2 Unix SMB/CIFS implementation.
3 kerberos keytab utility library
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Remus Koos 2001
6 Copyright (C) Luke Howard 2003
7 Copyright (C) Jim McDonough (jmcd@us.ibm.com) 2003
8 Copyright (C) Guenther Deschner 2003
9 Copyright (C) Rakesh Patel 2004
10 Copyright (C) Dan Perry 2004
11 Copyright (C) Jeremy Allison 2004
12 Copyright (C) Gerald Carter 2006
14 This program is free software; you can redistribute it and/or modify
15 it under the terms of the GNU General Public License as published by
16 the Free Software Foundation; either version 3 of the License, or
17 (at your option) any later version.
19 This program is distributed in the hope that it will be useful,
20 but WITHOUT ANY WARRANTY; without even the implied warranty of
21 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 GNU General Public License for more details.
24 You should have received a copy of the GNU General Public License
25 along with this program. If not, see <http://www.gnu.org/licenses/>.
35 /**********************************************************************
36 **********************************************************************/
38 static krb5_error_code
seek_and_delete_old_entries(krb5_context context
,
44 bool keep_old_entries
)
47 krb5_kt_cursor cursor
;
48 krb5_kt_cursor zero_csr
;
49 krb5_keytab_entry kt_entry
;
50 krb5_keytab_entry zero_kt_entry
;
54 ZERO_STRUCT(zero_csr
);
55 ZERO_STRUCT(kt_entry
);
56 ZERO_STRUCT(zero_kt_entry
);
58 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
59 if (ret
== KRB5_KT_END
|| ret
== ENOENT
) {
64 DEBUG(3, (__location__
": Will try to delete old keytab entries\n"));
65 while (!krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
)) {
68 if (!flush
&& (princ_s
!= NULL
)) {
69 ret
= smb_krb5_unparse_name(talloc_tos(), context
,
73 DEBUG(1, (__location__
74 ": smb_krb5_unparse_name failed "
75 "(%s)\n", error_message(ret
)));
79 #ifdef HAVE_KRB5_KT_COMPARE
80 name_ok
= krb5_kt_compare(context
, &kt_entry
,
83 name_ok
= (strcmp(ktprinc
, princ_s
) == 0);
87 DEBUG(10, (__location__
": ignoring keytab "
88 "entry principal %s, kvno = %d\n",
89 ktprinc
, kt_entry
.vno
));
92 * just free this entry and continue. */
93 ret
= smb_krb5_kt_free_entry(context
,
95 ZERO_STRUCT(kt_entry
);
97 DEBUG(1, (__location__
98 ": smb_krb5_kt_free_entry "
100 error_message(ret
)));
104 TALLOC_FREE(ktprinc
);
108 TALLOC_FREE(ktprinc
);
111 /*------------------------------------------------------------
112 * Save the entries with kvno - 1. This is what microsoft does
113 * to allow people with existing sessions that have kvno - 1
114 * to still work. Otherwise, when the password for the machine
115 * changes, all kerberizied sessions will 'break' until either
116 * the client reboots or the client's session key expires and
117 * they get a new session ticket with the new kvno.
120 if (!flush
&& (kt_entry
.vno
== kvno
- 1)) {
121 DEBUG(5, (__location__
": Saving previous (kvno %d) "
122 "entry for principal: %s.\n",
127 if (keep_old_entries
) {
128 DEBUG(5, (__location__
": Saving old (kvno %d) "
129 "entry for principal: %s.\n",
134 DEBUG(5, (__location__
": Found old entry for principal: %s "
135 "(kvno %d) - trying to remove it.\n",
136 princ_s
, kt_entry
.vno
));
138 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
141 DEBUG(1, (__location__
": krb5_kt_end_seq_get() "
142 "failed (%s)\n", error_message(ret
)));
145 ret
= krb5_kt_remove_entry(context
, keytab
, &kt_entry
);
147 DEBUG(1, (__location__
": krb5_kt_remove_entry() "
148 "failed (%s)\n", error_message(ret
)));
152 DEBUG(5, (__location__
": removed old entry for principal: "
153 "%s (kvno %d).\n", princ_s
, kt_entry
.vno
));
155 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
157 DEBUG(1, (__location__
": krb5_kt_start_seq() failed "
158 "(%s)\n", error_message(ret
)));
161 ret
= smb_krb5_kt_free_entry(context
, &kt_entry
);
162 ZERO_STRUCT(kt_entry
);
164 DEBUG(1, (__location__
": krb5_kt_remove_entry() "
165 "failed (%s)\n", error_message(ret
)));
171 if (memcmp(&zero_kt_entry
, &kt_entry
, sizeof(krb5_keytab_entry
))) {
172 smb_krb5_kt_free_entry(context
, &kt_entry
);
175 if (memcmp(&cursor
, &zero_csr
, sizeof(krb5_kt_cursor
)) != 0) {
176 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
183 static int smb_krb5_kt_add_entry(krb5_context context
,
187 krb5_enctype
*enctypes
,
190 bool keep_old_entries
)
193 krb5_keytab_entry kt_entry
;
194 krb5_principal princ
= NULL
;
197 ZERO_STRUCT(kt_entry
);
199 ret
= smb_krb5_parse_name(context
, princ_s
, &princ
);
201 DEBUG(1, (__location__
": smb_krb5_parse_name(%s) "
202 "failed (%s)\n", princ_s
, error_message(ret
)));
206 /* Seek and delete old keytab entries */
207 ret
= seek_and_delete_old_entries(context
, keytab
, kvno
,
208 princ_s
, princ
, false,
214 /* If we get here, we have deleted all the old entries with kvno's
215 * not equal to the current kvno-1. */
217 /* Now add keytab entries for all encryption types */
218 for (i
= 0; enctypes
[i
]; i
++) {
221 keyp
= KRB5_KT_KEY(&kt_entry
);
223 if (create_kerberos_key_from_string(context
, princ
,
225 enctypes
[i
], no_salt
)) {
229 kt_entry
.principal
= princ
;
232 DEBUG(3, (__location__
": adding keytab entry for (%s) with "
233 "encryption type (%d) and version (%d)\n",
234 princ_s
, enctypes
[i
], kt_entry
.vno
));
235 ret
= krb5_kt_add_entry(context
, keytab
, &kt_entry
);
236 krb5_free_keyblock_contents(context
, keyp
);
237 ZERO_STRUCT(kt_entry
);
239 DEBUG(1, (__location__
": adding entry to keytab "
240 "failed (%s)\n", error_message(ret
)));
247 krb5_free_principal(context
, princ
);
253 /**********************************************************************
254 Adds a single service principal, i.e. 'host' to the system keytab
255 ***********************************************************************/
257 int ads_keytab_add_entry(ADS_STRUCT
*ads
, const char *srvPrinc
)
259 krb5_error_code ret
= 0;
260 krb5_context context
= NULL
;
261 krb5_keytab keytab
= NULL
;
264 krb5_enctype enctypes
[6] = {
267 #ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96
268 ENCTYPE_AES128_CTS_HMAC_SHA1_96
,
270 #ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96
271 ENCTYPE_AES256_CTS_HMAC_SHA1_96
,
273 ENCTYPE_ARCFOUR_HMAC
,
276 char *princ_s
= NULL
;
277 char *short_princ_s
= NULL
;
278 char *password_s
= NULL
;
280 TALLOC_CTX
*tmpctx
= NULL
;
284 initialize_krb5_error_table();
285 ret
= krb5_init_context(&context
);
287 DEBUG(1, (__location__
": could not krb5_init_context: %s\n",
288 error_message(ret
)));
292 ret
= smb_krb5_open_keytab(context
, NULL
, True
, &keytab
);
294 DEBUG(1, (__location__
": smb_krb5_open_keytab failed (%s)\n",
295 error_message(ret
)));
299 /* retrieve the password */
300 if (!secrets_init()) {
301 DEBUG(1, (__location__
": secrets_init failed\n"));
305 password_s
= secrets_fetch_machine_password(lp_workgroup(), NULL
, NULL
);
307 DEBUG(1, (__location__
": failed to fetch machine password\n"));
311 ZERO_STRUCT(password
);
312 password
.data
= password_s
;
313 password
.length
= strlen(password_s
);
315 /* we need the dNSHostName value here */
316 tmpctx
= talloc_init(__location__
);
318 DEBUG(0, (__location__
": talloc_init() failed!\n"));
323 my_fqdn
= ads_get_dnshostname(ads
, tmpctx
, global_myname());
325 DEBUG(0, (__location__
": unable to determine machine "
326 "account's dns name in AD!\n"));
331 machine_name
= ads_get_samaccountname(ads
, tmpctx
, global_myname());
333 DEBUG(0, (__location__
": unable to determine machine "
334 "account's short name in AD!\n"));
338 /*strip the trailing '$' */
339 machine_name
[strlen(machine_name
)-1] = '\0';
341 /* Construct our principal */
342 if (strchr_m(srvPrinc
, '@')) {
343 /* It's a fully-named principal. */
344 princ_s
= talloc_asprintf(tmpctx
, "%s", srvPrinc
);
349 } else if (srvPrinc
[strlen(srvPrinc
)-1] == '$') {
350 /* It's the machine account, as used by smbclient clients. */
351 princ_s
= talloc_asprintf(tmpctx
, "%s@%s",
352 srvPrinc
, lp_realm());
358 /* It's a normal service principal. Add the SPN now so that we
359 * can obtain credentials for it and double-check the salt value
360 * used to generate the service's keys. */
362 princ_s
= talloc_asprintf(tmpctx
, "%s/%s@%s",
363 srvPrinc
, my_fqdn
, lp_realm());
368 short_princ_s
= talloc_asprintf(tmpctx
, "%s/%s@%s",
369 srvPrinc
, machine_name
,
376 /* According to http://support.microsoft.com/kb/326985/en-us,
377 certain principal names are automatically mapped to the
378 host/... principal in the AD account.
379 So only create these in the keytab, not in AD. --jerry */
381 if (!strequal(srvPrinc
, "cifs") &&
382 !strequal(srvPrinc
, "host")) {
383 DEBUG(3, (__location__
": Attempting to add/update "
386 aderr
= ads_add_service_principal_name(ads
,
387 global_myname(), my_fqdn
, srvPrinc
);
388 if (!ADS_ERR_OK(aderr
)) {
389 DEBUG(1, (__location__
": failed to "
390 "ads_add_service_principal_name.\n"));
396 kvno
= (krb5_kvno
)ads_get_machine_kvno(ads
, global_myname());
398 /* -1 indicates failure, everything else is OK */
399 DEBUG(1, (__location__
": ads_get_machine_kvno failed to "
400 "determine the system's kvno.\n"));
405 /* add the fqdn principal to the keytab */
406 ret
= smb_krb5_kt_add_entry(context
, keytab
, kvno
,
407 princ_s
, enctypes
, password
,
410 DEBUG(1, (__location__
": Failed to add entry to keytab\n"));
414 /* add the short principal name if we have one */
416 ret
= smb_krb5_kt_add_entry(context
, keytab
, kvno
,
417 short_princ_s
, enctypes
, password
,
420 DEBUG(1, (__location__
421 ": Failed to add short entry to keytab\n"));
430 krb5_kt_close(context
, keytab
);
433 krb5_free_context(context
);
438 /**********************************************************************
439 Flushes all entries from the system keytab.
440 ***********************************************************************/
442 int ads_keytab_flush(ADS_STRUCT
*ads
)
444 krb5_error_code ret
= 0;
445 krb5_context context
= NULL
;
446 krb5_keytab keytab
= NULL
;
450 initialize_krb5_error_table();
451 ret
= krb5_init_context(&context
);
453 DEBUG(1, (__location__
": could not krb5_init_context: %s\n",
454 error_message(ret
)));
458 ret
= smb_krb5_open_keytab(context
, NULL
, True
, &keytab
);
460 DEBUG(1, (__location__
": smb_krb5_open_keytab failed (%s)\n",
461 error_message(ret
)));
465 kvno
= (krb5_kvno
)ads_get_machine_kvno(ads
, global_myname());
467 /* -1 indicates a failure */
468 DEBUG(1, (__location__
": Error determining the kvno.\n"));
472 /* Seek and delete old keytab entries */
473 ret
= seek_and_delete_old_entries(context
, keytab
, kvno
,
474 NULL
, NULL
, true, false);
479 aderr
= ads_clear_service_principal_names(ads
, global_myname());
480 if (!ADS_ERR_OK(aderr
)) {
481 DEBUG(1, (__location__
": Error while clearing service "
482 "principal listings in LDAP.\n"));
488 krb5_kt_close(context
, keytab
);
491 krb5_free_context(context
);
496 /**********************************************************************
497 Adds all the required service principals to the system keytab.
498 ***********************************************************************/
500 int ads_keytab_create_default(ADS_STRUCT
*ads
)
502 krb5_error_code ret
= 0;
503 krb5_context context
= NULL
;
504 krb5_keytab keytab
= NULL
;
505 krb5_kt_cursor cursor
;
506 krb5_keytab_entry kt_entry
;
509 char *sam_account_name
, *upn
;
510 char **oldEntries
= NULL
, *princ_s
[26];
511 TALLOC_CTX
*tmpctx
= NULL
;
514 /* these are the main ones we need */
515 ret
= ads_keytab_add_entry(ads
, "host");
517 DEBUG(1, (__location__
": ads_keytab_add_entry failed while "
518 "adding 'host' principal.\n"));
523 #if 0 /* don't create the CIFS/... keytab entries since no one except smbd
524 really needs them and we will fall back to verifying against
527 ret
= ads_keytab_add_entry(ads
, "cifs"));
529 DEBUG(1, (__location__
": ads_keytab_add_entry failed while "
530 "adding 'cifs'.\n"));
535 memset(princ_s
, '\0', sizeof(princ_s
));
536 ZERO_STRUCT(kt_entry
);
539 initialize_krb5_error_table();
540 ret
= krb5_init_context(&context
);
542 DEBUG(1, (__location__
": could not krb5_init_context: %s\n",
543 error_message(ret
)));
547 tmpctx
= talloc_init(__location__
);
549 DEBUG(0, (__location__
": talloc_init() failed!\n"));
554 machine_name
= talloc_strdup(tmpctx
, global_myname());
560 /* now add the userPrincipalName and sAMAccountName entries */
561 sam_account_name
= ads_get_samaccountname(ads
, tmpctx
, machine_name
);
562 if (!sam_account_name
) {
563 DEBUG(0, (__location__
": unable to determine machine "
564 "account's name in AD!\n"));
569 /* upper case the sAMAccountName to make it easier for apps to
570 know what case to use in the keytab file */
571 strupper_m(sam_account_name
);
573 ret
= ads_keytab_add_entry(ads
, sam_account_name
);
575 DEBUG(1, (__location__
": ads_keytab_add_entry() failed "
576 "while adding sAMAccountName (%s)\n",
581 /* remember that not every machine account will have a upn */
582 upn
= ads_get_upn(ads
, tmpctx
, machine_name
);
584 ret
= ads_keytab_add_entry(ads
, upn
);
586 DEBUG(1, (__location__
": ads_keytab_add_entry() "
587 "failed while adding UPN (%s)\n", upn
));
592 /* Now loop through the keytab and update any other existing entries */
593 kvno
= (krb5_kvno
)ads_get_machine_kvno(ads
, machine_name
);
595 DEBUG(1, (__location__
": ads_get_machine_kvno() failed to "
596 "determine the system's kvno.\n"));
600 DEBUG(3, (__location__
": Searching for keytab entries to preserve "
603 ret
= smb_krb5_open_keytab(context
, NULL
, True
, &keytab
);
605 DEBUG(1, (__location__
": smb_krb5_open_keytab failed (%s)\n",
606 error_message(ret
)));
610 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
611 if (ret
!= KRB5_KT_END
&& ret
!= ENOENT
) {
612 while ((ret
= krb5_kt_next_entry(context
, keytab
,
613 &kt_entry
, &cursor
)) == 0) {
614 smb_krb5_kt_free_entry(context
, &kt_entry
);
615 ZERO_STRUCT(kt_entry
);
619 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
623 * Hmmm. There is no "rewind" function for the keytab. This means we
624 * have a race condition where someone else could add entries after
625 * we've counted them. Re-open asap to minimise the race. JRA.
627 DEBUG(3, (__location__
": Found %d entries in the keytab.\n", found
));
632 oldEntries
= talloc_array(tmpctx
, char *, found
);
634 DEBUG(1, (__location__
": Failed to allocate space to store "
635 "the old keytab entries (talloc failed?).\n"));
639 memset(oldEntries
, '\0', found
* sizeof(char *));
641 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
642 if (ret
== KRB5_KT_END
|| ret
== ENOENT
) {
643 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
648 while (krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
) == 0) {
649 if (kt_entry
.vno
!= kvno
) {
650 char *ktprinc
= NULL
;
653 /* This returns a malloc'ed string in ktprinc. */
654 ret
= smb_krb5_unparse_name(oldEntries
, context
,
658 DEBUG(1, (__location__
659 ": smb_krb5_unparse_name failed "
660 "(%s)\n", error_message(ret
)));
664 * From looking at the krb5 source they don't seem to
665 * take locale or mb strings into account.
666 * Maybe this is because they assume utf8 ?
667 * In this case we may need to convert from utf8 to
668 * mb charset here ? JRA.
670 p
= strchr_m(ktprinc
, '@');
675 p
= strchr_m(ktprinc
, '/');
679 for (i
= 0; i
< found
; i
++) {
680 if (!oldEntries
[i
]) {
681 oldEntries
[i
] = ktprinc
;
684 if (!strcmp(oldEntries
[i
], ktprinc
)) {
685 TALLOC_FREE(ktprinc
);
690 TALLOC_FREE(ktprinc
);
693 smb_krb5_kt_free_entry(context
, &kt_entry
);
694 ZERO_STRUCT(kt_entry
);
697 for (i
= 0; oldEntries
[i
]; i
++) {
698 ret
|= ads_keytab_add_entry(ads
, oldEntries
[i
]);
699 TALLOC_FREE(oldEntries
[i
]);
701 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
705 TALLOC_FREE(oldEntries
);
709 krb5_keytab_entry zero_kt_entry
;
710 ZERO_STRUCT(zero_kt_entry
);
711 if (memcmp(&zero_kt_entry
, &kt_entry
,
712 sizeof(krb5_keytab_entry
))) {
713 smb_krb5_kt_free_entry(context
, &kt_entry
);
717 krb5_kt_cursor zero_csr
;
718 ZERO_STRUCT(zero_csr
);
719 if ((memcmp(&cursor
, &zero_csr
,
720 sizeof(krb5_kt_cursor
)) != 0) && keytab
) {
721 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
725 krb5_kt_close(context
, keytab
);
728 krb5_free_context(context
);
733 /**********************************************************************
735 ***********************************************************************/
737 int ads_keytab_list(const char *keytab_name
)
739 krb5_error_code ret
= 0;
740 krb5_context context
= NULL
;
741 krb5_keytab keytab
= NULL
;
742 krb5_kt_cursor cursor
;
743 krb5_keytab_entry kt_entry
;
745 ZERO_STRUCT(kt_entry
);
748 initialize_krb5_error_table();
749 ret
= krb5_init_context(&context
);
751 DEBUG(1, (__location__
": could not krb5_init_context: %s\n",
752 error_message(ret
)));
756 ret
= smb_krb5_open_keytab(context
, keytab_name
, False
, &keytab
);
758 DEBUG(1, (__location__
": smb_krb5_open_keytab failed (%s)\n",
759 error_message(ret
)));
763 ret
= krb5_kt_start_seq_get(context
, keytab
, &cursor
);
769 printf("Vno Type Principal\n");
771 while (krb5_kt_next_entry(context
, keytab
, &kt_entry
, &cursor
) == 0) {
773 char *princ_s
= NULL
;
774 char *etype_s
= NULL
;
775 krb5_enctype enctype
= 0;
777 ret
= smb_krb5_unparse_name(talloc_tos(), context
,
778 kt_entry
.principal
, &princ_s
);
783 enctype
= smb_get_enctype_from_kt_entry(&kt_entry
);
785 ret
= smb_krb5_enctype_to_string(context
, enctype
, &etype_s
);
787 (asprintf(&etype_s
, "UNKNOWN: %d\n", enctype
) == -1)) {
788 TALLOC_FREE(princ_s
);
792 printf("%3d %s\t\t %s\n", kt_entry
.vno
, etype_s
, princ_s
);
794 TALLOC_FREE(princ_s
);
797 ret
= smb_krb5_kt_free_entry(context
, &kt_entry
);
803 ret
= krb5_kt_end_seq_get(context
, keytab
, &cursor
);
808 /* Ensure we don't double free. */
809 ZERO_STRUCT(kt_entry
);
814 krb5_keytab_entry zero_kt_entry
;
815 ZERO_STRUCT(zero_kt_entry
);
816 if (memcmp(&zero_kt_entry
, &kt_entry
,
817 sizeof(krb5_keytab_entry
))) {
818 smb_krb5_kt_free_entry(context
, &kt_entry
);
822 krb5_kt_cursor zero_csr
;
823 ZERO_STRUCT(zero_csr
);
824 if ((memcmp(&cursor
, &zero_csr
,
825 sizeof(krb5_kt_cursor
)) != 0) && keytab
) {
826 krb5_kt_end_seq_get(context
, keytab
, &cursor
);
831 krb5_kt_close(context
, keytab
);
834 krb5_free_context(context
);
839 #endif /* HAVE_KRB5 */