source3/passdb/account_pol.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  account policy storage
   4  *  Copyright (C) Jean François Micouleau      1998-2001
   5  *  Copyright (C) Andrew Bartlett              2002
   6  *  Copyright (C) Guenther Deschner            2004-2005
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23 #include "system/filesys.h"
  24 #include "passdb.h"
  25 #include "dbwrap/dbwrap.h"
  26 #include "dbwrap/dbwrap_open.h"
  27 #include "../libcli/security/security.h"
  28 #include "lib/privileges.h"
  29 #include "lib/gencache.h"
  30
  31 static struct db_context *db;
  32
  33 /* cache all entries for 60 seconds for to save ldap-queries (cache is updated
  34  * after this period if admins do not use pdbedit or usermanager but manipulate
  35  * ldap directly) - gd */
  36
  37 #define DATABASE_VERSION        3
  38 #define AP_TTL                  60
  39
  40
  41 struct ap_table {
  42         enum pdb_policy_type type;
  43         const char *string;
  44         uint32_t default_val;
  45         const char *description;
  46         const char *ldap_attr;
  47 };
  48
  49 static const struct ap_table account_policy_names[] = {
  50         {PDB_POLICY_MIN_PASSWORD_LEN, "min password length", MINPASSWDLENGTH,
  51                 "Minimal password length (default: 5)",
  52                 "sambaMinPwdLength" },
  53
  54         {PDB_POLICY_PASSWORD_HISTORY, "password history", 0,
  55                 "Length of Password History Entries (default: 0 => off)",
  56                 "sambaPwdHistoryLength" },
  57
  58         {PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS, "user must logon to change password", 0,
  59                 "Force Users to logon for password change (default: 0 => off, 2 => on)",
  60                 "sambaLogonToChgPwd" },
  61
  62         {PDB_POLICY_MAX_PASSWORD_AGE, "maximum password age", (uint32_t) -1,
  63                 "Maximum password age, in seconds (default: -1 => never expire passwords)",
  64                 "sambaMaxPwdAge" },
  65
  66         {PDB_POLICY_MIN_PASSWORD_AGE,"minimum password age", 0,
  67                 "Minimal password age, in seconds (default: 0 => allow immediate password change)",
  68                 "sambaMinPwdAge" },
  69
  70         {PDB_POLICY_LOCK_ACCOUNT_DURATION, "lockout duration", 30,
  71                 "Lockout duration in minutes (default: 30, -1 => forever)",
  72                 "sambaLockoutDuration" },
  73
  74         {PDB_POLICY_RESET_COUNT_TIME, "reset count minutes", 30,
  75                 "Reset time after lockout in minutes (default: 30)",
  76                 "sambaLockoutObservationWindow" },
  77
  78         {PDB_POLICY_BAD_ATTEMPT_LOCKOUT, "bad lockout attempt", 0,
  79                 "Lockout users after bad logon attempts (default: 0 => off)",
  80                 "sambaLockoutThreshold" },
  81
  82         {PDB_POLICY_TIME_TO_LOGOUT, "disconnect time", (uint32_t) -1,
  83                 "Disconnect Users outside logon hours (default: -1 => off, 0 => on)",
  84                 "sambaForceLogoff" },
  85
  86         {PDB_POLICY_REFUSE_MACHINE_PW_CHANGE, "refuse machine password change", 0,
  87                 "Allow Machine Password changes (default: 0 => off)",
  88                 "sambaRefuseMachinePwdChange" },
  89
  90         {0, NULL, 0, "", NULL}
  91 };
  92
  93 void account_policy_names_list(TALLOC_CTX *mem_ctx, const char ***names, int *num_names)
  94 {
  95         const char **nl;
  96         int i, count = ARRAY_SIZE(account_policy_names);
  97
  98         nl = talloc_array(mem_ctx, const char *, count);
  99         if (!nl) {
 100                 *num_names = 0;
 101                 return;
 102         }
 103         for (i=0; i<count; i++) {
 104                 nl[i] = account_policy_names[i].string;
 105         }
 106         /* Do not return the last null entry */
 107         *num_names = count-1;
 108         *names = nl;
 109         return;
 110 }
 111
 112 /****************************************************************************
 113 Get the account policy name as a string from its #define'ed number
 114 ****************************************************************************/
 115
 116 const char *decode_account_policy_name(enum pdb_policy_type type)
 117 {
 118         int i;
 119         for (i=0; account_policy_names[i].string; i++) {
 120                 if (type == account_policy_names[i].type) {
 121                         return account_policy_names[i].string;
 122                 }
 123         }
 124         return NULL;
 125 }
 126
 127 /****************************************************************************
 128 Get the account policy LDAP attribute as a string from its #define'ed number
 129 ****************************************************************************/
 130
 131 const char *get_account_policy_attr(enum pdb_policy_type type)
 132 {
 133         int i;
 134         for (i=0; account_policy_names[i].type; i++) {
 135                 if (type == account_policy_names[i].type) {
 136                         return account_policy_names[i].ldap_attr;
 137                 }
 138         }
 139         return NULL;
 140 }
 141
 142 /****************************************************************************
 143 Get the account policy description as a string from its #define'ed number
 144 ****************************************************************************/
 145
 146 const char *account_policy_get_desc(enum pdb_policy_type type)
 147 {
 148         int i;
 149         for (i=0; account_policy_names[i].string; i++) {
 150                 if (type == account_policy_names[i].type) {
 151                         return account_policy_names[i].description;
 152                 }
 153         }
 154         return NULL;
 155 }
 156
 157 /****************************************************************************
 158 Get the account policy name as a string from its #define'ed number
 159 ****************************************************************************/
 160
 161 enum pdb_policy_type account_policy_name_to_typenum(const char *name)
 162 {
 163         int i;
 164         for (i=0; account_policy_names[i].string; i++) {
 165                 if (strcmp(name, account_policy_names[i].string) == 0) {
 166                         return account_policy_names[i].type;
 167                 }
 168         }
 169         return 0;
 170 }
 171
 172 /*****************************************************************************
 173 Get default value for account policy
 174 *****************************************************************************/
 175
 176 bool account_policy_get_default(enum pdb_policy_type type, uint32_t *val)
 177 {
 178         int i;
 179         for (i=0; account_policy_names[i].type; i++) {
 180                 if (account_policy_names[i].type == type) {
 181                         *val = account_policy_names[i].default_val;
 182                         return True;
 183                 }
 184         }
 185         DEBUG(0,("no default for account_policy index %d found. This should never happen\n",
 186                 type));
 187         return False;
 188 }
 189
 190 /*****************************************************************************
 191  Set default for a type if it is empty
 192 *****************************************************************************/
 193
 194 static bool account_policy_set_default_on_empty(enum pdb_policy_type type)
 195 {
 196
 197         uint32_t value;
 198
 199         if (!account_policy_get(type, &value) &&
 200             !account_policy_get_default(type, &value)) {
 201                 return False;
 202         }
 203
 204         return account_policy_set(type, value);
 205 }
 206
 207 /*****************************************************************************
 208  Open the account policy tdb.
 209 ***`*************************************************************************/
 210
 211 bool init_account_policy(void)
 212 {
 213
 214         const char *vstring = "INFO/version";
 215         uint32_t version = 0;
 216         int i;
 217         NTSTATUS status;
 218         char *db_path;
 219
 220         if (db != NULL) {
 221                 return True;
 222         }
 223
 224         db_path = state_path(talloc_tos(), "account_policy.tdb");
 225         if (db_path == NULL) {
 226                 return false;
 227         }
 228
 229         db = db_open(NULL, db_path, 0, TDB_DEFAULT,
 230                      O_RDWR, 0600, DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
 231
 232         if (db == NULL) { /* the account policies files does not exist or open
 233                            * failed, try to create a new one */
 234                 db = db_open(NULL, db_path, 0,
 235                              TDB_DEFAULT, O_RDWR|O_CREAT, 0600,
 236                              DBWRAP_LOCK_ORDER_1, DBWRAP_FLAG_NONE);
 237                 if (db == NULL) {
 238                         DEBUG(0,("Failed to open account policy database\n"));
 239                         TALLOC_FREE(db_path);
 240                         return False;
 241                 }
 242         }
 243         TALLOC_FREE(db_path);
 244
 245         status = dbwrap_fetch_uint32_bystring(db, vstring, &version);
 246         if (!NT_STATUS_IS_OK(status)) {
 247                 version = 0;
 248         }
 249
 250         if (version == DATABASE_VERSION) {
 251                 return true;
 252         }
 253
 254         /* handle a Samba upgrade */
 255
 256         if (dbwrap_transaction_start(db) != 0) {
 257                 DEBUG(0, ("transaction_start failed\n"));
 258                 TALLOC_FREE(db);
 259                 return false;
 260         }
 261
 262         status = dbwrap_fetch_uint32_bystring(db, vstring, &version);
 263         if (!NT_STATUS_IS_OK(status)) {
 264                 version = 0;
 265         }
 266
 267         if (version == DATABASE_VERSION) {
 268                 /*
 269                  * Race condition
 270                  */
 271                 if (dbwrap_transaction_cancel(db)) {
 272                         smb_panic("transaction_cancel failed");
 273                 }
 274                 return true;
 275         }
 276
 277         if (version != DATABASE_VERSION) {
 278                 status = dbwrap_store_uint32_bystring(db, vstring,
 279                                                       DATABASE_VERSION);
 280                 if (!NT_STATUS_IS_OK(status)) {
 281                         DEBUG(0, ("dbwrap_store_uint32_t failed: %s\n",
 282                                   nt_errstr(status)));
 283                         goto cancel;
 284                 }
 285
 286                 for (i=0; account_policy_names[i].type; i++) {
 287
 288                         if (!account_policy_set_default_on_empty(account_policy_names[i].type)) {
 289                                 DEBUG(0,("failed to set default value in account policy tdb\n"));
 290                                 goto cancel;
 291                         }
 292                 }
 293         }
 294
 295         /* These exist by default on NT4 in [HKLM\SECURITY\Policy\Accounts] */
 296
 297         privilege_create_account( &global_sid_World );
 298         privilege_create_account( &global_sid_Builtin_Account_Operators );
 299         privilege_create_account( &global_sid_Builtin_Server_Operators );
 300         privilege_create_account( &global_sid_Builtin_Print_Operators );
 301         privilege_create_account( &global_sid_Builtin_Backup_Operators );
 302
 303         /* BUILTIN\Administrators get everything -- *always* */
 304
 305         if ( lp_enable_privileges() ) {
 306                 if ( !grant_all_privileges( &global_sid_Builtin_Administrators ) ) {
 307                         DEBUG(1,("init_account_policy: Failed to grant privileges "
 308                                 "to BUILTIN\\Administrators!\n"));
 309                 }
 310         }
 311
 312         if (dbwrap_transaction_commit(db) != 0) {
 313                 DEBUG(0, ("transaction_commit failed\n"));
 314                 TALLOC_FREE(db);
 315                 return false;
 316         }
 317
 318         return True;
 319
 320  cancel:
 321         if (dbwrap_transaction_cancel(db)) {
 322                 smb_panic("transaction_cancel failed");
 323         }
 324         TALLOC_FREE(db);
 325
 326         return false;
 327 }
 328
 329 /*****************************************************************************
 330 Get an account policy (from tdb)
 331 *****************************************************************************/
 332
 333 bool account_policy_get(enum pdb_policy_type type, uint32_t *value)
 334 {
 335         const char *name;
 336         uint32_t regval;
 337         NTSTATUS status;
 338
 339         if (!init_account_policy()) {
 340                 return False;
 341         }
 342
 343         if (value) {
 344                 *value = 0;
 345         }
 346
 347         name = decode_account_policy_name(type);
 348         if (name == NULL) {
 349                 DEBUG(1, ("account_policy_get: Field %d is not a valid account policy type!  Cannot get, returning 0.\n", type));
 350                 return False;
 351         }
 352
 353         status = dbwrap_fetch_uint32_bystring(db, name, &regval);
 354         if (!NT_STATUS_IS_OK(status)) {
 355                 DEBUG(2, ("account_policy_get: tdb_fetch_uint32_t failed for type %d (%s), returning 0\n", type, name));
 356                 return False;
 357         }
 358
 359         if (value) {
 360                 *value = regval;
 361         }
 362
 363         DEBUG(10,("account_policy_get: name: %s, val: %d\n", name, regval));
 364         return True;
 365 }
 366
 367
 368 /****************************************************************************
 369 Set an account policy (in tdb)
 370 ****************************************************************************/
 371
 372 bool account_policy_set(enum pdb_policy_type type, uint32_t value)
 373 {
 374         const char *name;
 375         NTSTATUS status;
 376
 377         if (!init_account_policy()) {
 378                 return False;
 379         }
 380
 381         name = decode_account_policy_name(type);
 382         if (name == NULL) {
 383                 DEBUG(1, ("Field %d is not a valid account policy type!  Cannot set.\n", type));
 384                 return False;
 385         }
 386
 387         status = dbwrap_trans_store_uint32_bystring(db, name, value);
 388         if (!NT_STATUS_IS_OK(status)) {
 389                 DEBUG(1, ("store_uint32_t failed for type %d (%s) on value "
 390                           "%u: %s\n", type, name, value, nt_errstr(status)));
 391                 return False;
 392         }
 393
 394         DEBUG(10,("account_policy_set: name: %s, value: %d\n", name, value));
 395
 396         return True;
 397 }
 398
 399 /****************************************************************************
 400 Set an account policy in the cache
 401 ****************************************************************************/
 402
 403 bool cache_account_policy_set(enum pdb_policy_type type, uint32_t value)
 404 {
 405         const char *policy_name = NULL;
 406         char *cache_key = NULL;
 407         char *cache_value = NULL;
 408         bool ret = False;
 409
 410         policy_name = decode_account_policy_name(type);
 411         if (policy_name == NULL) {
 412                 DEBUG(0,("cache_account_policy_set: no policy found\n"));
 413                 return False;
 414         }
 415
 416         if (asprintf(&cache_key, "ACCT_POL/%s", policy_name) < 0) {
 417                 DEBUG(0, ("asprintf failed\n"));
 418                 goto done;
 419         }
 420
 421         if (asprintf(&cache_value, "%lu\n", (unsigned long)value) < 0) {
 422                 DEBUG(0, ("asprintf failed\n"));
 423                 goto done;
 424         }
 425
 426         DEBUG(10,("cache_account_policy_set: updating account pol cache\n"));
 427
 428         ret = gencache_set(cache_key, cache_value, time(NULL)+AP_TTL);
 429
 430  done:
 431         SAFE_FREE(cache_key);
 432         SAFE_FREE(cache_value);
 433         return ret;
 434 }
 435
 436 /*****************************************************************************
 437 Get an account policy from the cache
 438 *****************************************************************************/
 439
 440 bool cache_account_policy_get(enum pdb_policy_type type, uint32_t *value)
 441 {
 442         const char *policy_name = NULL;
 443         char *cache_key = NULL;
 444         char *cache_value = NULL;
 445         bool ret = False;
 446
 447         policy_name = decode_account_policy_name(type);
 448         if (policy_name == NULL) {
 449                 DEBUG(0,("cache_account_policy_set: no policy found\n"));
 450                 return False;
 451         }
 452
 453         if (asprintf(&cache_key, "ACCT_POL/%s", policy_name) < 0) {
 454                 DEBUG(0, ("asprintf failed\n"));
 455                 goto done;
 456         }
 457
 458         if (gencache_get(cache_key, talloc_tos(), &cache_value, NULL)) {
 459                 int error = 0;
 460                 uint32_t tmp;
 461
 462                 tmp = strtoul_err(cache_value, NULL, 10, &error);
 463                 if (error != 0) {
 464                         goto done;
 465                 }
 466                 *value = tmp;
 467                 ret = True;
 468         }
 469
 470  done:
 471         SAFE_FREE(cache_key);
 472         TALLOC_FREE(cache_value);
 473         return ret;
 474 }
 475
 476 /****************************************************************************
 477 ****************************************************************************/
 478
 479 struct db_context *get_account_pol_db( void )
 480 {
 481
 482         if ( db == NULL ) {
 483                 if ( !init_account_policy() ) {
 484                         return NULL;
 485                 }
 486         }
 487
 488         return db;
 489 }