2 Unix SMB/CIFS implementation.
4 kpasswd Server implementation
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 Copyright (C) Andrew Tridgell 2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "smbd/service_task.h"
25 #include "lib/events/events.h"
26 #include "lib/socket/socket.h"
27 #include "lib/tsocket/tsocket.h"
28 #include "system/network.h"
29 #include "../lib/util/dlinklist.h"
30 #include "lib/ldb/include/ldb.h"
31 #include "auth/gensec/gensec.h"
32 #include "auth/credentials/credentials.h"
33 #include "auth/credentials/credentials_krb5.h"
34 #include "auth/auth.h"
35 #include "dsdb/samdb/samdb.h"
36 #include "../lib/util/util_ldb.h"
37 #include "rpc_server/dcerpc_server.h"
38 #include "rpc_server/samr/proto.h"
39 #include "libcli/security/security.h"
40 #include "param/param.h"
43 /* TODO: remove all SAMBA4_INTERNAL_HEIMDAL stuff from this file */
44 #ifdef SAMBA4_INTERNAL_HEIMDAL
45 #include "heimdal_build/kpasswdd-glue.h"
48 /* Return true if there is a valid error packet formed in the error_blob */
49 static bool kpasswdd_make_error_reply(struct kdc_server
*kdc
,
52 const char *error_string
,
53 DATA_BLOB
*error_blob
)
55 char *error_string_utf8
;
58 DEBUG(result_code
? 3 : 10, ("kpasswdd: %s\n", error_string
));
60 if (!push_utf8_talloc(mem_ctx
, &error_string_utf8
, error_string
, &len
)) {
64 *error_blob
= data_blob_talloc(mem_ctx
, NULL
, 2 + len
+ 1);
65 if (!error_blob
->data
) {
68 RSSVAL(error_blob
->data
, 0, result_code
);
69 memcpy(error_blob
->data
+ 2, error_string_utf8
, len
+ 1);
73 /* Return true if there is a valid error packet formed in the error_blob */
74 static bool kpasswdd_make_unauth_error_reply(struct kdc_server
*kdc
,
77 const char *error_string
,
78 DATA_BLOB
*error_blob
)
82 DATA_BLOB error_bytes
;
83 krb5_data k5_error_bytes
, k5_error_blob
;
84 ret
= kpasswdd_make_error_reply(kdc
, mem_ctx
, result_code
, error_string
,
89 k5_error_bytes
.data
= error_bytes
.data
;
90 k5_error_bytes
.length
= error_bytes
.length
;
91 kret
= krb5_mk_error(kdc
->smb_krb5_context
->krb5_context
,
92 result_code
, NULL
, &k5_error_bytes
,
93 NULL
, NULL
, NULL
, NULL
, &k5_error_blob
);
97 *error_blob
= data_blob_talloc(mem_ctx
, k5_error_blob
.data
, k5_error_blob
.length
);
98 krb5_data_free(&k5_error_blob
);
99 if (!error_blob
->data
) {
105 static bool kpasswd_make_pwchange_reply(struct kdc_server
*kdc
,
108 enum samPwdChangeReason reject_reason
,
109 struct samr_DomInfo1
*dominfo
,
110 DATA_BLOB
*error_blob
)
112 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_USER
)) {
113 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
114 KRB5_KPASSWD_ACCESSDENIED
,
115 "No such user when changing password",
118 if (NT_STATUS_EQUAL(status
, NT_STATUS_ACCESS_DENIED
)) {
119 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
120 KRB5_KPASSWD_ACCESSDENIED
,
121 "Not permitted to change password",
124 if (dominfo
&& NT_STATUS_EQUAL(status
, NT_STATUS_PASSWORD_RESTRICTION
)) {
125 const char *reject_string
;
126 switch (reject_reason
) {
127 case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT
:
128 reject_string
= talloc_asprintf(mem_ctx
, "Password too short, password must be at least %d characters long",
129 dominfo
->min_password_length
);
131 case SAM_PWD_CHANGE_NOT_COMPLEX
:
132 reject_string
= "Password does not meet complexity requirements";
134 case SAM_PWD_CHANGE_PWD_IN_HISTORY
:
135 reject_string
= "Password is already in password history";
138 reject_string
= talloc_asprintf(mem_ctx
, "Password must be at least %d characters long, and cannot match any of your %d previous passwords",
139 dominfo
->min_password_length
, dominfo
->password_history_length
);
142 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
143 KRB5_KPASSWD_SOFTERROR
,
147 if (!NT_STATUS_IS_OK(status
)) {
148 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
149 KRB5_KPASSWD_HARDERROR
,
150 talloc_asprintf(mem_ctx
, "failed to set password: %s", nt_errstr(status
)),
154 return kpasswdd_make_error_reply(kdc
, mem_ctx
, KRB5_KPASSWD_SUCCESS
,
160 A user password change
162 Return true if there is a valid error packet (or success) formed in
165 static bool kpasswdd_change_password(struct kdc_server
*kdc
,
167 struct auth_session_info
*session_info
,
168 const DATA_BLOB
*password
,
172 enum samPwdChangeReason reject_reason
;
173 struct samr_DomInfo1
*dominfo
;
174 struct samr_Password
*oldLmHash
, *oldNtHash
;
175 struct ldb_context
*samdb
;
176 const char * const attrs
[] = { "dBCSPwd", "unicodePwd", NULL
};
177 struct ldb_message
**res
;
180 /* Connect to a SAMDB with system privileges for fetching the old pw
182 samdb
= samdb_connect(mem_ctx
, kdc
->task
->event_ctx
, kdc
->task
->lp_ctx
,
183 system_session(kdc
->task
->lp_ctx
), 0);
185 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
186 KRB5_KPASSWD_HARDERROR
,
187 "Failed to open samdb",
191 /* Fetch the old hashes to get the old password in order to perform
192 * the password change operation. Naturally it would be much better to
193 * have a password hash from an authentication around but this doesn't
194 * seem to be the case here. */
195 ret
= gendb_search(samdb
, mem_ctx
, NULL
, &res
, attrs
,
196 "(&(objectClass=user)(sAMAccountName=%s))",
197 session_info
->server_info
->account_name
);
199 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
200 KRB5_KPASSWD_ACCESSDENIED
,
201 "No such user when changing password",
205 status
= samdb_result_passwords(mem_ctx
, kdc
->task
->lp_ctx
, res
[0],
206 &oldLmHash
, &oldNtHash
);
207 if (!NT_STATUS_IS_OK(status
)) {
208 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
209 KRB5_KPASSWD_ACCESSDENIED
,
210 "Not permitted to change password",
214 /* Start a SAM with user privileges for the password change */
215 samdb
= samdb_connect(mem_ctx
, kdc
->task
->event_ctx
, kdc
->task
->lp_ctx
,
218 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
219 KRB5_KPASSWD_HARDERROR
,
220 "Failed to open samdb",
224 DEBUG(3, ("Changing password of %s\\%s (%s)\n",
225 session_info
->server_info
->domain_name
,
226 session_info
->server_info
->account_name
,
227 dom_sid_string(mem_ctx
, &session_info
->security_token
->sids
[PRIMARY_USER_SID_INDEX
])));
229 /* Performs the password change */
230 status
= samdb_set_password_sid(samdb
, mem_ctx
,
231 &session_info
->security_token
->sids
[PRIMARY_USER_SID_INDEX
],
232 password
, NULL
, NULL
,
233 oldLmHash
, oldNtHash
, /* this is a user password change */
236 return kpasswd_make_pwchange_reply(kdc
, mem_ctx
,
244 static bool kpasswd_process_request(struct kdc_server
*kdc
,
246 struct gensec_security
*gensec_security
,
251 struct auth_session_info
*session_info
;
254 if (!NT_STATUS_IS_OK(gensec_session_info(gensec_security
,
256 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
257 KRB5_KPASSWD_HARDERROR
,
258 "gensec_session_info failed!",
263 case KRB5_KPASSWD_VERS_CHANGEPW
:
266 if (!convert_string_talloc_convenience(mem_ctx
, lpcfg_iconv_convenience(kdc
->task
->lp_ctx
),
268 (const char *)input
->data
,
270 (void **)&password
.data
, &pw_len
, false)) {
273 password
.length
= pw_len
;
275 return kpasswdd_change_password(kdc
, mem_ctx
, session_info
,
278 case KRB5_KPASSWD_VERS_SETPW
:
281 enum samPwdChangeReason reject_reason
= SAM_PWD_CHANGE_NO_ERROR
;
282 struct samr_DomInfo1
*dominfo
= NULL
;
283 struct ldb_context
*samdb
;
284 krb5_context context
= kdc
->smb_krb5_context
->krb5_context
;
286 ChangePasswdDataMS chpw
;
289 krb5_principal principal
;
290 char *set_password_on_princ
;
291 struct ldb_dn
*set_password_on_dn
;
292 bool service_principal_name
= false;
297 ret
= decode_ChangePasswdDataMS(input
->data
, input
->length
,
300 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
301 KRB5_KPASSWD_MALFORMED
,
302 "failed to decode password change structure",
306 if (!convert_string_talloc_convenience(mem_ctx
, lpcfg_iconv_convenience(kdc
->task
->lp_ctx
),
308 (const char *)chpw
.newpasswd
.data
,
309 chpw
.newpasswd
.length
,
310 (void **)&password
.data
, &pw_len
, false)) {
311 free_ChangePasswdDataMS(&chpw
);
315 password
.length
= pw_len
;
317 if ((chpw
.targname
&& !chpw
.targrealm
)
318 || (!chpw
.targname
&& chpw
.targrealm
)) {
319 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
320 KRB5_KPASSWD_MALFORMED
,
321 "Realm and principal must be both present, or neither present",
324 if (chpw
.targname
&& chpw
.targrealm
) {
325 #ifdef SAMBA4_INTERNAL_HEIMDAL
326 if (_krb5_principalname2krb5_principal(kdc
->smb_krb5_context
->krb5_context
,
327 &principal
, *chpw
.targname
,
328 *chpw
.targrealm
) != 0) {
329 free_ChangePasswdDataMS(&chpw
);
330 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
331 KRB5_KPASSWD_MALFORMED
,
332 "failed to extract principal to set",
336 #else /* SAMBA4_INTERNAL_HEIMDAL */
337 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
338 KRB5_KPASSWD_BAD_VERSION
,
339 "Operation Not Implemented",
341 #endif /* SAMBA4_INTERNAL_HEIMDAL */
343 free_ChangePasswdDataMS(&chpw
);
344 return kpasswdd_change_password(kdc
, mem_ctx
, session_info
,
347 free_ChangePasswdDataMS(&chpw
);
349 if (principal
->name
.name_string
.len
>= 2) {
350 service_principal_name
= true;
352 /* We use this, rather than 'no realm' flag,
353 * as we don't want to accept a password
354 * change on a principal from another realm */
356 if (krb5_unparse_name_short(context
, principal
, &set_password_on_princ
) != 0) {
357 krb5_free_principal(context
, principal
);
358 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
359 KRB5_KPASSWD_MALFORMED
,
360 "krb5_unparse_name failed!",
364 if (krb5_unparse_name(context
, principal
, &set_password_on_princ
) != 0) {
365 krb5_free_principal(context
, principal
);
366 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
367 KRB5_KPASSWD_MALFORMED
,
368 "krb5_unparse_name failed!",
372 krb5_free_principal(context
, principal
);
374 samdb
= samdb_connect(mem_ctx
, kdc
->task
->event_ctx
, kdc
->task
->lp_ctx
, session_info
, 0);
376 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
377 KRB5_KPASSWD_HARDERROR
,
378 "Unable to open database!",
382 DEBUG(3, ("%s\\%s (%s) is changing password of %s\n",
383 session_info
->server_info
->domain_name
,
384 session_info
->server_info
->account_name
,
385 dom_sid_string(mem_ctx
, &session_info
->security_token
->sids
[PRIMARY_USER_SID_INDEX
]),
386 set_password_on_princ
));
387 ret
= ldb_transaction_start(samdb
);
388 if (ret
!= LDB_SUCCESS
) {
389 status
= NT_STATUS_TRANSACTION_ABORTED
;
390 return kpasswd_make_pwchange_reply(kdc
, mem_ctx
,
392 SAM_PWD_CHANGE_NO_ERROR
,
397 if (service_principal_name
) {
398 status
= crack_service_principal_name(samdb
, mem_ctx
,
399 set_password_on_princ
,
400 &set_password_on_dn
, NULL
);
402 status
= crack_user_principal_name(samdb
, mem_ctx
,
403 set_password_on_princ
,
404 &set_password_on_dn
, NULL
);
406 free(set_password_on_princ
);
407 if (!NT_STATUS_IS_OK(status
)) {
408 ldb_transaction_cancel(samdb
);
409 return kpasswd_make_pwchange_reply(kdc
, mem_ctx
,
411 SAM_PWD_CHANGE_NO_ERROR
,
416 if (NT_STATUS_IS_OK(status
)) {
417 /* Admin password set */
418 status
= samdb_set_password(samdb
, mem_ctx
,
419 set_password_on_dn
, NULL
,
420 &password
, NULL
, NULL
,
421 NULL
, NULL
, /* this is not a user password change */
422 &reject_reason
, &dominfo
);
425 if (NT_STATUS_IS_OK(status
)) {
426 ret
= ldb_transaction_commit(samdb
);
427 if (ret
!= LDB_SUCCESS
) {
428 DEBUG(1,("Failed to commit transaction to set password on %s: %s\n",
429 ldb_dn_get_linearized(set_password_on_dn
),
430 ldb_errstring(samdb
)));
431 status
= NT_STATUS_TRANSACTION_ABORTED
;
434 ldb_transaction_cancel(samdb
);
436 return kpasswd_make_pwchange_reply(kdc
, mem_ctx
,
443 return kpasswdd_make_error_reply(kdc
, mem_ctx
,
444 KRB5_KPASSWD_BAD_VERSION
,
445 talloc_asprintf(mem_ctx
,
446 "Protocol version %u not supported",
452 bool kpasswdd_process(struct kdc_server
*kdc
,
456 struct tsocket_address
*peer_addr
,
457 struct tsocket_address
*my_addr
,
461 const uint16_t header_len
= 6;
464 uint16_t krb_priv_len
;
467 DATA_BLOB ap_req
, krb_priv_req
;
468 DATA_BLOB krb_priv_rep
= data_blob(NULL
, 0);
469 DATA_BLOB ap_rep
= data_blob(NULL
, 0);
470 DATA_BLOB kpasswd_req
, kpasswd_rep
;
471 struct cli_credentials
*server_credentials
;
472 struct gensec_security
*gensec_security
;
473 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
481 /* Be parinoid. We need to ensure we don't just let the
482 * caller lead us into a buffer overflow */
483 if (input
->length
<= header_len
) {
484 talloc_free(tmp_ctx
);
488 len
= RSVAL(input
->data
, 0);
489 if (input
->length
!= len
) {
490 talloc_free(tmp_ctx
);
494 /* There are two different versions of this protocol so far,
495 * plus others in the standards pipe. Fortunetly they all
496 * take a very similar framing */
497 version
= RSVAL(input
->data
, 2);
498 ap_req_len
= RSVAL(input
->data
, 4);
499 if ((ap_req_len
>= len
) || (ap_req_len
+ header_len
) >= len
) {
500 talloc_free(tmp_ctx
);
504 krb_priv_len
= len
- ap_req_len
;
505 ap_req
= data_blob_const(&input
->data
[header_len
], ap_req_len
);
506 krb_priv_req
= data_blob_const(&input
->data
[header_len
+ ap_req_len
], krb_priv_len
);
508 server_credentials
= cli_credentials_init(tmp_ctx
);
509 if (!server_credentials
) {
510 DEBUG(1, ("Failed to init server credentials\n"));
514 /* We want the credentials subsystem to use the krb5 context
515 * we already have, rather than a new context */
516 cli_credentials_set_krb5_context(server_credentials
, kdc
->smb_krb5_context
);
517 cli_credentials_set_conf(server_credentials
, kdc
->task
->lp_ctx
);
519 keytab_name
= talloc_asprintf(server_credentials
, "HDB:samba4&%p", kdc
->base_ctx
);
521 cli_credentials_set_username(server_credentials
, "kadmin/changepw", CRED_SPECIFIED
);
522 ret
= cli_credentials_set_keytab_name(server_credentials
, kdc
->task
->lp_ctx
, keytab_name
, CRED_SPECIFIED
);
524 ret
= kpasswdd_make_unauth_error_reply(kdc
, mem_ctx
,
525 KRB5_KPASSWD_HARDERROR
,
526 talloc_asprintf(mem_ctx
,
527 "Failed to obtain server credentials for kadmin/changepw: %s\n",
528 nt_errstr(nt_status
)),
534 talloc_free(tmp_ctx
);
538 /* We don't strictly need to call this wrapper, and could call
539 * gensec_server_start directly, as we have no need for NTLM
540 * and we have a PAC, but this ensures that the wrapper can be
541 * safely extended for other helpful things in future */
542 nt_status
= samba_server_gensec_start(tmp_ctx
, kdc
->task
->event_ctx
,
548 if (!NT_STATUS_IS_OK(nt_status
)) {
549 talloc_free(tmp_ctx
);
553 /* The kerberos PRIV packets include these addresses. MIT
554 * clients check that they are present */
556 /* Skip this part for now, it breaks with a NetAPP filer and
557 * in any case where the client address is behind NAT. If
558 * older MIT clients need this, we might have to insert more
561 nt_status
= gensec_set_local_address(gensec_security
, peer_addr
);
562 if (!NT_STATUS_IS_OK(nt_status
)) {
563 talloc_free(tmp_ctx
);
568 nt_status
= gensec_set_local_address(gensec_security
, my_addr
);
569 if (!NT_STATUS_IS_OK(nt_status
)) {
570 talloc_free(tmp_ctx
);
574 /* We want the GENSEC wrap calls to generate PRIV tokens */
575 gensec_want_feature(gensec_security
, GENSEC_FEATURE_SEAL
);
577 nt_status
= gensec_start_mech_by_name(gensec_security
, "krb5");
578 if (!NT_STATUS_IS_OK(nt_status
)) {
579 talloc_free(tmp_ctx
);
583 /* Accept the AP-REQ and generate teh AP-REP we need for the reply */
584 nt_status
= gensec_update(gensec_security
, tmp_ctx
, ap_req
, &ap_rep
);
585 if (!NT_STATUS_IS_OK(nt_status
) && !NT_STATUS_EQUAL(nt_status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
587 ret
= kpasswdd_make_unauth_error_reply(kdc
, mem_ctx
,
588 KRB5_KPASSWD_HARDERROR
,
589 talloc_asprintf(mem_ctx
,
590 "gensec_update failed: %s",
591 nt_errstr(nt_status
)),
597 talloc_free(tmp_ctx
);
601 /* Extract the data from the KRB-PRIV half of the message */
602 nt_status
= gensec_unwrap(gensec_security
, tmp_ctx
, &krb_priv_req
, &kpasswd_req
);
603 if (!NT_STATUS_IS_OK(nt_status
)) {
604 ret
= kpasswdd_make_unauth_error_reply(kdc
, mem_ctx
,
605 KRB5_KPASSWD_HARDERROR
,
606 talloc_asprintf(mem_ctx
,
607 "gensec_unwrap failed: %s",
608 nt_errstr(nt_status
)),
614 talloc_free(tmp_ctx
);
618 /* Figure out something to do with it (probably changing a password...) */
619 ret
= kpasswd_process_request(kdc
, tmp_ctx
,
622 &kpasswd_req
, &kpasswd_rep
);
628 /* And wrap up the reply: This ensures that the error message
629 * or success can be verified by the client */
630 nt_status
= gensec_wrap(gensec_security
, tmp_ctx
,
631 &kpasswd_rep
, &krb_priv_rep
);
632 if (!NT_STATUS_IS_OK(nt_status
)) {
633 ret
= kpasswdd_make_unauth_error_reply(kdc
, mem_ctx
,
634 KRB5_KPASSWD_HARDERROR
,
635 talloc_asprintf(mem_ctx
,
636 "gensec_wrap failed: %s",
637 nt_errstr(nt_status
)),
643 talloc_free(tmp_ctx
);
648 *reply
= data_blob_talloc(mem_ctx
, NULL
, krb_priv_rep
.length
+ ap_rep
.length
+ header_len
);
653 RSSVAL(reply
->data
, 0, reply
->length
);
654 RSSVAL(reply
->data
, 2, 1); /* This is a version 1 reply, MS change/set or otherwise */
655 RSSVAL(reply
->data
, 4, ap_rep
.length
);
656 memcpy(reply
->data
+ header_len
,
659 memcpy(reply
->data
+ header_len
+ ap_rep
.length
,
661 krb_priv_rep
.length
);
663 talloc_free(tmp_ctx
);