2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Tridgell 1992-2000
5 Copyright (C) Luke Kenneth Casson Leighton 1996-2000
6 Copyright (C) Andrew Bartlett 2001
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 /****************************************************************************
26 core of smb password checking routine.
27 ****************************************************************************/
28 static BOOL
smb_pwd_check_ntlmv1(DATA_BLOB nt_response
,
29 const uchar
*part_passwd
,
31 uint8 user_sess_key
[16])
33 /* Finish the encryption of part_passwd. */
36 if (part_passwd
== NULL
) {
37 DEBUG(10,("No password set - DISALLOWING access\n"));
38 /* No password set - always false ! */
42 if (sec_blob
.length
!= 8) {
43 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect challenge size (%d)\n", sec_blob
.length
));
47 if (nt_response
.length
!= 24) {
48 DEBUG(0, ("smb_pwd_check_ntlmv1: incorrect password length (%d)\n", nt_response
.length
));
52 SMBOWFencrypt(part_passwd
, sec_blob
.data
, p24
);
53 if (user_sess_key
!= NULL
)
55 SMBsesskeygen_ntv1(part_passwd
, NULL
, user_sess_key
);
61 DEBUG(100,("Part password (P16) was |"));
62 dump_data(100, part_passwd
, 16);
63 DEBUG(100,("Password from client was |"));
64 dump_data(100, nt_response
.data
, nt_response
.length
);
65 DEBUG(100,("Given challenge was |"));
66 dump_data(100, sec_blob
.data
, sec_blob
.length
);
67 DEBUG(100,("Value from encryption was |"));
68 dump_data(100, p24
, 24);
70 return (memcmp(p24
, nt_response
.data
, 24) == 0);
73 /****************************************************************************
74 core of smb password checking routine.
75 ****************************************************************************/
76 static BOOL
smb_pwd_check_ntlmv2(const DATA_BLOB ntv2_response
,
77 const uchar
*part_passwd
,
78 const DATA_BLOB sec_blob
,
79 const char *user
, const char *domain
,
80 uint8 user_sess_key
[16])
82 /* Finish the encryption of part_passwd. */
84 uchar value_from_encryption
[16];
85 uchar client_response
[16];
86 DATA_BLOB client_key_data
;
88 if (part_passwd
== NULL
)
90 DEBUG(10,("No password set - DISALLOWING access\n"));
91 /* No password set - always False */
95 if (ntv2_response
.length
< 16) {
96 /* We MUST have more than 16 bytes, or the stuff below will go
98 DEBUG(0, ("smb_pwd_check_ntlmv2: incorrect password length (%d)\n",
99 ntv2_response
.length
));
103 client_key_data
= data_blob(ntv2_response
.data
+16, ntv2_response
.length
-16);
104 memcpy(client_response
, ntv2_response
.data
, sizeof(client_response
));
106 ntv2_owf_gen(part_passwd
, user
, domain
, kr
);
107 SMBOWFencrypt_ntv2(kr
, sec_blob
, client_key_data
, (char *)value_from_encryption
);
108 if (user_sess_key
!= NULL
)
110 SMBsesskeygen_ntv2(kr
, value_from_encryption
, user_sess_key
);
114 DEBUG(100,("Part password (P16) was |"));
115 dump_data(100, part_passwd
, 16);
116 DEBUG(100,("Password from client was |"));
117 dump_data(100, ntv2_response
.data
, ntv2_response
.length
);
118 DEBUG(100,("Variable data from client was |"));
119 dump_data(100, client_key_data
.data
, client_key_data
.length
);
120 DEBUG(100,("Given challenge was |"));
121 dump_data(100, sec_blob
.data
, sec_blob
.length
);
122 DEBUG(100,("Value from encryption was |"));
123 dump_data(100, value_from_encryption
, 16);
125 data_blob_clear_free(&client_key_data
);
126 return (memcmp(value_from_encryption
, client_response
, 16) == 0);
130 /****************************************************************************
131 Do a specific test for an smb password being correct, given a smb_password and
132 the lanman and NT responses.
133 ****************************************************************************/
134 static NTSTATUS
sam_password_ok(const struct auth_context
*auth_context
,
136 SAM_ACCOUNT
*sampass
,
137 const auth_usersupplied_info
*user_info
,
138 uint8 user_sess_key
[16])
141 const uint8
*nt_pw
, *lm_pw
;
144 acct_ctrl
= pdb_get_acct_ctrl(sampass
);
145 if (acct_ctrl
& ACB_PWNOTREQ
)
147 if (lp_null_passwords())
149 DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", pdb_get_username(sampass
)));
150 return(NT_STATUS_OK
);
154 DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", pdb_get_username(sampass
)));
155 return(NT_STATUS_LOGON_FAILURE
);
159 nt_pw
= pdb_get_nt_passwd(sampass
);
160 lm_pw
= pdb_get_lanman_passwd(sampass
);
162 auth_flags
= user_info
->auth_flags
;
165 DEBUG(3,("sam_password_ok: NO NT password stored for user %s.\n",
166 pdb_get_username(sampass
)));
167 /* No return, we want to check the LM hash below in this case */
168 auth_flags
&= (~(AUTH_FLAG_NTLMv2_RESP
| AUTH_FLAG_NTLM_RESP
));
171 if (auth_flags
& AUTH_FLAG_NTLMv2_RESP
) {
172 /* We have the NT MD4 hash challenge available - see if we can
173 use it (ie. does it exist in the smbpasswd file).
175 DEBUG(4,("sam_password_ok: Checking NTLMv2 password\n"));
176 if (smb_pwd_check_ntlmv2( user_info
->nt_resp
,
177 nt_pw
, auth_context
->challenge
,
178 user_info
->smb_name
.str
,
179 user_info
->client_domain
.str
,
184 DEBUG(3,("sam_password_ok: NTLMv2 password check failed\n"));
185 return NT_STATUS_WRONG_PASSWORD
;
187 } else if (auth_flags
& AUTH_FLAG_NTLM_RESP
) {
188 if (lp_ntlm_auth()) {
189 /* We have the NT MD4 hash challenge available - see if we can
190 use it (ie. does it exist in the smbpasswd file).
192 DEBUG(4,("sam_password_ok: Checking NT MD4 password\n"));
193 if (smb_pwd_check_ntlmv1(user_info
->nt_resp
,
194 nt_pw
, auth_context
->challenge
,
199 DEBUG(3,("sam_password_ok: NT MD4 password check failed for user %s\n",pdb_get_username(sampass
)));
200 return NT_STATUS_WRONG_PASSWORD
;
203 DEBUG(2,("sam_password_ok: NTLMv1 passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass
)));
204 /* No return, we want to check the LM hash below in this case */
209 DEBUG(3,("sam_password_ok: NO LanMan password set for user %s (and no NT password supplied)\n",pdb_get_username(sampass
)));
210 auth_flags
&= (~AUTH_FLAG_LM_RESP
);
213 if (auth_flags
& AUTH_FLAG_LM_RESP
) {
215 if (user_info
->lm_resp
.length
!= 24) {
216 DEBUG(2,("sam_password_ok: invalid LanMan password length (%d) for user %s\n",
217 user_info
->nt_resp
.length
, pdb_get_username(sampass
)));
220 if (!lp_lanman_auth()) {
221 DEBUG(3,("sam_password_ok: Lanman passwords NOT PERMITTED for user %s\n",pdb_get_username(sampass
)));
222 return NT_STATUS_LOGON_FAILURE
;
225 DEBUG(4,("sam_password_ok: Checking LM password\n"));
226 if (smb_pwd_check_ntlmv1(user_info
->lm_resp
,
227 lm_pw
, auth_context
->challenge
,
232 DEBUG(4,("sam_password_ok: LM password check failed for user %s\n",pdb_get_username(sampass
)));
233 return NT_STATUS_WRONG_PASSWORD
;
237 /* Should not be reached, but if they send nothing... */
238 DEBUG(3,("sam_password_ok: NEITHER LanMan nor NT password supplied for user %s\n",pdb_get_username(sampass
)));
239 return NT_STATUS_WRONG_PASSWORD
;
242 /****************************************************************************
243 Do a specific test for a SAM_ACCOUNT being vaild for this connection
244 (ie not disabled, expired and the like).
245 ****************************************************************************/
246 static NTSTATUS
sam_account_ok(TALLOC_CTX
*mem_ctx
,
247 SAM_ACCOUNT
*sampass
,
248 const auth_usersupplied_info
*user_info
)
250 uint16 acct_ctrl
= pdb_get_acct_ctrl(sampass
);
251 char *workstation_list
;
254 DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n",pdb_get_username(sampass
)));
256 /* Quit if the account was disabled. */
257 if (acct_ctrl
& ACB_DISABLED
) {
258 DEBUG(1,("Account for user '%s' was disabled.\n", pdb_get_username(sampass
)));
259 return NT_STATUS_ACCOUNT_DISABLED
;
262 /* Test account expire time */
264 kickoff_time
= pdb_get_kickoff_time(sampass
);
265 if (kickoff_time
!= 0 && time(NULL
) > kickoff_time
) {
266 DEBUG(1,("Account for user '%s' has expried.\n", pdb_get_username(sampass
)));
267 DEBUG(3,("Account expired at '%ld' unix time.\n", (long)kickoff_time
));
268 return NT_STATUS_ACCOUNT_EXPIRED
;
271 if (!(pdb_get_acct_ctrl(sampass
) & ACB_PWNOEXP
)) {
272 time_t must_change_time
= pdb_get_pass_must_change_time(sampass
);
273 time_t last_set_time
= pdb_get_pass_last_set_time(sampass
);
275 /* check for immediate expiry "must change at next logon" */
276 if (must_change_time
== 0 && last_set_time
!= 0) {
277 DEBUG(1,("Account for user '%s' password must change!.\n", pdb_get_username(sampass
)));
278 return NT_STATUS_PASSWORD_MUST_CHANGE
;
281 /* check for expired password */
282 if (must_change_time
< time(NULL
) && must_change_time
!= 0) {
283 DEBUG(1,("Account for user '%s' password expired!.\n", pdb_get_username(sampass
)));
284 DEBUG(1,("Password expired at '%s' (%ld) unix time.\n", http_timestring(must_change_time
), (long)must_change_time
));
285 return NT_STATUS_PASSWORD_EXPIRED
;
289 /* Test workstation. Workstation list is comma separated. */
291 workstation_list
= talloc_strdup(mem_ctx
, pdb_get_workstations(sampass
));
293 if (!workstation_list
) return NT_STATUS_NO_MEMORY
;
295 if (*workstation_list
) {
296 BOOL invalid_ws
= True
;
297 char *s
= workstation_list
;
301 while (next_token(&s
, tok
, ",", sizeof(tok
))) {
302 DEBUG(10,("checking for workstation match %s and %s (len=%d)\n",
303 tok
, user_info
->wksta_name
.str
, user_info
->wksta_name
.len
));
304 if(strequal(tok
, user_info
->wksta_name
.str
)) {
311 return NT_STATUS_INVALID_WORKSTATION
;
314 if (acct_ctrl
& ACB_DOMTRUST
) {
315 DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", pdb_get_username(sampass
)));
316 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT
;
319 if (acct_ctrl
& ACB_SVRTRUST
) {
320 DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", pdb_get_username(sampass
)));
321 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT
;
324 if (acct_ctrl
& ACB_WSTRUST
) {
325 DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", pdb_get_username(sampass
)));
326 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT
;
333 /****************************************************************************
334 check if a username/password is OK assuming the password is a 24 byte
335 SMB hash supplied in the user_info structure
336 return an NT_STATUS constant.
337 ****************************************************************************/
339 static NTSTATUS
check_sam_security(const struct auth_context
*auth_context
,
340 void *my_private_data
,
342 const auth_usersupplied_info
*user_info
,
343 auth_serversupplied_info
**server_info
)
345 SAM_ACCOUNT
*sampass
=NULL
;
348 uint8 user_sess_key
[16];
349 const uint8
* lm_hash
;
351 if (!user_info
|| !auth_context
) {
352 return NT_STATUS_UNSUCCESSFUL
;
355 /* Can't use the talloc version here, becouse the returned struct gets
356 kept on the server_info */
357 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(&sampass
))) {
361 /* get the account information */
364 ret
= pdb_getsampwnam(sampass
, user_info
->internal_username
.str
);
369 DEBUG(1,("Couldn't find user '%s' in passdb file.\n", user_info
->internal_username
.str
));
370 pdb_free_sam(&sampass
);
371 return NT_STATUS_NO_SUCH_USER
;
374 nt_status
= sam_password_ok(auth_context
, mem_ctx
, sampass
, user_info
, user_sess_key
);
376 if (!NT_STATUS_IS_OK(nt_status
)) {
377 pdb_free_sam(&sampass
);
381 nt_status
= sam_account_ok(mem_ctx
, sampass
, user_info
);
383 if (!NT_STATUS_IS_OK(nt_status
)) {
384 pdb_free_sam(&sampass
);
388 if (!make_server_info_sam(server_info
, sampass
)) {
389 DEBUG(0,("failed to malloc memory for server_info\n"));
390 return NT_STATUS_NO_MEMORY
;
393 lm_hash
= pdb_get_lanman_passwd((*server_info
)->sam_account
);
395 memcpy((*server_info
)->first_8_lm_hash
, lm_hash
, 8);
398 memcpy((*server_info
)->session_key
, user_sess_key
, sizeof(user_sess_key
));
403 /* module initialisation */
404 BOOL
auth_init_sam(struct auth_context
*auth_context
, auth_methods
**auth_method
)
406 if (!make_auth_methods(auth_context
, auth_method
)) {
410 (*auth_method
)->auth
= check_sam_security
;
415 /****************************************************************************
416 Check SAM security (above) but with a few extra checks.
417 ****************************************************************************/
419 static NTSTATUS
check_samstrict_security(const struct auth_context
*auth_context
,
420 void *my_private_data
,
422 const auth_usersupplied_info
*user_info
,
423 auth_serversupplied_info
**server_info
)
426 if (!user_info
|| !auth_context
) {
427 return NT_STATUS_LOGON_FAILURE
;
430 /* If we are a domain member, we must not
431 attempt to check the password locally,
432 unless it is one of our aliases. */
434 if (!is_netbios_alias_or_name(user_info
->domain
.str
)) {
435 return NT_STATUS_NO_SUCH_USER
;
438 return check_sam_security(auth_context
, my_private_data
, mem_ctx
, user_info
, server_info
);
441 /* module initialisation */
442 BOOL
auth_init_samstrict(struct auth_context
*auth_context
, auth_methods
**auth_method
)
444 if (!make_auth_methods(auth_context
, auth_method
)) {
448 (*auth_method
)->auth
= check_samstrict_security
;