source/pam_smbpass/pam_smb_passwd.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Use PAM to update user passwords in the local SAM
   4    Copyright (C) Steve Langasek         1998-2003
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19
  20 */
  21
  22 /* indicate the following groups are defined */
  23 #define PAM_SM_PASSWORD
  24
  25 #include "includes.h"
  26
  27 /* This is only used in the Sun implementation.  FIXME: we really
  28    want a define here that distinguishes between the Solaris PAM
  29    and others (including FreeBSD). */
  30
  31 #ifndef LINUX
  32 #include <security/pam_appl.h>
  33 #endif
  34
  35 #include <security/pam_modules.h>
  36
  37 #include "general.h"
  38
  39 #include "support.h"
  40
  41 int smb_update_db( pam_handle_t *pamh, int ctrl, const char *user,  const char *pass_new )
  42 {
  43         int retval;
  44         pstring err_str;
  45         pstring msg_str;
  46
  47         err_str[0] = '\0';
  48         msg_str[0] = '\0';
  49
  50         retval = NT_STATUS_IS_OK(local_password_change( user, LOCAL_SET_PASSWORD, pass_new,
  51                                         err_str, sizeof(err_str),
  52                                         msg_str, sizeof(msg_str) ));
  53
  54         if (!retval) {
  55                 if (*err_str) {
  56                         err_str[PSTRING_LEN-1] = '\0';
  57                         make_remark( pamh, ctrl, PAM_ERROR_MSG, err_str );
  58                 }
  59
  60                 /* FIXME: what value is appropriate here? */
  61                 retval = PAM_AUTHTOK_ERR;
  62         } else {
  63                 if (*msg_str) {
  64                         msg_str[PSTRING_LEN-1] = '\0';
  65                         make_remark( pamh, ctrl, PAM_TEXT_INFO, msg_str );
  66                 }
  67                 retval = PAM_SUCCESS;
  68         }
  69
  70         return retval;
  71 }
  72
  73
  74 /* data tokens */
  75
  76 #define _SMB_OLD_AUTHTOK  "-SMB-OLD-PASS"
  77 #define _SMB_NEW_AUTHTOK  "-SMB-NEW-PASS"
  78
  79 /*
  80  * FUNCTION: pam_sm_chauthtok()
  81  *
  82  * This function is called twice by the PAM library, once with
  83  * PAM_PRELIM_CHECK set, and then again with PAM_UPDATE_AUTHTOK set.  With
  84  * Linux-PAM, these two passes generally involve first checking the old
  85  * token and then changing the token.  This is what we do here.
  86  *
  87  * Having obtained a new password. The function updates the
  88  * SMB_PASSWD_FILE file (normally, $(LIBDIR)/smbpasswd).
  89  */
  90
  91 int pam_sm_chauthtok(pam_handle_t *pamh, int flags,
  92                      int argc, const char **argv)
  93 {
  94     unsigned int ctrl;
  95     int retval;
  96
  97     extern BOOL in_client;
  98
  99     struct samu *sampass = NULL;
 100     void (*oldsig_handler)(int);
 101     const char *user;
 102     char *pass_old;
 103     char *pass_new;
 104
 105     /* Samba initialization. */
 106     load_case_tables();
 107     setup_logging( "pam_smbpass", False );
 108     in_client = True;
 109
 110     ctrl = set_ctrl(flags, argc, argv);
 111
 112     /*
 113      * First get the name of a user.  No need to do anything if we can't
 114      * determine this.
 115      */
 116
 117     retval = pam_get_user( pamh, &user, "Username: " );
 118     if (retval != PAM_SUCCESS) {
 119         if (on( SMB_DEBUG, ctrl )) {
 120             _log_err( LOG_DEBUG, "password: could not identify user" );
 121         }
 122         return retval;
 123     }
 124     if (on( SMB_DEBUG, ctrl )) {
 125         _log_err( LOG_DEBUG, "username [%s] obtained", user );
 126     }
 127
 128     if (geteuid() != 0) {
 129         _log_err( LOG_DEBUG, "Cannot access samba password database, not running as root.");
 130         return PAM_AUTHINFO_UNAVAIL;
 131     }
 132
 133     /* Getting into places that might use LDAP -- protect the app
 134        from a SIGPIPE it's not expecting */
 135     oldsig_handler = CatchSignal(SIGPIPE, SIGNAL_CAST SIG_IGN);
 136
 137     if (!initialize_password_db(False)) {
 138         _log_err( LOG_ALERT, "Cannot access samba password database" );
 139         CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 140         return PAM_AUTHINFO_UNAVAIL;
 141     }
 142
 143     /* obtain user record */
 144     if ( !(sampass = samu_new( NULL )) ) {
 145         CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 146         return nt_status_to_pam(NT_STATUS_NO_MEMORY);
 147     }
 148
 149     if (!pdb_getsampwnam(sampass,user)) {
 150         _log_err( LOG_ALERT, "Failed to find entry for user %s.", user );
 151         CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 152         return PAM_USER_UNKNOWN;
 153     }
 154     if (on( SMB_DEBUG, ctrl )) {
 155         _log_err( LOG_DEBUG, "Located account for %s", user );
 156     }
 157
 158     if (flags & PAM_PRELIM_CHECK) {
 159         /*
 160          * obtain and verify the current password (OLDAUTHTOK) for
 161          * the user.
 162          */
 163
 164         char *Announce;
 165
 166         if (_smb_blankpasswd( ctrl, sampass )) {
 167
 168             TALLOC_FREE(sampass);
 169             CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 170             return PAM_SUCCESS;
 171         }
 172
 173         /* Password change by root, or for an expired token, doesn't
 174            require authentication.  Is this a good choice? */
 175         if (getuid() != 0 && !(flags & PAM_CHANGE_EXPIRED_AUTHTOK)) {
 176
 177             /* tell user what is happening */
 178 #define greeting "Changing password for "
 179             Announce = SMB_MALLOC_ARRAY(char, sizeof(greeting)+strlen(user));
 180             if (Announce == NULL) {
 181                 _log_err(LOG_CRIT, "password: out of memory");
 182                 TALLOC_FREE(sampass);
 183                 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 184                 return PAM_BUF_ERR;
 185             }
 186             strncpy( Announce, greeting, sizeof(greeting) );
 187             strncpy( Announce+sizeof(greeting)-1, user, strlen(user)+1 );
 188 #undef greeting
 189
 190             set( SMB__OLD_PASSWD, ctrl );
 191             retval = _smb_read_password( pamh, ctrl, Announce, "Current SMB password: ",
 192                                          NULL, _SMB_OLD_AUTHTOK, &pass_old );
 193             SAFE_FREE( Announce );
 194
 195             if (retval != PAM_SUCCESS) {
 196                 _log_err( LOG_NOTICE
 197                           , "password - (old) token not obtained" );
 198                 TALLOC_FREE(sampass);
 199                 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 200                 return retval;
 201             }
 202
 203             /* verify that this is the password for this user */
 204
 205             retval = _smb_verify_password( pamh, sampass, pass_old, ctrl );
 206
 207         } else {
 208             pass_old = NULL;
 209             retval = PAM_SUCCESS;           /* root doesn't have to */
 210         }
 211
 212         pass_old = NULL;
 213         TALLOC_FREE(sampass);
 214         CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 215         return retval;
 216
 217     } else if (flags & PAM_UPDATE_AUTHTOK) {
 218
 219         /*
 220          * obtain the proposed password
 221          */
 222
 223         /*
 224          * get the old token back. NULL was ok only if root [at this
 225          * point we assume that this has already been enforced on a
 226          * previous call to this function].
 227          */
 228
 229         if (off( SMB_NOT_SET_PASS, ctrl )) {
 230             retval = pam_get_item( pamh, PAM_OLDAUTHTOK,
 231                                    (const void **)&pass_old );
 232         } else {
 233             retval = pam_get_data( pamh, _SMB_OLD_AUTHTOK,
 234                                    (const void **)&pass_old );
 235             if (retval == PAM_NO_MODULE_DATA) {
 236                 pass_old = NULL;
 237                 retval = PAM_SUCCESS;
 238             }
 239         }
 240
 241         if (retval != PAM_SUCCESS) {
 242             _log_err( LOG_NOTICE, "password: user not authenticated" );
 243             TALLOC_FREE(sampass);
 244             CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 245             return retval;
 246         }
 247
 248         /*
 249          * use_authtok is to force the use of a previously entered
 250          * password -- needed for pluggable password strength checking
 251          * or other module stacking
 252          */
 253
 254         if (on( SMB_USE_AUTHTOK, ctrl )) {
 255             set( SMB_USE_FIRST_PASS, ctrl );
 256         }
 257
 258         retval = _smb_read_password( pamh, ctrl
 259                                       , NULL
 260                                       , "Enter new SMB password: "
 261                                       , "Retype new SMB password: "
 262                                       , _SMB_NEW_AUTHTOK
 263                                       , &pass_new );
 264
 265         if (retval != PAM_SUCCESS) {
 266             if (on( SMB_DEBUG, ctrl )) {
 267                 _log_err( LOG_ALERT
 268                           , "password: new password not obtained" );
 269             }
 270             pass_old = NULL;                               /* tidy up */
 271             TALLOC_FREE(sampass);
 272             CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 273             return retval;
 274         }
 275
 276         /*
 277          * At this point we know who the user is and what they
 278          * propose as their new password. Verify that the new
 279          * password is acceptable.
 280          */
 281
 282         if (pass_new[0] == '\0') {     /* "\0" password = NULL */
 283             pass_new = NULL;
 284         }
 285
 286         retval = _pam_smb_approve_pass(pamh, ctrl, pass_old, pass_new);
 287
 288         if (retval != PAM_SUCCESS) {
 289             _log_err(LOG_NOTICE, "new password not acceptable");
 290             pass_new = pass_old = NULL;               /* tidy up */
 291             TALLOC_FREE(sampass);
 292             CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 293             return retval;
 294         }
 295
 296         /*
 297          * By reaching here we have approved the passwords and must now
 298          * rebuild the smb password file.
 299          */
 300
 301         /* update the password database */
 302
 303         retval = smb_update_db(pamh, ctrl, user, pass_new);
 304         if (retval == PAM_SUCCESS) {
 305             uid_t uid;
 306
 307             /* password updated */
 308                 if (!sid_to_uid(pdb_get_user_sid(sampass), &uid)) {
 309                         _log_err( LOG_NOTICE, "Unable to get uid for user %s",
 310                                 pdb_get_username(sampass));
 311                         _log_err( LOG_NOTICE, "password for (%s) changed by (%s/%d)",
 312                                 user, uidtoname(getuid()), getuid());
 313                 } else {
 314                         _log_err( LOG_NOTICE, "password for (%s/%d) changed by (%s/%d)",
 315                                 user, uid, uidtoname(getuid()), getuid());
 316                 }
 317         } else {
 318                 _log_err( LOG_ERR, "password change failed for user %s", user);
 319         }
 320
 321         pass_old = pass_new = NULL;
 322         if (sampass) {
 323                 TALLOC_FREE(sampass);
 324                 sampass = NULL;
 325         }
 326
 327     } else {            /* something has broken with the library */
 328
 329         _log_err( LOG_ALERT, "password received unknown request" );
 330         retval = PAM_ABORT;
 331
 332     }
 333
 334     if (sampass) {
 335         TALLOC_FREE(sampass);
 336         sampass = NULL;
 337     }
 338
 339     TALLOC_FREE(sampass);
 340     CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
 341     return retval;
 342 }
 343
 344 /* static module data */
 345 #ifdef PAM_STATIC
 346 struct pam_module _pam_smbpass_passwd_modstruct = {
 347      "pam_smbpass",
 348      NULL,
 349      NULL,
 350      NULL,
 351      NULL,
 352      NULL,
 353      pam_sm_chauthtok
 354 };
 355 #endif
 356