2 Unix SMB/Netbios implementation.
4 Authentication utility functions
5 Copyright (C) Andrew Tridgell 1992-1998
6 Copyright (C) Andrew Bartlett 2001
7 Copyright (C) Jeremy Allison 2000-2001
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 extern fstring remote_machine
;
27 extern pstring global_myname
;
29 /****************************************************************************
30 Create a UNIX user on demand.
31 ****************************************************************************/
33 static int smb_create_user(const char *unix_user
, const char *homedir
)
38 pstrcpy(add_script
, lp_adduser_script());
41 all_string_sub(add_script
, "%u", unix_user
, sizeof(pstring
));
43 all_string_sub(add_script
, "%H", homedir
, sizeof(pstring
));
44 ret
= smbrun(add_script
,NULL
);
45 DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script
,ret
));
49 /****************************************************************************
50 Delete a UNIX user on demand.
51 ****************************************************************************/
53 int smb_delete_user(const char *unix_user
)
58 pstrcpy(del_script
, lp_deluser_script());
61 all_string_sub(del_script
, "%u", unix_user
, sizeof(pstring
));
62 ret
= smbrun(del_script
,NULL
);
63 DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script
,ret
));
67 /****************************************************************************
68 Add and Delete UNIX users on demand, based on NTSTATUS codes.
69 ****************************************************************************/
71 void smb_user_control(const auth_usersupplied_info
*user_info
, auth_serversupplied_info
*server_info
, NTSTATUS nt_status
)
73 struct passwd
*pwd
=NULL
;
75 if (NT_STATUS_IS_OK(nt_status
)) {
77 if (!(server_info
->sam_fill_level
& SAM_FILL_UNIX
)) {
80 * User validated ok against Domain controller.
81 * If the admin wants us to try and create a UNIX
82 * user on the fly, do so.
85 if(lp_adduser_script() && !(pwd
= Get_Pwnam(user_info
->internal_username
.str
))) {
86 smb_create_user(user_info
->internal_username
.str
, NULL
);
89 } else if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
)) {
91 * User failed to validate ok against Domain controller.
92 * If the failure was "user doesn't exist" and admin
93 * wants us to try and delete that UNIX user on the fly,
96 if (lp_deluser_script()) {
97 smb_delete_user(user_info
->internal_username
.str
);
102 /****************************************************************************
103 Create an auth_usersupplied_data structure
104 ****************************************************************************/
106 static BOOL
make_user_info(auth_usersupplied_info
**user_info
,
107 const char *smb_name
,
108 const char *internal_username
,
109 const char *client_domain
,
111 const char *wksta_name
,
112 DATA_BLOB lm_pwd
, DATA_BLOB nt_pwd
,
114 uint32 auth_flags
, BOOL encrypted
)
117 DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username
, smb_name
));
119 *user_info
= malloc(sizeof(**user_info
));
121 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info
)));
125 ZERO_STRUCTP(*user_info
);
127 DEBUG(5,("makeing strings for %s's user_info struct\n", internal_username
));
129 (*user_info
)->smb_name
.str
= strdup(smb_name
);
130 if ((*user_info
)->smb_name
.str
) {
131 (*user_info
)->smb_name
.len
= strlen(smb_name
);
133 free_user_info(user_info
);
137 (*user_info
)->internal_username
.str
= strdup(internal_username
);
138 if ((*user_info
)->internal_username
.str
) {
139 (*user_info
)->internal_username
.len
= strlen(internal_username
);
141 free_user_info(user_info
);
145 (*user_info
)->domain
.str
= strdup(domain
);
146 if ((*user_info
)->domain
.str
) {
147 (*user_info
)->domain
.len
= strlen(domain
);
149 free_user_info(user_info
);
153 (*user_info
)->client_domain
.str
= strdup(client_domain
);
154 if ((*user_info
)->client_domain
.str
) {
155 (*user_info
)->client_domain
.len
= strlen(client_domain
);
157 free_user_info(user_info
);
161 (*user_info
)->wksta_name
.str
= strdup(wksta_name
);
162 if ((*user_info
)->wksta_name
.str
) {
163 (*user_info
)->wksta_name
.len
= strlen(wksta_name
);
165 free_user_info(user_info
);
169 DEBUG(5,("makeing blobs for %s's user_info struct\n", internal_username
));
171 (*user_info
)->lm_resp
= data_blob(lm_pwd
.data
, lm_pwd
.length
);
172 (*user_info
)->nt_resp
= data_blob(nt_pwd
.data
, nt_pwd
.length
);
173 (*user_info
)->plaintext_password
= data_blob(plaintext
.data
, plaintext
.length
);
175 (*user_info
)->encrypted
= encrypted
;
176 (*user_info
)->auth_flags
= auth_flags
;
178 DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted
? "":"un" , internal_username
, smb_name
));
183 /****************************************************************************
184 Create an auth_usersupplied_data structure after appropriate mapping.
185 ****************************************************************************/
187 BOOL
make_user_info_map(auth_usersupplied_info
**user_info
,
188 const char *smb_name
,
189 const char *client_domain
,
190 const char *wksta_name
,
191 DATA_BLOB lm_pwd
, DATA_BLOB nt_pwd
,
193 uint32 ntlmssp_flags
, BOOL encrypted
)
196 fstring internal_username
;
197 fstrcpy(internal_username
, smb_name
);
198 map_username(internal_username
);
200 if (lp_allow_trusted_domains()) {
201 /* the client could have given us a workstation name
202 or other crap for the workgroup - we really need a
203 way of telling if this domain name is one of our
206 The way I do it here is by checking if the fully
207 qualified username exists. This is rather reliant
208 on winbind, but until we have a better method this
212 domain
= client_domain
;
214 if ((smb_name
) && (*smb_name
)) { /* Don't do this for guests */
216 asprintf(&user
, "%s%s%s",
217 client_domain
, lp_winbind_separator(),
219 if (Get_Pwnam(user
) == NULL
) {
220 domain
= lp_workgroup();
225 domain
= lp_workgroup();
228 return make_user_info(user_info
,
229 smb_name
, internal_username
,
230 client_domain
, domain
,
234 ntlmssp_flags
, encrypted
);
238 /****************************************************************************
239 Create an auth_usersupplied_data, making the DATA_BLOBs here.
240 Decrypt and encrypt the passwords.
241 ****************************************************************************/
243 BOOL
make_user_info_netlogon_network(auth_usersupplied_info
**user_info
,
244 const char *smb_name
,
245 const char *client_domain
,
246 const char *wksta_name
,
247 const uchar
*lm_network_pwd
, int lm_pwd_len
,
248 const uchar
*nt_network_pwd
, int nt_pwd_len
)
251 DATA_BLOB lm_blob
= data_blob(lm_network_pwd
, lm_pwd_len
);
252 DATA_BLOB nt_blob
= data_blob(nt_network_pwd
, nt_pwd_len
);
253 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
254 uint32 auth_flags
= AUTH_FLAG_NONE
;
257 auth_flags
|= AUTH_FLAG_LM_RESP
;
258 if (nt_pwd_len
== 24) {
259 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
260 } else if (nt_pwd_len
!= 0) {
261 auth_flags
|= AUTH_FLAG_NTLMv2_RESP
;
264 ret
= make_user_info_map(user_info
,
265 smb_name
, client_domain
,
271 data_blob_free(&lm_blob
);
272 data_blob_free(&nt_blob
);
276 /****************************************************************************
277 Create an auth_usersupplied_data, making the DATA_BLOBs here.
278 Decrypt and encrypt the passwords.
279 ****************************************************************************/
281 BOOL
make_user_info_netlogon_interactive(auth_usersupplied_info
**user_info
,
282 const char *smb_name
,
283 const char *client_domain
,
284 const char *wksta_name
,
286 const uchar lm_interactive_pwd
[16],
287 const uchar nt_interactive_pwd
[16],
288 const uchar
*dc_sess_key
)
292 unsigned char local_lm_response
[24];
293 unsigned char local_nt_response
[24];
294 unsigned char key
[16];
295 uint32 auth_flags
= AUTH_FLAG_NONE
;
298 memcpy(key
, dc_sess_key
, 8);
300 if (lm_interactive_pwd
) memcpy(lm_pwd
, lm_interactive_pwd
, sizeof(lm_pwd
));
301 if (nt_interactive_pwd
) memcpy(nt_pwd
, nt_interactive_pwd
, sizeof(nt_pwd
));
303 #ifdef DEBUG_PASSWORD
305 dump_data(100, (char *)key
, sizeof(key
));
307 DEBUG(100,("lm owf password:"));
308 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
310 DEBUG(100,("nt owf password:"));
311 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
314 SamOEMhash((uchar
*)lm_pwd
, key
, sizeof(lm_pwd
));
315 SamOEMhash((uchar
*)nt_pwd
, key
, sizeof(nt_pwd
));
317 #ifdef DEBUG_PASSWORD
318 DEBUG(100,("decrypt of lm owf password:"));
319 dump_data(100, lm_pwd
, sizeof(lm_pwd
));
321 DEBUG(100,("decrypt of nt owf password:"));
322 dump_data(100, nt_pwd
, sizeof(nt_pwd
));
325 SMBOWFencrypt((const unsigned char *)lm_pwd
, chal
, local_lm_response
);
326 SMBOWFencrypt((const unsigned char *)nt_pwd
, chal
, local_nt_response
);
328 /* Password info parinoia */
335 DATA_BLOB local_lm_blob
= data_blob(local_lm_response
, sizeof(local_lm_response
));
336 DATA_BLOB local_nt_blob
= data_blob(local_nt_response
, sizeof(local_nt_response
));
337 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
339 if (lm_interactive_pwd
)
340 auth_flags
|= AUTH_FLAG_LM_RESP
;
341 if (nt_interactive_pwd
)
342 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
344 ret
= make_user_info_map(user_info
,
345 smb_name
, client_domain
,
352 data_blob_free(&local_lm_blob
);
353 data_blob_free(&local_nt_blob
);
359 /****************************************************************************
360 Create an auth_usersupplied_data structure
361 ****************************************************************************/
363 BOOL
make_user_info_for_reply(auth_usersupplied_info
**user_info
,
364 const char *smb_name
,
365 const char *client_domain
,
367 DATA_BLOB plaintext_password
)
370 DATA_BLOB local_lm_blob
;
371 DATA_BLOB local_nt_blob
;
373 uint32 auth_flags
= AUTH_FLAG_NONE
;
376 * Not encrypted - do so.
379 DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
381 if (plaintext_password
.data
) {
382 unsigned char local_lm_response
[24];
384 #ifdef DEBUG_PASSWORD
385 DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password
.length
));
386 dump_data(100, plaintext_password
.data
, plaintext_password
.length
);
389 SMBencrypt( (const uchar
*)plaintext_password
.data
, (const uchar
*)chal
, local_lm_response
);
390 local_lm_blob
= data_blob(local_lm_response
, 24);
392 /* We can't do an NT hash here, as the password needs to be
394 local_nt_blob
= data_blob(NULL
, 0);
396 auth_flags
= (AUTH_FLAG_PLAINTEXT
| AUTH_FLAG_LM_RESP
);
398 local_lm_blob
= data_blob(NULL
, 0);
399 local_nt_blob
= data_blob(NULL
, 0);
402 ret
= make_user_info_map(user_info
, smb_name
,
410 data_blob_free(&local_lm_blob
);
414 /****************************************************************************
415 Create an auth_usersupplied_data structure
416 ****************************************************************************/
418 BOOL
make_user_info_for_reply_enc(auth_usersupplied_info
**user_info
,
419 const char *smb_name
,
420 const char *client_domain
,
421 DATA_BLOB lm_resp
, DATA_BLOB nt_resp
)
423 uint32 auth_flags
= AUTH_FLAG_NONE
;
425 DATA_BLOB no_plaintext_blob
= data_blob(NULL
, 0);
427 if (lm_resp
.length
== 24) {
428 auth_flags
|= AUTH_FLAG_LM_RESP
;
430 if (nt_resp
.length
== 0) {
431 } else if (nt_resp
.length
== 24) {
432 auth_flags
|= AUTH_FLAG_NTLM_RESP
;
434 auth_flags
|= AUTH_FLAG_NTLMv2_RESP
;
437 return make_user_info_map(user_info
, smb_name
,
446 /****************************************************************************
447 Create a guest user_info blob, for anonymous authenticaion.
448 ****************************************************************************/
450 BOOL
make_user_info_guest(auth_usersupplied_info
**user_info
)
452 DATA_BLOB lm_blob
= data_blob(NULL
, 0);
453 DATA_BLOB nt_blob
= data_blob(NULL
, 0);
454 DATA_BLOB plaintext_blob
= data_blob(NULL
, 0);
455 uint32 auth_flags
= AUTH_FLAG_NONE
;
457 return make_user_info(user_info
,
466 /***************************************************************************
467 Make a user_info struct
468 ***************************************************************************/
470 BOOL
make_server_info(auth_serversupplied_info
**server_info
)
472 *server_info
= malloc(sizeof(**server_info
));
474 DEBUG(0,("make_server_info: malloc failed!\n"));
477 ZERO_STRUCTP(*server_info
);
481 /***************************************************************************
482 Make (and fill) a user_info struct from a SAM_ACCOUNT
483 ***************************************************************************/
485 BOOL
make_server_info_sam(auth_serversupplied_info
**server_info
, SAM_ACCOUNT
*sampass
)
487 if (!make_server_info(server_info
)) {
491 (*server_info
)->sam_fill_level
= SAM_FILL_ALL
;
492 (*server_info
)->sam_account
= sampass
;
494 DEBUG(5,("make_server_info_sam: made server info for user %s\n",
495 pdb_get_username((*server_info
)->sam_account
)));
499 /***************************************************************************
500 Make (and fill) a user_info struct from a 'struct passwd' by conversion
502 ***************************************************************************/
504 BOOL
make_server_info_pw(auth_serversupplied_info
**server_info
, const struct passwd
*pwd
)
506 SAM_ACCOUNT
*sampass
= NULL
;
507 if (!NT_STATUS_IS_OK(pdb_init_sam_pw(&sampass
, pwd
))) {
510 return make_server_info_sam(server_info
, sampass
);
513 /***************************************************************************
514 Free a user_info struct
515 ***************************************************************************/
517 void free_user_info(auth_usersupplied_info
**user_info
)
519 DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
520 if (*user_info
!= NULL
) {
521 if ((*user_info
)->smb_name
.str
) {
522 DEBUG(10,("structure was created for %s\n", (*user_info
)->smb_name
.str
));
524 SAFE_FREE((*user_info
)->smb_name
.str
);
525 SAFE_FREE((*user_info
)->internal_username
.str
);
526 SAFE_FREE((*user_info
)->client_domain
.str
);
527 SAFE_FREE((*user_info
)->domain
.str
);
528 SAFE_FREE((*user_info
)->wksta_name
.str
);
529 data_blob_free(&(*user_info
)->lm_resp
);
530 data_blob_free(&(*user_info
)->nt_resp
);
531 SAFE_FREE((*user_info
)->interactive_password
);
532 data_blob_clear_free(&(*user_info
)->plaintext_password
);
533 ZERO_STRUCT(**user_info
);
535 SAFE_FREE(*user_info
);
538 /***************************************************************************
539 Clear out a server_info struct that has been allocated
540 ***************************************************************************/
542 void free_server_info(auth_serversupplied_info
**server_info
)
544 if (*server_info
!= NULL
) {
545 pdb_free_sam(&(*server_info
)->sam_account
);
547 /* call pam_end here, unless we know we are keeping it */
548 delete_nt_token( &(*server_info
)->ptok
);
549 ZERO_STRUCT(**server_info
);
551 SAFE_FREE(*server_info
);
554 /***************************************************************************
555 Make a server_info struct for a guest user
556 ***************************************************************************/
558 BOOL
make_server_info_guest(auth_serversupplied_info
**server_info
)
560 struct passwd
*pass
= getpwnam_alloc(lp_guestaccount());
563 if (!make_server_info_pw(server_info
, pass
)) {
567 (*server_info
)->guest
= True
;
571 DEBUG(0,("make_server_info_guest: getpwnam_alloc() failed on guest account!\n"));
575 /***************************************************************************
576 Make an auth_methods struct
577 ***************************************************************************/
579 BOOL
make_auth_methods(struct auth_context
*auth_context
, auth_methods
**auth_method
)
582 smb_panic("no auth_context supplied to make_auth_methods()!\n");
586 smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
589 *auth_method
= talloc(auth_context
->mem_ctx
, sizeof(**auth_method
));
591 DEBUG(0,("make_auth_method: malloc failed!\n"));
594 ZERO_STRUCTP(*auth_method
);
599 /****************************************************************************
601 ****************************************************************************/
603 void delete_nt_token(NT_USER_TOKEN
**pptoken
)
606 NT_USER_TOKEN
*ptoken
= *pptoken
;
607 SAFE_FREE( ptoken
->user_sids
);
608 ZERO_STRUCTP(ptoken
);
613 /****************************************************************************
614 Duplicate a SID token.
615 ****************************************************************************/
617 NT_USER_TOKEN
*dup_nt_token(NT_USER_TOKEN
*ptoken
)
619 NT_USER_TOKEN
*token
;
624 if ((token
= (NT_USER_TOKEN
*)malloc( sizeof(NT_USER_TOKEN
) ) ) == NULL
)
629 if ((token
->user_sids
= (DOM_SID
*)memdup( ptoken
->user_sids
, sizeof(DOM_SID
) * ptoken
->num_sids
)) == NULL
) {
634 token
->num_sids
= ptoken
->num_sids
;
640 * Squash an NT_STATUS in line with security requirements.
641 * In an attempt to avoid giving the whole game away when users
642 * are authenticating, NT replaces both NT_STATUS_NO_SUCH_USER and
643 * NT_STATUS_WRONG_PASSWORD with NT_STATUS_LOGON_FAILURE in certain situations
644 * (session setups in particular).
646 * @param nt_status NTSTATUS input for squashing.
647 * @return the 'squashed' nt_status
650 NTSTATUS
nt_status_squash(NTSTATUS nt_status
)
652 if NT_STATUS_IS_OK(nt_status
) {
654 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_SUCH_USER
) {
655 /* Match WinXP and don't give the game away */
656 return NT_STATUS_LOGON_FAILURE
;
658 } else if NT_STATUS_EQUAL(nt_status
, NT_STATUS_WRONG_PASSWORD
) {
659 /* Match WinXP and don't give the game away */
660 return NT_STATUS_LOGON_FAILURE
;