2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2008
7 Copyright (C) Andrew Tridgell 2005
8 Copyright (C) Stefan Metzmacher 2005
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "samba/process_model.h"
26 #include "lib/tsocket/tsocket.h"
27 #include "lib/messaging/irpc.h"
28 #include "librpc/gen_ndr/ndr_irpc.h"
29 #include "librpc/gen_ndr/ndr_krb5pac.h"
30 #include "lib/socket/netif.h"
31 #include "param/param.h"
32 #include "kdc/kdc-server.h"
33 #include "kdc/kdc-proxy.h"
34 #include "kdc/kdc-glue.h"
35 #include "kdc/pac-glue.h"
36 #include "kdc/kpasswd-service.h"
37 #include "dsdb/samdb/samdb.h"
38 #include "auth/session.h"
39 #include "libds/common/roles.h"
44 #define DBGC_CLASS DBGC_KERBEROS
46 NTSTATUS
server_service_kdc_init(TALLOC_CTX
*);
48 extern struct krb5plugin_kdc_ftable kdc_plugin_table
;
51 Wrapper for krb5_kdc_process_krb5_request, converting to/from Samba
55 static kdc_code
kdc_process(struct kdc_server
*kdc
,
59 struct tsocket_address
*peer_addr
,
60 struct tsocket_address
*my_addr
,
65 struct sockaddr_storage ss
;
67 krb5_kdc_configuration
*kdc_config
=
68 (krb5_kdc_configuration
*)kdc
->private_data
;
70 krb5_data_zero(&k5_reply
);
72 krb5_kdc_update_time(NULL
);
74 ret
= tsocket_address_bsd_sockaddr(peer_addr
, (struct sockaddr
*) &ss
,
75 sizeof(struct sockaddr_storage
));
79 pa
= tsocket_address_string(peer_addr
, mem_ctx
);
84 DBG_DEBUG("Received KDC packet of length %zu from %s\n",
87 ret
= krb5_kdc_process_krb5_request(kdc
->smb_krb5_context
->krb5_context
,
89 input
->data
, input
->length
,
92 (struct sockaddr
*) &ss
,
95 *reply
= data_blob(NULL
, 0);
99 if (ret
== HDB_ERR_NOT_FOUND_HERE
) {
100 *reply
= data_blob(NULL
, 0);
101 return KDC_PROXY_REQUEST
;
104 if (k5_reply
.length
) {
105 *reply
= data_blob_talloc(mem_ctx
, k5_reply
.data
, k5_reply
.length
);
106 krb5_data_free(&k5_reply
);
108 *reply
= data_blob(NULL
, 0);
114 setup our listening sockets on the configured network interfaces
116 static NTSTATUS
kdc_startup_interfaces(struct kdc_server
*kdc
,
117 struct loadparm_context
*lp_ctx
,
118 struct interface
*ifaces
,
119 const struct model_ops
*model_ops
)
122 TALLOC_CTX
*tmp_ctx
= talloc_new(kdc
);
125 uint16_t kdc_port
= lpcfg_krb5_port(lp_ctx
);
126 uint16_t kpasswd_port
= lpcfg_kpasswd_port(lp_ctx
);
127 bool done_wildcard
= false;
129 num_interfaces
= iface_list_count(ifaces
);
131 /* if we are allowing incoming packets from any address, then
132 we need to bind to the wildcard address */
133 if (!lpcfg_bind_interfaces_only(lp_ctx
)) {
134 size_t num_binds
= 0;
135 char **wcard
= iface_list_wildcard(kdc
);
136 NT_STATUS_HAVE_NO_MEMORY(wcard
);
137 for (i
=0; wcard
[i
]; i
++) {
139 status
= kdc_add_socket(kdc
, model_ops
,
140 "kdc", wcard
[i
], kdc_port
,
142 if (NT_STATUS_IS_OK(status
)) {
148 status
= kdc_add_socket(kdc
, model_ops
,
149 "kpasswd", wcard
[i
], kpasswd_port
,
150 kpasswd_process
, false);
151 if (NT_STATUS_IS_OK(status
)) {
157 if (num_binds
== 0) {
158 return NT_STATUS_INVALID_PARAMETER_MIX
;
160 done_wildcard
= true;
163 for (i
=0; i
<num_interfaces
; i
++) {
164 const char *address
= talloc_strdup(tmp_ctx
, iface_list_n_ip(ifaces
, i
));
167 status
= kdc_add_socket(kdc
, model_ops
,
168 "kdc", address
, kdc_port
,
169 kdc_process
, done_wildcard
);
170 NT_STATUS_NOT_OK_RETURN(status
);
174 status
= kdc_add_socket(kdc
, model_ops
,
175 "kpasswd", address
, kpasswd_port
,
176 kpasswd_process
, done_wildcard
);
177 NT_STATUS_NOT_OK_RETURN(status
);
181 talloc_free(tmp_ctx
);
186 static NTSTATUS
kdc_check_generic_kerberos(struct irpc_message
*msg
,
187 struct kdc_check_generic_kerberos
*r
)
189 struct PAC_Validate pac_validate
;
191 struct PAC_SIGNATURE_DATA kdc_sig
;
192 struct kdc_server
*kdc
= talloc_get_type(msg
->private_data
, struct kdc_server
);
193 krb5_kdc_configuration
*kdc_config
=
194 (krb5_kdc_configuration
*)kdc
->private_data
;
195 enum ndr_err_code ndr_err
;
198 krb5_principal principal
;
201 /* There is no reply to this request */
202 r
->out
.generic_reply
= data_blob(NULL
, 0);
204 ndr_err
= ndr_pull_struct_blob(&r
->in
.generic_request
, msg
, &pac_validate
,
205 (ndr_pull_flags_fn_t
)ndr_pull_PAC_Validate
);
206 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
207 return NT_STATUS_INVALID_PARAMETER
;
210 if (pac_validate
.MessageType
!= NETLOGON_GENERIC_KRB5_PAC_VALIDATE
) {
211 /* We don't implement any other message types - such as certificate validation - yet */
212 return NT_STATUS_INVALID_PARAMETER
;
215 if (pac_validate
.ChecksumAndSignature
.length
!= (pac_validate
.ChecksumLength
+ pac_validate
.SignatureLength
)
216 || pac_validate
.ChecksumAndSignature
.length
< pac_validate
.ChecksumLength
217 || pac_validate
.ChecksumAndSignature
.length
< pac_validate
.SignatureLength
) {
218 return NT_STATUS_INVALID_PARAMETER
;
221 srv_sig
= data_blob_const(pac_validate
.ChecksumAndSignature
.data
,
222 pac_validate
.ChecksumLength
);
224 ret
= krb5_make_principal(kdc
->smb_krb5_context
->krb5_context
, &principal
,
225 lpcfg_realm(kdc
->task
->lp_ctx
),
226 "krbtgt", lpcfg_realm(kdc
->task
->lp_ctx
),
230 return NT_STATUS_NO_MEMORY
;
233 ret
= kdc_config
->db
[0]->hdb_fetch_kvno(kdc
->smb_krb5_context
->krb5_context
,
236 HDB_F_GET_KRBTGT
| HDB_F_DECRYPT
,
241 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, kdc_config
->db
[0], &ent
);
242 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
244 return NT_STATUS_LOGON_FAILURE
;
247 kdc_sig
.type
= pac_validate
.SignatureType
;
248 kdc_sig
.signature
= data_blob_const(&pac_validate
.ChecksumAndSignature
.data
[pac_validate
.ChecksumLength
],
249 pac_validate
.SignatureLength
);
251 ret
= kdc_check_pac(kdc
->smb_krb5_context
->krb5_context
, srv_sig
, &kdc_sig
, &ent
);
253 hdb_free_entry(kdc
->smb_krb5_context
->krb5_context
, kdc_config
->db
[0], &ent
);
254 krb5_free_principal(kdc
->smb_krb5_context
->krb5_context
, principal
);
257 return NT_STATUS_LOGON_FAILURE
;
267 static NTSTATUS
kdc_task_init(struct task_server
*task
)
269 struct kdc_server
*kdc
;
271 struct interface
*ifaces
;
273 switch (lpcfg_server_role(task
->lp_ctx
)) {
274 case ROLE_STANDALONE
:
275 task_server_terminate(task
, "kdc: no KDC required in standalone configuration", false);
276 return NT_STATUS_INVALID_DOMAIN_ROLE
;
277 case ROLE_DOMAIN_MEMBER
:
278 task_server_terminate(task
, "kdc: no KDC required in member server configuration", false);
279 return NT_STATUS_INVALID_DOMAIN_ROLE
;
280 case ROLE_DOMAIN_PDC
:
281 case ROLE_DOMAIN_BDC
:
283 task_server_terminate(
284 task
, "Cannot start KDC as a 'classic Samba' DC", false);
285 return NT_STATUS_INVALID_DOMAIN_ROLE
;
286 case ROLE_ACTIVE_DIRECTORY_DC
:
287 /* Yes, we want a KDC */
291 load_interface_list(task
, task
->lp_ctx
, &ifaces
);
293 if (iface_list_count(ifaces
) == 0) {
294 task_server_terminate(task
, "kdc: no network interfaces configured", false);
295 return NT_STATUS_UNSUCCESSFUL
;
298 task_server_set_title(task
, "task[kdc]");
300 kdc
= talloc_zero(task
, struct kdc_server
);
302 task_server_terminate(task
, "kdc: out of memory", true);
303 return NT_STATUS_NO_MEMORY
;
307 task
->private_data
= kdc
;
309 /* start listening on the configured network interfaces */
310 status
= kdc_startup_interfaces(kdc
, task
->lp_ctx
, ifaces
,
312 if (!NT_STATUS_IS_OK(status
)) {
313 task_server_terminate(task
, "kdc failed to setup interfaces", true);
322 initialise the kdc task after a fork
324 static void kdc_post_fork(struct task_server
*task
, struct process_details
*pd
)
326 struct kdc_server
*kdc
;
327 krb5_kdc_configuration
*kdc_config
= NULL
;
333 task_server_terminate(task
, "kdc: Null task", true);
336 if (task
->private_data
== NULL
) {
337 task_server_terminate(task
, "kdc: No kdc_server info", true);
340 kdc
= talloc_get_type_abort(task
->private_data
, struct kdc_server
);
342 /* get a samdb connection */
343 kdc
->samdb
= samdb_connect(kdc
,
344 kdc
->task
->event_ctx
,
346 system_session(kdc
->task
->lp_ctx
),
350 DBG_WARNING("kdc_task_init: unable to connect to samdb\n");
351 task_server_terminate(task
, "kdc: krb5_init_context samdb connect failed", true);
355 ldb_ret
= samdb_rodc(kdc
->samdb
, &kdc
->am_rodc
);
356 if (ldb_ret
!= LDB_SUCCESS
) {
357 DBG_WARNING("kdc_task_init: "
358 "Cannot determine if we are an RODC: %s\n",
359 ldb_errstring(kdc
->samdb
));
360 task_server_terminate(task
, "kdc: krb5_init_context samdb RODC connect failed", true);
364 kdc
->proxy_timeout
= lpcfg_parm_int(kdc
->task
->lp_ctx
, NULL
, "kdc", "proxy timeout", 5);
366 initialize_krb5_error_table();
368 ret
= smb_krb5_init_context(kdc
, task
->lp_ctx
, &kdc
->smb_krb5_context
);
370 DBG_WARNING("kdc_task_init: krb5_init_context failed (%s)\n",
372 task_server_terminate(task
, "kdc: krb5_init_context failed", true);
376 krb5_add_et_list(kdc
->smb_krb5_context
->krb5_context
, initialize_hdb_error_table_r
);
378 ret
= krb5_kdc_get_config(kdc
->smb_krb5_context
->krb5_context
,
381 task_server_terminate(task
, "kdc: failed to get KDC configuration", true);
385 kdc_config
->logf
= (krb5_log_facility
*)kdc
->smb_krb5_context
->pvt_log_data
;
386 kdc_config
->db
= talloc(kdc
, struct HDB
*);
387 if (!kdc_config
->db
) {
388 task_server_terminate(task
, "kdc: out of memory", true);
391 kdc_config
->num_db
= 1;
394 * Note with the CVE-2022-37966 patches,
395 * see https://bugzilla.samba.org/show_bug.cgi?id=15219
396 * and https://bugzilla.samba.org/show_bug.cgi?id=15237
397 * we want to use the strongest keys for everything.
399 * Some of these don't have any real effect anymore,
400 * but it is better to have them as true...
402 kdc_config
->tgt_use_strongest_session_key
= true;
403 kdc_config
->preauth_use_strongest_session_key
= true;
404 kdc_config
->svc_use_strongest_session_key
= true;
405 kdc_config
->use_strongest_server_key
= true;
407 kdc_config
->force_include_pa_etype_salt
= true;
410 * For Samba CVE-2020-25719 Require PAC to be present
411 * This instructs Heimdal to match AD behaviour,
412 * as seen after Microsoft's CVE-2021-42287 when
413 * PacRequestorEnforcement is set to 2.
415 * Samba BUG: https://bugzilla.samba.org/show_bug.cgi?id=14686
416 * REF: https://support.microsoft.com/en-au/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041
419 kdc_config
->require_pac
= true;
422 * By default we enable RFC6113/FAST support,
423 * but we have an option to disable in order to
424 * test against a KDC with FAST support.
426 kdc_config
->enable_fast
= lpcfg_kdc_enable_fast(task
->lp_ctx
);
429 static const char *dummy_string
= "Microsoft";
432 * The FAST cookie is not cryptographically required,
433 * provided that the non-AD gss-preauth authentication
434 * method is removed (as this is the only multi-step
435 * authentication method).
437 * gss-preauth has been disabled both by not being
438 * configured and by being made dependent
439 * configuration for a "real" fast cookie.
441 * The hide_client_names feature in Heimdal is the
442 * only other state that is persisted in the cookie,
443 * and this does not need to be in the cookie for
444 * single-shot authentication protocols such as ENC-TS
445 * and ENC-CHAL, the standard password protocols in
448 * Furthermore, the Heimdal KDC does not fail if the
449 * client does not supply a FAST cookie, showing that
450 * the presence of the cookie is not required.
452 kdc_config
->enable_fast_cookie
= false;
453 kdc_config
->dummy_fast_cookie
= smb_krb5_make_data(discard_const_p(char, dummy_string
),
454 strlen(dummy_string
));
458 * Match Windows and RFC6113 and Windows but break older
461 kdc_config
->enable_armored_pa_enc_timestamp
= false;
463 /* Register hdb-samba4 hooks for use as a keytab */
465 kdc
->base_ctx
= talloc_zero(kdc
, struct samba_kdc_base_context
);
466 if (!kdc
->base_ctx
) {
467 task_server_terminate(task
, "kdc: out of memory", true);
471 kdc
->base_ctx
->ev_ctx
= task
->event_ctx
;
472 kdc
->base_ctx
->lp_ctx
= task
->lp_ctx
;
473 kdc
->base_ctx
->msg_ctx
= task
->msg_ctx
;
475 status
= hdb_samba4_create_kdc(kdc
->base_ctx
,
476 kdc
->smb_krb5_context
->krb5_context
,
478 if (!NT_STATUS_IS_OK(status
)) {
479 task_server_terminate(task
, "kdc: hdb_samba4_create_kdc (setup KDC database) failed", true);
483 ret
= krb5_plugin_register(kdc
->smb_krb5_context
->krb5_context
,
484 PLUGIN_TYPE_DATA
, "hdb_samba4_interface",
485 &hdb_samba4_interface
);
487 task_server_terminate(task
, "kdc: failed to register hdb plugin", true);
491 kdc
->kpasswd_keytab_name
= talloc_asprintf(kdc
, "HDBGET:samba4:&%p", kdc
->base_ctx
);
492 if (kdc
->kpasswd_keytab_name
== NULL
) {
493 task_server_terminate(task
,
494 "kdc: Failed to set keytab name",
499 ret
= krb5_kt_register(kdc
->smb_krb5_context
->krb5_context
, &hdb_get_kt_ops
);
501 task_server_terminate(task
, "kdc: failed to register keytab plugin", true);
505 /* Register KDC hooks */
506 ret
= krb5_plugin_register(kdc
->smb_krb5_context
->krb5_context
,
507 PLUGIN_TYPE_DATA
, "kdc",
510 task_server_terminate(task
, "kdc: failed to register kdc plugin", true);
514 ret
= krb5_kdc_plugin_init(kdc
->smb_krb5_context
->krb5_context
);
517 task_server_terminate(task
, "kdc: failed to init kdc plugin", true);
521 ret
= krb5_kdc_pkinit_config(kdc
->smb_krb5_context
->krb5_context
, kdc_config
);
524 task_server_terminate(task
, "kdc: failed to init kdc pkinit subsystem", true);
527 kdc
->private_data
= kdc_config
;
529 status
= IRPC_REGISTER(task
->msg_ctx
, irpc
, KDC_CHECK_GENERIC_KERBEROS
,
530 kdc_check_generic_kerberos
, kdc
);
531 if (!NT_STATUS_IS_OK(status
)) {
532 task_server_terminate(task
, "kdc failed to setup monitoring", true);
536 irpc_add_name(task
->msg_ctx
, "kdc_server");
540 /* called at smbd startup - register ourselves as a server service */
541 NTSTATUS
server_service_kdc_init(TALLOC_CTX
*ctx
)
543 static const struct service_details details
= {
544 .inhibit_fork_on_accept
= true,
545 .inhibit_pre_fork
= false,
546 .task_init
= kdc_task_init
,
547 .post_fork
= kdc_post_fork
549 return register_server_service(ctx
, "kdc", &details
);