source/lib/account_pol.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  account policy storage
   4  *  Copyright (C) Jean François Micouleau      1998-2001.
   5  *  Copyright (C) Andrew Bartlett              2002
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 2 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, write to the Free Software
  19  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20  */
  21
  22 #include "includes.h"
  23 static TDB_CONTEXT *tdb;
  24
  25 #define DATABASE_VERSION 2
  26
  27 /****************************************************************************
  28  Set default for a field if it is empty
  29 ****************************************************************************/
  30
  31 static void set_default_on_empty(int field, uint32 value)
  32 {
  33         if (account_policy_get(field, NULL))
  34                 return;
  35         account_policy_set(field, value);
  36         return;
  37 }
  38
  39 /****************************************************************************
  40  Open the account policy tdb.
  41 ****************************************************************************/
  42
  43 BOOL init_account_policy(void)
  44 {
  45         const char *vstring = "INFO/version";
  46         uint32 version;
  47
  48         if (tdb)
  49                 return True;
  50         tdb = tdb_open_log(lock_path("account_policy.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
  51         if (!tdb) {
  52                 DEBUG(0,("Failed to open account policy database\n"));
  53                 return False;
  54         }
  55
  56         /* handle a Samba upgrade */
  57         tdb_lock_bystring(tdb, vstring,0);
  58         if (!tdb_fetch_uint32(tdb, vstring, &version) || version != DATABASE_VERSION) {
  59                 tdb_store_uint32(tdb, vstring, DATABASE_VERSION);
  60
  61                 set_default_on_empty(
  62                         AP_MIN_PASSWORD_LEN,
  63                         MINPASSWDLENGTH);/* 5 chars minimum             */
  64                 set_default_on_empty(
  65                         AP_PASSWORD_HISTORY,
  66                         0);             /* don't keep any old password  */
  67                 set_default_on_empty(
  68                         AP_USER_MUST_LOGON_TO_CHG_PASS,
  69                         0);             /* don't force user to logon    */
  70                 set_default_on_empty(
  71                         AP_MAX_PASSWORD_AGE,
  72                         (uint32)-1);    /* don't expire                 */
  73                 set_default_on_empty(
  74                         AP_MIN_PASSWORD_AGE,
  75                         0);             /* 0 days                      */
  76                 set_default_on_empty(
  77                         AP_LOCK_ACCOUNT_DURATION,
  78                         30);            /* lockout for 30 minutes      */
  79                 set_default_on_empty(
  80                         AP_RESET_COUNT_TIME,
  81                         30);            /* reset after 30 minutes      */
  82                 set_default_on_empty(
  83                         AP_BAD_ATTEMPT_LOCKOUT,
  84                         0);             /* don't lockout               */
  85                 set_default_on_empty(
  86                         AP_TIME_TO_LOGOUT,
  87                         -1);            /* don't force logout          */
  88                 set_default_on_empty(
  89                         AP_REFUSE_MACHINE_PW_CHANGE,
  90                         0);             /* allow machine pw changes    */
  91         }
  92         tdb_unlock_bystring(tdb, vstring);
  93
  94         /* These exist by default on NT4 in [HKLM\SECURITY\Policy\Accounts] */
  95
  96         privilege_create_account( &global_sid_World );
  97         privilege_create_account( &global_sid_Builtin_Administrators );
  98         privilege_create_account( &global_sid_Builtin_Account_Operators );
  99         privilege_create_account( &global_sid_Builtin_Server_Operators );
 100         privilege_create_account( &global_sid_Builtin_Print_Operators );
 101         privilege_create_account( &global_sid_Builtin_Backup_Operators );
 102
 103         return True;
 104 }
 105
 106 static const struct {
 107         int field;
 108         const char *string;
 109 } account_policy_names[] = {
 110         {AP_MIN_PASSWORD_LEN, "min password length"},
 111         {AP_PASSWORD_HISTORY, "password history"},
 112         {AP_USER_MUST_LOGON_TO_CHG_PASS, "user must logon to change password"},
 113         {AP_MAX_PASSWORD_AGE, "maximum password age"},
 114         {AP_MIN_PASSWORD_AGE,"minimum password age"},
 115         {AP_LOCK_ACCOUNT_DURATION, "lockout duration"},
 116         {AP_RESET_COUNT_TIME, "reset count minutes"},
 117         {AP_BAD_ATTEMPT_LOCKOUT, "bad lockout attempt"},
 118         {AP_TIME_TO_LOGOUT, "disconnect time"},
 119         {AP_REFUSE_MACHINE_PW_CHANGE, "refuse machine password change"},
 120         {0, NULL}
 121 };
 122
 123 char *account_policy_names_list(void)
 124 {
 125         char *nl, *p;
 126         int i;
 127         size_t len = 0;
 128
 129         for (i=0; account_policy_names[i].string; i++) {
 130                 len += strlen(account_policy_names[i].string) + 1;
 131         }
 132         len++;
 133         nl = SMB_MALLOC(len);
 134         if (!nl) {
 135                 return NULL;
 136         }
 137         p = nl;
 138         for (i=0; account_policy_names[i].string; i++) {
 139                 memcpy(p, account_policy_names[i].string, strlen(account_policy_names[i].string) + 1);
 140                 p[strlen(account_policy_names[i].string)] = '\n';
 141                 p += strlen(account_policy_names[i].string) + 1;
 142         }
 143         *p = '\0';
 144         return nl;
 145 }
 146
 147 /****************************************************************************
 148 Get the account policy name as a string from its #define'ed number
 149 ****************************************************************************/
 150
 151 static const char *decode_account_policy_name(int field)
 152 {
 153         int i;
 154         for (i=0; account_policy_names[i].string; i++) {
 155                 if (field == account_policy_names[i].field)
 156                         return account_policy_names[i].string;
 157         }
 158         return NULL;
 159
 160 }
 161
 162 /****************************************************************************
 163 Get the account policy name as a string from its #define'ed number
 164 ****************************************************************************/
 165
 166 int account_policy_name_to_fieldnum(const char *name)
 167 {
 168         int i;
 169         for (i=0; account_policy_names[i].string; i++) {
 170                 if (strcmp(name, account_policy_names[i].string) == 0)
 171                         return account_policy_names[i].field;
 172         }
 173         return 0;
 174
 175 }
 176
 177 /****************************************************************************
 178 ****************************************************************************/
 179
 180 BOOL account_policy_get(int field, uint32 *value)
 181 {
 182         fstring name;
 183         uint32 regval;
 184
 185         if(!init_account_policy())return False;
 186
 187         if (value)
 188                 *value = 0;
 189
 190         fstrcpy(name, decode_account_policy_name(field));
 191         if (!*name) {
 192                 DEBUG(1, ("account_policy_get: Field %d is not a valid account policy type!  Cannot get, returning 0.\n", field));
 193                 return False;
 194         }
 195         if (!tdb_fetch_uint32(tdb, name, &regval)) {
 196                 DEBUG(1, ("account_policy_get: tdb_fetch_uint32 failed for field %d (%s), returning 0\n", field, name));
 197                 return False;
 198         }
 199         if (value)
 200                 *value = regval;
 201
 202         DEBUG(10,("account_policy_get: %s:%d\n", name, regval));
 203         return True;
 204 }
 205
 206
 207 /****************************************************************************
 208 ****************************************************************************/
 209 BOOL account_policy_set(int field, uint32 value)
 210 {
 211         fstring name;
 212
 213         if(!init_account_policy())return False;
 214
 215         fstrcpy(name, decode_account_policy_name(field));
 216         if (!*name) {
 217                 DEBUG(1, ("Field %d is not a valid account policy type!  Cannot set.\n", field));
 218                 return False;
 219         }
 220
 221         if (!tdb_store_uint32(tdb, name, value)) {
 222                 DEBUG(1, ("tdb_store_uint32 failed for field %d (%s) on value %u", field, name, value));
 223                 return False;
 224         }
 225
 226         DEBUG(10,("account_policy_set: %s:%d\n", name, value));
 227
 228         return True;
 229 }
 230
 231 /****************************************************************************
 232 ****************************************************************************/
 233
 234 TDB_CONTEXT *get_account_pol_tdb( void )
 235 {
 236
 237         if ( !tdb ) {
 238                 if ( !init_account_policy() )
 239                         return NULL;
 240         }
 241
 242         return tdb;
 243 }
 244