source/libnet/libnet_samsync_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    dump the remote SAM using rpc samsync operations
   4
   5    Copyright (C) Guenther Deschner 2008.
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "libnet/libnet.h"
  23
  24 #if defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC)
  25
  26 /****************************************************************
  27 ****************************************************************/
  28
  29 static NTSTATUS keytab_ad_connect(TALLOC_CTX *mem_ctx,
  30                                   const char *domain_name,
  31                                   const char *username,
  32                                   const char *password,
  33                                   struct libnet_keytab_context *ctx)
  34 {
  35         NTSTATUS status;
  36         ADS_STATUS ad_status;
  37         ADS_STRUCT *ads;
  38         struct netr_DsRGetDCNameInfo *info = NULL;
  39         const char *dc;
  40
  41         status = dsgetdcname(mem_ctx, NULL, domain_name, NULL, NULL, 0, &info);
  42         if (!NT_STATUS_IS_OK(status)) {
  43                 return status;
  44         }
  45
  46         dc = strip_hostname(info->dc_unc);
  47
  48         ads = ads_init(NULL, domain_name, dc);
  49         NT_STATUS_HAVE_NO_MEMORY(ads);
  50
  51         if (getenv(KRB5_ENV_CCNAME) == NULL) {
  52                 setenv(KRB5_ENV_CCNAME, "MEMORY:libnet_samsync_keytab", 1);
  53         }
  54
  55         ads->auth.user_name = SMB_STRDUP(username);
  56         ads->auth.password = SMB_STRDUP(password);
  57
  58         ad_status = ads_connect_user_creds(ads);
  59         if (!ADS_ERR_OK(ad_status)) {
  60                 return NT_STATUS_UNSUCCESSFUL;
  61         }
  62
  63         ctx->ads = ads;
  64
  65         ctx->dns_domain_name = talloc_strdup_upper(mem_ctx, ads->config.realm);
  66         NT_STATUS_HAVE_NO_MEMORY(ctx->dns_domain_name);
  67
  68         return NT_STATUS_OK;
  69 }
  70
  71 /****************************************************************
  72 ****************************************************************/
  73
  74 static NTSTATUS fetch_sam_entry_keytab(TALLOC_CTX *mem_ctx,
  75                                        enum netr_SamDatabaseID database_id,
  76                                        uint32_t rid,
  77                                        struct netr_DELTA_USER *r,
  78                                        bool last_query,
  79                                        struct libnet_keytab_context *ctx)
  80 {
  81         uchar nt_passwd[16];
  82         struct libnet_keytab_entry entry;
  83
  84         if (memcmp(r->ntpassword.hash, ctx->zero_buf, 16) == 0) {
  85                 return NT_STATUS_OK;
  86         }
  87
  88         sam_pwd_hash(rid, r->ntpassword.hash, nt_passwd, 0);
  89
  90         entry.name = talloc_strdup(mem_ctx, r->account_name.string);
  91         entry.principal = talloc_asprintf(mem_ctx, "%s@%s",
  92                                           r->account_name.string,
  93                                           ctx->dns_domain_name);
  94         entry.password = data_blob_talloc(mem_ctx, nt_passwd, 16);
  95         entry.kvno = ads_get_kvno(ctx->ads, entry.name);
  96
  97         NT_STATUS_HAVE_NO_MEMORY(entry.name);
  98         NT_STATUS_HAVE_NO_MEMORY(entry.principal);
  99         NT_STATUS_HAVE_NO_MEMORY(entry.password.data);
 100
 101
 102         ADD_TO_ARRAY(mem_ctx, struct libnet_keytab_entry, entry,
 103                      &ctx->entries, &ctx->count);
 104
 105         return NT_STATUS_OK;
 106 }
 107
 108 /****************************************************************
 109 ****************************************************************/
 110
 111 NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
 112                                   enum netr_SamDatabaseID database_id,
 113                                   struct netr_DELTA_ENUM_ARRAY *r,
 114                                   bool last_query,
 115                                   struct samsync_context *ctx)
 116 {
 117         NTSTATUS status = NT_STATUS_OK;
 118         krb5_error_code ret = 0;
 119         static struct libnet_keytab_context *keytab_ctx = NULL;
 120         int i;
 121
 122         if (!keytab_ctx) {
 123                 ret = libnet_keytab_init(mem_ctx, ctx->output_filename,
 124                                          &keytab_ctx);
 125                 if (ret) {
 126                         status = krb5_to_nt_status(ret);
 127                         goto out;
 128                 }
 129         }
 130
 131         status = keytab_ad_connect(mem_ctx,
 132                                    ctx->domain_name,
 133                                    ctx->username,
 134                                    ctx->password,
 135                                    keytab_ctx);
 136         if (!NT_STATUS_IS_OK(status)) {
 137                 goto out;
 138         }
 139
 140         for (i = 0; i < r->num_deltas; i++) {
 141
 142                 if (r->delta_enum[i].delta_type != NETR_DELTA_USER) {
 143                         continue;
 144                 }
 145
 146                 status = fetch_sam_entry_keytab(mem_ctx, database_id,
 147                                                 r->delta_enum[i].delta_id_union.rid,
 148                                                 r->delta_enum[i].delta_union.user,
 149                                                 last_query,
 150                                                 keytab_ctx);
 151                 if (!NT_STATUS_IS_OK(status)) {
 152                         goto out;
 153                 }
 154         }
 155
 156         if (last_query) {
 157
 158                 ret = libnet_keytab_add(keytab_ctx);
 159                 if (ret) {
 160                         status = krb5_to_nt_status(ret);
 161                         ctx->error_message = talloc_asprintf(mem_ctx,
 162                                 "Failed to add entries to keytab %s: %s",
 163                                 keytab_ctx->keytab_name, error_message(ret));
 164                         goto out;
 165                 }
 166
 167                 ctx->result_message = talloc_asprintf(mem_ctx,
 168                         "Vampired %d accounts to keytab %s",
 169                         keytab_ctx->count,
 170                         keytab_ctx->keytab_name);
 171
 172                 TALLOC_FREE(keytab_ctx);
 173         }
 174
 175         return NT_STATUS_OK;
 176  out:
 177         TALLOC_FREE(keytab_ctx);
 178
 179         return status;
 180 }
 181
 182 #else
 183
 184 NTSTATUS fetch_sam_entries_keytab(TALLOC_CTX *mem_ctx,
 185                                   enum netr_SamDatabaseID database_id,
 186                                   struct netr_DELTA_ENUM_ARRAY *r,
 187                                   bool last_query,
 188                                   struct samsync_context *ctx)
 189 {
 190         return NT_STATUS_NOT_SUPPORTED;
 191 }
 192
 193 #endif /* defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC) */