2 Unix SMB/CIFS implementation.
3 Samba utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001-2004
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 /* These comments regard the code to change the user's unix password: */
24 /* fork a child process to exec passwd and write to its
25 * tty to change a users password. This is running as the
26 * user who is attempting to change the password.
30 * This code was copied/borrowed and stolen from various sources.
31 * The primary source was the poppasswd.c from the authors of POPMail. This software
32 * was included as a client to change passwords using the 'passwd' program
33 * on the remote machine.
35 * This code has been hacked by Bob Nance (nance@niehs.nih.gov) and Evan Patterson
36 * (patters2@niehs.nih.gov) at the National Institute of Environmental Health Sciences
37 * and rights to modify, distribute or incorporate this change to the CAP suite or
38 * using it for any other reason are granted, so long as this disclaimer is left intact.
42 This code was hacked considerably for inclusion in Samba, primarily
43 by Andrew.Tridgell@anu.edu.au. The biggest change was the addition
44 of the "password chat" option, which allows the easy runtime
45 specification of the expected sequence of events to change a
51 extern struct passdb_ops pdb_ops
;
53 static NTSTATUS
check_oem_password(const char *user
,
54 uchar password_encrypted_with_lm_hash
[516],
55 const uchar old_lm_hash_encrypted
[16],
56 uchar password_encrypted_with_nt_hash
[516],
57 const uchar old_nt_hash_encrypted
[16],
58 struct samu
**hnd
, char *new_passwd
,
61 #if ALLOW_CHANGE_PASSWORD
63 static int findpty(char **slave
)
70 #if defined(HAVE_GRANTPT)
71 /* Try to open /dev/ptmx. If that fails, fall through to old method. */
72 if ((master
= sys_open("/dev/ptmx", O_RDWR
, 0)) >= 0)
76 *slave
= (char *)ptsname(master
);
80 ("findpty: Unable to create master/slave pty pair.\n"));
81 /* Stop fd leak on error. */
88 ("findpty: Allocated slave pty %s\n", *slave
));
92 #endif /* HAVE_GRANTPT */
94 fstrcpy(line
, "/dev/ptyXX");
96 dirp
= sys_opendir("/dev");
99 while ((dpname
= readdirname(dirp
)) != NULL
)
101 if (strncmp(dpname
, "pty", 3) == 0 && strlen(dpname
) == 5)
104 ("pty: try to open %s, line was %s\n", dpname
,
108 if ((master
= sys_open(line
, O_RDWR
, 0)) >= 0)
110 DEBUG(3, ("pty: opened %s\n", line
));
122 static int dochild(int master
, const char *slavedev
, const struct passwd
*pass
,
123 const char *passwordprogram
, BOOL as_root
)
126 struct termios stermios
;
133 ("dochild: user doesn't exist in the UNIX password database.\n"));
140 gain_root_privilege();
142 /* Start new session - gets rid of controlling terminal. */
146 ("Weirdness, couldn't let go of controlling terminal\n"));
150 /* Open slave pty and acquire as new controlling terminal. */
151 if ((slave
= sys_open(slavedev
, O_RDWR
, 0)) < 0)
153 DEBUG(3, ("More weirdness, could not open %s\n", slavedev
));
156 #if defined(I_PUSH) && defined(I_FIND)
157 if (ioctl(slave
, I_FIND
, "ptem") == 0) {
158 ioctl(slave
, I_PUSH
, "ptem");
160 if (ioctl(slave
, I_FIND
, "ldterm") == 0) {
161 ioctl(slave
, I_PUSH
, "ldterm");
163 #elif defined(TIOCSCTTY)
164 if (ioctl(slave
, TIOCSCTTY
, 0) < 0)
166 DEBUG(3, ("Error in ioctl call for slave pty\n"));
174 /* Make slave stdin/out/err of child. */
176 if (sys_dup2(slave
, STDIN_FILENO
) != STDIN_FILENO
)
178 DEBUG(3, ("Could not re-direct stdin\n"));
181 if (sys_dup2(slave
, STDOUT_FILENO
) != STDOUT_FILENO
)
183 DEBUG(3, ("Could not re-direct stdout\n"));
186 if (sys_dup2(slave
, STDERR_FILENO
) != STDERR_FILENO
)
188 DEBUG(3, ("Could not re-direct stderr\n"));
194 /* Set proper terminal attributes - no echo, canonical input processing,
195 no map NL to CR/NL on output. */
197 if (tcgetattr(0, &stermios
) < 0)
200 ("could not read default terminal attributes on pty\n"));
203 stermios
.c_lflag
&= ~(ECHO
| ECHOE
| ECHOK
| ECHONL
);
204 stermios
.c_lflag
|= ICANON
;
206 stermios
.c_oflag
&= ~(ONLCR
);
208 if (tcsetattr(0, TCSANOW
, &stermios
) < 0)
210 DEBUG(3, ("could not set attributes of pty\n"));
214 /* make us completely into the right uid */
217 become_user_permanently(uid
, gid
);
221 ("Invoking '%s' as password change program.\n",
224 /* execl() password-change application */
225 if (execl("/bin/sh", "sh", "-c", passwordprogram
, NULL
) < 0)
227 DEBUG(3, ("Bad status returned from %s\n", passwordprogram
));
233 static int expect(int master
, char *issue
, char *expected
)
236 int attempts
, timeout
, nread
, len
;
239 for (attempts
= 0; attempts
< 2; attempts
++) {
240 if (!strequal(issue
, ".")) {
241 if (lp_passwd_chat_debug())
242 DEBUG(100, ("expect: sending [%s]\n", issue
));
244 if ((len
= sys_write(master
, issue
, strlen(issue
))) != strlen(issue
)) {
245 DEBUG(2,("expect: (short) write returned %d\n", len
));
250 if (strequal(expected
, "."))
253 /* Initial timeout. */
254 timeout
= lp_passwd_chat_timeout() * 1000;
258 while ((len
= read_socket_with_timeout(master
, buffer
+ nread
, 1,
259 sizeof(buffer
) - nread
- 1,
265 /* Eat leading/trailing whitespace before match. */
267 pstrcpy( str
, buffer
);
268 trim_char( str
, ' ', ' ');
270 if ((match
= unix_wild_match(expected
, str
)) == True
) {
271 /* Now data has started to return, lower timeout. */
272 timeout
= lp_passwd_chat_timeout() * 100;
277 if (lp_passwd_chat_debug())
278 DEBUG(100, ("expect: expected [%s] received [%s] match %s\n",
279 expected
, buffer
, match
? "yes" : "no" ));
285 DEBUG(2, ("expect: %s\n", strerror(errno
)));
290 DEBUG(10,("expect: returning %s\n", match
? "True" : "False" ));
294 static void pwd_sub(char *buf
)
296 all_string_sub(buf
, "\\n", "\n", 0);
297 all_string_sub(buf
, "\\r", "\r", 0);
298 all_string_sub(buf
, "\\s", " ", 0);
299 all_string_sub(buf
, "\\t", "\t", 0);
302 static int talktochild(int master
, const char *seq
)
305 fstring issue
, expected
;
309 while (next_token(&seq
, expected
, NULL
, sizeof(expected
)))
314 if (!expect(master
, issue
, expected
))
316 DEBUG(3, ("Response %d incorrect\n", count
));
320 if (!next_token(&seq
, issue
, NULL
, sizeof(issue
)))
325 if (!strequal(issue
, ".")) {
326 /* we have one final issue to send */
327 fstrcpy(expected
, ".");
328 if (!expect(master
, issue
, expected
))
335 static BOOL
chat_with_program(char *passwordprogram
, const struct passwd
*pass
,
336 char *chatsequence
, BOOL as_root
)
345 DEBUG(0, ("chat_with_program: user doesn't exist in the UNIX password database.\n"));
349 /* allocate a pseudo-terminal device */
350 if ((master
= findpty(&slavedev
)) < 0) {
351 DEBUG(3, ("chat_with_program: Cannot Allocate pty for password change: %s\n", pass
->pw_name
));
356 * We need to temporarily stop CatchChild from eating
357 * SIGCLD signals as it also eats the exit status code. JRA.
360 CatchChildLeaveStatus();
362 if ((pid
= sys_fork()) < 0) {
363 DEBUG(3, ("chat_with_program: Cannot fork() child for password change: %s\n", pass
->pw_name
));
369 /* we now have a pty */
370 if (pid
> 0) { /* This is the parent process */
371 if ((chstat
= talktochild(master
, chatsequence
)) == False
) {
372 DEBUG(3, ("chat_with_program: Child failed to change password: %s\n", pass
->pw_name
));
373 kill(pid
, SIGKILL
); /* be sure to end this process */
376 while ((wpid
= sys_waitpid(pid
, &wstat
, 0)) < 0) {
377 if (errno
== EINTR
) {
385 DEBUG(3, ("chat_with_program: The process is no longer waiting!\n\n"));
392 * Go back to ignoring children.
399 DEBUG(3, ("chat_with_program: We were waiting for the wrong process ID\n"));
402 if (WIFEXITED(wstat
) && (WEXITSTATUS(wstat
) != 0)) {
403 DEBUG(3, ("chat_with_program: The process exited with status %d \
404 while we were waiting\n", WEXITSTATUS(wstat
)));
407 #if defined(WIFSIGNALLED) && defined(WTERMSIG)
408 else if (WIFSIGNALLED(wstat
)) {
409 DEBUG(3, ("chat_with_program: The process was killed by signal %d \
410 while we were waiting\n", WTERMSIG(wstat
)));
418 * Lose any elevated privileges.
420 drop_effective_capability(KERNEL_OPLOCK_CAPABILITY
);
421 drop_effective_capability(DMAPI_ACCESS_CAPABILITY
);
423 /* make sure it doesn't freeze */
429 DEBUG(3, ("chat_with_program: Dochild for user %s (uid=%d,gid=%d) (as_root = %s)\n", pass
->pw_name
,
430 (int)getuid(), (int)getgid(), BOOLSTR(as_root
) ));
431 chstat
= dochild(master
, slavedev
, pass
, passwordprogram
, as_root
);
437 * The child should never return from dochild() ....
440 DEBUG(0, ("chat_with_program: Error: dochild() returned %d\n", chstat
));
445 DEBUG(3, ("chat_with_program: Password change %ssuccessful for user %s\n",
446 (chstat
? "" : "un"), pass
->pw_name
));
450 BOOL
chgpasswd(const char *name
, const struct passwd
*pass
,
451 const char *oldpass
, const char *newpass
, BOOL as_root
)
453 pstring passwordprogram
;
454 pstring chatsequence
;
462 DEBUG(3, ("chgpasswd: Password change (as_root=%s) for user: %s\n", BOOLSTR(as_root
), name
));
464 #ifdef DEBUG_PASSWORD
465 DEBUG(100, ("chgpasswd: Passwords: old=%s new=%s\n", oldpass
, newpass
));
468 /* Take the passed information and test it for minimum criteria */
470 /* Password is same as old password */
471 if (strcmp(oldpass
, newpass
) == 0) {
472 /* don't allow same password */
473 DEBUG(2, ("chgpasswd: Password Change: %s, New password is same as old\n", name
)); /* log the attempt */
474 return (False
); /* inform the user */
478 * Check the old and new passwords don't contain any control
482 len
= strlen(oldpass
);
483 for (i
= 0; i
< len
; i
++) {
484 if (iscntrl((int)oldpass
[i
])) {
485 DEBUG(0, ("chgpasswd: oldpass contains control characters (disallowed).\n"));
490 len
= strlen(newpass
);
491 for (i
= 0; i
< len
; i
++) {
492 if (iscntrl((int)newpass
[i
])) {
493 DEBUG(0, ("chgpasswd: newpass contains control characters (disallowed).\n"));
499 if (lp_pam_password_change()) {
506 ret
= smb_pam_passchange(pass
->pw_name
, oldpass
, newpass
);
508 ret
= smb_pam_passchange(name
, oldpass
, newpass
);
518 /* A non-PAM password change just doen't make sense without a valid local user */
521 DEBUG(0, ("chgpasswd: user %s doesn't exist in the UNIX password database.\n", name
));
525 pstrcpy(passwordprogram
, lp_passwd_program());
526 pstrcpy(chatsequence
, lp_passwd_chat());
528 if (!*chatsequence
) {
529 DEBUG(2, ("chgpasswd: Null chat sequence - no password changing\n"));
533 if (!*passwordprogram
) {
534 DEBUG(2, ("chgpasswd: Null password program - no password changing\n"));
539 /* The password program *must* contain the user name to work. Fail if not. */
540 if (strstr_m(passwordprogram
, "%u") == NULL
) {
541 DEBUG(0,("chgpasswd: Running as root the 'passwd program' parameter *MUST* contain \
542 the string %%u, and the given string %s does not.\n", passwordprogram
));
547 pstring_sub(passwordprogram
, "%u", name
);
548 /* note that we do NOT substitute the %o and %n in the password program
549 as this would open up a security hole where the user could use
550 a new password containing shell escape characters */
552 pstring_sub(chatsequence
, "%u", name
);
553 all_string_sub(chatsequence
, "%o", oldpass
, sizeof(pstring
));
554 all_string_sub(chatsequence
, "%n", newpass
, sizeof(pstring
));
555 return (chat_with_program
556 (passwordprogram
, pass
, chatsequence
, as_root
));
559 #else /* ALLOW_CHANGE_PASSWORD */
561 BOOL
chgpasswd(const char *name
, const struct passwd
*pass
,
562 const char *oldpass
, const char *newpass
, BOOL as_root
)
564 DEBUG(0, ("chgpasswd: Unix Password changing not compiled in (user=%s)\n", name
));
567 #endif /* ALLOW_CHANGE_PASSWORD */
569 /***********************************************************
570 Code to check the lanman hashed password.
571 ************************************************************/
573 BOOL
check_lanman_password(char *user
, uchar
* pass1
,
574 uchar
* pass2
, struct samu
**hnd
)
576 uchar unenc_new_pw
[16];
577 uchar unenc_old_pw
[16];
578 struct samu
*sampass
= NULL
;
580 const uint8
*lanman_pw
;
583 if ( !(sampass
= samu_new(NULL
)) ) {
584 DEBUG(0, ("samu_new() failed!\n"));
589 ret
= pdb_getsampwnam(sampass
, user
);
593 DEBUG(0,("check_lanman_password: getsampwnam returned NULL\n"));
594 TALLOC_FREE(sampass
);
598 acct_ctrl
= pdb_get_acct_ctrl (sampass
);
599 lanman_pw
= pdb_get_lanman_passwd (sampass
);
601 if (acct_ctrl
& ACB_DISABLED
) {
602 DEBUG(0,("check_lanman_password: account %s disabled.\n", user
));
603 TALLOC_FREE(sampass
);
607 if (lanman_pw
== NULL
) {
608 if (acct_ctrl
& ACB_PWNOTREQ
) {
609 /* this saves the pointer for the caller */
613 DEBUG(0, ("check_lanman_password: no lanman password !\n"));
614 TALLOC_FREE(sampass
);
619 /* Get the new lanman hash. */
620 D_P16(lanman_pw
, pass2
, unenc_new_pw
);
622 /* Use this to get the old lanman hash. */
623 D_P16(unenc_new_pw
, pass1
, unenc_old_pw
);
625 /* Check that the two old passwords match. */
626 if (memcmp(lanman_pw
, unenc_old_pw
, 16)) {
627 DEBUG(0,("check_lanman_password: old password doesn't match.\n"));
628 TALLOC_FREE(sampass
);
632 /* this saves the pointer for the caller */
637 /***********************************************************
638 Code to change the lanman hashed password.
639 It nulls out the NT hashed password as it will
641 NOTE this function is designed to be called as root. Check the old password
642 is correct before calling. JRA.
643 ************************************************************/
645 BOOL
change_lanman_password(struct samu
*sampass
, uchar
*pass2
)
647 static uchar null_pw
[16];
648 uchar unenc_new_pw
[16];
653 if (sampass
== NULL
) {
654 DEBUG(0,("change_lanman_password: no smb password entry.\n"));
658 acct_ctrl
= pdb_get_acct_ctrl(sampass
);
659 pwd
= pdb_get_lanman_passwd(sampass
);
661 if (acct_ctrl
& ACB_DISABLED
) {
662 DEBUG(0,("change_lanman_password: account %s disabled.\n",
663 pdb_get_username(sampass
)));
668 if (acct_ctrl
& ACB_PWNOTREQ
) {
670 memset(no_pw
, '\0', 14);
671 E_P16(no_pw
, null_pw
);
673 /* Get the new lanman hash. */
674 D_P16(null_pw
, pass2
, unenc_new_pw
);
676 DEBUG(0,("change_lanman_password: no lanman password !\n"));
680 /* Get the new lanman hash. */
681 D_P16(pwd
, pass2
, unenc_new_pw
);
684 if (!pdb_set_lanman_passwd(sampass
, unenc_new_pw
, PDB_CHANGED
)) {
688 if (!pdb_set_nt_passwd (sampass
, NULL
, PDB_CHANGED
)) {
689 return False
; /* We lose the NT hash. Sorry. */
692 if (!pdb_set_pass_changed_now (sampass
)) {
693 TALLOC_FREE(sampass
);
694 /* Not quite sure what this one qualifies as, but this will do */
698 /* Now flush the sam_passwd struct to persistent storage */
699 ret
= NT_STATUS_IS_OK(pdb_update_sam_account (sampass
));
704 /***********************************************************
705 Code to check and change the OEM hashed password.
706 ************************************************************/
708 NTSTATUS
pass_oem_change(char *user
,
709 uchar password_encrypted_with_lm_hash
[516],
710 const uchar old_lm_hash_encrypted
[16],
711 uchar password_encrypted_with_nt_hash
[516],
712 const uchar old_nt_hash_encrypted
[16],
713 uint32
*reject_reason
)
716 struct samu
*sampass
= NULL
;
717 NTSTATUS nt_status
= check_oem_password(user
, password_encrypted_with_lm_hash
,
718 old_lm_hash_encrypted
,
719 password_encrypted_with_nt_hash
,
720 old_nt_hash_encrypted
,
721 &sampass
, new_passwd
, sizeof(new_passwd
));
723 if (!NT_STATUS_IS_OK(nt_status
))
726 /* We've already checked the old password here.... */
728 nt_status
= change_oem_password(sampass
, NULL
, new_passwd
, True
, reject_reason
);
731 memset(new_passwd
, 0, sizeof(new_passwd
));
733 TALLOC_FREE(sampass
);
738 /***********************************************************
739 Decrypt and verify a user password change.
741 The 516 byte long buffers are encrypted with the old NT and
742 old LM passwords, and if the NT passwords are present, both
743 buffers contain a unicode string.
745 After decrypting the buffers, check the password is correct by
746 matching the old hashed passwords with the passwords in the passdb.
748 ************************************************************/
750 static NTSTATUS
check_oem_password(const char *user
,
751 uchar password_encrypted_with_lm_hash
[516],
752 const uchar old_lm_hash_encrypted
[16],
753 uchar password_encrypted_with_nt_hash
[516],
754 const uchar old_nt_hash_encrypted
[16],
755 struct samu
**hnd
, char *new_passwd
,
758 static uchar null_pw
[16];
759 static uchar null_ntpw
[16];
760 struct samu
*sampass
= NULL
;
761 uint8
*password_encrypted
;
762 const uint8
*encryption_key
;
763 const uint8
*lanman_pw
, *nt_pw
;
766 uchar new_nt_hash
[16];
767 uchar new_lm_hash
[16];
772 BOOL nt_pass_set
= (password_encrypted_with_nt_hash
&& old_nt_hash_encrypted
);
773 BOOL lm_pass_set
= (password_encrypted_with_lm_hash
&& old_lm_hash_encrypted
);
777 if ( !(sampass
= samu_new( NULL
)) ) {
778 return NT_STATUS_NO_MEMORY
;
782 ret
= pdb_getsampwnam(sampass
, user
);
786 DEBUG(0, ("check_oem_password: getsmbpwnam returned NULL\n"));
787 TALLOC_FREE(sampass
);
788 return NT_STATUS_NO_SUCH_USER
;
791 acct_ctrl
= pdb_get_acct_ctrl(sampass
);
793 if (acct_ctrl
& ACB_DISABLED
) {
794 DEBUG(2,("check_lanman_password: account %s disabled.\n", user
));
795 TALLOC_FREE(sampass
);
796 return NT_STATUS_ACCOUNT_DISABLED
;
799 if ((acct_ctrl
& ACB_PWNOTREQ
) && lp_null_passwords()) {
800 /* construct a null password (in case one is needed */
803 nt_lm_owf_gen(no_pw
, null_ntpw
, null_pw
);
808 /* save pointers to passwords so we don't have to keep looking them up */
809 if (lp_lanman_auth()) {
810 lanman_pw
= pdb_get_lanman_passwd(sampass
);
814 nt_pw
= pdb_get_nt_passwd(sampass
);
817 if (nt_pw
&& nt_pass_set
) {
818 /* IDEAL Case: passwords are in unicode, and we can
819 * read use the password encrypted with the NT hash
821 password_encrypted
= password_encrypted_with_nt_hash
;
822 encryption_key
= nt_pw
;
823 } else if (lanman_pw
&& lm_pass_set
) {
824 /* password may still be in unicode, but use LM hash version */
825 password_encrypted
= password_encrypted_with_lm_hash
;
826 encryption_key
= lanman_pw
;
827 } else if (nt_pass_set
) {
828 DEBUG(1, ("NT password change supplied for user %s, but we have no NT password to check it with\n",
830 TALLOC_FREE(sampass
);
831 return NT_STATUS_WRONG_PASSWORD
;
832 } else if (lm_pass_set
) {
833 if (lp_lanman_auth()) {
834 DEBUG(1, ("LM password change supplied for user %s, but we have no LanMan password to check it with\n",
837 DEBUG(1, ("LM password change supplied for user %s, but we have disabled LanMan authentication\n",
840 TALLOC_FREE(sampass
);
841 return NT_STATUS_WRONG_PASSWORD
;
843 DEBUG(1, ("password change requested for user %s, but no password supplied!\n",
845 TALLOC_FREE(sampass
);
846 return NT_STATUS_WRONG_PASSWORD
;
850 * Decrypt the password with the key
852 SamOEMhash( password_encrypted
, encryption_key
, 516);
854 if ( !decode_pw_buffer(password_encrypted
, new_passwd
, new_passwd_size
, &new_pw_len
,
855 nt_pass_set
? STR_UNICODE
: STR_ASCII
)) {
856 TALLOC_FREE(sampass
);
857 return NT_STATUS_WRONG_PASSWORD
;
861 * To ensure we got the correct new password, hash it and
862 * use it as a key to test the passed old password.
866 /* NT passwords, verify the NT hash. */
868 /* Calculate the MD4 hash (NT compatible) of the password */
869 memset(new_nt_hash
, '\0', 16);
870 E_md4hash(new_passwd
, new_nt_hash
);
874 * check the NT verifier
876 E_old_pw_hash(new_nt_hash
, nt_pw
, verifier
);
877 if (memcmp(verifier
, old_nt_hash_encrypted
, 16)) {
878 DEBUG(0,("check_oem_password: old lm password doesn't match.\n"));
879 TALLOC_FREE(sampass
);
880 return NT_STATUS_WRONG_PASSWORD
;
883 /* We could check the LM password here, but there is
884 * little point, we already know the password is
885 * correct, and the LM password might not even be
888 /* Further, LM hash generation algorithms
889 * differ with charset, so we could
890 * incorrectly fail a perfectly valid password
892 #ifdef DEBUG_PASSWORD
894 ("check_oem_password: password %s ok\n", new_passwd
));
902 * check the lm verifier
904 E_old_pw_hash(new_nt_hash
, lanman_pw
, verifier
);
905 if (memcmp(verifier
, old_lm_hash_encrypted
, 16)) {
906 DEBUG(0,("check_oem_password: old lm password doesn't match.\n"));
907 TALLOC_FREE(sampass
);
908 return NT_STATUS_WRONG_PASSWORD
;
910 #ifdef DEBUG_PASSWORD
912 ("check_oem_password: password %s ok\n", new_passwd
));
919 if (lanman_pw
&& lm_pass_set
) {
921 E_deshash(new_passwd
, new_lm_hash
);
924 * check the lm verifier
926 E_old_pw_hash(new_lm_hash
, lanman_pw
, verifier
);
927 if (memcmp(verifier
, old_lm_hash_encrypted
, 16)) {
928 DEBUG(0,("check_oem_password: old lm password doesn't match.\n"));
929 TALLOC_FREE(sampass
);
930 return NT_STATUS_WRONG_PASSWORD
;
933 #ifdef DEBUG_PASSWORD
935 ("check_oem_password: password %s ok\n", new_passwd
));
941 /* should not be reached */
942 TALLOC_FREE(sampass
);
943 return NT_STATUS_WRONG_PASSWORD
;
946 /***********************************************************
947 This routine takes the given password and checks it against
948 the password history. Returns True if this password has been
949 found in the history list.
950 ************************************************************/
952 static BOOL
check_passwd_history(struct samu
*sampass
, const char *plaintext
)
954 uchar new_nt_p16
[NT_HASH_LEN
];
955 uchar zero_md5_nt_pw
[SALTED_MD5_HASH_LEN
];
957 const uint8
*pwhistory
;
960 uint32 pwHisLen
, curr_pwHisLen
;
962 pdb_get_account_policy(AP_PASSWORD_HISTORY
, &pwHisLen
);
967 pwhistory
= pdb_get_pw_history(sampass
, &curr_pwHisLen
);
968 if (!pwhistory
|| curr_pwHisLen
== 0) {
972 /* Only examine the minimum of the current history len and
973 the stored history len. Avoids race conditions. */
974 pwHisLen
= MIN(pwHisLen
,curr_pwHisLen
);
976 nt_pw
= pdb_get_nt_passwd(sampass
);
978 E_md4hash(plaintext
, new_nt_p16
);
980 if (!memcmp(nt_pw
, new_nt_p16
, NT_HASH_LEN
)) {
981 DEBUG(10,("check_passwd_history: proposed new password for user %s is the same as the current password !\n",
982 pdb_get_username(sampass
) ));
986 dump_data(100, (const char *)new_nt_p16
, NT_HASH_LEN
);
987 dump_data(100, (const char *)pwhistory
, PW_HISTORY_ENTRY_LEN
*pwHisLen
);
989 memset(zero_md5_nt_pw
, '\0', SALTED_MD5_HASH_LEN
);
990 for (i
=0; i
<pwHisLen
; i
++) {
991 uchar new_nt_pw_salted_md5_hash
[SALTED_MD5_HASH_LEN
];
992 const uchar
*current_salt
= &pwhistory
[i
*PW_HISTORY_ENTRY_LEN
];
993 const uchar
*old_nt_pw_salted_md5_hash
= &pwhistory
[(i
*PW_HISTORY_ENTRY_LEN
)+
994 PW_HISTORY_SALT_LEN
];
995 if (!memcmp(zero_md5_nt_pw
, old_nt_pw_salted_md5_hash
, SALTED_MD5_HASH_LEN
)) {
996 /* Ignore zero valued entries. */
999 /* Create salted versions of new to compare. */
1000 E_md5hash(current_salt
, new_nt_p16
, new_nt_pw_salted_md5_hash
);
1002 if (!memcmp(new_nt_pw_salted_md5_hash
, old_nt_pw_salted_md5_hash
, SALTED_MD5_HASH_LEN
)) {
1003 DEBUG(1,("check_passwd_history: proposed new password for user %s found in history list !\n",
1004 pdb_get_username(sampass
) ));
1012 /***********************************************************
1013 Code to change the oem password. Changes both the lanman
1014 and NT hashes. Old_passwd is almost always NULL.
1015 NOTE this function is designed to be called as root. Check the old password
1016 is correct before calling. JRA.
1017 ************************************************************/
1019 NTSTATUS
change_oem_password(struct samu
*hnd
, char *old_passwd
, char *new_passwd
, BOOL as_root
, uint32
*samr_reject_reason
)
1021 uint32 min_len
, min_age
;
1022 struct passwd
*pass
= NULL
;
1023 const char *username
= pdb_get_username(hnd
);
1024 time_t last_change_time
= pdb_get_pass_last_set_time(hnd
);
1025 time_t can_change_time
= pdb_get_pass_can_change_time(hnd
);
1027 if (samr_reject_reason
) {
1028 *samr_reject_reason
= Undefined
;
1031 if (pdb_get_account_policy(AP_MIN_PASSWORD_AGE
, &min_age
)) {
1033 * Windows calculates the minimum password age check
1034 * dynamically, it basically ignores the pwdcanchange
1035 * timestamp. Do likewise.
1037 if (last_change_time
+ min_age
> time(NULL
)) {
1038 DEBUG(1, ("user %s cannot change password now, must "
1039 "wait until %s\n", username
,
1040 http_timestring(last_change_time
+min_age
)));
1041 if (samr_reject_reason
) {
1042 *samr_reject_reason
= REJECT_REASON_OTHER
;
1044 return NT_STATUS_ACCOUNT_RESTRICTION
;
1047 if ((can_change_time
!= 0) && (time(NULL
) < can_change_time
)) {
1048 DEBUG(1, ("user %s cannot change password now, must "
1049 "wait until %s\n", username
,
1050 http_timestring(can_change_time
)));
1051 if (samr_reject_reason
) {
1052 *samr_reject_reason
= REJECT_REASON_OTHER
;
1054 return NT_STATUS_ACCOUNT_RESTRICTION
;
1058 if (pdb_get_account_policy(AP_MIN_PASSWORD_LEN
, &min_len
) && (str_charnum(new_passwd
) < min_len
)) {
1059 DEBUG(1, ("user %s cannot change password - password too short\n",
1061 DEBUGADD(1, (" account policy min password len = %d\n", min_len
));
1062 if (samr_reject_reason
) {
1063 *samr_reject_reason
= REJECT_REASON_TOO_SHORT
;
1065 return NT_STATUS_PASSWORD_RESTRICTION
;
1066 /* return NT_STATUS_PWD_TOO_SHORT; */
1069 if (check_passwd_history(hnd
,new_passwd
)) {
1070 if (samr_reject_reason
) {
1071 *samr_reject_reason
= REJECT_REASON_IN_HISTORY
;
1073 return NT_STATUS_PASSWORD_RESTRICTION
;
1076 pass
= Get_Pwnam(username
);
1078 DEBUG(1, ("change_oem_password: Username %s does not exist in system !?!\n", username
));
1079 return NT_STATUS_ACCESS_DENIED
;
1082 /* Use external script to check password complexity */
1083 if (lp_check_password_script() && *(lp_check_password_script())) {
1086 check_ret
= smbrunsecret(lp_check_password_script(), new_passwd
);
1087 DEBUG(5, ("change_oem_password: check password script (%s) returned [%d]\n", lp_check_password_script(), check_ret
));
1089 if (check_ret
!= 0) {
1090 DEBUG(1, ("change_oem_password: check password script said new password is not good enough!\n"));
1091 if (samr_reject_reason
) {
1092 *samr_reject_reason
= REJECT_REASON_NOT_COMPLEX
;
1094 return NT_STATUS_PASSWORD_RESTRICTION
;
1099 * If unix password sync was requested, attempt to change
1100 * the /etc/passwd database first. Return failure if this cannot
1103 * This occurs before the oem change, because we don't want to
1104 * update it if chgpasswd failed.
1106 * Conditional on lp_unix_password_sync() because we don't want
1107 * to touch the unix db unless we have admin permission.
1110 if(lp_unix_password_sync() &&
1111 !chgpasswd(username
, pass
, old_passwd
, new_passwd
, as_root
)) {
1112 return NT_STATUS_ACCESS_DENIED
;
1115 if (!pdb_set_plaintext_passwd (hnd
, new_passwd
)) {
1116 return NT_STATUS_ACCESS_DENIED
;
1119 /* Now write it into the file. */
1120 return pdb_update_sam_account (hnd
);