?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-auth Use correct RID for domain guests primary group
[Samba.git] / source3 / auth / auth_util.c
blobfc93641fd3b2684c689d6ae1ed1ef31a70bab067
1 /*
2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
6 Copyright (C) Jeremy Allison 2000-2001
7 Copyright (C) Rafal Szczesniak 2002
8 Copyright (C) Volker Lendecke 2006
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "auth.h"
26 #include "../libcli/auth/libcli_auth.h"
27 #include "../lib/crypto/arcfour.h"
28 #include "rpc_client/init_lsa.h"
29 #include "../libcli/security/security.h"
30 #include "../lib/util/util_pw.h"
31 #include "lib/winbind_util.h"
32 #include "passdb.h"
33
34 #undef DBGC_CLASS
35 #define DBGC_CLASS DBGC_AUTH
36
37 /****************************************************************************
38 Create a UNIX user on demand.
39 ****************************************************************************/
40
41 static int _smb_create_user(const char *domain, const char *unix_username, const char *homedir)
42 {
43 TALLOC_CTX *ctx = talloc_tos();
44 char *add_script;
45 int ret;
46
47 add_script = talloc_strdup(ctx, lp_adduser_script());
48 if (!add_script || !*add_script) {
49 return -1;
50 }
51 add_script = talloc_all_string_sub(ctx,
52 add_script,
53 "%u",
54 unix_username);
55 if (!add_script) {
56 return -1;
57 }
58 if (domain) {
59 add_script = talloc_all_string_sub(ctx,
60 add_script,
61 "%D",
62 domain);
63 if (!add_script) {
64 return -1;
65 }
66 }
67 if (homedir) {
68 add_script = talloc_all_string_sub(ctx,
69 add_script,
70 "%H",
71 homedir);
72 if (!add_script) {
73 return -1;
74 }
75 }
76 ret = smbrun(add_script,NULL);
77 flush_pwnam_cache();
78 DEBUG(ret ? 0 : 3,
79 ("smb_create_user: Running the command `%s' gave %d\n",
80 add_script,ret));
81 return ret;
82 }
83
84 /****************************************************************************
85 Create an auth_usersupplied_data structure after appropriate mapping.
86 ****************************************************************************/
87
88 NTSTATUS make_user_info_map(struct auth_usersupplied_info **user_info,
89 const char *smb_name,
90 const char *client_domain,
91 const char *workstation_name,
92 DATA_BLOB *lm_pwd,
93 DATA_BLOB *nt_pwd,
94 const struct samr_Password *lm_interactive_pwd,
95 const struct samr_Password *nt_interactive_pwd,
96 const char *plaintext,
97 enum auth_password_state password_state)
98 {
99 const char *domain;
100 NTSTATUS result;
101 bool was_mapped;
102 char *internal_username = NULL;
103
104 was_mapped = map_username(talloc_tos(), smb_name, &internal_username);
105 if (!internal_username) {
106 return NT_STATUS_NO_MEMORY;
107 }
108
109 DEBUG(5, ("Mapping user [%s]\\[%s] from workstation [%s]\n",
110 client_domain, smb_name, workstation_name));
111
112 domain = client_domain;
113
114 /* If you connect to a Windows domain member using a bogus domain name,
115 * the Windows box will map the BOGUS\user to SAMNAME\user. Thus, if
116 * the Windows box is a DC the name will become DOMAIN\user and be
117 * authenticated against AD, if the Windows box is a member server but
118 * not a DC the name will become WORKSTATION\user. A standalone
119 * non-domain member box will also map to WORKSTATION\user.
120 * This also deals with the client passing in a "" domain */
121
122 if (!is_trusted_domain(domain) &&
123 !strequal(domain, my_sam_name()))
124 {
125 if (lp_map_untrusted_to_domain())
126 domain = my_sam_name();
127 else
128 domain = get_global_sam_name();
129 DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
130 "workstation [%s]\n",
131 client_domain, domain, smb_name, workstation_name));
132 }
133
134 /* We know that the given domain is trusted (and we are allowing them),
135 * it is our global SAM name, or for legacy behavior it is our
136 * primary domain name */
137
138 result = make_user_info(user_info, smb_name, internal_username,
139 client_domain, domain, workstation_name,
140 lm_pwd, nt_pwd,
141 lm_interactive_pwd, nt_interactive_pwd,
142 plaintext, password_state);
143 if (NT_STATUS_IS_OK(result)) {
144 /* We have tried mapping */
145 (*user_info)->mapped_state = True;
146 /* did we actually map the user to a different name? */
147 (*user_info)->was_mapped = was_mapped;
148 }
149 return result;
150 }
151
152 /****************************************************************************
153 Create an auth_usersupplied_data, making the DATA_BLOBs here.
154 Decrypt and encrypt the passwords.
155 ****************************************************************************/
156
157 bool make_user_info_netlogon_network(struct auth_usersupplied_info **user_info,
158 const char *smb_name,
159 const char *client_domain,
160 const char *workstation_name,
161 uint32 logon_parameters,
162 const uchar *lm_network_pwd,
163 int lm_pwd_len,
164 const uchar *nt_network_pwd,
165 int nt_pwd_len)
166 {
167 bool ret;
168 NTSTATUS status;
169 DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
170 DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
171
172 status = make_user_info_map(user_info,
173 smb_name, client_domain,
174 workstation_name,
175 lm_pwd_len ? &lm_blob : NULL,
176 nt_pwd_len ? &nt_blob : NULL,
177 NULL, NULL, NULL,
178 AUTH_PASSWORD_RESPONSE);
179
180 if (NT_STATUS_IS_OK(status)) {
181 (*user_info)->logon_parameters = logon_parameters;
182 }
183 ret = NT_STATUS_IS_OK(status) ? True : False;
184
185 data_blob_free(&lm_blob);
186 data_blob_free(&nt_blob);
187 return ret;
188 }
189
190 /****************************************************************************
191 Create an auth_usersupplied_data, making the DATA_BLOBs here.
192 Decrypt and encrypt the passwords.
193 ****************************************************************************/
194
195 bool make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_info,
196 const char *smb_name,
197 const char *client_domain,
198 const char *workstation_name,
199 uint32 logon_parameters,
200 const uchar chal[8],
201 const uchar lm_interactive_pwd[16],
202 const uchar nt_interactive_pwd[16],
203 const uchar *dc_sess_key)
204 {
205 struct samr_Password lm_pwd;
206 struct samr_Password nt_pwd;
207 unsigned char local_lm_response[24];
208 unsigned char local_nt_response[24];
209 unsigned char key[16];
210
211 memcpy(key, dc_sess_key, 16);
212
213 if (lm_interactive_pwd)
214 memcpy(lm_pwd.hash, lm_interactive_pwd, sizeof(lm_pwd.hash));
215
216 if (nt_interactive_pwd)
217 memcpy(nt_pwd.hash, nt_interactive_pwd, sizeof(nt_pwd.hash));
218
219 #ifdef DEBUG_PASSWORD
220 DEBUG(100,("key:"));
221 dump_data(100, key, sizeof(key));
222
223 DEBUG(100,("lm owf password:"));
224 dump_data(100, lm_pwd.hash, sizeof(lm_pwd.hash));
225
226 DEBUG(100,("nt owf password:"));
227 dump_data(100, nt_pwd.hash, sizeof(nt_pwd.hash));
228 #endif
229
230 if (lm_interactive_pwd)
231 arcfour_crypt(lm_pwd.hash, key, sizeof(lm_pwd.hash));
232
233 if (nt_interactive_pwd)
234 arcfour_crypt(nt_pwd.hash, key, sizeof(nt_pwd.hash));
235
236 #ifdef DEBUG_PASSWORD
237 DEBUG(100,("decrypt of lm owf password:"));
238 dump_data(100, lm_pwd.hash, sizeof(lm_pwd));
239
240 DEBUG(100,("decrypt of nt owf password:"));
241 dump_data(100, nt_pwd.hash, sizeof(nt_pwd));
242 #endif
243
244 if (lm_interactive_pwd)
245 SMBOWFencrypt(lm_pwd.hash, chal,
246 local_lm_response);
247
248 if (nt_interactive_pwd)
249 SMBOWFencrypt(nt_pwd.hash, chal,
250 local_nt_response);
251
252 /* Password info paranoia */
253 ZERO_STRUCT(key);
254
255 {
256 bool ret;
257 NTSTATUS nt_status;
258 DATA_BLOB local_lm_blob;
259 DATA_BLOB local_nt_blob;
260
261 if (lm_interactive_pwd) {
262 local_lm_blob = data_blob(local_lm_response,
263 sizeof(local_lm_response));
264 }
265
266 if (nt_interactive_pwd) {
267 local_nt_blob = data_blob(local_nt_response,
268 sizeof(local_nt_response));
269 }
270
271 nt_status = make_user_info_map(
272 user_info,
273 smb_name, client_domain, workstation_name,
274 lm_interactive_pwd ? &local_lm_blob : NULL,
275 nt_interactive_pwd ? &local_nt_blob : NULL,
276 lm_interactive_pwd ? &lm_pwd : NULL,
277 nt_interactive_pwd ? &nt_pwd : NULL,
278 NULL, AUTH_PASSWORD_HASH);
279
280 if (NT_STATUS_IS_OK(nt_status)) {
281 (*user_info)->logon_parameters = logon_parameters;
282 }
283
284 ret = NT_STATUS_IS_OK(nt_status) ? True : False;
285 data_blob_free(&local_lm_blob);
286 data_blob_free(&local_nt_blob);
287 return ret;
288 }
289 }
290
291
292 /****************************************************************************
293 Create an auth_usersupplied_data structure
294 ****************************************************************************/
295
296 bool make_user_info_for_reply(struct auth_usersupplied_info **user_info,
297 const char *smb_name,
298 const char *client_domain,
299 const uint8 chal[8],
300 DATA_BLOB plaintext_password)
301 {
302
303 DATA_BLOB local_lm_blob;
304 DATA_BLOB local_nt_blob;
305 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
306 char *plaintext_password_string;
307 /*
308 * Not encrypted - do so.
309 */
310
311 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted "
312 "format.\n"));
313 if (plaintext_password.data && plaintext_password.length) {
314 unsigned char local_lm_response[24];
315
316 #ifdef DEBUG_PASSWORD
317 DEBUG(10,("Unencrypted password (len %d):\n",
318 (int)plaintext_password.length));
319 dump_data(100, plaintext_password.data,
320 plaintext_password.length);
321 #endif
322
323 SMBencrypt( (const char *)plaintext_password.data,
324 (const uchar*)chal, local_lm_response);
325 local_lm_blob = data_blob(local_lm_response, 24);
326
327 /* We can't do an NT hash here, as the password needs to be
328 case insensitive */
329 local_nt_blob = data_blob_null;
330 } else {
331 local_lm_blob = data_blob_null;
332 local_nt_blob = data_blob_null;
333 }
334
335 plaintext_password_string = talloc_strndup(talloc_tos(),
336 (const char *)plaintext_password.data,
337 plaintext_password.length);
338 if (!plaintext_password_string) {
339 return False;
340 }
341
342 ret = make_user_info_map(
343 user_info, smb_name, client_domain,
344 get_remote_machine_name(),
345 local_lm_blob.data ? &local_lm_blob : NULL,
346 local_nt_blob.data ? &local_nt_blob : NULL,
347 NULL, NULL,
348 plaintext_password_string,
349 AUTH_PASSWORD_PLAIN);
350
351 if (plaintext_password_string) {
352 memset(plaintext_password_string, '\0', strlen(plaintext_password_string));
353 talloc_free(plaintext_password_string);
354 }
355
356 data_blob_free(&local_lm_blob);
357 return NT_STATUS_IS_OK(ret) ? True : False;
358 }
359
360 /****************************************************************************
361 Create an auth_usersupplied_data structure
362 ****************************************************************************/
363
364 NTSTATUS make_user_info_for_reply_enc(struct auth_usersupplied_info **user_info,
365 const char *smb_name,
366 const char *client_domain,
367 DATA_BLOB lm_resp, DATA_BLOB nt_resp)
368 {
369 return make_user_info_map(user_info, smb_name,
370 client_domain,
371 get_remote_machine_name(),
372 lm_resp.data && (lm_resp.length > 0) ? &lm_resp : NULL,
373 nt_resp.data && (nt_resp.length > 0) ? &nt_resp : NULL,
374 NULL, NULL, NULL,
375 AUTH_PASSWORD_RESPONSE);
376 }
377
378 /****************************************************************************
379 Create a guest user_info blob, for anonymous authenticaion.
380 ****************************************************************************/
381
382 bool make_user_info_guest(struct auth_usersupplied_info **user_info)
383 {
384 NTSTATUS nt_status;
385
386 nt_status = make_user_info(user_info,
387 "","",
388 "","",
389 "",
390 NULL, NULL,
391 NULL, NULL,
392 NULL,
393 AUTH_PASSWORD_RESPONSE);
394
395 return NT_STATUS_IS_OK(nt_status) ? True : False;
396 }
397
398 static NTSTATUS log_nt_token(struct security_token *token)
399 {
400 TALLOC_CTX *frame = talloc_stackframe();
401 char *command;
402 char *group_sidstr;
403 size_t i;
404
405 if ((lp_log_nt_token_command() == NULL) ||
406 (strlen(lp_log_nt_token_command()) == 0)) {
407 TALLOC_FREE(frame);
408 return NT_STATUS_OK;
409 }
410
411 group_sidstr = talloc_strdup(frame, "");
412 for (i=1; i<token->num_sids; i++) {
413 group_sidstr = talloc_asprintf(
414 frame, "%s %s", group_sidstr,
415 sid_string_talloc(frame, &token->sids[i]));
416 }
417
418 command = talloc_string_sub(
419 frame, lp_log_nt_token_command(),
420 "%s", sid_string_talloc(frame, &token->sids[0]));
421 command = talloc_string_sub(frame, command, "%t", group_sidstr);
422
423 if (command == NULL) {
424 TALLOC_FREE(frame);
425 return NT_STATUS_NO_MEMORY;
426 }
427
428 DEBUG(8, ("running command: [%s]\n", command));
429 if (smbrun(command, NULL) != 0) {
430 DEBUG(0, ("Could not log NT token\n"));
431 TALLOC_FREE(frame);
432 return NT_STATUS_ACCESS_DENIED;
433 }
434
435 TALLOC_FREE(frame);
436 return NT_STATUS_OK;
437 }
438
439 /*
440 * Create the token to use from server_info->info3 and
441 * server_info->sids (the info3/sam groups). Find the unix gids.
442 */
443
444 NTSTATUS create_local_token(struct auth_serversupplied_info *server_info)
445 {
446 struct security_token *t;
447 NTSTATUS status;
448 size_t i;
449 struct dom_sid tmp_sid;
450 struct wbcUnixId *ids;
451
452 /*
453 * If winbind is not around, we can not make much use of the SIDs the
454 * domain controller provided us with. Likewise if the user name was
455 * mapped to some local unix user.
456 */
457
458 if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
459 (server_info->nss_token)) {
460 status = create_token_from_username(server_info,
461 server_info->unix_name,
462 server_info->guest,
463 &server_info->utok.uid,
464 &server_info->utok.gid,
465 &server_info->unix_name,
466 &server_info->security_token);
467
468 } else {
469 status = create_local_nt_token_from_info3(server_info,
470 server_info->guest,
471 server_info->info3,
472 &server_info->extra,
473 &server_info->security_token);
474 }
475
476 if (!NT_STATUS_IS_OK(status)) {
477 return status;
478 }
479
480 /* Convert the SIDs to gids. */
481
482 server_info->utok.ngroups = 0;
483 server_info->utok.groups = NULL;
484
485 t = server_info->security_token;
486
487 ids = TALLOC_ARRAY(talloc_tos(), struct wbcUnixId,
488 t->num_sids);
489 if (ids == NULL) {
490 return NT_STATUS_NO_MEMORY;
491 }
492
493 if (!sids_to_unix_ids(t->sids, t->num_sids, ids)) {
494 TALLOC_FREE(ids);
495 return NT_STATUS_NO_MEMORY;
496 }
497
498 /* Start at index 1, where the groups start. */
499
500 for (i=1; i<t->num_sids; i++) {
501
502 if (ids[i].type != WBC_ID_TYPE_GID) {
503 DEBUG(10, ("Could not convert SID %s to gid, "
504 "ignoring it\n",
505 sid_string_dbg(&t->sids[i])));
506 continue;
507 }
508 if (!add_gid_to_array_unique(server_info, ids[i].id.gid,
509 &server_info->utok.groups,
510 &server_info->utok.ngroups)) {
511 return NT_STATUS_NO_MEMORY;
512 }
513 }
514
515 /*
516 * Add the "Unix Group" SID for each gid to catch mapped groups
517 * and their Unix equivalent. This is to solve the backwards
518 * compatibility problem of 'valid users = +ntadmin' where
519 * ntadmin has been paired with "Domain Admins" in the group
520 * mapping table. Otherwise smb.conf would need to be changed
521 * to 'valid user = "Domain Admins"'. --jerry
522 *
523 * For consistency we also add the "Unix User" SID,
524 * so that the complete unix token is represented within
525 * the nt token.
526 */
527
528 uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid);
529
530 add_sid_to_array_unique(server_info->security_token, &tmp_sid,
531 &server_info->security_token->sids,
532 &server_info->security_token->num_sids);
533
534 for ( i=0; i<server_info->utok.ngroups; i++ ) {
535 gid_to_unix_groups_sid(server_info->utok.groups[i], &tmp_sid);
536 add_sid_to_array_unique(server_info->security_token, &tmp_sid,
537 &server_info->security_token->sids,
538 &server_info->security_token->num_sids);
539 }
540
541 security_token_debug(DBGC_AUTH, 10, server_info->security_token);
542 debug_unix_user_token(DBGC_AUTH, 10,
543 server_info->utok.uid,
544 server_info->utok.gid,
545 server_info->utok.ngroups,
546 server_info->utok.groups);
547
548 status = log_nt_token(server_info->security_token);
549 return status;
550 }
551
552 /***************************************************************************
553 Make (and fill) a server_info struct from a 'struct passwd' by conversion
554 to a struct samu
555 ***************************************************************************/
556
557 NTSTATUS make_server_info_pw(struct auth_serversupplied_info **server_info,
558 char *unix_username,
559 struct passwd *pwd)
560 {
561 NTSTATUS status;
562 struct samu *sampass = NULL;
563 char *qualified_name = NULL;
564 TALLOC_CTX *mem_ctx = NULL;
565 struct dom_sid u_sid;
566 enum lsa_SidType type;
567 struct auth_serversupplied_info *result;
568
569 /*
570 * The SID returned in server_info->sam_account is based
571 * on our SAM sid even though for a pure UNIX account this should
572 * not be the case as it doesn't really exist in the SAM db.
573 * This causes lookups on "[in]valid users" to fail as they
574 * will lookup this name as a "Unix User" SID to check against
575 * the user token. Fix this by adding the "Unix User"\unix_username
576 * SID to the sid array. The correct fix should probably be
577 * changing the server_info->sam_account user SID to be a
578 * S-1-22 Unix SID, but this might break old configs where
579 * plaintext passwords were used with no SAM backend.
580 */
581
582 mem_ctx = talloc_init("make_server_info_pw_tmp");
583 if (!mem_ctx) {
584 return NT_STATUS_NO_MEMORY;
585 }
586
587 qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
588 unix_users_domain_name(),
589 unix_username );
590 if (!qualified_name) {
591 TALLOC_FREE(mem_ctx);
592 return NT_STATUS_NO_MEMORY;
593 }
594
595 if (!lookup_name(mem_ctx, qualified_name, LOOKUP_NAME_ALL,
596 NULL, NULL,
597 &u_sid, &type)) {
598 TALLOC_FREE(mem_ctx);
599 return NT_STATUS_NO_SUCH_USER;
600 }
601
602 TALLOC_FREE(mem_ctx);
603
604 if (type != SID_NAME_USER) {
605 return NT_STATUS_NO_SUCH_USER;
606 }
607
608 if ( !(sampass = samu_new( NULL )) ) {
609 return NT_STATUS_NO_MEMORY;
610 }
611
612 status = samu_set_unix( sampass, pwd );
613 if (!NT_STATUS_IS_OK(status)) {
614 return status;
615 }
616
617 /* In pathological cases the above call can set the account
618 * name to the DOMAIN\username form. Reset the account name
619 * using unix_username */
620 pdb_set_username(sampass, unix_username, PDB_SET);
621
622 /* set the user sid to be the calculated u_sid */
623 pdb_set_user_sid(sampass, &u_sid, PDB_SET);
624
625 result = make_server_info(NULL);
626 if (result == NULL) {
627 TALLOC_FREE(sampass);
628 return NT_STATUS_NO_MEMORY;
629 }
630
631 status = samu_to_SamInfo3(result, sampass, global_myname(),
632 &result->info3, &result->extra);
633 TALLOC_FREE(sampass);
634 if (!NT_STATUS_IS_OK(status)) {
635 DEBUG(10, ("Failed to convert samu to info3: %s\n",
636 nt_errstr(status)));
637 TALLOC_FREE(result);
638 return status;
639 }
640
641 result->unix_name = talloc_strdup(result, unix_username);
642 result->sanitized_username = sanitize_username(result, unix_username);
643
644 if ((result->unix_name == NULL)
645 || (result->sanitized_username == NULL)) {
646 TALLOC_FREE(result);
647 return NT_STATUS_NO_MEMORY;
648 }
649
650 result->utok.uid = pwd->pw_uid;
651 result->utok.gid = pwd->pw_gid;
652
653 *server_info = result;
654
655 return NT_STATUS_OK;
656 }
657
658 static NTSTATUS get_system_info3(TALLOC_CTX *mem_ctx,
659 struct passwd *pwd,
660 struct netr_SamInfo3 *info3)
661 {
662 struct dom_sid domain_sid;
663 const char *tmp;
664
665 /* Set account name */
666 tmp = talloc_strdup(mem_ctx, pwd->pw_name);
667 if (tmp == NULL) {
668 return NT_STATUS_NO_MEMORY;
669 }
670 init_lsa_String(&info3->base.account_name, tmp);
671
672 /* Set domain name */
673 tmp = talloc_strdup(mem_ctx, get_global_sam_name());
674 if (tmp == NULL) {
675 return NT_STATUS_NO_MEMORY;
676 }
677 init_lsa_StringLarge(&info3->base.domain, tmp);
678
679 /* Domain sid */
680 sid_copy(&domain_sid, get_global_sam_sid());
681
682 info3->base.domain_sid = dom_sid_dup(mem_ctx, &domain_sid);
683 if (info3->base.domain_sid == NULL) {
684 return NT_STATUS_NO_MEMORY;
685 }
686
687 /* Admin rid */
688 info3->base.rid = DOMAIN_RID_ADMINISTRATOR;
689
690 /* Primary gid */
691 info3->base.primary_gid = BUILTIN_RID_ADMINISTRATORS;
692
693 return NT_STATUS_OK;
694 }
695
696 static NTSTATUS get_guest_info3(TALLOC_CTX *mem_ctx,
697 struct netr_SamInfo3 *info3)
698 {
699 const char *guest_account = lp_guestaccount();
700 struct dom_sid domain_sid;
701 struct passwd *pwd;
702 const char *tmp;
703
704 pwd = Get_Pwnam_alloc(mem_ctx, guest_account);
705 if (pwd == NULL) {
706 DEBUG(0,("SamInfo3_for_guest: Unable to locate guest "
707 "account [%s]!\n", guest_account));
708 return NT_STATUS_NO_SUCH_USER;
709 }
710
711 /* Set acount name */
712 tmp = talloc_strdup(mem_ctx, pwd->pw_name);
713 if (tmp == NULL) {
714 return NT_STATUS_NO_MEMORY;
715 }
716 init_lsa_String(&info3->base.account_name, tmp);
717
718 /* Set domain name */
719 tmp = talloc_strdup(mem_ctx, get_global_sam_name());
720 if (tmp == NULL) {
721 return NT_STATUS_NO_MEMORY;
722 }
723 init_lsa_StringLarge(&info3->base.domain, tmp);
724
725 /* Domain sid */
726 sid_copy(&domain_sid, get_global_sam_sid());
727
728 info3->base.domain_sid = dom_sid_dup(mem_ctx, &domain_sid);
729 if (info3->base.domain_sid == NULL) {
730 return NT_STATUS_NO_MEMORY;
731 }
732
733 /* Guest rid */
734 info3->base.rid = DOMAIN_RID_GUEST;
735
736 /* Primary gid */
737 info3->base.primary_gid = DOMAIN_RID_GUESTS;
738
739 TALLOC_FREE(pwd);
740 return NT_STATUS_OK;
741 }
742
743 /***************************************************************************
744 Make (and fill) a user_info struct for a guest login.
745 This *must* succeed for smbd to start. If there is no mapping entry for
746 the guest gid, then create one.
747 ***************************************************************************/
748
749 static NTSTATUS make_new_server_info_guest(struct auth_serversupplied_info **server_info)
750 {
751 static const char zeros[16] = {0};
752 const char *guest_account = lp_guestaccount();
753 const char *domain = global_myname();
754 struct netr_SamInfo3 info3;
755 TALLOC_CTX *tmp_ctx;
756 NTSTATUS status;
757 fstring tmp;
758
759 tmp_ctx = talloc_stackframe();
760 if (tmp_ctx == NULL) {
761 return NT_STATUS_NO_MEMORY;
762 }
763
764 ZERO_STRUCT(info3);
765
766 status = get_guest_info3(tmp_ctx, &info3);
767 if (!NT_STATUS_IS_OK(status)) {
768 goto done;
769 }
770
771 status = make_server_info_info3(tmp_ctx,
772 guest_account,
773 domain,
774 server_info,
775 &info3);
776 if (!NT_STATUS_IS_OK(status)) {
777 goto done;
778 }
779
780 (*server_info)->guest = True;
781
782 status = create_local_token(*server_info);
783 if (!NT_STATUS_IS_OK(status)) {
784 DEBUG(10, ("create_local_token failed: %s\n",
785 nt_errstr(status)));
786 goto done;
787 }
788
789 /* annoying, but the Guest really does have a session key, and it is
790 all zeros! */
791 (*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
792 (*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
793
794 alpha_strcpy(tmp, (*server_info)->info3->base.account_name.string,
795 ". _-$", sizeof(tmp));
796 (*server_info)->sanitized_username = talloc_strdup(*server_info, tmp);
797
798 status = NT_STATUS_OK;
799 done:
800 TALLOC_FREE(tmp_ctx);
801 return status;
802 }
803
804 /****************************************************************************
805 Fake a auth_session_info just from a username (as a
806 session_info structure, with create_local_token() already called on
807 it.
808 ****************************************************************************/
809
810 static NTSTATUS make_system_session_info_from_pw(TALLOC_CTX *mem_ctx,
811 struct passwd *pwd,
812 struct auth_serversupplied_info **server_info)
813 {
814 const char *domain = global_myname();
815 struct netr_SamInfo3 info3;
816 TALLOC_CTX *tmp_ctx;
817 NTSTATUS status;
818
819 tmp_ctx = talloc_stackframe();
820 if (tmp_ctx == NULL) {
821 return NT_STATUS_NO_MEMORY;
822 }
823
824 ZERO_STRUCT(info3);
825
826 status = get_system_info3(tmp_ctx, pwd, &info3);
827 if (!NT_STATUS_IS_OK(status)) {
828 DEBUG(0, ("Failed creating system info3 with %s\n",
829 nt_errstr(status)));
830 goto done;
831 }
832
833 status = make_server_info_info3(mem_ctx,
834 pwd->pw_name,
835 domain,
836 server_info,
837 &info3);
838 if (!NT_STATUS_IS_OK(status)) {
839 DEBUG(0, ("make_server_info_info3 failed with %s\n",
840 nt_errstr(status)));
841 goto done;
842 }
843
844 (*server_info)->nss_token = true;
845
846 /* Now turn the server_info into a session_info with the full token etc */
847 status = create_local_token(*server_info);
848 if (!NT_STATUS_IS_OK(status)) {
849 DEBUG(0, ("create_local_token failed: %s\n",
850 nt_errstr(status)));
851 goto done;
852 }
853
854 status = NT_STATUS_OK;
855 done:
856 TALLOC_FREE(tmp_ctx);
857 return status;
858 }
859
860 /***************************************************************************
861 Make (and fill) a auth_session_info struct for a system user login.
862 This *must* succeed for smbd to start.
863 ***************************************************************************/
864
865 static NTSTATUS make_new_session_info_system(TALLOC_CTX *mem_ctx,
866 struct auth_serversupplied_info **session_info)
867 {
868 struct passwd *pwd;
869 NTSTATUS status;
870
871 pwd = getpwuid_alloc(mem_ctx, sec_initial_uid());
872 if (pwd == NULL) {
873 return NT_STATUS_NO_SUCH_USER;
874 }
875
876 status = make_system_session_info_from_pw(mem_ctx,
877 pwd,
878 session_info);
879 TALLOC_FREE(pwd);
880 if (!NT_STATUS_IS_OK(status)) {
881 return status;
882 }
883
884 (*session_info)->system = true;
885
886 status = add_sid_to_array_unique((*session_info)->security_token->sids,
887 &global_sid_System,
888 &(*session_info)->security_token->sids,
889 &(*session_info)->security_token->num_sids);
890 if (!NT_STATUS_IS_OK(status)) {
891 TALLOC_FREE((*session_info));
892 return status;
893 }
894
895 return NT_STATUS_OK;
896 }
897
898 /****************************************************************************
899 Fake a auth_serversupplied_info just from a username
900 ****************************************************************************/
901
902 NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
903 const char *username,
904 bool is_guest,
905 struct auth_serversupplied_info **presult)
906 {
907 struct auth_serversupplied_info *result;
908 struct passwd *pwd;
909 NTSTATUS status;
910
911 pwd = Get_Pwnam_alloc(talloc_tos(), username);
912 if (pwd == NULL) {
913 return NT_STATUS_NO_SUCH_USER;
914 }
915
916 status = make_server_info_pw(&result, pwd->pw_name, pwd);
917
918 TALLOC_FREE(pwd);
919
920 if (!NT_STATUS_IS_OK(status)) {
921 return status;
922 }
923
924 result->nss_token = true;
925 result->guest = is_guest;
926
927 status = create_local_token(result);
928
929 if (!NT_STATUS_IS_OK(status)) {
930 TALLOC_FREE(result);
931 return status;
932 }
933
934 *presult = talloc_steal(mem_ctx, result);
935 return NT_STATUS_OK;
936 }
937
938
939 struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
940 const struct auth_serversupplied_info *src)
941 {
942 struct auth_serversupplied_info *dst;
943
944 dst = make_server_info(mem_ctx);
945 if (dst == NULL) {
946 return NULL;
947 }
948
949 dst->guest = src->guest;
950 dst->system = src->system;
951 dst->utok.uid = src->utok.uid;
952 dst->utok.gid = src->utok.gid;
953 dst->utok.ngroups = src->utok.ngroups;
954 if (src->utok.ngroups != 0) {
955 dst->utok.groups = (gid_t *)TALLOC_MEMDUP(
956 dst, src->utok.groups,
957 sizeof(gid_t)*dst->utok.ngroups);
958 } else {
959 dst->utok.groups = NULL;
960 }
961
962 if (src->security_token) {
963 dst->security_token = dup_nt_token(dst, src->security_token);
964 if (!dst->security_token) {
965 TALLOC_FREE(dst);
966 return NULL;
967 }
968 }
969
970 dst->user_session_key = data_blob_talloc( dst, src->user_session_key.data,
971 src->user_session_key.length);
972
973 dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
974 src->lm_session_key.length);
975
976 dst->info3 = copy_netr_SamInfo3(dst, src->info3);
977 if (!dst->info3) {
978 TALLOC_FREE(dst);
979 return NULL;
980 }
981 dst->extra = src->extra;
982
983 dst->unix_name = talloc_strdup(dst, src->unix_name);
984 if (!dst->unix_name) {
985 TALLOC_FREE(dst);
986 return NULL;
987 }
988
989 dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
990 if (!dst->sanitized_username) {
991 TALLOC_FREE(dst);
992 return NULL;
993 }
994
995 return dst;
996 }
997
998 /*
999 * Set a new session key. Used in the rpc server where we have to override the
1000 * SMB level session key with SystemLibraryDTC
1001 */
1002
1003 bool session_info_set_session_key(struct auth_serversupplied_info *info,
1004 DATA_BLOB session_key)
1005 {
1006 TALLOC_FREE(info->user_session_key.data);
1007
1008 info->user_session_key = data_blob_talloc(
1009 info, session_key.data, session_key.length);
1010
1011 return (info->user_session_key.data != NULL);
1012 }
1013
1014 static struct auth_serversupplied_info *guest_info = NULL;
1015
1016 bool init_guest_info(void)
1017 {
1018 if (guest_info != NULL)
1019 return True;
1020
1021 return NT_STATUS_IS_OK(make_new_server_info_guest(&guest_info));
1022 }
1023
1024 NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
1025 struct auth_serversupplied_info **server_info)
1026 {
1027 *server_info = copy_serverinfo(mem_ctx, guest_info);
1028 return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1029 }
1030
1031 static struct auth_serversupplied_info *system_info = NULL;
1032
1033 NTSTATUS init_system_info(void)
1034 {
1035 if (system_info != NULL)
1036 return NT_STATUS_OK;
1037
1038 return make_new_session_info_system(NULL, &system_info);
1039 }
1040
1041 NTSTATUS make_session_info_system(TALLOC_CTX *mem_ctx,
1042 struct auth_serversupplied_info **session_info)
1043 {
1044 if (system_info == NULL) return NT_STATUS_UNSUCCESSFUL;
1045 *session_info = copy_serverinfo(mem_ctx, system_info);
1046 return (*session_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
1047 }
1048
1049 const struct auth_serversupplied_info *get_session_info_system(void)
1050 {
1051 return system_info;
1052 }
1053
1054 bool copy_current_user(struct current_user *dst, struct current_user *src)
1055 {
1056 gid_t *groups;
1057 struct security_token *nt_token;
1058
1059 groups = (gid_t *)memdup(src->ut.groups,
1060 sizeof(gid_t) * src->ut.ngroups);
1061 if ((src->ut.ngroups != 0) && (groups == NULL)) {
1062 return False;
1063 }
1064
1065 nt_token = dup_nt_token(NULL, src->nt_user_token);
1066 if (nt_token == NULL) {
1067 SAFE_FREE(groups);
1068 return False;
1069 }
1070
1071 dst->conn = src->conn;
1072 dst->vuid = src->vuid;
1073 dst->ut.uid = src->ut.uid;
1074 dst->ut.gid = src->ut.gid;
1075 dst->ut.ngroups = src->ut.ngroups;
1076 dst->ut.groups = groups;
1077 dst->nt_user_token = nt_token;
1078 return True;
1079 }
1080
1081 /***************************************************************************
1082 Purely internal function for make_server_info_info3
1083 ***************************************************************************/
1084
1085 static NTSTATUS check_account(TALLOC_CTX *mem_ctx, const char *domain,
1086 const char *username, char **found_username,
1087 struct passwd **pwd,
1088 bool *username_was_mapped)
1089 {
1090 char *orig_dom_user = NULL;
1091 char *dom_user = NULL;
1092 char *lower_username = NULL;
1093 char *real_username = NULL;
1094 struct passwd *passwd;
1095
1096 lower_username = talloc_strdup(mem_ctx, username);
1097 if (!lower_username) {
1098 return NT_STATUS_NO_MEMORY;
1099 }
1100 strlower_m( lower_username );
1101
1102 orig_dom_user = talloc_asprintf(mem_ctx,
1103 "%s%c%s",
1104 domain,
1105 *lp_winbind_separator(),
1106 lower_username);
1107 if (!orig_dom_user) {
1108 return NT_STATUS_NO_MEMORY;
1109 }
1110
1111 /* Get the passwd struct. Try to create the account if necessary. */
1112
1113 *username_was_mapped = map_username(mem_ctx, orig_dom_user, &dom_user);
1114 if (!dom_user) {
1115 return NT_STATUS_NO_MEMORY;
1116 }
1117
1118 passwd = smb_getpwnam(mem_ctx, dom_user, &real_username, True );
1119 if (!passwd) {
1120 DEBUG(3, ("Failed to find authenticated user %s via "
1121 "getpwnam(), denying access.\n", dom_user));
1122 return NT_STATUS_NO_SUCH_USER;
1123 }
1124
1125 if (!real_username) {
1126 return NT_STATUS_NO_MEMORY;
1127 }
1128
1129 *pwd = passwd;
1130
1131 /* This is pointless -- there is no suport for differing
1132 unix and windows names. Make sure to always store the
1133 one we actually looked up and succeeded. Have I mentioned
1134 why I hate the 'winbind use default domain' parameter?
1135 --jerry */
1136
1137 *found_username = talloc_strdup( mem_ctx, real_username );
1138
1139 return NT_STATUS_OK;
1140 }
1141
1142 /****************************************************************************
1143 Wrapper to allow the getpwnam() call to strip the domain name and
1144 try again in case a local UNIX user is already there. Also run through
1145 the username if we fallback to the username only.
1146 ****************************************************************************/
1147
1148 struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, const char *domuser,
1149 char **p_save_username, bool create )
1150 {
1151 struct passwd *pw = NULL;
1152 char *p = NULL;
1153 char *username = NULL;
1154
1155 /* we only save a copy of the username it has been mangled
1156 by winbindd use default domain */
1157 *p_save_username = NULL;
1158
1159 /* don't call map_username() here since it has to be done higher
1160 up the stack so we don't call it multiple times */
1161
1162 username = talloc_strdup(mem_ctx, domuser);
1163 if (!username) {
1164 return NULL;
1165 }
1166
1167 p = strchr_m( username, *lp_winbind_separator() );
1168
1169 /* code for a DOMAIN\user string */
1170
1171 if ( p ) {
1172 pw = Get_Pwnam_alloc( mem_ctx, domuser );
1173 if ( pw ) {
1174 /* make sure we get the case of the username correct */
1175 /* work around 'winbind use default domain = yes' */
1176
1177 if ( !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
1178 char *domain;
1179
1180 /* split the domain and username into 2 strings */
1181 *p = '\0';
1182 domain = username;
1183
1184 *p_save_username = talloc_asprintf(mem_ctx,
1185 "%s%c%s",
1186 domain,
1187 *lp_winbind_separator(),
1188 pw->pw_name);
1189 if (!*p_save_username) {
1190 TALLOC_FREE(pw);
1191 return NULL;
1192 }
1193 } else {
1194 *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
1195 }
1196
1197 /* whew -- done! */
1198 return pw;
1199 }
1200
1201 /* setup for lookup of just the username */
1202 /* remember that p and username are overlapping memory */
1203
1204 p++;
1205 username = talloc_strdup(mem_ctx, p);
1206 if (!username) {
1207 return NULL;
1208 }
1209 }
1210
1211 /* just lookup a plain username */
1212
1213 pw = Get_Pwnam_alloc(mem_ctx, username);
1214
1215 /* Create local user if requested but only if winbindd
1216 is not running. We need to protect against cases
1217 where winbindd is failing and then prematurely
1218 creating users in /etc/passwd */
1219
1220 if ( !pw && create && !winbind_ping() ) {
1221 /* Don't add a machine account. */
1222 if (username[strlen(username)-1] == '$')
1223 return NULL;
1224
1225 _smb_create_user(NULL, username, NULL);
1226 pw = Get_Pwnam_alloc(mem_ctx, username);
1227 }
1228
1229 /* one last check for a valid passwd struct */
1230
1231 if (pw) {
1232 *p_save_username = talloc_strdup(mem_ctx, pw->pw_name);
1233 }
1234 return pw;
1235 }
1236
1237 /***************************************************************************
1238 Make a server_info struct from the info3 returned by a domain logon
1239 ***************************************************************************/
1240
1241 NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
1242 const char *sent_nt_username,
1243 const char *domain,
1244 struct auth_serversupplied_info **server_info,
1245 struct netr_SamInfo3 *info3)
1246 {
1247 static const char zeros[16] = {0, };
1248
1249 NTSTATUS nt_status = NT_STATUS_OK;
1250 char *found_username = NULL;
1251 const char *nt_domain;
1252 const char *nt_username;
1253 struct dom_sid user_sid;
1254 struct dom_sid group_sid;
1255 bool username_was_mapped;
1256 struct passwd *pwd;
1257 struct auth_serversupplied_info *result;
1258
1259 /*
1260 Here is where we should check the list of
1261 trusted domains, and verify that the SID
1262 matches.
1263 */
1264
1265 if (!sid_compose(&user_sid, info3->base.domain_sid, info3->base.rid)) {
1266 return NT_STATUS_INVALID_PARAMETER;
1267 }
1268
1269 if (!sid_compose(&group_sid, info3->base.domain_sid,
1270 info3->base.primary_gid)) {
1271 return NT_STATUS_INVALID_PARAMETER;
1272 }
1273
1274 nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
1275 if (!nt_username) {
1276 /* If the server didn't give us one, just use the one we sent
1277 * them */
1278 nt_username = sent_nt_username;
1279 }
1280
1281 nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
1282 if (!nt_domain) {
1283 /* If the server didn't give us one, just use the one we sent
1284 * them */
1285 nt_domain = domain;
1286 }
1287
1288 /* If getpwnam() fails try the add user script (2.2.x behavior).
1289
1290 We use the _unmapped_ username here in an attempt to provide
1291 consistent username mapping behavior between kerberos and NTLM[SSP]
1292 authentication in domain mode security. I.E. Username mapping
1293 should be applied to the fully qualified username
1294 (e.g. DOMAIN\user) and not just the login name. Yes this means we
1295 called map_username() unnecessarily in make_user_info_map() but
1296 that is how the current code is designed. Making the change here
1297 is the least disruptive place. -- jerry */
1298
1299 /* this call will try to create the user if necessary */
1300
1301 nt_status = check_account(mem_ctx, nt_domain, sent_nt_username,
1302 &found_username, &pwd,
1303 &username_was_mapped);
1304
1305 if (!NT_STATUS_IS_OK(nt_status)) {
1306 return nt_status;
1307 }
1308
1309 result = make_server_info(NULL);
1310 if (result == NULL) {
1311 DEBUG(4, ("make_server_info failed!\n"));
1312 return NT_STATUS_NO_MEMORY;
1313 }
1314
1315 result->unix_name = talloc_strdup(result, found_username);
1316
1317 result->sanitized_username = sanitize_username(result,
1318 result->unix_name);
1319 if (result->sanitized_username == NULL) {
1320 TALLOC_FREE(result);
1321 return NT_STATUS_NO_MEMORY;
1322 }
1323
1324 /* copy in the info3 */
1325 result->info3 = copy_netr_SamInfo3(result, info3);
1326 if (result->info3 == NULL) {
1327 TALLOC_FREE(result);
1328 return NT_STATUS_NO_MEMORY;
1329 }
1330
1331 /* Fill in the unix info we found on the way */
1332
1333 result->utok.uid = pwd->pw_uid;
1334 result->utok.gid = pwd->pw_gid;
1335
1336 /* ensure we are never given NULL session keys */
1337
1338 if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
1339 result->user_session_key = data_blob_null;
1340 } else {
1341 result->user_session_key = data_blob_talloc(
1342 result, info3->base.key.key,
1343 sizeof(info3->base.key.key));
1344 }
1345
1346 if (memcmp(info3->base.LMSessKey.key, zeros, 8) == 0) {
1347 result->lm_session_key = data_blob_null;
1348 } else {
1349 result->lm_session_key = data_blob_talloc(
1350 result, info3->base.LMSessKey.key,
1351 sizeof(info3->base.LMSessKey.key));
1352 }
1353
1354 result->nss_token |= username_was_mapped;
1355
1356 *server_info = result;
1357
1358 return NT_STATUS_OK;
1359 }
1360
1361 /*****************************************************************************
1362 Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
1363 ******************************************************************************/
1364
1365 NTSTATUS make_server_info_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
1366 const char *sent_nt_username,
1367 const char *domain,
1368 const struct wbcAuthUserInfo *info,
1369 struct auth_serversupplied_info **server_info)
1370 {
1371 struct netr_SamInfo3 *info3;
1372
1373 info3 = wbcAuthUserInfo_to_netr_SamInfo3(mem_ctx, info);
1374 if (!info3) {
1375 return NT_STATUS_NO_MEMORY;
1376 }
1377
1378 return make_server_info_info3(mem_ctx,
1379 sent_nt_username, domain,
1380 server_info, info3);
1381 }
1382
1383 /**
1384 * Verify whether or not given domain is trusted.
1385 *
1386 * @param domain_name name of the domain to be verified
1387 * @return true if domain is one of the trusted ones or
1388 * false if otherwise
1389 **/
1390
1391 bool is_trusted_domain(const char* dom_name)
1392 {
1393 struct dom_sid trustdom_sid;
1394 bool ret;
1395
1396 /* no trusted domains for a standalone server */
1397
1398 if ( lp_server_role() == ROLE_STANDALONE )
1399 return False;
1400
1401 if (dom_name == NULL || dom_name[0] == '\0') {
1402 return false;
1403 }
1404
1405 if (strequal(dom_name, get_global_sam_name())) {
1406 return false;
1407 }
1408
1409 /* if we are a DC, then check for a direct trust relationships */
1410
1411 if ( IS_DC ) {
1412 become_root();
1413 DEBUG (5,("is_trusted_domain: Checking for domain trust with "
1414 "[%s]\n", dom_name ));
1415 ret = pdb_get_trusteddom_pw(dom_name, NULL, NULL, NULL);
1416 unbecome_root();
1417 if (ret)
1418 return True;
1419 }
1420 else {
1421 wbcErr result;
1422
1423 /* If winbind is around, ask it */
1424
1425 result = wb_is_trusted_domain(dom_name);
1426
1427 if (result == WBC_ERR_SUCCESS) {
1428 return True;
1429 }
1430
1431 if (result == WBC_ERR_DOMAIN_NOT_FOUND) {
1432 /* winbind could not find the domain */
1433 return False;
1434 }
1435
1436 /* The only other possible result is that winbind is not up
1437 and running. We need to update the trustdom_cache
1438 ourselves */
1439
1440 update_trustdom_cache();
1441 }
1442
1443 /* now the trustdom cache should be available a DC could still
1444 * have a transitive trust so fall back to the cache of trusted
1445 * domains (like a domain member would use */
1446
1447 if ( trustdom_cache_fetch(dom_name, &trustdom_sid) ) {
1448 return True;
1449 }
1450
1451 return False;
1452 }
1453
Samba GIT mirror