2 Unix SMB/CIFS implementation.
3 SMB client password change routine
4 Copyright (C) Andrew Tridgell 1994-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "../librpc/gen_ndr/ndr_samr.h"
22 #include "rpc_client/cli_pipe.h"
23 #include "rpc_client/cli_samr.h"
25 /*************************************************************
26 Change a password on a remote machine using IPC calls.
27 *************************************************************/
29 NTSTATUS
remote_password_change(const char *remote_machine
, const char *user_name
,
30 const char *old_passwd
, const char *new_passwd
,
33 struct nmb_name calling
, called
;
34 struct cli_state
*cli
= NULL
;
35 struct rpc_pipe_client
*pipe_hnd
= NULL
;
36 struct sockaddr_storage ss
;
37 char *user
, *domain
, *p
;
40 bool pass_must_change
= False
;
42 user
= talloc_strdup(talloc_tos(), user_name
);
43 SMB_ASSERT(user
!= NULL
);
44 domain
= talloc_strdup(talloc_tos(), "");
45 SMB_ASSERT(domain
!= NULL
);
47 /* allow usernames of the form domain\\user or domain/user */
48 if ((p
= strchr_m(user
,'\\')) || (p
= strchr_m(user
,'/')) ||
49 (p
= strchr_m(user
,*lp_winbind_separator()))) {
57 if(!resolve_name( remote_machine
, &ss
, 0x20, false)) {
58 if (asprintf(err_str
, "Unable to find an IP address for machine "
59 "%s.\n", remote_machine
) == -1) {
62 return NT_STATUS_UNSUCCESSFUL
;
65 cli
= cli_initialise();
67 return NT_STATUS_NO_MEMORY
;
70 result
= cli_connect(cli
, remote_machine
, &ss
);
71 if (!NT_STATUS_IS_OK(result
)) {
72 if (asprintf(err_str
, "Unable to connect to SMB server on "
73 "machine %s. Error was : %s.\n",
74 remote_machine
, nt_errstr(result
))==-1) {
81 make_nmb_name(&calling
, global_myname() , 0x0);
82 make_nmb_name(&called
, remote_machine
, 0x20);
84 if (!cli_session_request(cli
, &calling
, &called
)) {
85 if (asprintf(err_str
, "machine %s rejected the session setup. "
87 remote_machine
, cli_errstr(cli
)) == -1) {
90 result
= cli_nt_error(cli
);
95 cli
->protocol
= PROTOCOL_NT1
;
97 result
= cli_negprot(cli
);
99 if (!NT_STATUS_IS_OK(result
)) {
100 if (asprintf(err_str
, "machine %s rejected the negotiate "
101 "protocol. Error was : %s.\n",
102 remote_machine
, nt_errstr(result
)) == -1) {
105 result
= cli_nt_error(cli
);
110 /* Given things like SMB signing, restrict anonymous and the like,
111 try an authenticated connection first */
112 result
= cli_session_setup(cli
, user_name
,
113 old_passwd
, strlen(old_passwd
)+1,
114 old_passwd
, strlen(old_passwd
)+1, "");
116 if (!NT_STATUS_IS_OK(result
)) {
118 /* Password must change or Password expired are the only valid
119 * error conditions here from where we can proceed, the rest like
120 * account locked out or logon failure will lead to errors later
123 if (!NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_MUST_CHANGE
) &&
124 !NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_EXPIRED
)) {
125 if (asprintf(err_str
, "Could not connect to machine %s: "
126 "%s\n", remote_machine
, cli_errstr(cli
)) == -1) {
133 pass_must_change
= True
;
136 * We should connect as the anonymous user here, in case
137 * the server has "must change password" checked...
138 * Thanks to <Nicholas.S.Jenkins@cdc.com> for this fix.
141 result
= cli_session_setup(cli
, "", "", 0, "", 0, "");
143 if (!NT_STATUS_IS_OK(result
)) {
144 if (asprintf(err_str
, "machine %s rejected the session "
145 "setup. Error was : %s.\n",
146 remote_machine
, cli_errstr(cli
)) == -1) {
153 result
= cli_init_creds(cli
, "", "", NULL
);
154 if (!NT_STATUS_IS_OK(result
)) {
159 result
= cli_init_creds(cli
, user
, domain
, old_passwd
);
160 if (!NT_STATUS_IS_OK(result
)) {
166 result
= cli_tcon_andx(cli
, "IPC$", "IPC", "", 1);
167 if (!NT_STATUS_IS_OK(result
)) {
168 if (asprintf(err_str
, "machine %s rejected the tconX on the "
169 "IPC$ share. Error was : %s.\n",
170 remote_machine
, nt_errstr(result
))) {
177 /* Try not to give the password away too easily */
179 if (!pass_must_change
) {
180 result
= cli_rpc_pipe_open_ntlmssp(cli
,
181 &ndr_table_samr
.syntax_id
,
183 DCERPC_AUTH_LEVEL_PRIVACY
,
189 * If the user password must be changed the ntlmssp bind will
190 * fail the same way as the session setup above did. The
191 * difference ist that with a pipe bind we don't get a good
192 * error message, the result will be that the rpc call below
193 * will just fail. So we do it anonymously, there's no other
196 result
= cli_rpc_pipe_open_noauth(
197 cli
, &ndr_table_samr
.syntax_id
, &pipe_hnd
);
200 if (!NT_STATUS_IS_OK(result
)) {
201 if (lp_client_lanman_auth()) {
202 /* Use the old RAP method. */
203 if (!cli_oem_change_password(cli
, user_name
, new_passwd
, old_passwd
)) {
204 if (asprintf(err_str
, "machine %s rejected the "
205 "password change: Error was : %s.\n",
206 remote_machine
, cli_errstr(cli
)) == -1) {
209 result
= cli_nt_error(cli
);
214 if (asprintf(err_str
, "SAMR connection to machine %s "
215 "failed. Error was %s, but LANMAN password "
216 "changes are disabled\n",
217 remote_machine
, nt_errstr(result
)) == -1) {
220 result
= cli_nt_error(cli
);
226 result
= rpccli_samr_chgpasswd_user2(pipe_hnd
, talloc_tos(),
227 user_name
, new_passwd
, old_passwd
);
228 if (NT_STATUS_IS_OK(result
)) {
229 /* Great - it all worked! */
233 } else if (!(NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
)
234 || NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
))) {
235 /* it failed, but for reasons such as wrong password, too short etc ... */
237 if (asprintf(err_str
, "machine %s rejected the password change: "
239 remote_machine
, get_friendly_nt_error_msg(result
)) == -1) {
246 /* OK, that failed, so try again... */
247 TALLOC_FREE(pipe_hnd
);
249 /* Try anonymous NTLMSSP... */
250 result
= cli_init_creds(cli
, "", "", NULL
);
251 if (!NT_STATUS_IS_OK(result
)) {
256 result
= NT_STATUS_UNSUCCESSFUL
;
258 /* OK, this is ugly, but... try an anonymous pipe. */
259 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_samr
.syntax_id
,
262 if ( NT_STATUS_IS_OK(result
) &&
263 (NT_STATUS_IS_OK(result
= rpccli_samr_chgpasswd_user2(
264 pipe_hnd
, talloc_tos(), user_name
,
265 new_passwd
, old_passwd
)))) {
266 /* Great - it all worked! */
270 if (!(NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
)
271 || NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
))) {
272 /* it failed, but again it was due to things like new password too short */
274 if (asprintf(err_str
, "machine %s rejected the "
275 "(anonymous) password change: Error was : "
276 "%s.\n", remote_machine
,
277 get_friendly_nt_error_msg(result
)) == -1) {
284 /* We have failed to change the user's password, and we think the server
285 just might not support SAMR password changes, so fall back */
287 if (lp_client_lanman_auth()) {
288 /* Use the old RAP method. */
289 if (cli_oem_change_password(cli
, user_name
, new_passwd
, old_passwd
)) {
290 /* SAMR failed, but the old LanMan protocol worked! */
295 if (asprintf(err_str
, "machine %s rejected the password "
296 "change: Error was : %s.\n",
297 remote_machine
, cli_errstr(cli
)) == -1) {
300 result
= cli_nt_error(cli
);
304 if (asprintf(err_str
, "SAMR connection to machine %s "
305 "failed. Error was %s, but LANMAN password "
306 "changes are disabled\n",
307 nt_errstr(result
), remote_machine
) == -1) {
311 return NT_STATUS_UNSUCCESSFUL
;