2 * Unix SMB/CIFS implementation.
3 * Periodic Trust account password changing.
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997.
7 * Copyright (C) Jeremy Allison 1998.
8 * Copyright (C) Andrew Bartlett 2001.
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 /*********************************************************
28 Change the domain password on the PDC.
29 **********************************************************/
31 static NTSTATUS
modify_trust_password( const char *domain
, const char *remote_machine
,
32 unsigned char orig_trust_passwd_hash
[16])
34 struct cli_state
*cli
;
39 * Ensure we have the domain SID for this domain.
42 if (!secrets_fetch_domain_sid(domain
, &domain_sid
)) {
43 DEBUG(0, ("modify_trust_password: unable to fetch domain sid.\n"));
44 return NT_STATUS_UNSUCCESSFUL
;
47 if (!NT_STATUS_IS_OK(cli_full_connection(&cli
, global_myname(), remote_machine
,
53 DEBUG(0,("modify_trust_password: Connection to %s failed!\n", remote_machine
));
54 return NT_STATUS_UNSUCCESSFUL
;
58 * Ok - we have an anonymous connection to the IPC$ share.
59 * Now start the NT Domain stuff :-).
62 if(cli_nt_session_open(cli
, PI_NETLOGON
) == False
) {
63 DEBUG(0,("modify_trust_password: unable to open the domain client session to machine %s. Error was : %s.\n",
64 remote_machine
, cli_errstr(cli
)));
65 cli_nt_session_close(cli
);
68 return NT_STATUS_UNSUCCESSFUL
;
71 nt_status
= trust_pw_change_and_store_it(cli
, cli
->mem_ctx
,
72 orig_trust_passwd_hash
);
74 cli_nt_session_close(cli
);
81 /************************************************************************
82 Change the trust account password for a domain.
83 ************************************************************************/
85 NTSTATUS
change_trust_account_password( const char *domain
, const char *remote_machine
)
87 unsigned char old_trust_passwd_hash
[16];
89 NTSTATUS res
= NT_STATUS_UNSUCCESSFUL
;
90 struct in_addr pdc_ip
;
94 if(!secrets_fetch_trust_account_password(domain
, old_trust_passwd_hash
, &lct
)) {
95 DEBUG(0,("change_trust_account_password: unable to read the machine account password for domain %s.\n",
97 return NT_STATUS_UNSUCCESSFUL
;
100 if (remote_machine
== NULL
|| !strcmp(remote_machine
, "*")) {
101 /* Use the PDC *only* for this */
103 if ( !get_pdc_ip(domain
, &pdc_ip
) ) {
104 DEBUG(0,("Can't get IP for PDC for domain %s\n", domain
));
108 if ( !lookup_dc_name(global_myname(), domain
, &pdc_ip
, dc_name
) )
111 /* supoport old deprecated "smbpasswd -j DOMAIN -r MACHINE" behavior */
113 fstrcpy( dc_name
, remote_machine
);
116 /* if this next call fails, then give up. We can't do
117 password changes on BDC's --jerry */
119 res
= modify_trust_password(domain
, dc_name
, old_trust_passwd_hash
);
122 if (!NT_STATUS_IS_OK(res
)) {
123 DEBUG(0,("%s : change_trust_account_password: Failed to change password for domain %s.\n",
124 timestring(False
), domain
));