2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Tridgell 1992-2000
5 Copyright (C) Luke Kenneth Casson Leighton 1996-2000
6 Copyright (C) Andrew Bartlett 2001
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #define DBGC_CLASS DBGC_AUTH
28 /****************************************************************************
29 core of smb password checking routine.
30 ****************************************************************************/
31 static BOOL
smb_pwd_check_ntlmv1(DATA_BLOB nt_response
,
32 const uchar
*part_passwd
,
34 uint8 user_sess_key
[16])
36 /* Finish the encryption of part_passwd. */
39 if (part_passwd
== NULL
) {
40 DEBUG(10,("No password set - DISALLOWING access\n"));
41 /* No password set - always false ! */
45 if (sec_blob
.length
!= 8) {
46 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%d)\n", sec_blob
.length
));
50 if (nt_response
.length
!= 24) {
51 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%d)\n", nt_response
.length
));
55 SMBOWFencrypt(part_passwd
, sec_blob
.data
, p24
);
56 if (user_sess_key
!= NULL
)
58 SMBsesskeygen_ntv1(part_passwd
, NULL
, user_sess_key
);
64 DEBUG(100,("Part password (P16) was |"));
65 dump_data(100, part_passwd
, 16);
66 DEBUG(100,("Password from client was |"));
67 dump_data(100, nt_response
.data
, nt_response
.length
);
68 DEBUG(100,("Given challenge was |"));
69 dump_data(100, sec_blob
.data
, sec_blob
.length
);
70 DEBUG(100,("Value from encryption was |"));
71 dump_data(100, p24
, 24);
73 return (memcmp(p24
, nt_response
.data
, 24) == 0);
76 /****************************************************************************
77 core of smb password checking routine.
78 ****************************************************************************/
79 static BOOL
smb_pwd_check_ntlmv2(const DATA_BLOB ntv2_response
,
80 const uchar
*part_passwd
,
81 const DATA_BLOB sec_blob
,
82 const char *user
, const char *domain
,
83 uint8 user_sess_key
[16])
85 /* Finish the encryption of part_passwd. */
87 uchar value_from_encryption
[16];
88 uchar client_response
[16];
89 DATA_BLOB client_key_data
;
91 if (part_passwd
== NULL
)
93 DEBUG(10,("No password set - DISALLOWING access\n"));
94 /* No password set - always False */
98 if (ntv2_response
.length
< 16) {
99 /* We MUST have more than 16 bytes, or the stuff below will go
101 DEBUG(0, ("smb_pwd_check_ntlmv2: incorrect password length (%d)\n",
102 ntv2_response
.length
));
106 client_key_data
= data_blob(ntv2_response
.data
+16, ntv2_response
.length
-16);
107 memcpy(client_response
, ntv2_response
.data
, sizeof(client_response
));
109 ntv2_owf_gen(part_passwd
, user
, domain
, kr
);
110 SMBOWFencrypt_ntv2(kr
, sec_blob
, client_key_data
, value_from_encryption
);
111 if (user_sess_key
!= NULL
)
113 SMBsesskeygen_ntv2(kr
, value_from_encryption
, user_sess_key
);
117 DEBUG(100,("Part password (P16) was |"));
118 dump_data(100, part_passwd
, 16);
119 DEBUG(100,("Password from client was |"));
120 dump_data(100, ntv2_response
.data
, ntv2_response
.length
);
121 DEBUG(100,("Variable data from client was |"));
122 dump_data(100, client_key_data
.data
, client_key_data
.length
);
123 DEBUG(100,("Given challenge was |"));
124 dump_data(100, sec_blob
.data
, sec_blob
.length
);
125 DEBUG(100,("Value from encryption was |"));
126 dump_data(100, value_from_encryption
, 16);
128 data_blob_clear_free(&client_key_data
);
129 return (memcmp(value_from_encryption
, client_response
, 16) == 0);
133 /****************************************************************************
134 Do a specific test for an smb password being correct, given a smb_password and
135 the lanman and NT responses.
136 ****************************************************************************/
137 static NTSTATUS
sam_password_ok(const struct auth_context
*auth_context
,
139 SAM_ACCOUNT
*sampass
,
140 const auth_usersupplied_info
*user_info
,
141 uint8 user_sess_key
[16])
144 const uint8
*nt_pw
, *lm_pw
;
147 acct_ctrl
= pdb_get_acct_ctrl(sampass
);
148 if (acct_ctrl
& ACB_PWNOTREQ
)
150 if (lp_null_passwords())
152 DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", pdb_get_username(sampass
)));
153 return(NT_STATUS_OK
);
157 DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", pdb_get_username(sampass
)));
158 return(NT_STATUS_LOGON_FAILURE
);
162 nt_pw
= pdb_get_nt_passwd(sampass
);
163 lm_pw
= pdb_get_lanman_passwd(sampass
);
165 auth_flags
= user_info
->auth_flags
;
168 DEBUG(3,("sam_password_ok: NO NT password stored for user %s.\n",
169 pdb_get_username(sampass
)));
170 /* No return, we want to check the LM hash below in this case */
171 auth_flags
&= (~(AUTH_FLAG_NTLMv2_RESP
| AUTH_FLAG_NTLM_RESP
));
174 if (auth_flags
& AUTH_FLAG_NTLMv2_RESP
) {
175 /* We have the NT MD4 hash challenge available - see if we can
176 use it (ie. does it exist in the smbpasswd file).
178 DEBUG(4,("sam_password_ok: Checking NTLMv2 password\n"));
179 if (smb_pwd_check_ntlmv2( user_info
->nt_resp
,
180 nt_pw
, auth_context
->challenge
,
181 user_info
->smb_name
.str
,
182 user_info
->client_domain
.str
,
187 DEBUG(3,("sam_password_ok: NTLMv2 password check failed\n"));
188 return NT_STATUS_WRONG_PASSWORD
;
190 } else if (auth_flags
& AUTH_FLAG_NTLM_RESP
) {
191 if (lp_ntlm_auth()) {
192 /* We have the NT MD4 hash challenge available - see if we can
193 use it (ie. does it exist in the smbpasswd file).
195 DEBUG(4,("sam_password_ok: Checking NT MD4 password\n"));
196 if (smb_pwd_check_ntlmv1(user_info
->nt_resp
,
197 nt_pw
, auth_context
->challenge
,
202 DEBUG(3,("sam_password_ok: NT MD4 password check failed for user %s\n",pdb_get_username(sampass
)));
203 return NT_STATUS_WRONG_PASSWORD
;
206 DEBUG(2,("sam_password_ok: NTLMv1 passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass
)));
207 /* No return, we want to check the LM hash below in this case */
212 DEBUG(3,("sam_password_ok: NO LanMan password set for user %s (and no NT password supplied)\n",pdb_get_username(sampass
)));
213 auth_flags
&= (~AUTH_FLAG_LM_RESP
);
216 if (auth_flags
& AUTH_FLAG_LM_RESP
) {
218 if (user_info
->lm_resp
.length
!= 24) {
219 DEBUG(2,("sam_password_ok: invalid LanMan password length (%d) for user %s\n",
220 user_info
->nt_resp
.length
, pdb_get_username(sampass
)));
223 if (!lp_lanman_auth()) {
224 DEBUG(3,("sam_password_ok: Lanman passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass
)));
225 return NT_STATUS_LOGON_FAILURE
;
228 DEBUG(4,("sam_password_ok: Checking LM password\n"));
229 if (smb_pwd_check_ntlmv1(user_info
->lm_resp
,
230 lm_pw
, auth_context
->challenge
,
235 if (lp_ntlm_auth()) {
236 /* Apparently NT accepts NT responses in the LM feild
237 - I think this is related to Win9X pass-though authenticaion
239 DEBUG(4,("sam_password_ok: Checking NT MD4 password in LM feild\n"));
240 if (smb_pwd_check_ntlmv1(user_info
->lm_resp
,
241 nt_pw
, auth_context
->challenge
,
246 DEBUG(3,("sam_password_ok: NT MD4 password in LM feild failed for user %s\n",pdb_get_username(sampass
)));
247 return NT_STATUS_WRONG_PASSWORD
;
250 DEBUG(4,("sam_password_ok: LM password check failed for user %s\n",pdb_get_username(sampass
)));
251 return NT_STATUS_WRONG_PASSWORD
;
255 /* Should not be reached, but if they send nothing... */
256 DEBUG(3,("sam_password_ok: NEITHER LanMan nor NT password supplied for user %s\n",pdb_get_username(sampass
)));
257 return NT_STATUS_WRONG_PASSWORD
;
260 /****************************************************************************
261 Do a specific test for a SAM_ACCOUNT being vaild for this connection
262 (ie not disabled, expired and the like).
263 ****************************************************************************/
264 static NTSTATUS
sam_account_ok(TALLOC_CTX
*mem_ctx
,
265 SAM_ACCOUNT
*sampass
,
266 const auth_usersupplied_info
*user_info
)
268 uint16 acct_ctrl
= pdb_get_acct_ctrl(sampass
);
269 char *workstation_list
;
272 DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n",pdb_get_username(sampass
)));
274 /* Quit if the account was disabled. */
275 if (acct_ctrl
& ACB_DISABLED
) {
276 DEBUG(1,("Account for user '%s' was disabled.\n", pdb_get_username(sampass
)));
277 return NT_STATUS_ACCOUNT_DISABLED
;
280 /* Test account expire time */
282 kickoff_time
= pdb_get_kickoff_time(sampass
);
283 if (kickoff_time
!= 0 && time(NULL
) > kickoff_time
) {
284 DEBUG(1,("Account for user '%s' has expried.\n", pdb_get_username(sampass
)));
285 DEBUG(3,("Account expired at '%ld' unix time.\n", (long)kickoff_time
));
286 return NT_STATUS_ACCOUNT_EXPIRED
;
289 if (!(pdb_get_acct_ctrl(sampass
) & ACB_PWNOEXP
)) {
290 time_t must_change_time
= pdb_get_pass_must_change_time(sampass
);
291 time_t last_set_time
= pdb_get_pass_last_set_time(sampass
);
293 /* check for immediate expiry "must change at next logon" */
294 if (must_change_time
== 0 && last_set_time
!= 0) {
295 DEBUG(1,("Account for user '%s' password must change!.\n", pdb_get_username(sampass
)));
296 return NT_STATUS_PASSWORD_MUST_CHANGE
;
299 /* check for expired password */
300 if (must_change_time
< time(NULL
) && must_change_time
!= 0) {
301 DEBUG(1,("Account for user '%s' password expired!.\n", pdb_get_username(sampass
)));
302 DEBUG(1,("Password expired at '%s' (%ld) unix time.\n", http_timestring(must_change_time
), (long)must_change_time
));
303 return NT_STATUS_PASSWORD_EXPIRED
;
307 /* Test workstation. Workstation list is comma separated. */
309 workstation_list
= talloc_strdup(mem_ctx
, pdb_get_workstations(sampass
));
311 if (!workstation_list
) return NT_STATUS_NO_MEMORY
;
313 if (*workstation_list
) {
314 BOOL invalid_ws
= True
;
315 char *s
= workstation_list
;
319 while (next_token(&s
, tok
, ",", sizeof(tok
))) {
320 DEBUG(10,("checking for workstation match %s and %s (len=%d)\n",
321 tok
, user_info
->wksta_name
.str
, user_info
->wksta_name
.len
));
322 if(strequal(tok
, user_info
->wksta_name
.str
)) {
329 return NT_STATUS_INVALID_WORKSTATION
;
332 if (acct_ctrl
& ACB_DOMTRUST
) {
333 DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", pdb_get_username(sampass
)));
334 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
;
337 if (acct_ctrl
& ACB_SVRTRUST
) {
338 DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", pdb_get_username(sampass
)));
339 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT
;
342 if (acct_ctrl
& ACB_WSTRUST
) {
343 DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", pdb_get_username(sampass
)));
344 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
;
351 /****************************************************************************
352 check if a username/password is OK assuming the password is a 24 byte
353 SMB hash supplied in the user_info structure
354 return an NT_STATUS constant.
355 ****************************************************************************/
357 static NTSTATUS
check_sam_security(const struct auth_context
*auth_context
,
358 void *my_private_data
,
360 const auth_usersupplied_info
*user_info
,
361 auth_serversupplied_info
**server_info
)
363 SAM_ACCOUNT
*sampass
=NULL
;
366 uint8 user_sess_key
[16];
367 const uint8
* lm_hash
;
369 if (!user_info
|| !auth_context
) {
370 return NT_STATUS_UNSUCCESSFUL
;
373 /* Can't use the talloc version here, becouse the returned struct gets
374 kept on the server_info */
375 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(&sampass
))) {
379 /* get the account information */
382 ret
= pdb_getsampwnam(sampass
, user_info
->internal_username
.str
);
387 DEBUG(3,("Couldn't find user '%s' in passdb file.\n", user_info
->internal_username
.str
));
388 pdb_free_sam(&sampass
);
389 return NT_STATUS_NO_SUCH_USER
;
392 nt_status
= sam_password_ok(auth_context
, mem_ctx
, sampass
, user_info
, user_sess_key
);
394 if (!NT_STATUS_IS_OK(nt_status
)) {
395 pdb_free_sam(&sampass
);
399 nt_status
= sam_account_ok(mem_ctx
, sampass
, user_info
);
401 if (!NT_STATUS_IS_OK(nt_status
)) {
402 pdb_free_sam(&sampass
);
406 if (!make_server_info_sam(server_info
, sampass
)) {
407 DEBUG(0,("failed to malloc memory for server_info\n"));
408 return NT_STATUS_NO_MEMORY
;
411 lm_hash
= pdb_get_lanman_passwd((*server_info
)->sam_account
);
413 memcpy((*server_info
)->first_8_lm_hash
, lm_hash
, 8);
416 memcpy((*server_info
)->session_key
, user_sess_key
, sizeof(user_sess_key
));
421 /* module initialisation */
422 NTSTATUS
auth_init_sam(struct auth_context
*auth_context
, const char *param
, auth_methods
**auth_method
)
424 if (!make_auth_methods(auth_context
, auth_method
)) {
425 return NT_STATUS_NO_MEMORY
;
428 (*auth_method
)->auth
= check_sam_security
;
429 (*auth_method
)->name
= "sam";
434 /****************************************************************************
435 Check SAM security (above) but with a few extra checks.
436 ****************************************************************************/
438 static NTSTATUS
check_samstrict_security(const struct auth_context
*auth_context
,
439 void *my_private_data
,
441 const auth_usersupplied_info
*user_info
,
442 auth_serversupplied_info
**server_info
)
445 if (!user_info
|| !auth_context
) {
446 return NT_STATUS_LOGON_FAILURE
;
449 /* If we are a domain member, we must not
450 attempt to check the password locally,
451 unless it is one of our aliases. */
453 if (!is_netbios_alias_or_name(user_info
->domain
.str
)) {
454 return NT_STATUS_NO_SUCH_USER
;
457 return check_sam_security(auth_context
, my_private_data
, mem_ctx
, user_info
, server_info
);
460 /* module initialisation */
461 NTSTATUS
auth_init_samstrict(struct auth_context
*auth_context
, const char *param
, auth_methods
**auth_method
)
463 if (!make_auth_methods(auth_context
, auth_method
)) {
464 return NT_STATUS_NO_MEMORY
;
467 (*auth_method
)->auth
= check_samstrict_security
;
468 (*auth_method
)->name
= "samstrict";