STATUS_SUCCESS) {
 125                 return False;
 126         }
 127
 128         /* Display response */
 129
 130         if (response.extra_data) {
 131                 while(next_token((char **)&response.extra_data, name, ",",
 132                                  sizeof(fstring))) {
 133                         printf("%s\n", name);
 134                 }
 135         }
 136
 137         return True;
 138 }
 139
 140 /* Check trust account password */
 141
 142 static BOOL wbinfo_check_secret(void)
 143 {
 144         struct winbindd_response response;
 145         BOOL result;
 146
 147         ZERO_STRUCT(response);
 148
 149         result = winbindd_request(WINBINDD_CHECK_MACHACC, NULL, &response) ==
 150                 NSS_STATUS_SUCCESS;
 151
 152         if (result) {
 153
 154                 if (response.data.num_entries == 0) {
 155                         printf("Secret is good\n");
 156                 } else {
 157                         printf("Secret is bad\n0x%08x\n",
 158                                response.data.num_entries);
 159                 }
 160
 161                 return True;
 162         }
 163
 164         return False;
 165 }
 166
 167 /* Convert uid to sid */
 168
 169 static BOOL wbinfo_uid_to_sid(uid_t uid)
 170 {
 171         struct winbindd_request request;
 172         struct winbindd_response response;
 173
 174         ZERO_STRUCT(request);
 175         ZERO_STRUCT(response);
 176
 177         /* Send request */
 178
 179         request.data.uid = uid;
 180         if (winbindd_request(WINBINDD_UID_TO_SID, &request, &response) !=
 181             NSS_STATUS_SUCCESS) {
 182                 return False;
 183         }
 184
 185         /* Display response */
 186
 187         printf("%s\n", response.data.sid.sid);
 188
 189         return True;
 190 }
 191
 192 /* Convert gid to sid */
 193
 194 static BOOL wbinfo_gid_to_sid(gid_t gid)
 195 {
 196         struct winbindd_request request;
 197         struct winbindd_response response;
 198
 199         ZERO_STRUCT(request);
 200         ZERO_STRUCT(response);
 201
 202         /* Send request */
 203
 204         request.data.gid = gid;
 205         if (winbindd_request(WINBINDD_GID_TO_SID, &request, &response) !=
 206             NSS_STATUS_SUCCESS) {
 207                 return False;
 208         }
 209
 210         /* Display response */
 211
 212         printf("%s\n", response.data.sid.sid);
 213
 214         return True;
 215 }
 216
 217 /* Convert sid to uid */
 218
 219 static BOOL wbinfo_sid_to_uid(char *sid)
 220 {
 221         struct winbindd_request request;
 222         struct winbindd_response response;
 223
 224         ZERO_STRUCT(request);
 225         ZERO_STRUCT(response);
 226
 227         /* Send request */
 228
 229         fstrcpy(request.data.sid, sid);
 230         if (winbindd_request(WINBINDD_SID_TO_UID, &request, &response) !=
 231             NSS_STATUS_SUCCESS) {
 232                 return False;
 233         }
 234
 235         /* Display response */
 236
 237         printf("%d\n", (int)response.data.uid);
 238
 239         return True;
 240 }
 241
 242 static BOOL wbinfo_sid_to_gid(char *sid)
 243 {
 244         struct winbindd_request request;
 245         struct winbindd_response response;
 246
 247         ZERO_STRUCT(request);
 248         ZERO_STRUCT(response);
 249
 250         /* Send request */
 251
 252         fstrcpy(request.data.sid, sid);
 253         if (winbindd_request(WINBINDD_SID_TO_GID, &request, &response) !=
 254             NSS_STATUS_SUCCESS) {
 255                 return False;
 256         }
 257
 258         /* Display response */
 259
 260         printf("%d\n", (int)response.data.gid);
 261
 262         return True;
 263 }
 264
 265 /* Convert sid to string */
 266
 267 static BOOL wbinfo_lookupsid(char *sid)
 268 {
 269         struct winbindd_request request;
 270         struct winbindd_response response;
 271
 272         ZERO_STRUCT(request);
 273         ZERO_STRUCT(response);
 274
 275         /* Send off request */
 276
 277         fstrcpy(request.data.sid, sid);
 278         if (winbindd_request(WINBINDD_LOOKUPSID, &request, &response) !=
 279             NSS_STATUS_SUCCESS) {
 280                 return False;
 281         }
 282
 283         /* Display response */
 284
 285         printf("%s %d\n", response.data.name.name, response.data.name.type);
 286
 287         return True;
 288 }
 289
 290 /* Convert string to sid */
 291
 292 static BOOL wbinfo_lookupname(char *name)
 293 {
 294         struct winbindd_request request;
 295         struct winbindd_response response;
 296
 297         /*
 298          * Don't do the lookup if the name has no separator.
 299          */
 300
 301         if (!strchr(name, *lp_winbind_separator()))
 302                 return False;
 303
 304         /* Send off request */
 305
 306         ZERO_STRUCT(request);
 307         ZERO_STRUCT(response);
 308
 309         fstrcpy(request.data.name, name);
 310         if (winbindd_request(WINBINDD_LOOKUPNAME, &request, &response) !=
 311             NSS_STATUS_SUCCESS) {
 312                 return False;
 313         }
 314
 315         /* Display response */
 316
 317         printf("%s %d\n", response.data.sid.sid, response.data.sid.type);
 318
 319         return True;
 320 }
 321
 322 /* Authenticate a user with a plaintext password */
 323
 324 static BOOL wbinfo_auth(char *username)
 325 {
 326         struct winbindd_request request;
 327         struct winbindd_response response;
 328         NSS_STATUS result;
 329         char *p;
 330
 331         /*
 332          * Don't do the lookup if the name has no separator.
 333          */
 334
 335         if (!strchr(username, *lp_winbind_separator()))
 336                 return False;
 337
 338         /* Send off request */
 339
 340         ZERO_STRUCT(request);
 341         ZERO_STRUCT(response);
 342
 343         p = strchr(username, '%');
 344
 345         if (p) {
 346                 *p = 0;
 347                 fstrcpy(request.data.auth.user, username);
 348                 fstrcpy(request.data.auth.pass, p + 1);
 349                 *p = '%';
 350         } else
 351                 fstrcpy(request.data.auth.user, username);
 352
 353         result = winbindd_request(WINBINDD_PAM_AUTH, &request, &response);
 354
 355         /* Display response */
 356
 357         printf("plaintext password authentication %s\n",
 358                (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
 359
 360         return result == NSS_STATUS_SUCCESS;
 361 }
 362
 363 /* Authenticate a user with a challenge/response */
 364
 365 static BOOL wbinfo_auth_crap(char *username)
 366 {
 367         struct winbindd_request request;
 368         struct winbindd_response response;
 369         NSS_STATUS result;
 370         fstring pass;
 371         char *p;
 372
 373         /*
 374          * Don't do the lookup if the name has no separator.
 375          */
 376
 377         if (!strchr(username, *lp_winbind_separator()))
 378                 return False;
 379
 380         /* Send off request */
 381
 382         ZERO_STRUCT(request);
 383         ZERO_STRUCT(response);
 384
 385         p = strchr(username, '%');
 386
 387         if (p) {
 388                 *p = 0;
 389                 fstrcpy(request.data.auth_crap.user, username);
 390                 fstrcpy(pass, p + 1);
 391                 *p = '%';
 392         } else
 393                 fstrcpy(request.data.auth_crap.user, username);
 394
 395         generate_random_buffer(request.data.auth_crap.chal, 8, False);
 396
 397         SMBencrypt((uchar *)pass, request.data.auth_crap.chal,
 398                    (uchar *)request.data.auth_crap.lm_resp);
 399         SMBNTencrypt((uchar *)pass, request.data.auth_crap.chal,
 400                      (uchar *)request.data.auth_crap.nt_resp);
 401
 402         request.data.auth_crap.lm_resp_len = 24;
 403         request.data.auth_crap.nt_resp_len = 24;
 404
 405         result = winbindd_request(WINBINDD_PAM_AUTH_CRAP, &request, &response);
 406
 407         /* Display response */
 408
 409         printf("challenge/response password authentication %s\n",
 410                (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
 411
 412         return result == NSS_STATUS_SUCCESS;
 413 }
 414
 415 /* Print domain users */
 416
 417 static BOOL print_domain_users(void)
 418 {
 419         struct winbindd_response response;
 420         fstring name;
 421
 422         /* Send request to winbind daemon */
 423
 424         ZERO_STRUCT(response);
 425
 426         if (winbindd_request(WINBINDD_LIST_USERS, NULL, &response) !=
 427             NSS_STATUS_SUCCESS) {
 428                 return False;
 429         }
 430
 431         /* Look through extra data */
 432
 433         if (!response.extra_data) {
 434                 return False;
 435         }
 436
 437         while(next_token((char **)&response.extra_data, name, ",",
 438                          sizeof(fstring))) {
 439                 printf("%s\n", name);
 440         }
 441
 442         return True;
 443 }
 444
 445 /* Print domain groups */
 446
 447 static BOOL print_domain_groups(void)
 448 {
 449         struct winbindd_response response;
 450         fstring name;
 451
 452         ZERO_STRUCT(response);
 453
 454         if (winbindd_request(WINBINDD_LIST_GROUPS, NULL, &response) !=
 455             NSS_STATUS_SUCCESS) {
 456                 return False;
 457         }
 458
 459         /* Look through extra data */
 460
 461         if (!response.extra_data) {
 462                 return False;
 463         }
 464
 465         while(next_token((char **)&response.extra_data, name, ",",
 466                          sizeof(fstring))) {
 467                 printf("%s\n", name);
 468         }
 469
 470         return True;
 471 }
 472
 473 /* Set the authorised user for winbindd access in secrets.tdb */
 474
 475 static BOOL wbinfo_set_auth_user(char *username)
 476 {
 477         char *password;
 478
 479         /* Separate into user and password */
 480
 481         password = strchr(username, '%');
 482
 483         if (password) {
 484                 *password = 0;
 485                 password++;
 486         } else
 487                 password = "";
 488
 489         /* Store in secrets.tdb */
 490
 491         if (!secrets_init() ||
 492             !secrets_store(SECRETS_AUTH_USER, username, strlen(username) + 1) ||
 493             !secrets_store(SECRETS_AUTH_PASSWORD, password, strlen(password) + 1)) {
 494                 fprintf(stderr, "error storing authenticated user info\n");
 495                 return False;
 496         }
 497
 498         return True;
 499 }
 500
 501 /* Print program usage */
 502
 503 static void usage(void)
 504 {
 505         printf("Usage: wbinfo -ug | -n name | -sSY sid | -UG uid/gid | -tm "
 506                "| -aA user%%password\n");
 507         printf("\t-u\t\t\tlists all domain users\n");
 508         printf("\t-g\t\t\tlists all domain groups\n");
 509         printf("\t-h name\t\t\tconverts NetBIOS hostname to IP\n");
 510         printf("\t-i ip\t\t\tconverts IP address to NetBIOS name\n");
 511         printf("\t-n name\t\t\tconverts name to sid\n");
 512         printf("\t-s sid\t\t\tconverts sid to name\n");
 513         printf("\t-U uid\t\t\tconverts uid to sid\n");
 514         printf("\t-G gid\t\t\tconverts gid to sid\n");
 515         printf("\t-S sid\t\t\tconverts sid to uid\n");
 516         printf("\t-Y sid\t\t\tconverts sid to gid\n");
 517         printf("\t-t\t\t\tcheck shared secret\n");
 518         printf("\t-m\t\t\tlist trusted domains\n");
 519         printf("\t-r user\t\t\tget user groups\n");
 520         printf("\t-a user%%password\tauthenticate user\n");
 521         printf("\t-A user%%password\tstore session setup auth password\n");
 522 }
 523
 524 /* Main program */
 525
 526 int main(int argc, char **argv)
 527 {
 528         extern pstring global_myname;
 529         int opt;
 530
 531         /* Samba client initialisation */
 532
 533         if (!*global_myname) {
 534                 char *p;
 535
 536                 fstrcpy(global_myname, myhostname());
 537                 p = strchr(global_myname, '.');
 538                 if (p) {
 539                         *p = 0;
 540                 }
 541         }
 542
 543         TimeInit();
 544
 545         codepage_initialise(lp_client_code_page());
 546         charset_initialise();
 547
 548         if (!lp_load(CONFIGFILE, True, False, False)) {
 549                 fprintf(stderr, "wbinfo: error opening config file %s. Error was %s\n",
 550                         CONFIGFILE, strerror(errno));
 551                 exit(1);
 552         }
 553
 554         load_interfaces();
 555
 556         /* Parse command line options */
 557
 558         if (argc == 1) {
 559                 usage();
 560                 return 1;
 561         }
 562
 563         while ((opt = getopt(argc, argv, "h:i:ugs:n:U:G:S:Y:tmr:a:A:")) != EOF) {
 564                 switch (opt) {
 565                 case 'u':
 566                         if (!print_domain_users()) {
 567                                 printf("Error looking up domain users\n");
 568                                 return 1;
 569                         }
 570                         break;
 571                 case 'g':
 572                         if (!print_domain_groups()) {
 573                                 printf("Error looking up domain groups\n");
 574                                 return 1;
 575                         }
 576                         break;
 577                 case 'h':
 578                         if (!wbinfo_wins_byname(optarg)) {
 579                                 printf("Could not lookup WINS by hostname %s\n", optarg);
 580                                 return 1;
 581                         }
 582                         break;
 583                 case 'i':
 584                         if (!wbinfo_wins_byip(optarg)) {
 585                                 printf("Could not lookup WINS by IP %s\n", optarg);
 586                                 return 1;
 587                         }
 588                         break;
 589                 case 's':
 590                         if (!wbinfo_lookupsid(optarg)) {
 591                                 printf("Could not lookup sid %s\n", optarg);
 592                                 return 1;
 593                         }
 594                         break;
 595                 case 'n':
 596                         if (!wbinfo_lookupname(optarg)) {
 597                                 printf("Could not lookup name %s\n", optarg);
 598                                 return 1;
 599                         }
 600                         break;
 601                 case 'U':
 602                         if (!wbinfo_uid_to_sid(atoi(optarg))) {
 603                                 printf("Could not convert uid %s to sid\n",
 604                                        optarg);
 605                                 return 1;
 606                         }
 607                         break;
 608                 case 'G':
 609                         if (!wbinfo_gid_to_sid(atoi(optarg))) {
 610                                 printf("Could not convert gid %s to sid\n",
 611                                        optarg);
 612                                 return 1;
 613                         }
 614                         break;
 615                 case 'S':
 616                         if (!wbinfo_sid_to_uid(optarg)) {
 617                                 printf("Could not convert sid %s to uid\n",
 618                                        optarg);
 619                                 return 1;
 620                         }
 621                         break;
 622                 case 'Y':
 623                         if (!wbinfo_sid_to_gid(optarg)) {
 624                                 printf("Could not convert sid %s to gid\n",
 625                                        optarg);
 626                                 return 1;
 627                         }
 628                         break;
 629                 case 't':
 630                         if (!wbinfo_check_secret()) {
 631                                 printf("Could not check secret\n");
 632                                 return 1;
 633                         }
 634                         break;
 635                 case 'm':
 636                         if (!wbinfo_list_domains()) {
 637                                 printf("Could not list trusted domains\n");
 638                                 return 1;
 639                         }
 640                         break;
 641                 case 'r':
 642                         if (!wbinfo_get_usergroups(optarg)) {
 643                                 printf("Could not get groups for user %s\n",
 644                                        optarg);
 645                                 return 1;
 646                         }
 647                         break;
 648                 case 'a': {
 649                         BOOL got_error = False;
 650
 651                         if (!wbinfo_auth(optarg)) {
 652                                 printf("Could not authenticate user %s with "
 653                                        "plaintext password\n", optarg);
 654                                 got_error = True;
 655                         }
 656
 657                         if (!wbinfo_auth_crap(optarg)) {
 658                                 printf("Could not authenticate user %s with "
 659                                        "challenge/response\n", optarg);
 660                                 got_error = True;
 661                         }
 662
 663                         if (got_error)
 664                                 return 1;
 665                         break;
 666
 667                 }
 668                 case 'A': {
 669                         if (!(wbinfo_set_auth_user(optarg))) {
 670                                 return 1;
 671                         }
 672                         break;
 673                 }
 674                       /* Invalid option */
 675
 676                 default:
 677                         usage();
 678                         return 1;
 679                 }
 680         }
 681
 682         /* Clean exit */
 683
 684         return 0;
 685 }