2 Unix SMB/CIFS implementation.
3 Authenticate to a remote server
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #define DBGC_CLASS DBGC_AUTH
27 extern userdom_struct current_user_info
;
29 /****************************************************************************
30 Support for server level security.
31 ****************************************************************************/
33 static struct cli_state
*server_cryptkey(TALLOC_CTX
*mem_ctx
)
35 struct cli_state
*cli
= NULL
;
37 struct in_addr dest_ip
;
40 BOOL connected_ok
= False
;
42 if (!(cli
= cli_initialise(cli
)))
45 /* security = server just can't function with spnego */
46 cli
->use_spnego
= False
;
48 pserver
= talloc_strdup(mem_ctx
, lp_passwordserver());
51 while(next_token( &p
, desthost
, LIST_SEP
, sizeof(desthost
))) {
52 standard_sub_basic(current_user_info
.smb_name
, desthost
, sizeof(desthost
));
55 if(!resolve_name( desthost
, &dest_ip
, 0x20)) {
56 DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost
));
60 if (ismyip(dest_ip
)) {
61 DEBUG(1,("Password server loop - disabling password server %s\n",desthost
));
65 /* we use a mutex to prevent two connections at once - when a
66 Win2k PDC get two connections where one hasn't completed a
67 session setup yet it will send a TCP reset to the first
68 connection (tridge) */
70 if (!grab_server_mutex(desthost
)) {
74 if (cli_connect(cli
, desthost
, &dest_ip
)) {
75 DEBUG(3,("connected to password server %s\n",desthost
));
82 release_server_mutex();
83 DEBUG(0,("password server not available\n"));
88 if (!attempt_netbios_session_request(cli
, global_myname(),
89 desthost
, &dest_ip
)) {
90 release_server_mutex();
91 DEBUG(1,("password server fails session request\n"));
96 if (strequal(desthost
,myhostname())) {
97 exit_server("Password server loop!");
100 DEBUG(3,("got session\n"));
102 if (!cli_negprot(cli
)) {
103 DEBUG(1,("%s rejected the negprot\n",desthost
));
104 release_server_mutex();
109 if (cli
->protocol
< PROTOCOL_LANMAN2
||
110 !(cli
->sec_mode
& NEGOTIATE_SECURITY_USER_LEVEL
)) {
111 DEBUG(1,("%s isn't in user level security mode\n",desthost
));
112 release_server_mutex();
117 /* Get the first session setup done quickly, to avoid silly
118 Win2k bugs. (The next connection to the server will kill
122 if (!cli_session_setup(cli
, "", "", 0, "", 0,
124 DEBUG(0,("%s rejected the initial session setup (%s)\n",
125 desthost
, cli_errstr(cli
)));
126 release_server_mutex();
131 release_server_mutex();
133 DEBUG(3,("password server OK\n"));
138 /****************************************************************************
139 Clean up our allocated cli.
140 ****************************************************************************/
142 static void free_server_private_data(void **private_data_pointer
)
144 struct cli_state
**cli
= (struct cli_state
**)private_data_pointer
;
145 if (*cli
&& (*cli
)->initialised
) {
150 /****************************************************************************
151 Send a 'keepalive' packet down the cli pipe.
152 ****************************************************************************/
154 static void send_server_keepalive(void **private_data_pointer
)
156 /* also send a keepalive to the password server if its still
158 if (private_data_pointer
) {
159 struct cli_state
*cli
= (struct cli_state
*)(*private_data_pointer
);
160 if (cli
&& cli
->initialised
) {
161 if (!send_keepalive(cli
->fd
)) {
162 DEBUG( 2, ( "send_server_keepalive: password server keepalive failed.\n"));
164 *private_data_pointer
= NULL
;
170 /****************************************************************************
171 Get the challenge out of a password server.
172 ****************************************************************************/
174 static DATA_BLOB
auth_get_challenge_server(const struct auth_context
*auth_context
,
175 void **my_private_data
,
178 struct cli_state
*cli
= server_cryptkey(mem_ctx
);
181 DEBUG(3,("using password server validation\n"));
183 if ((cli
->sec_mode
& NEGOTIATE_SECURITY_CHALLENGE_RESPONSE
) == 0) {
184 /* We can't work with unencrypted password servers
185 unless 'encrypt passwords = no' */
186 DEBUG(5,("make_auth_info_server: Server is unencrypted, no challenge available..\n"));
188 /* However, it is still a perfectly fine connection
189 to pass that unencrypted password over */
190 *my_private_data
= (void *)cli
;
191 return data_blob(NULL
, 0);
193 } else if (cli
->secblob
.length
< 8) {
194 /* We can't do much if we don't get a full challenge */
195 DEBUG(2,("make_auth_info_server: Didn't receive a full challenge from server\n"));
197 return data_blob(NULL
, 0);
200 *my_private_data
= (void *)cli
;
202 /* The return must be allocated on the caller's mem_ctx, as our own will be
203 destoyed just after the call. */
204 return data_blob_talloc(auth_context
->mem_ctx
, cli
->secblob
.data
,8);
206 return data_blob(NULL
, 0);
211 /****************************************************************************
212 Check for a valid username and password in security=server mode.
213 - Validate a password with the password server.
214 ****************************************************************************/
216 static NTSTATUS
check_smbserver_security(const struct auth_context
*auth_context
,
217 void *my_private_data
,
219 const auth_usersupplied_info
*user_info
,
220 auth_serversupplied_info
**server_info
)
222 struct cli_state
*cli
;
223 static unsigned char badpass
[24];
224 static fstring baduser
;
225 static BOOL tested_password_server
= False
;
226 static BOOL bad_password_server
= False
;
227 NTSTATUS nt_status
= NT_STATUS_NOT_IMPLEMENTED
;
228 BOOL locally_made_cli
= False
;
231 * Check that the requested domain is not our own machine name.
232 * If it is, we should never check the PDC here, we use our own local
236 if(is_myname(user_info
->domain
.str
)) {
237 DEBUG(3,("check_smbserver_security: Requested domain was for this machine.\n"));
241 cli
= my_private_data
;
245 cli
= server_cryptkey(mem_ctx
);
246 locally_made_cli
= True
;
249 if (!cli
|| !cli
->initialised
) {
250 DEBUG(1,("password server is not connected (cli not initilised)\n"));
251 return NT_STATUS_LOGON_FAILURE
;
254 if ((cli
->sec_mode
& NEGOTIATE_SECURITY_CHALLENGE_RESPONSE
) == 0) {
255 if (user_info
->encrypted
) {
256 DEBUG(1,("password server %s is plaintext, but we are encrypted. This just can't work :-(\n", cli
->desthost
));
257 return NT_STATUS_LOGON_FAILURE
;
260 if (memcmp(cli
->secblob
.data
, auth_context
->challenge
.data
, 8) != 0) {
261 DEBUG(1,("the challenge that the password server (%s) supplied us is not the one we gave our client. This just can't work :-(\n", cli
->desthost
));
262 return NT_STATUS_LOGON_FAILURE
;
267 memset(badpass
, 0x1f, sizeof(badpass
));
269 if((user_info
->nt_resp
.length
== sizeof(badpass
)) &&
270 !memcmp(badpass
, user_info
->nt_resp
.data
, sizeof(badpass
))) {
272 * Very unlikely, our random bad password is the same as the users
275 memset(badpass
, badpass
[0]+1, sizeof(badpass
));
278 if(baduser
[0] == 0) {
279 fstrcpy(baduser
, INVALID_USER_PREFIX
);
280 fstrcat(baduser
, global_myname());
284 * Attempt a session setup with a totally incorrect password.
285 * If this succeeds with the guest bit *NOT* set then the password
286 * server is broken and is not correctly setting the guest bit. We
287 * need to detect this as some versions of NT4.x are broken. JRA.
290 /* I sure as hell hope that there aren't servers out there that take
291 * NTLMv2 and have this bug, as we don't test for that...
292 * - abartlet@samba.org
295 if ((!tested_password_server
) && (lp_paranoid_server_security())) {
296 if (cli_session_setup(cli
, baduser
, (char *)badpass
, sizeof(badpass
),
297 (char *)badpass
, sizeof(badpass
), user_info
->domain
.str
)) {
300 * We connected to the password server so we
301 * can say we've tested it.
303 tested_password_server
= True
;
305 if ((SVAL(cli
->inbuf
,smb_vwv2
) & 1) == 0) {
306 DEBUG(0,("server_validate: password server %s allows users as non-guest \
307 with a bad password.\n", cli
->desthost
));
308 DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
309 use this machine as the password server.\n"));
313 * Password server has the bug.
315 bad_password_server
= True
;
316 return NT_STATUS_LOGON_FAILURE
;
323 * We have already tested the password server.
324 * Fail immediately if it has the bug.
327 if(bad_password_server
) {
328 DEBUG(0,("server_validate: [1] password server %s allows users as non-guest \
329 with a bad password.\n", cli
->desthost
));
330 DEBUG(0,("server_validate: [1] This is broken (and insecure) behaviour. Please do not \
331 use this machine as the password server.\n"));
332 return NT_STATUS_LOGON_FAILURE
;
337 * Now we know the password server will correctly set the guest bit, or is
338 * not guest enabled, we can try with the real password.
341 if (!user_info
->encrypted
) {
342 /* Plaintext available */
343 if (!cli_session_setup(cli
, user_info
->smb_name
.str
,
344 (char *)user_info
->plaintext_password
.data
,
345 user_info
->plaintext_password
.length
,
347 user_info
->domain
.str
)) {
348 DEBUG(1,("password server %s rejected the password\n", cli
->desthost
));
349 /* Make this cli_nt_error() when the conversion is in */
350 nt_status
= cli_nt_error(cli
);
352 nt_status
= NT_STATUS_OK
;
355 if (!cli_session_setup(cli
, user_info
->smb_name
.str
,
356 (char *)user_info
->lm_resp
.data
,
357 user_info
->lm_resp
.length
,
358 (char *)user_info
->nt_resp
.data
,
359 user_info
->nt_resp
.length
,
360 user_info
->domain
.str
)) {
361 DEBUG(1,("password server %s rejected the password\n", cli
->desthost
));
362 /* Make this cli_nt_error() when the conversion is in */
363 nt_status
= cli_nt_error(cli
);
365 nt_status
= NT_STATUS_OK
;
369 /* if logged in as guest then reject */
370 if ((SVAL(cli
->inbuf
,smb_vwv2
) & 1) != 0) {
371 DEBUG(1,("password server %s gave us guest only\n", cli
->desthost
));
372 nt_status
= NT_STATUS_LOGON_FAILURE
;
377 if (NT_STATUS_IS_OK(nt_status
)) {
378 struct passwd
*pass
= Get_Pwnam(user_info
->internal_username
.str
);
380 nt_status
= make_server_info_pw(server_info
, pass
);
382 auth_add_user_script(user_info
->domain
.str
, user_info
->internal_username
.str
);
383 pass
= Get_Pwnam(user_info
->internal_username
.str
);
386 nt_status
= make_server_info_pw(server_info
, pass
);
388 nt_status
= NT_STATUS_NO_SUCH_USER
;
393 if (locally_made_cli
) {
400 static NTSTATUS
auth_init_smbserver(struct auth_context
*auth_context
, const char* param
, auth_methods
**auth_method
)
402 if (!make_auth_methods(auth_context
, auth_method
)) {
403 return NT_STATUS_NO_MEMORY
;
405 (*auth_method
)->name
= "smbserver";
406 (*auth_method
)->auth
= check_smbserver_security
;
407 (*auth_method
)->get_chal
= auth_get_challenge_server
;
408 (*auth_method
)->send_keepalive
= send_server_keepalive
;
409 (*auth_method
)->free_private_data
= free_server_private_data
;
413 NTSTATUS
auth_server_init(void)
415 return smb_register_auth(AUTH_INTERFACE_VERSION
, "smbserver", auth_init_smbserver
);