source4/auth/auth_server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authenticate to a remote server
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett 2001
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 /****************************************************************************
  25  Support for server level security.
  26 ****************************************************************************/
  27
  28 static struct smbcli_state *server_cryptkey(TALLOC_CTX *mem_ctx)
  29 {
  30         struct smbcli_state *cli = NULL;
  31         fstring desthost;
  32         struct ipv4_addr dest_ip;
  33         const char *p;
  34         char *pserver;
  35         BOOL connected_ok = False;
  36
  37         if (!(cli = smbcli_initialise(cli)))
  38                 return NULL;
  39
  40         /* security = server just can't function with spnego */
  41         cli->use_spnego = False;
  42
  43         pserver = talloc_strdup(mem_ctx, lp_passwordserver());
  44         p = pserver;
  45
  46         while(next_token( &p, desthost, LIST_SEP, sizeof(desthost))) {
  47                 strupper(desthost);
  48
  49                 if(!resolve_name( desthost, &dest_ip, 0x20)) {
  50                         DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost));
  51                         continue;
  52                 }
  53
  54                 if (ismyip(dest_ip)) {
  55                         DEBUG(1,("Password server loop - disabling password server %s\n",desthost));
  56                         continue;
  57                 }
  58
  59                 /* we use a mutex to prevent two connections at once - when a
  60                    Win2k PDC get two connections where one hasn't completed a
  61                    session setup yet it will send a TCP reset to the first
  62                    connection (tridge) */
  63
  64                 if (!grab_server_mutex(desthost)) {
  65                         return NULL;
  66                 }
  67
  68                 if (smbcli_connect(cli, desthost, &dest_ip)) {
  69                         DEBUG(3,("connected to password server %s\n",desthost));
  70                         connected_ok = True;
  71                         break;
  72                 }
  73         }
  74
  75         if (!connected_ok) {
  76                 release_server_mutex();
  77                 DEBUG(0,("password server not available\n"));
  78                 talloc_free(cli);
  79                 return NULL;
  80         }
  81
  82         if (!attempt_netbios_session_request(cli, lp_netbios_name(),
  83                                              desthost, &dest_ip)) {
  84                 release_server_mutex();
  85                 DEBUG(1,("password server fails session request\n"));
  86                 talloc_free(cli);
  87                 return NULL;
  88         }
  89
  90         if (strequal(desthost,myhostname(mem_ctx))) {
  91                 exit_server("Password server loop!");
  92         }
  93
  94         DEBUG(3,("got session\n"));
  95
  96         if (!smbcli_negprot(cli)) {
  97                 DEBUG(1,("%s rejected the negprot\n",desthost));
  98                 release_server_mutex();
  99                 talloc_free(cli);
 100                 return NULL;
 101         }
 102
 103         if (cli->protocol < PROTOCOL_LANMAN2 ||
 104             !(cli->sec_mode & NEGOTIATE_SECURITY_USER_LEVEL)) {
 105                 DEBUG(1,("%s isn't in user level security mode\n",desthost));
 106                 release_server_mutex();
 107                 talloc_free(cli);
 108                 return NULL;
 109         }
 110
 111         /* Get the first session setup done quickly, to avoid silly
 112            Win2k bugs.  (The next connection to the server will kill
 113            this one...
 114         */
 115
 116         if (!smbcli_session_setup(cli, "", "", 0, "", 0,
 117                                "")) {
 118                 DEBUG(0,("%s rejected the initial session setup (%s)\n",
 119                          desthost, smbcli_errstr(cli)));
 120                 release_server_mutex();
 121                 talloc_free(cli);
 122                 return NULL;
 123         }
 124
 125         release_server_mutex();
 126
 127         DEBUG(3,("password server OK\n"));
 128
 129         return cli;
 130 }
 131
 132 /****************************************************************************
 133  Clean up our allocated cli.
 134 ****************************************************************************/
 135
 136 static void free_server_private_data(void **private_data_pointer)
 137 {
 138         struct smbcli_state **cli = (struct smbcli_state **)private_data_pointer;
 139         if (*cli && (*cli)->initialised) {
 140                 talloc_free(*cli);
 141         }
 142 }
 143
 144 /****************************************************************************
 145  Get the challenge out of a password server.
 146 ****************************************************************************/
 147
 148 static DATA_BLOB auth_get_challenge_server(const struct auth_context *auth_context,
 149                                            void **my_private_data,
 150                                            TALLOC_CTX *mem_ctx)
 151 {
 152         struct smbcli_state *cli = server_cryptkey(mem_ctx);
 153
 154         if (cli) {
 155                 DEBUG(3,("using password server validation\n"));
 156
 157                 if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
 158                         /* We can't work with unencrypted password servers
 159                            unless 'encrypt passwords = no' */
 160                         DEBUG(5,("make_auth_info_server: Server is unencrypted, no challenge available..\n"));
 161
 162                         /* However, it is still a perfectly fine connection
 163                            to pass that unencrypted password over */
 164                         *my_private_data = (void *)cli;
 165                         return data_blob(NULL, 0);
 166
 167                 } else if (cli->secblob.length < 8) {
 168                         /* We can't do much if we don't get a full challenge */
 169                         DEBUG(2,("make_auth_info_server: Didn't receive a full challenge from server\n"));
 170                         talloc_free(cli);
 171                         return data_blob(NULL, 0);
 172                 }
 173
 174                 *my_private_data = (void *)cli;
 175
 176                 /* The return must be allocated on the caller's mem_ctx, as our own will be
 177                    destoyed just after the call. */
 178                 return data_blob_talloc(auth_context->mem_ctx, cli->secblob.data,8);
 179         } else {
 180                 return data_blob(NULL, 0);
 181         }
 182 }
 183
 184
 185 /****************************************************************************
 186  Check for a valid username and password in security=server mode.
 187   - Validate a password with the password server.
 188 ****************************************************************************/
 189
 190 static NTSTATUS check_smbserver_security(const struct auth_context *auth_context,
 191                                          void *my_private_data,
 192                                          TALLOC_CTX *mem_ctx,
 193                                          const auth_usersupplied_info *user_info,
 194                                          auth_serversupplied_info **server_info)
 195 {
 196         struct smbcli_state *cli;
 197         static uint8_t badpass[24];
 198         static fstring baduser;
 199         static BOOL tested_password_server = False;
 200         static BOOL bad_password_server = False;
 201         NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
 202         BOOL locally_made_cli = False;
 203
 204         /*
 205          * Check that the requested domain is not our own machine name.
 206          * If it is, we should never check the PDC here, we use our own local
 207          * password file.
 208          */
 209
 210         if(is_myname(user_info->domain.str)) {
 211                 DEBUG(3,("check_smbserver_security: Requested domain was for this machine.\n"));
 212                 return NT_STATUS_LOGON_FAILURE;
 213         }
 214
 215         cli = my_private_data;
 216
 217         if (cli) {
 218         } else {
 219                 cli = server_cryptkey(mem_ctx);
 220                 locally_made_cli = True;
 221         }
 222
 223         if (!cli || !cli->initialised) {
 224                 DEBUG(1,("password server is not connected (cli not initilised)\n"));
 225                 return NT_STATUS_LOGON_FAILURE;
 226         }
 227
 228         if ((cli->sec_mode & NEGOTIATE_SECURITY_CHALLENGE_RESPONSE) == 0) {
 229                 if (user_info->encrypted) {
 230                         DEBUG(1,("password server %s is plaintext, but we are encrypted. This just can't work :-(\n", cli->desthost));
 231                         return NT_STATUS_LOGON_FAILURE;
 232                 }
 233         } else {
 234                 if (memcmp(cli->secblob.data, auth_context->challenge.data, 8) != 0) {
 235                         DEBUG(1,("the challenge that the password server (%s) supplied us is not the one we gave our client. This just can't work :-(\n", cli->desthost));
 236                         return NT_STATUS_LOGON_FAILURE;
 237                 }
 238         }
 239
 240         if(badpass[0] == 0)
 241                 memset(badpass, 0x1f, sizeof(badpass));
 242
 243         if((user_info->nt_resp.length == sizeof(badpass)) &&
 244            !memcmp(badpass, user_info->nt_resp.data, sizeof(badpass))) {
 245                 /*
 246                  * Very unlikely, our random bad password is the same as the users
 247                  * password.
 248                  */
 249                 memset(badpass, badpass[0]+1, sizeof(badpass));
 250         }
 251
 252         if(baduser[0] == 0) {
 253                 fstrcpy(baduser, INVALID_USER_PREFIX);
 254                 fstrcat(baduser, lp_netbios_name());
 255         }
 256
 257         /*
 258          * Attempt a session setup with a totally incorrect password.
 259          * If this succeeds with the guest bit *NOT* set then the password
 260          * server is broken and is not correctly setting the guest bit. We
 261          * need to detect this as some versions of NT4.x are broken. JRA.
 262          */
 263
 264         /* I sure as hell hope that there aren't servers out there that take
 265          * NTLMv2 and have this bug, as we don't test for that...
 266          *  - abartlet@samba.org
 267          */
 268
 269         if ((!tested_password_server) && (lp_paranoid_server_security())) {
 270                 if (smbcli_session_setup(cli, baduser, (char *)badpass, sizeof(badpass),
 271                                         (char *)badpass, sizeof(badpass), user_info->domain.str)) {
 272
 273                         /*
 274                          * We connected to the password server so we
 275                          * can say we've tested it.
 276                          */
 277                         tested_password_server = True;
 278
 279                         if ((SVAL(cli->inbuf,smb_vwv2) & 1) == 0) {
 280                                 DEBUG(0,("server_validate: password server %s allows users as non-guest \
 281 with a bad password.\n", cli->desthost));
 282                                 DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
 283 use this machine as the password server.\n"));
 284                                 smbcli_ulogoff(cli);
 285
 286                                 /*
 287                                  * Password server has the bug.
 288                                  */
 289                                 bad_password_server = True;
 290                                 return NT_STATUS_LOGON_FAILURE;
 291                         }
 292                         smbcli_ulogoff(cli);
 293                 }
 294         } else {
 295
 296                 /*
 297                  * We have already tested the password server.
 298                  * Fail immediately if it has the bug.
 299                  */
 300
 301                 if(bad_password_server) {
 302                         DEBUG(0,("server_validate: [1] password server %s allows users as non-guest \
 303 with a bad password.\n", cli->desthost));
 304                         DEBUG(0,("server_validate: [1] This is broken (and insecure) behaviour. Please do not \
 305 use this machine as the password server.\n"));
 306                         return NT_STATUS_LOGON_FAILURE;
 307                 }
 308         }
 309
 310         /*
 311          * Now we know the password server will correctly set the guest bit, or is
 312          * not guest enabled, we can try with the real password.
 313          */
 314
 315         if (!user_info->encrypted) {
 316                 /* Plaintext available */
 317                 if (!smbcli_session_setup(cli, user_info->smb_name.str,
 318                                        (char *)user_info->plaintext_password.data,
 319                                        user_info->plaintext_password.length,
 320                                        NULL, 0,
 321                                        user_info->domain.str)) {
 322                         DEBUG(1,("password server %s rejected the password\n", cli->desthost));
 323                         /* Make this smbcli_nt_error() when the conversion is in */
 324                         nt_status = smbcli_nt_error(cli);
 325                 } else {
 326                         nt_status = NT_STATUS_OK;
 327                 }
 328         } else {
 329                 if (!smbcli_session_setup(cli, user_info->smb_name.str,
 330                                        (char *)user_info->lm_resp.data,
 331                                        user_info->lm_resp.length,
 332                                        (char *)user_info->nt_resp.data,
 333                                        user_info->nt_resp.length,
 334                                        user_info->domain.str)) {
 335                         DEBUG(1,("password server %s rejected the password\n", cli->desthost));
 336                         /* Make this smbcli_nt_error() when the conversion is in */
 337                         nt_status = smbcli_nt_error(cli);
 338                 } else {
 339                         nt_status = NT_STATUS_OK;
 340                 }
 341         }
 342
 343         /* if logged in as guest then reject */
 344         if ((SVAL(cli->inbuf,smb_vwv2) & 1) != 0) {
 345                 DEBUG(1,("password server %s gave us guest only\n", cli->desthost));
 346                 nt_status = NT_STATUS_LOGON_FAILURE;
 347         }
 348
 349         smbcli_ulogoff(cli);
 350
 351         if NT_STATUS_IS_OK(nt_status) {
 352                 struct passwd *pass = Get_Pwnam(user_info->internal_username.str);
 353                 if (pass) {
 354                         nt_status = make_server_info_pw(auth_context, server_info, pass);
 355                 } else {
 356                         nt_status = NT_STATUS_NO_SUCH_USER;
 357                 }
 358         }
 359
 360         if (locally_made_cli) {
 361                 talloc_free(cli);
 362         }
 363
 364         return(nt_status);
 365 }
 366
 367 NTSTATUS auth_init_smbserver(struct auth_context *auth_context, const char* param, auth_methods **auth_method)
 368 {
 369         if (!make_auth_methods(auth_context, auth_method)) {
 370                 return NT_STATUS_NO_MEMORY;
 371         }
 372         (*auth_method)->name = "smbserver";
 373         (*auth_method)->auth = check_smbserver_security;
 374         (*auth_method)->get_chal = auth_get_challenge_server;
 375         (*auth_method)->send_keepalive = send_server_keepalive;
 376         (*auth_method)->free_private_data = free_server_private_data;
 377         return NT_STATUS_OK;
 378 }