2 Unix SMB/CIFS implementation.
3 Authenticate to a remote server
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #define DBGC_CLASS DBGC_AUTH
27 extern userdom_struct current_user_info
;
29 /****************************************************************************
30 Support for server level security.
31 ****************************************************************************/
33 static struct cli_state
*server_cryptkey(TALLOC_CTX
*mem_ctx
)
35 struct cli_state
*cli
= NULL
;
37 struct in_addr dest_ip
;
40 BOOL connected_ok
= False
;
42 if (!(cli
= cli_initialise()))
45 /* security = server just can't function with spnego */
46 cli
->use_spnego
= False
;
48 pserver
= talloc_strdup(mem_ctx
, lp_passwordserver());
51 while(next_token( &p
, desthost
, LIST_SEP
, sizeof(desthost
))) {
54 standard_sub_basic(current_user_info
.smb_name
, current_user_info
.domain
,
55 desthost
, sizeof(desthost
));
58 if(!resolve_name( desthost
, &dest_ip
, 0x20)) {
59 DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost
));
63 if (ismyip(dest_ip
)) {
64 DEBUG(1,("Password server loop - disabling password server %s\n",desthost
));
68 /* we use a mutex to prevent two connections at once - when a
69 Win2k PDC get two connections where one hasn't completed a
70 session setup yet it will send a TCP reset to the first
71 connection (tridge) */
73 if (!grab_server_mutex(desthost
)) {
77 status
= cli_connect(cli
, desthost
, &dest_ip
);
78 if (NT_STATUS_IS_OK(status
)) {
79 DEBUG(3,("connected to password server %s\n",desthost
));
83 DEBUG(10,("server_cryptkey: failed to connect to server %s. Error %s\n",
84 desthost
, nt_errstr(status
) ));
88 release_server_mutex();
89 DEBUG(0,("password server not available\n"));
94 if (!attempt_netbios_session_request(&cli
, global_myname(),
95 desthost
, &dest_ip
)) {
96 release_server_mutex();
97 DEBUG(1,("password server fails session request\n"));
102 if (strequal(desthost
,myhostname())) {
103 exit_server_cleanly("Password server loop!");
106 DEBUG(3,("got session\n"));
108 if (!cli_negprot(cli
)) {
109 DEBUG(1,("%s rejected the negprot\n",desthost
));
110 release_server_mutex();
115 if (cli
->protocol
< PROTOCOL_LANMAN2
||
116 !(cli
->sec_mode
& NEGOTIATE_SECURITY_USER_LEVEL
)) {
117 DEBUG(1,("%s isn't in user level security mode\n",desthost
));
118 release_server_mutex();
123 /* Get the first session setup done quickly, to avoid silly
124 Win2k bugs. (The next connection to the server will kill
128 if (!NT_STATUS_IS_OK(cli_session_setup(cli
, "", "", 0, "", 0,
130 DEBUG(0,("%s rejected the initial session setup (%s)\n",
131 desthost
, cli_errstr(cli
)));
132 release_server_mutex();
137 release_server_mutex();
139 DEBUG(3,("password server OK\n"));
144 /****************************************************************************
145 Clean up our allocated cli.
146 ****************************************************************************/
148 static void free_server_private_data(void **private_data_pointer
)
150 struct cli_state
**cli
= (struct cli_state
**)private_data_pointer
;
151 if (*cli
&& (*cli
)->initialised
) {
152 DEBUG(10, ("Shutting down smbserver connection\n"));
155 *private_data_pointer
= NULL
;
158 /****************************************************************************
159 Send a 'keepalive' packet down the cli pipe.
160 ****************************************************************************/
162 static void send_server_keepalive(void **private_data_pointer
)
164 /* also send a keepalive to the password server if its still
166 if (private_data_pointer
) {
167 struct cli_state
*cli
= (struct cli_state
*)(*private_data_pointer
);
168 if (cli
&& cli
->initialised
) {
169 if (!send_keepalive(cli
->fd
)) {
170 DEBUG( 2, ( "send_server_keepalive: password server keepalive failed.\n"));
172 *private_data_pointer
= NULL
;
178 /****************************************************************************
179 Get the challenge out of a password server.
180 ****************************************************************************/
182 static DATA_BLOB
auth_get_challenge_server(const struct auth_context
*auth_context
,
183 void **my_private_data
,
186 struct cli_state
*cli
= server_cryptkey(mem_ctx
);
189 DEBUG(3,("using password server validation\n"));
191 if ((cli
->sec_mode
& NEGOTIATE_SECURITY_CHALLENGE_RESPONSE
) == 0) {
192 /* We can't work with unencrypted password servers
193 unless 'encrypt passwords = no' */
194 DEBUG(5,("make_auth_info_server: Server is unencrypted, no challenge available..\n"));
196 /* However, it is still a perfectly fine connection
197 to pass that unencrypted password over */
198 *my_private_data
= (void *)cli
;
199 return data_blob(NULL
, 0);
201 } else if (cli
->secblob
.length
< 8) {
202 /* We can't do much if we don't get a full challenge */
203 DEBUG(2,("make_auth_info_server: Didn't receive a full challenge from server\n"));
205 return data_blob(NULL
, 0);
208 *my_private_data
= (void *)cli
;
210 /* The return must be allocated on the caller's mem_ctx, as our own will be
211 destoyed just after the call. */
212 return data_blob_talloc(auth_context
->mem_ctx
, cli
->secblob
.data
,8);
214 return data_blob(NULL
, 0);
219 /****************************************************************************
220 Check for a valid username and password in security=server mode.
221 - Validate a password with the password server.
222 ****************************************************************************/
224 static NTSTATUS
check_smbserver_security(const struct auth_context
*auth_context
,
225 void *my_private_data
,
227 const auth_usersupplied_info
*user_info
,
228 auth_serversupplied_info
**server_info
)
230 struct cli_state
*cli
;
231 static unsigned char badpass
[24];
232 static fstring baduser
;
233 static BOOL tested_password_server
= False
;
234 static BOOL bad_password_server
= False
;
235 NTSTATUS nt_status
= NT_STATUS_NOT_IMPLEMENTED
;
236 BOOL locally_made_cli
= False
;
238 cli
= (struct cli_state
*)my_private_data
;
242 cli
= server_cryptkey(mem_ctx
);
243 locally_made_cli
= True
;
246 if (!cli
|| !cli
->initialised
) {
247 DEBUG(1,("password server is not connected (cli not initilised)\n"));
248 return NT_STATUS_LOGON_FAILURE
;
251 if ((cli
->sec_mode
& NEGOTIATE_SECURITY_CHALLENGE_RESPONSE
) == 0) {
252 if (user_info
->encrypted
) {
253 DEBUG(1,("password server %s is plaintext, but we are encrypted. This just can't work :-(\n", cli
->desthost
));
254 return NT_STATUS_LOGON_FAILURE
;
257 if (memcmp(cli
->secblob
.data
, auth_context
->challenge
.data
, 8) != 0) {
258 DEBUG(1,("the challenge that the password server (%s) supplied us is not the one we gave our client. This just can't work :-(\n", cli
->desthost
));
259 return NT_STATUS_LOGON_FAILURE
;
264 memset(badpass
, 0x1f, sizeof(badpass
));
266 if((user_info
->nt_resp
.length
== sizeof(badpass
)) &&
267 !memcmp(badpass
, user_info
->nt_resp
.data
, sizeof(badpass
))) {
269 * Very unlikely, our random bad password is the same as the users
272 memset(badpass
, badpass
[0]+1, sizeof(badpass
));
275 if(baduser
[0] == 0) {
276 fstrcpy(baduser
, INVALID_USER_PREFIX
);
277 fstrcat(baduser
, global_myname());
281 * Attempt a session setup with a totally incorrect password.
282 * If this succeeds with the guest bit *NOT* set then the password
283 * server is broken and is not correctly setting the guest bit. We
284 * need to detect this as some versions of NT4.x are broken. JRA.
287 /* I sure as hell hope that there aren't servers out there that take
288 * NTLMv2 and have this bug, as we don't test for that...
289 * - abartlet@samba.org
292 if ((!tested_password_server
) && (lp_paranoid_server_security())) {
293 if (NT_STATUS_IS_OK(cli_session_setup(cli
, baduser
,
298 user_info
->domain
))) {
301 * We connected to the password server so we
302 * can say we've tested it.
304 tested_password_server
= True
;
306 if ((SVAL(cli
->inbuf
,smb_vwv2
) & 1) == 0) {
307 DEBUG(0,("server_validate: password server %s allows users as non-guest \
308 with a bad password.\n", cli
->desthost
));
309 DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
310 use this machine as the password server.\n"));
314 * Password server has the bug.
316 bad_password_server
= True
;
317 return NT_STATUS_LOGON_FAILURE
;
324 * We have already tested the password server.
325 * Fail immediately if it has the bug.
328 if(bad_password_server
) {
329 DEBUG(0,("server_validate: [1] password server %s allows users as non-guest \
330 with a bad password.\n", cli
->desthost
));
331 DEBUG(0,("server_validate: [1] This is broken (and insecure) behaviour. Please do not \
332 use this machine as the password server.\n"));
333 return NT_STATUS_LOGON_FAILURE
;
338 * Now we know the password server will correctly set the guest bit, or is
339 * not guest enabled, we can try with the real password.
342 if (!user_info
->encrypted
) {
343 /* Plaintext available */
344 nt_status
= cli_session_setup(
345 cli
, user_info
->smb_name
,
346 (char *)user_info
->plaintext_password
.data
,
347 user_info
->plaintext_password
.length
,
348 NULL
, 0, user_info
->domain
);
351 nt_status
= cli_session_setup(
352 cli
, user_info
->smb_name
,
353 (char *)user_info
->lm_resp
.data
,
354 user_info
->lm_resp
.length
,
355 (char *)user_info
->nt_resp
.data
,
356 user_info
->nt_resp
.length
,
360 if (!NT_STATUS_IS_OK(nt_status
)) {
361 DEBUG(1,("password server %s rejected the password: %s\n",
362 cli
->desthost
, nt_errstr(nt_status
)));
365 /* if logged in as guest then reject */
366 if ((SVAL(cli
->inbuf
,smb_vwv2
) & 1) != 0) {
367 DEBUG(1,("password server %s gave us guest only\n", cli
->desthost
));
368 nt_status
= NT_STATUS_LOGON_FAILURE
;
373 if (NT_STATUS_IS_OK(nt_status
)) {
374 fstring real_username
;
377 if ( (pass
= smb_getpwnam( NULL
, user_info
->internal_username
,
378 real_username
, True
)) != NULL
)
380 /* if a real user check pam account restrictions */
381 /* only really perfomed if "obey pam restriction" is true */
382 nt_status
= smb_pam_accountcheck(pass
->pw_name
);
383 if ( !NT_STATUS_IS_OK(nt_status
)) {
384 DEBUG(1, ("PAM account restriction prevents user login\n"));
387 nt_status
= make_server_info_pw(server_info
, pass
->pw_name
, pass
);
393 nt_status
= NT_STATUS_NO_SUCH_USER
;
397 if (locally_made_cli
) {
404 static NTSTATUS
auth_init_smbserver(struct auth_context
*auth_context
, const char* param
, auth_methods
**auth_method
)
406 if (!make_auth_methods(auth_context
, auth_method
)) {
407 return NT_STATUS_NO_MEMORY
;
409 (*auth_method
)->name
= "smbserver";
410 (*auth_method
)->auth
= check_smbserver_security
;
411 (*auth_method
)->get_chal
= auth_get_challenge_server
;
412 (*auth_method
)->send_keepalive
= send_server_keepalive
;
413 (*auth_method
)->free_private_data
= free_server_private_data
;
417 NTSTATUS
auth_server_init(void)
419 return smb_register_auth(AUTH_INTERFACE_VERSION
, "smbserver", auth_init_smbserver
);