2 Unix SMB/CIFS implementation.
3 SMB client password change routine
4 Copyright (C) Andrew Tridgell 1994-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "../librpc/gen_ndr/ndr_samr.h"
22 #include "rpc_client/cli_pipe.h"
23 #include "rpc_client/cli_samr.h"
24 #include "libsmb/clirap.h"
26 /*************************************************************
27 Change a password on a remote machine using IPC calls.
28 *************************************************************/
30 NTSTATUS
remote_password_change(const char *remote_machine
, const char *user_name
,
31 const char *old_passwd
, const char *new_passwd
,
34 struct nmb_name calling
, called
;
35 struct cli_state
*cli
= NULL
;
36 struct rpc_pipe_client
*pipe_hnd
= NULL
;
37 struct sockaddr_storage ss
;
38 char *user
, *domain
, *p
;
41 bool pass_must_change
= False
;
43 user
= talloc_strdup(talloc_tos(), user_name
);
44 SMB_ASSERT(user
!= NULL
);
45 domain
= talloc_strdup(talloc_tos(), "");
46 SMB_ASSERT(domain
!= NULL
);
48 /* allow usernames of the form domain\\user or domain/user */
49 if ((p
= strchr_m(user
,'\\')) || (p
= strchr_m(user
,'/')) ||
50 (p
= strchr_m(user
,*lp_winbind_separator()))) {
58 if(!resolve_name( remote_machine
, &ss
, 0x20, false)) {
59 if (asprintf(err_str
, "Unable to find an IP address for machine "
60 "%s.\n", remote_machine
) == -1) {
63 return NT_STATUS_UNSUCCESSFUL
;
66 cli
= cli_initialise();
68 return NT_STATUS_NO_MEMORY
;
71 result
= cli_connect(cli
, remote_machine
, &ss
);
72 if (!NT_STATUS_IS_OK(result
)) {
73 if (asprintf(err_str
, "Unable to connect to SMB server on "
74 "machine %s. Error was : %s.\n",
75 remote_machine
, nt_errstr(result
))==-1) {
82 make_nmb_name(&calling
, global_myname() , 0x0);
83 make_nmb_name(&called
, remote_machine
, 0x20);
85 if (!cli_session_request(cli
, &calling
, &called
)) {
86 if (asprintf(err_str
, "machine %s rejected the session setup. "
88 remote_machine
, cli_errstr(cli
)) == -1) {
91 result
= cli_nt_error(cli
);
96 cli
->protocol
= PROTOCOL_NT1
;
98 result
= cli_negprot(cli
);
100 if (!NT_STATUS_IS_OK(result
)) {
101 if (asprintf(err_str
, "machine %s rejected the negotiate "
102 "protocol. Error was : %s.\n",
103 remote_machine
, nt_errstr(result
)) == -1) {
106 result
= cli_nt_error(cli
);
111 /* Given things like SMB signing, restrict anonymous and the like,
112 try an authenticated connection first */
113 result
= cli_session_setup(cli
, user_name
,
114 old_passwd
, strlen(old_passwd
)+1,
115 old_passwd
, strlen(old_passwd
)+1, "");
117 if (!NT_STATUS_IS_OK(result
)) {
119 /* Password must change or Password expired are the only valid
120 * error conditions here from where we can proceed, the rest like
121 * account locked out or logon failure will lead to errors later
124 if (!NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_MUST_CHANGE
) &&
125 !NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_EXPIRED
)) {
126 if (asprintf(err_str
, "Could not connect to machine %s: "
127 "%s\n", remote_machine
, cli_errstr(cli
)) == -1) {
134 pass_must_change
= True
;
137 * We should connect as the anonymous user here, in case
138 * the server has "must change password" checked...
139 * Thanks to <Nicholas.S.Jenkins@cdc.com> for this fix.
142 result
= cli_session_setup(cli
, "", "", 0, "", 0, "");
144 if (!NT_STATUS_IS_OK(result
)) {
145 if (asprintf(err_str
, "machine %s rejected the session "
146 "setup. Error was : %s.\n",
147 remote_machine
, cli_errstr(cli
)) == -1) {
154 result
= cli_init_creds(cli
, "", "", NULL
);
155 if (!NT_STATUS_IS_OK(result
)) {
160 result
= cli_init_creds(cli
, user
, domain
, old_passwd
);
161 if (!NT_STATUS_IS_OK(result
)) {
167 result
= cli_tcon_andx(cli
, "IPC$", "IPC", "", 1);
168 if (!NT_STATUS_IS_OK(result
)) {
169 if (asprintf(err_str
, "machine %s rejected the tconX on the "
170 "IPC$ share. Error was : %s.\n",
171 remote_machine
, nt_errstr(result
))) {
178 /* Try not to give the password away too easily */
180 if (!pass_must_change
) {
181 result
= cli_rpc_pipe_open_ntlmssp(cli
,
182 &ndr_table_samr
.syntax_id
,
184 DCERPC_AUTH_LEVEL_PRIVACY
,
190 * If the user password must be changed the ntlmssp bind will
191 * fail the same way as the session setup above did. The
192 * difference ist that with a pipe bind we don't get a good
193 * error message, the result will be that the rpc call below
194 * will just fail. So we do it anonymously, there's no other
197 result
= cli_rpc_pipe_open_noauth(
198 cli
, &ndr_table_samr
.syntax_id
, &pipe_hnd
);
201 if (!NT_STATUS_IS_OK(result
)) {
202 if (lp_client_lanman_auth()) {
203 /* Use the old RAP method. */
204 if (!cli_oem_change_password(cli
, user_name
, new_passwd
, old_passwd
)) {
205 if (asprintf(err_str
, "machine %s rejected the "
206 "password change: Error was : %s.\n",
207 remote_machine
, cli_errstr(cli
)) == -1) {
210 result
= cli_nt_error(cli
);
215 if (asprintf(err_str
, "SAMR connection to machine %s "
216 "failed. Error was %s, but LANMAN password "
217 "changes are disabled\n",
218 remote_machine
, nt_errstr(result
)) == -1) {
221 result
= cli_nt_error(cli
);
227 result
= rpccli_samr_chgpasswd_user2(pipe_hnd
, talloc_tos(),
228 user_name
, new_passwd
, old_passwd
);
229 if (NT_STATUS_IS_OK(result
)) {
230 /* Great - it all worked! */
234 } else if (!(NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
)
235 || NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
))) {
236 /* it failed, but for reasons such as wrong password, too short etc ... */
238 if (asprintf(err_str
, "machine %s rejected the password change: "
240 remote_machine
, get_friendly_nt_error_msg(result
)) == -1) {
247 /* OK, that failed, so try again... */
248 TALLOC_FREE(pipe_hnd
);
250 /* Try anonymous NTLMSSP... */
251 result
= cli_init_creds(cli
, "", "", NULL
);
252 if (!NT_STATUS_IS_OK(result
)) {
257 result
= NT_STATUS_UNSUCCESSFUL
;
259 /* OK, this is ugly, but... try an anonymous pipe. */
260 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_samr
.syntax_id
,
263 if ( NT_STATUS_IS_OK(result
) &&
264 (NT_STATUS_IS_OK(result
= rpccli_samr_chgpasswd_user2(
265 pipe_hnd
, talloc_tos(), user_name
,
266 new_passwd
, old_passwd
)))) {
267 /* Great - it all worked! */
271 if (!(NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
)
272 || NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
))) {
273 /* it failed, but again it was due to things like new password too short */
275 if (asprintf(err_str
, "machine %s rejected the "
276 "(anonymous) password change: Error was : "
277 "%s.\n", remote_machine
,
278 get_friendly_nt_error_msg(result
)) == -1) {
285 /* We have failed to change the user's password, and we think the server
286 just might not support SAMR password changes, so fall back */
288 if (lp_client_lanman_auth()) {
289 /* Use the old RAP method. */
290 if (cli_oem_change_password(cli
, user_name
, new_passwd
, old_passwd
)) {
291 /* SAMR failed, but the old LanMan protocol worked! */
296 if (asprintf(err_str
, "machine %s rejected the password "
297 "change: Error was : %s.\n",
298 remote_machine
, cli_errstr(cli
)) == -1) {
301 result
= cli_nt_error(cli
);
305 if (asprintf(err_str
, "SAMR connection to machine %s "
306 "failed. Error was %s, but LANMAN password "
307 "changes are disabled\n",
308 nt_errstr(result
), remote_machine
) == -1) {
312 return NT_STATUS_UNSUCCESSFUL
;