?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
dsdb: Add test for modification of two attributes, one permitted, one denied (bug...
[Samba/gebeck_regimport.git] / nsswitch / pam_winbind.c
blob682af8ee88044f88c17fc3aacd7f2c863b726c7d
1 /* pam_winbind module
2
3 Copyright Andrew Tridgell <tridge@samba.org> 2000
4 Copyright Tim Potter <tpot@samba.org> 2000
5 Copyright Andrew Bartlett <abartlet@samba.org> 2002
6 Copyright Guenther Deschner <gd@samba.org> 2005-2008
7
8 largely based on pam_userdb by Cristian Gafton <gafton@redhat.com> also
9 contains large slabs of code from pam_unix by Elliot Lee
10 <sopwith@redhat.com> (see copyright below for full details)
11 */
12
13 #define UID_WRAPPER_NOT_REPLACE
14
15 #include "pam_winbind.h"
16
17 static int wbc_error_to_pam_error(wbcErr status)
18 {
19 switch (status) {
20 case WBC_ERR_SUCCESS:
21 return PAM_SUCCESS;
22 case WBC_ERR_NOT_IMPLEMENTED:
23 return PAM_SERVICE_ERR;
24 case WBC_ERR_UNKNOWN_FAILURE:
25 break;
26 case WBC_ERR_NO_MEMORY:
27 return PAM_BUF_ERR;
28 case WBC_ERR_INVALID_SID:
29 case WBC_ERR_INVALID_PARAM:
30 break;
31 case WBC_ERR_WINBIND_NOT_AVAILABLE:
32 return PAM_AUTHINFO_UNAVAIL;
33 case WBC_ERR_DOMAIN_NOT_FOUND:
34 return PAM_AUTHINFO_UNAVAIL;
35 case WBC_ERR_INVALID_RESPONSE:
36 return PAM_BUF_ERR;
37 case WBC_ERR_NSS_ERROR:
38 return PAM_USER_UNKNOWN;
39 case WBC_ERR_AUTH_ERROR:
40 return PAM_AUTH_ERR;
41 case WBC_ERR_UNKNOWN_USER:
42 return PAM_USER_UNKNOWN;
43 case WBC_ERR_UNKNOWN_GROUP:
44 return PAM_USER_UNKNOWN;
45 case WBC_ERR_PWD_CHANGE_FAILED:
46 break;
47 }
48
49 /* be paranoid */
50 return PAM_AUTH_ERR;
51 }
52
53 static const char *_pam_error_code_str(int err)
54 {
55 switch (err) {
56 case PAM_SUCCESS:
57 return "PAM_SUCCESS";
58 case PAM_OPEN_ERR:
59 return "PAM_OPEN_ERR";
60 case PAM_SYMBOL_ERR:
61 return "PAM_SYMBOL_ERR";
62 case PAM_SERVICE_ERR:
63 return "PAM_SERVICE_ERR";
64 case PAM_SYSTEM_ERR:
65 return "PAM_SYSTEM_ERR";
66 case PAM_BUF_ERR:
67 return "PAM_BUF_ERR";
68 case PAM_PERM_DENIED:
69 return "PAM_PERM_DENIED";
70 case PAM_AUTH_ERR:
71 return "PAM_AUTH_ERR";
72 case PAM_CRED_INSUFFICIENT:
73 return "PAM_CRED_INSUFFICIENT";
74 case PAM_AUTHINFO_UNAVAIL:
75 return "PAM_AUTHINFO_UNAVAIL";
76 case PAM_USER_UNKNOWN:
77 return "PAM_USER_UNKNOWN";
78 case PAM_MAXTRIES:
79 return "PAM_MAXTRIES";
80 case PAM_NEW_AUTHTOK_REQD:
81 return "PAM_NEW_AUTHTOK_REQD";
82 case PAM_ACCT_EXPIRED:
83 return "PAM_ACCT_EXPIRED";
84 case PAM_SESSION_ERR:
85 return "PAM_SESSION_ERR";
86 case PAM_CRED_UNAVAIL:
87 return "PAM_CRED_UNAVAIL";
88 case PAM_CRED_EXPIRED:
89 return "PAM_CRED_EXPIRED";
90 case PAM_CRED_ERR:
91 return "PAM_CRED_ERR";
92 case PAM_NO_MODULE_DATA:
93 return "PAM_NO_MODULE_DATA";
94 case PAM_CONV_ERR:
95 return "PAM_CONV_ERR";
96 case PAM_AUTHTOK_ERR:
97 return "PAM_AUTHTOK_ERR";
98 case PAM_AUTHTOK_RECOVER_ERR:
99 return "PAM_AUTHTOK_RECOVER_ERR";
100 case PAM_AUTHTOK_LOCK_BUSY:
101 return "PAM_AUTHTOK_LOCK_BUSY";
102 case PAM_AUTHTOK_DISABLE_AGING:
103 return "PAM_AUTHTOK_DISABLE_AGING";
104 case PAM_TRY_AGAIN:
105 return "PAM_TRY_AGAIN";
106 case PAM_IGNORE:
107 return "PAM_IGNORE";
108 case PAM_ABORT:
109 return "PAM_ABORT";
110 case PAM_AUTHTOK_EXPIRED:
111 return "PAM_AUTHTOK_EXPIRED";
112 #ifdef PAM_MODULE_UNKNOWN
113 case PAM_MODULE_UNKNOWN:
114 return "PAM_MODULE_UNKNOWN";
115 #endif
116 #ifdef PAM_BAD_ITEM
117 case PAM_BAD_ITEM:
118 return "PAM_BAD_ITEM";
119 #endif
120 #ifdef PAM_CONV_AGAIN
121 case PAM_CONV_AGAIN:
122 return "PAM_CONV_AGAIN";
123 #endif
124 #ifdef PAM_INCOMPLETE
125 case PAM_INCOMPLETE:
126 return "PAM_INCOMPLETE";
127 #endif
128 default:
129 return NULL;
130 }
131 }
132
133 #define _PAM_LOG_FUNCTION_ENTER(function, ctx) \
134 do { \
135 _pam_log_debug(ctx, LOG_DEBUG, "[pamh: %p] ENTER: " \
136 function " (flags: 0x%04x)", ctx->pamh, ctx->flags); \
137 _pam_log_state(ctx); \
138 } while (0)
139
140 #define _PAM_LOG_FUNCTION_LEAVE(function, ctx, retval) \
141 do { \
142 _pam_log_debug(ctx, LOG_DEBUG, "[pamh: %p] LEAVE: " \
143 function " returning %d (%s)", ctx->pamh, retval, \
144 _pam_error_code_str(retval)); \
145 _pam_log_state(ctx); \
146 } while (0)
147
148 /* data tokens */
149
150 #define MAX_PASSWD_TRIES 3
151
152 #ifdef HAVE_GETTEXT
153 static char initialized = 0;
154
155 static inline void textdomain_init(void);
156 static inline void textdomain_init(void)
157 {
158 if (!initialized) {
159 bindtextdomain(MODULE_NAME, LOCALEDIR);
160 initialized = 1;
161 }
162 return;
163 }
164 #endif
165
166
167 /* some syslogging */
168
169 #ifdef HAVE_PAM_VSYSLOG
170 static void _pam_log_int(const pam_handle_t *pamh,
171 int err,
172 const char *format,
173 va_list args)
174 {
175 pam_vsyslog(pamh, err, format, args);
176 }
177 #else
178 static void _pam_log_int(const pam_handle_t *pamh,
179 int err,
180 const char *format,
181 va_list args)
182 {
183 char *format2 = NULL;
184 const char *service;
185
186 pam_get_item(pamh, PAM_SERVICE, (const void **) &service);
187
188 format2 = (char *)malloc(strlen(MODULE_NAME)+strlen(format)+strlen(service)+5);
189 if (format2 == NULL) {
190 /* what else todo ? */
191 vsyslog(err, format, args);
192 return;
193 }
194
195 sprintf(format2, "%s(%s): %s", MODULE_NAME, service, format);
196 vsyslog(err, format2, args);
197 SAFE_FREE(format2);
198 }
199 #endif /* HAVE_PAM_VSYSLOG */
200
201 static bool _pam_log_is_silent(int ctrl)
202 {
203 return on(ctrl, WINBIND_SILENT);
204 }
205
206 static void _pam_log(struct pwb_context *r, int err, const char *format, ...) PRINTF_ATTRIBUTE(3,4);
207 static void _pam_log(struct pwb_context *r, int err, const char *format, ...)
208 {
209 va_list args;
210
211 if (_pam_log_is_silent(r->ctrl)) {
212 return;
213 }
214
215 va_start(args, format);
216 _pam_log_int(r->pamh, err, format, args);
217 va_end(args);
218 }
219 static void __pam_log(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...) PRINTF_ATTRIBUTE(4,5);
220 static void __pam_log(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...)
221 {
222 va_list args;
223
224 if (_pam_log_is_silent(ctrl)) {
225 return;
226 }
227
228 va_start(args, format);
229 _pam_log_int(pamh, err, format, args);
230 va_end(args);
231 }
232
233 static bool _pam_log_is_debug_enabled(int ctrl)
234 {
235 if (ctrl == -1) {
236 return false;
237 }
238
239 if (_pam_log_is_silent(ctrl)) {
240 return false;
241 }
242
243 if (!(ctrl & WINBIND_DEBUG_ARG)) {
244 return false;
245 }
246
247 return true;
248 }
249
250 static bool _pam_log_is_debug_state_enabled(int ctrl)
251 {
252 if (!(ctrl & WINBIND_DEBUG_STATE)) {
253 return false;
254 }
255
256 return _pam_log_is_debug_enabled(ctrl);
257 }
258
259 static void _pam_log_debug(struct pwb_context *r, int err, const char *format, ...) PRINTF_ATTRIBUTE(3,4);
260 static void _pam_log_debug(struct pwb_context *r, int err, const char *format, ...)
261 {
262 va_list args;
263
264 if (!_pam_log_is_debug_enabled(r->ctrl)) {
265 return;
266 }
267
268 va_start(args, format);
269 _pam_log_int(r->pamh, err, format, args);
270 va_end(args);
271 }
272 static void __pam_log_debug(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...) PRINTF_ATTRIBUTE(4,5);
273 static void __pam_log_debug(const pam_handle_t *pamh, int ctrl, int err, const char *format, ...)
274 {
275 va_list args;
276
277 if (!_pam_log_is_debug_enabled(ctrl)) {
278 return;
279 }
280
281 va_start(args, format);
282 _pam_log_int(pamh, err, format, args);
283 va_end(args);
284 }
285
286 static void _pam_log_state_datum(struct pwb_context *ctx,
287 int item_type,
288 const char *key,
289 int is_string)
290 {
291 const void *data = NULL;
292 if (item_type != 0) {
293 pam_get_item(ctx->pamh, item_type, &data);
294 } else {
295 pam_get_data(ctx->pamh, key, &data);
296 }
297 if (data != NULL) {
298 const char *type = (item_type != 0) ? "ITEM" : "DATA";
299 if (is_string != 0) {
300 _pam_log_debug(ctx, LOG_DEBUG,
301 "[pamh: %p] STATE: %s(%s) = \"%s\" (%p)",
302 ctx->pamh, type, key, (const char *)data,
303 data);
304 } else {
305 _pam_log_debug(ctx, LOG_DEBUG,
306 "[pamh: %p] STATE: %s(%s) = %p",
307 ctx->pamh, type, key, data);
308 }
309 }
310 }
311
312 #define _PAM_LOG_STATE_DATA_POINTER(ctx, module_data_name) \
313 _pam_log_state_datum(ctx, 0, module_data_name, 0)
314
315 #define _PAM_LOG_STATE_DATA_STRING(ctx, module_data_name) \
316 _pam_log_state_datum(ctx, 0, module_data_name, 1)
317
318 #define _PAM_LOG_STATE_ITEM_POINTER(ctx, item_type) \
319 _pam_log_state_datum(ctx, item_type, #item_type, 0)
320
321 #define _PAM_LOG_STATE_ITEM_STRING(ctx, item_type) \
322 _pam_log_state_datum(ctx, item_type, #item_type, 1)
323
324 #ifdef DEBUG_PASSWORD
325 #define _LOG_PASSWORD_AS_STRING 1
326 #else
327 #define _LOG_PASSWORD_AS_STRING 0
328 #endif
329
330 #define _PAM_LOG_STATE_ITEM_PASSWORD(ctx, item_type) \
331 _pam_log_state_datum(ctx, item_type, #item_type, \
332 _LOG_PASSWORD_AS_STRING)
333
334 static void _pam_log_state(struct pwb_context *ctx)
335 {
336 if (!_pam_log_is_debug_state_enabled(ctx->ctrl)) {
337 return;
338 }
339
340 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_SERVICE);
341 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_USER);
342 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_TTY);
343 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_RHOST);
344 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_RUSER);
345 _PAM_LOG_STATE_ITEM_PASSWORD(ctx, PAM_OLDAUTHTOK);
346 _PAM_LOG_STATE_ITEM_PASSWORD(ctx, PAM_AUTHTOK);
347 _PAM_LOG_STATE_ITEM_STRING(ctx, PAM_USER_PROMPT);
348 _PAM_LOG_STATE_ITEM_POINTER(ctx, PAM_CONV);
349 #ifdef PAM_FAIL_DELAY
350 _PAM_LOG_STATE_ITEM_POINTER(ctx, PAM_FAIL_DELAY);
351 #endif
352 #ifdef PAM_REPOSITORY
353 _PAM_LOG_STATE_ITEM_POINTER(ctx, PAM_REPOSITORY);
354 #endif
355
356 _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_HOMEDIR);
357 _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_LOGONSCRIPT);
358 _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_LOGONSERVER);
359 _PAM_LOG_STATE_DATA_STRING(ctx, PAM_WINBIND_PROFILEPATH);
360 _PAM_LOG_STATE_DATA_STRING(ctx,
361 PAM_WINBIND_NEW_AUTHTOK_REQD);
362 /* Use atoi to get PAM result code */
363 _PAM_LOG_STATE_DATA_STRING(ctx,
364 PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH);
365 _PAM_LOG_STATE_DATA_POINTER(ctx, PAM_WINBIND_PWD_LAST_SET);
366 }
367
368 static int _pam_parse(const pam_handle_t *pamh,
369 int flags,
370 int argc,
371 const char **argv,
372 dictionary **result_d)
373 {
374 int ctrl = 0;
375 const char *config_file = NULL;
376 int i;
377 const char **v;
378 dictionary *d = NULL;
379
380 if (flags & PAM_SILENT) {
381 ctrl |= WINBIND_SILENT;
382 }
383
384 for (i=argc,v=argv; i-- > 0; ++v) {
385 if (!strncasecmp(*v, "config", strlen("config"))) {
386 ctrl |= WINBIND_CONFIG_FILE;
387 config_file = v[i];
388 break;
389 }
390 }
391
392 if (config_file == NULL) {
393 config_file = PAM_WINBIND_CONFIG_FILE;
394 }
395
396 d = iniparser_load(discard_const_p(char, config_file));
397 if (d == NULL) {
398 goto config_from_pam;
399 }
400
401 if (iniparser_getboolean(d, discard_const_p(char, "global:debug"), false)) {
402 ctrl |= WINBIND_DEBUG_ARG;
403 }
404
405 if (iniparser_getboolean(d, discard_const_p(char, "global:debug_state"), false)) {
406 ctrl |= WINBIND_DEBUG_STATE;
407 }
408
409 if (iniparser_getboolean(d, discard_const_p(char, "global:cached_login"), false)) {
410 ctrl |= WINBIND_CACHED_LOGIN;
411 }
412
413 if (iniparser_getboolean(d, discard_const_p(char, "global:krb5_auth"), false)) {
414 ctrl |= WINBIND_KRB5_AUTH;
415 }
416
417 if (iniparser_getboolean(d, discard_const_p(char, "global:silent"), false)) {
418 ctrl |= WINBIND_SILENT;
419 }
420
421 if (iniparser_getstring(d, discard_const_p(char, "global:krb5_ccache_type"), NULL) != NULL) {
422 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
423 }
424
425 if ((iniparser_getstring(d, discard_const_p(char, "global:require-membership-of"), NULL)
426 != NULL) ||
427 (iniparser_getstring(d, discard_const_p(char, "global:require_membership_of"), NULL)
428 != NULL)) {
429 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
430 }
431
432 if (iniparser_getboolean(d, discard_const_p(char, "global:try_first_pass"), false)) {
433 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
434 }
435
436 if (iniparser_getint(d, discard_const_p(char, "global:warn_pwd_expire"), 0)) {
437 ctrl |= WINBIND_WARN_PWD_EXPIRE;
438 }
439
440 if (iniparser_getboolean(d, discard_const_p(char, "global:mkhomedir"), false)) {
441 ctrl |= WINBIND_MKHOMEDIR;
442 }
443
444 config_from_pam:
445 /* step through arguments */
446 for (i=argc,v=argv; i-- > 0; ++v) {
447
448 /* generic options */
449 if (!strcmp(*v,"debug"))
450 ctrl |= WINBIND_DEBUG_ARG;
451 else if (!strcasecmp(*v, "debug_state"))
452 ctrl |= WINBIND_DEBUG_STATE;
453 else if (!strcasecmp(*v, "silent"))
454 ctrl |= WINBIND_SILENT;
455 else if (!strcasecmp(*v, "use_authtok"))
456 ctrl |= WINBIND_USE_AUTHTOK_ARG;
457 else if (!strcasecmp(*v, "use_first_pass"))
458 ctrl |= WINBIND_USE_FIRST_PASS_ARG;
459 else if (!strcasecmp(*v, "try_first_pass"))
460 ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
461 else if (!strcasecmp(*v, "unknown_ok"))
462 ctrl |= WINBIND_UNKNOWN_OK_ARG;
463 else if (!strncasecmp(*v, "require_membership_of",
464 strlen("require_membership_of")))
465 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
466 else if (!strncasecmp(*v, "require-membership-of",
467 strlen("require-membership-of")))
468 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
469 else if (!strcasecmp(*v, "krb5_auth"))
470 ctrl |= WINBIND_KRB5_AUTH;
471 else if (!strncasecmp(*v, "krb5_ccache_type",
472 strlen("krb5_ccache_type")))
473 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
474 else if (!strcasecmp(*v, "cached_login"))
475 ctrl |= WINBIND_CACHED_LOGIN;
476 else if (!strcasecmp(*v, "mkhomedir"))
477 ctrl |= WINBIND_MKHOMEDIR;
478 else {
479 __pam_log(pamh, ctrl, LOG_ERR,
480 "pam_parse: unknown option: %s", *v);
481 return -1;
482 }
483
484 }
485
486 if (result_d) {
487 *result_d = d;
488 } else {
489 if (d) {
490 iniparser_freedict(d);
491 }
492 }
493
494 return ctrl;
495 };
496
497 static int _pam_winbind_free_context(struct pwb_context *ctx)
498 {
499 if (!ctx) {
500 return 0;
501 }
502
503 if (ctx->dict) {
504 iniparser_freedict(ctx->dict);
505 }
506
507 return 0;
508 }
509
510 static int _pam_winbind_init_context(pam_handle_t *pamh,
511 int flags,
512 int argc,
513 const char **argv,
514 struct pwb_context **ctx_p)
515 {
516 struct pwb_context *r = NULL;
517
518 #ifdef HAVE_GETTEXT
519 textdomain_init();
520 #endif
521
522 r = talloc_zero(NULL, struct pwb_context);
523 if (!r) {
524 return PAM_BUF_ERR;
525 }
526
527 talloc_set_destructor(r, _pam_winbind_free_context);
528
529 r->pamh = pamh;
530 r->flags = flags;
531 r->argc = argc;
532 r->argv = argv;
533 r->ctrl = _pam_parse(pamh, flags, argc, argv, &r->dict);
534 if (r->ctrl == -1) {
535 TALLOC_FREE(r);
536 return PAM_SYSTEM_ERR;
537 }
538
539 *ctx_p = r;
540
541 return PAM_SUCCESS;
542 }
543
544 static void _pam_winbind_cleanup_func(pam_handle_t *pamh,
545 void *data,
546 int error_status)
547 {
548 int ctrl = _pam_parse(pamh, 0, 0, NULL, NULL);
549 if (_pam_log_is_debug_state_enabled(ctrl)) {
550 __pam_log_debug(pamh, ctrl, LOG_DEBUG,
551 "[pamh: %p] CLEAN: cleaning up PAM data %p "
552 "(error_status = %d)", pamh, data,
553 error_status);
554 }
555 TALLOC_FREE(data);
556 }
557
558
559 static const struct ntstatus_errors {
560 const char *ntstatus_string;
561 const char *error_string;
562 } ntstatus_errors[] = {
563 {"NT_STATUS_OK",
564 N_("Success")},
565 {"NT_STATUS_BACKUP_CONTROLLER",
566 N_("No primary Domain Controler available")},
567 {"NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
568 N_("No domain controllers found")},
569 {"NT_STATUS_NO_LOGON_SERVERS",
570 N_("No logon servers")},
571 {"NT_STATUS_PWD_TOO_SHORT",
572 N_("Password too short")},
573 {"NT_STATUS_PWD_TOO_RECENT",
574 N_("The password of this user is too recent to change")},
575 {"NT_STATUS_PWD_HISTORY_CONFLICT",
576 N_("Password is already in password history")},
577 {"NT_STATUS_PASSWORD_EXPIRED",
578 N_("Your password has expired")},
579 {"NT_STATUS_PASSWORD_MUST_CHANGE",
580 N_("You need to change your password now")},
581 {"NT_STATUS_INVALID_WORKSTATION",
582 N_("You are not allowed to logon from this workstation")},
583 {"NT_STATUS_INVALID_LOGON_HOURS",
584 N_("You are not allowed to logon at this time")},
585 {"NT_STATUS_ACCOUNT_EXPIRED",
586 N_("Your account has expired. "
587 "Please contact your System administrator")}, /* SCNR */
588 {"NT_STATUS_ACCOUNT_DISABLED",
589 N_("Your account is disabled. "
590 "Please contact your System administrator")}, /* SCNR */
591 {"NT_STATUS_ACCOUNT_LOCKED_OUT",
592 N_("Your account has been locked. "
593 "Please contact your System administrator")}, /* SCNR */
594 {"NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT",
595 N_("Invalid Trust Account")},
596 {"NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT",
597 N_("Invalid Trust Account")},
598 {"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT",
599 N_("Invalid Trust Account")},
600 {"NT_STATUS_ACCESS_DENIED",
601 N_("Access is denied")},
602 {NULL, NULL}
603 };
604
605 static const char *_get_ntstatus_error_string(const char *nt_status_string)
606 {
607 int i;
608 for (i=0; ntstatus_errors[i].ntstatus_string != NULL; i++) {
609 if (!strcasecmp(ntstatus_errors[i].ntstatus_string,
610 nt_status_string)) {
611 return _(ntstatus_errors[i].error_string);
612 }
613 }
614 return NULL;
615 }
616
617 /* --- authentication management functions --- */
618
619 /* Attempt a conversation */
620
621 static int converse(const pam_handle_t *pamh,
622 int nargs,
623 struct pam_message **message,
624 struct pam_response **response)
625 {
626 int retval;
627 struct pam_conv *conv;
628
629 retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv);
630 if (retval == PAM_SUCCESS) {
631 retval = conv->conv(nargs,
632 (const struct pam_message **)message,
633 response, conv->appdata_ptr);
634 }
635
636 return retval; /* propagate error status */
637 }
638
639
640 static int _make_remark(struct pwb_context *ctx,
641 int type,
642 const char *text)
643 {
644 int retval = PAM_SUCCESS;
645
646 struct pam_message *pmsg[1], msg[1];
647 struct pam_response *resp;
648
649 if (ctx->flags & WINBIND_SILENT) {
650 return PAM_SUCCESS;
651 }
652
653 pmsg[0] = &msg[0];
654 msg[0].msg = discard_const_p(char, text);
655 msg[0].msg_style = type;
656
657 resp = NULL;
658 retval = converse(ctx->pamh, 1, pmsg, &resp);
659
660 if (resp) {
661 _pam_drop_reply(resp, 1);
662 }
663 return retval;
664 }
665
666 static int _make_remark_v(struct pwb_context *ctx,
667 int type,
668 const char *format,
669 va_list args)
670 {
671 char *var;
672 int ret;
673
674 ret = vasprintf(&var, format, args);
675 if (ret < 0) {
676 _pam_log(ctx, LOG_ERR, "memory allocation failure");
677 return ret;
678 }
679
680 ret = _make_remark(ctx, type, var);
681 SAFE_FREE(var);
682 return ret;
683 }
684
685 static int _make_remark_format(struct pwb_context *ctx, int type, const char *format, ...) PRINTF_ATTRIBUTE(3,4);
686 static int _make_remark_format(struct pwb_context *ctx, int type, const char *format, ...)
687 {
688 int ret;
689 va_list args;
690
691 va_start(args, format);
692 ret = _make_remark_v(ctx, type, format, args);
693 va_end(args);
694 return ret;
695 }
696
697 static int pam_winbind_request_log(struct pwb_context *ctx,
698 int retval,
699 const char *user,
700 const char *fn)
701 {
702 switch (retval) {
703 case PAM_AUTH_ERR:
704 /* incorrect password */
705 _pam_log(ctx, LOG_WARNING, "user '%s' denied access "
706 "(incorrect password or invalid membership)", user);
707 return retval;
708 case PAM_ACCT_EXPIRED:
709 /* account expired */
710 _pam_log(ctx, LOG_WARNING, "user '%s' account expired",
711 user);
712 return retval;
713 case PAM_AUTHTOK_EXPIRED:
714 /* password expired */
715 _pam_log(ctx, LOG_WARNING, "user '%s' password expired",
716 user);
717 return retval;
718 case PAM_NEW_AUTHTOK_REQD:
719 /* new password required */
720 _pam_log(ctx, LOG_WARNING, "user '%s' new password "
721 "required", user);
722 return retval;
723 case PAM_USER_UNKNOWN:
724 /* the user does not exist */
725 _pam_log_debug(ctx, LOG_NOTICE, "user '%s' not found",
726 user);
727 if (ctx->ctrl & WINBIND_UNKNOWN_OK_ARG) {
728 return PAM_IGNORE;
729 }
730 return retval;
731 case PAM_SUCCESS:
732 /* Otherwise, the authentication looked good */
733 if (strcmp(fn, "wbcLogonUser") == 0) {
734 _pam_log(ctx, LOG_NOTICE,
735 "user '%s' granted access", user);
736 } else {
737 _pam_log(ctx, LOG_NOTICE,
738 "user '%s' OK", user);
739 }
740 return retval;
741 default:
742 /* we don't know anything about this return value */
743 _pam_log(ctx, LOG_ERR,
744 "internal module error (retval = %s(%d), user = '%s')",
745 _pam_error_code_str(retval), retval, user);
746 return retval;
747 }
748 }
749
750 static int wbc_auth_error_to_pam_error(struct pwb_context *ctx,
751 struct wbcAuthErrorInfo *e,
752 wbcErr status,
753 const char *username,
754 const char *fn)
755 {
756 int ret = PAM_AUTH_ERR;
757
758 if (WBC_ERROR_IS_OK(status)) {
759 _pam_log_debug(ctx, LOG_DEBUG, "request %s succeeded",
760 fn);
761 ret = PAM_SUCCESS;
762 return pam_winbind_request_log(ctx, ret, username, fn);
763 }
764
765 if (e) {
766 if (e->pam_error != PAM_SUCCESS) {
767 _pam_log(ctx, LOG_ERR,
768 "request %s failed: %s, "
769 "PAM error: %s (%d), NTSTATUS: %s, "
770 "Error message was: %s",
771 fn,
772 wbcErrorString(status),
773 _pam_error_code_str(e->pam_error),
774 e->pam_error,
775 e->nt_string,
776 e->display_string);
777 ret = e->pam_error;
778 return pam_winbind_request_log(ctx, ret, username, fn);
779 }
780
781 _pam_log(ctx, LOG_ERR, "request %s failed, but PAM error 0!", fn);
782
783 ret = PAM_SERVICE_ERR;
784 return pam_winbind_request_log(ctx, ret, username, fn);
785 }
786
787 ret = wbc_error_to_pam_error(status);
788 return pam_winbind_request_log(ctx, ret, username, fn);
789 }
790
791 #if defined(HAVE_PAM_RADIO_TYPE)
792 static bool _pam_winbind_change_pwd(struct pwb_context *ctx)
793 {
794 struct pam_message msg, *pmsg;
795 struct pam_response *resp = NULL;
796 int ret;
797 bool retval = false;
798 pmsg = &msg;
799 msg.msg_style = PAM_RADIO_TYPE;
800 msg.msg = _("Do you want to change your password now?");
801 ret = converse(ctx->pamh, 1, &pmsg, &resp);
802 if (resp == NULL) {
803 if (ret == PAM_SUCCESS) {
804 _pam_log(ctx, LOG_CRIT, "pam_winbind: system error!\n");
805 return false;
806 }
807 }
808 if (ret != PAM_SUCCESS) {
809 return false;
810 }
811 _pam_log(ctx, LOG_CRIT, "Received [%s] reply from application.\n", resp->resp);
812
813 if ((resp->resp != NULL) && (strcasecmp(resp->resp, "yes") == 0)) {
814 retval = true;
815 }
816
817 _pam_drop_reply(resp, 1);
818 return retval;
819 }
820 #else
821 static bool _pam_winbind_change_pwd(struct pwb_context *ctx)
822 {
823 return false;
824 }
825 #endif
826
827 /**
828 * send a password expiry message if required
829 *
830 * @param ctx PAM winbind context.
831 * @param next_change expected (calculated) next expiry date.
832 * @param already_expired pointer to a boolean to indicate if the password is
833 * already expired.
834 *
835 * @return boolean Returns true if message has been sent, false if not.
836 */
837
838 static bool _pam_send_password_expiry_message(struct pwb_context *ctx,
839 time_t next_change,
840 time_t now,
841 int warn_pwd_expire,
842 bool *already_expired,
843 bool *change_pwd)
844 {
845 int days = 0;
846 struct tm tm_now, tm_next_change;
847 bool retval = false;
848 int ret;
849
850 if (already_expired) {
851 *already_expired = false;
852 }
853
854 if (change_pwd) {
855 *change_pwd = false;
856 }
857
858 if (next_change <= now) {
859 PAM_WB_REMARK_DIRECT(ctx, "NT_STATUS_PASSWORD_EXPIRED");
860 if (already_expired) {
861 *already_expired = true;
862 }
863 return true;
864 }
865
866 if ((next_change < 0) ||
867 (next_change > now + warn_pwd_expire * SECONDS_PER_DAY)) {
868 return false;
869 }
870
871 if ((localtime_r(&now, &tm_now) == NULL) ||
872 (localtime_r(&next_change, &tm_next_change) == NULL)) {
873 return false;
874 }
875
876 days = (tm_next_change.tm_yday+tm_next_change.tm_year*365) -
877 (tm_now.tm_yday+tm_now.tm_year*365);
878
879 if (days == 0) {
880 ret = _make_remark(ctx, PAM_TEXT_INFO,
881 _("Your password expires today.\n"));
882
883 /*
884 * If change_pwd and already_expired is null.
885 * We are just sending a notification message.
886 * We don't expect any response in this case.
887 */
888
889 if (!change_pwd && !already_expired) {
890 return true;
891 }
892
893 /*
894 * successfully sent the warning message.
895 * Give the user a chance to change pwd.
896 */
897 if (ret == PAM_SUCCESS) {
898 if (change_pwd) {
899 retval = _pam_winbind_change_pwd(ctx);
900 if (retval) {
901 *change_pwd = true;
902 }
903 }
904 }
905 return true;
906 }
907
908 if (days > 0 && days < warn_pwd_expire) {
909
910 ret = _make_remark_format(ctx, PAM_TEXT_INFO,
911 _("Your password will expire in %d %s.\n"),
912 days, (days > 1) ? _("days"):_("day"));
913 /*
914 * If change_pwd and already_expired is null.
915 * We are just sending a notification message.
916 * We don't expect any response in this case.
917 */
918
919 if (!change_pwd && !already_expired) {
920 return true;
921 }
922
923 /*
924 * successfully sent the warning message.
925 * Give the user a chance to change pwd.
926 */
927 if (ret == PAM_SUCCESS) {
928 if (change_pwd) {
929 retval = _pam_winbind_change_pwd(ctx);
930 if (retval) {
931 *change_pwd = true;
932 }
933 }
934 }
935 return true;
936 }
937
938 return false;
939 }
940
941 /**
942 * Send a warning if the password expires in the near future
943 *
944 * @param ctx PAM winbind context.
945 * @param response The full authentication response structure.
946 * @param already_expired boolean, is the pwd already expired?
947 *
948 * @return void.
949 */
950
951 static void _pam_warn_password_expiry(struct pwb_context *ctx,
952 const struct wbcAuthUserInfo *info,
953 const struct wbcUserPasswordPolicyInfo *policy,
954 int warn_pwd_expire,
955 bool *already_expired,
956 bool *change_pwd)
957 {
958 time_t now = time(NULL);
959 time_t next_change = 0;
960
961 if (!info || !policy) {
962 return;
963 }
964
965 if (already_expired) {
966 *already_expired = false;
967 }
968
969 if (change_pwd) {
970 *change_pwd = false;
971 }
972
973 /* accounts with WBC_ACB_PWNOEXP set never receive a warning */
974 if (info->acct_flags & WBC_ACB_PWNOEXP) {
975 return;
976 }
977
978 /* no point in sending a warning if this is a grace logon */
979 if (PAM_WB_GRACE_LOGON(info->user_flags)) {
980 return;
981 }
982
983 /* check if the info3 must change timestamp has been set */
984 next_change = info->pass_must_change_time;
985
986 if (_pam_send_password_expiry_message(ctx, next_change, now,
987 warn_pwd_expire,
988 already_expired,
989 change_pwd)) {
990 return;
991 }
992
993 /* now check for the global password policy */
994 /* good catch from Ralf Haferkamp: an expiry of "never" is translated
995 * to -1 */
996 if ((policy->expire == (int64_t)-1) ||
997 (policy->expire == 0)) {
998 return;
999 }
1000
1001 next_change = info->pass_last_set_time + policy->expire;
1002
1003 if (_pam_send_password_expiry_message(ctx, next_change, now,
1004 warn_pwd_expire,
1005 already_expired,
1006 change_pwd)) {
1007 return;
1008 }
1009
1010 /* no warning sent */
1011 }
1012
1013 #define IS_SID_STRING(name) (strncmp("S-", name, 2) == 0)
1014
1015 /**
1016 * Append a string, making sure not to overflow and to always return a
1017 * NULL-terminated string.
1018 *
1019 * @param dest Destination string buffer (must already be NULL-terminated).
1020 * @param src Source string buffer.
1021 * @param dest_buffer_size Size of dest buffer in bytes.
1022 *
1023 * @return false if dest buffer is not big enough (no bytes copied), true on
1024 * success.
1025 */
1026
1027 static bool safe_append_string(char *dest,
1028 const char *src,
1029 int dest_buffer_size)
1030 {
1031 int dest_length = strlen(dest);
1032 int src_length = strlen(src);
1033
1034 if (dest_length + src_length + 1 > dest_buffer_size) {
1035 return false;
1036 }
1037
1038 memcpy(dest + dest_length, src, src_length + 1);
1039 return true;
1040 }
1041
1042 /**
1043 * Convert a names into a SID string, appending it to a buffer.
1044 *
1045 * @param ctx PAM winbind context.
1046 * @param user User in PAM request.
1047 * @param name Name to convert.
1048 * @param sid_list_buffer Where to append the string sid.
1049 * @param sid_list_buffer Size of sid_list_buffer (in bytes).
1050 *
1051 * @return false on failure, true on success.
1052 */
1053 static bool winbind_name_to_sid_string(struct pwb_context *ctx,
1054 const char *user,
1055 const char *name,
1056 char *sid_list_buffer,
1057 int sid_list_buffer_size)
1058 {
1059 char sid_string[WBC_SID_STRING_BUFLEN];
1060
1061 /* lookup name? */
1062 if (IS_SID_STRING(name)) {
1063 strlcpy(sid_string, name, sizeof(sid_string));
1064 } else {
1065 wbcErr wbc_status;
1066 struct wbcDomainSid sid;
1067 enum wbcSidType type;
1068
1069 _pam_log_debug(ctx, LOG_DEBUG,
1070 "no sid given, looking up: %s\n", name);
1071
1072 wbc_status = wbcLookupName("", name, &sid, &type);
1073 if (!WBC_ERROR_IS_OK(wbc_status)) {
1074 _pam_log(ctx, LOG_INFO,
1075 "could not lookup name: %s\n", name);
1076 return false;
1077 }
1078
1079 wbcSidToStringBuf(&sid, sid_string, sizeof(sid_string));
1080 }
1081
1082 if (!safe_append_string(sid_list_buffer, sid_string,
1083 sid_list_buffer_size)) {
1084 return false;
1085 }
1086 return true;
1087 }
1088
1089 /**
1090 * Convert a list of names into a list of sids.
1091 *
1092 * @param ctx PAM winbind context.
1093 * @param user User in PAM request.
1094 * @param name_list List of names or string sids, separated by commas.
1095 * @param sid_list_buffer Where to put the list of string sids.
1096 * @param sid_list_buffer Size of sid_list_buffer (in bytes).
1097 *
1098 * @return false on failure, true on success.
1099 */
1100 static bool winbind_name_list_to_sid_string_list(struct pwb_context *ctx,
1101 const char *user,
1102 const char *name_list,
1103 char *sid_list_buffer,
1104 int sid_list_buffer_size)
1105 {
1106 bool result = false;
1107 char *current_name = NULL;
1108 const char *search_location;
1109 const char *comma;
1110 int len;
1111
1112 if (sid_list_buffer_size > 0) {
1113 sid_list_buffer[0] = 0;
1114 }
1115
1116 search_location = name_list;
1117 while ((comma = strchr(search_location, ',')) != NULL) {
1118 current_name = strndup(search_location,
1119 comma - search_location);
1120 if (NULL == current_name) {
1121 goto out;
1122 }
1123
1124 if (!winbind_name_to_sid_string(ctx, user,
1125 current_name,
1126 sid_list_buffer,
1127 sid_list_buffer_size)) {
1128 /*
1129 * If one group name failed, we must not fail
1130 * the authentication totally, continue with
1131 * the following group names. If user belongs to
1132 * one of the valid groups, we must allow it
1133 * login. -- BoYang
1134 */
1135
1136 _pam_log(ctx, LOG_INFO, "cannot convert group %s to sid, "
1137 "check if group %s is valid group.", current_name,
1138 current_name);
1139 _make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s "
1140 "to sid, please contact your administrator to see "
1141 "if group %s is valid."), current_name, current_name);
1142 SAFE_FREE(current_name);
1143 search_location = comma + 1;
1144 continue;
1145 }
1146
1147 SAFE_FREE(current_name);
1148
1149 if (!safe_append_string(sid_list_buffer, ",",
1150 sid_list_buffer_size)) {
1151 goto out;
1152 }
1153
1154 search_location = comma + 1;
1155 }
1156
1157 if (!winbind_name_to_sid_string(ctx, user, search_location,
1158 sid_list_buffer,
1159 sid_list_buffer_size)) {
1160 _pam_log(ctx, LOG_INFO, "cannot convert group %s to sid, "
1161 "check if group %s is valid group.", search_location,
1162 search_location);
1163 _make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s "
1164 "to sid, please contact your administrator to see "
1165 "if group %s is valid."), search_location, search_location);
1166 /*
1167 * The lookup of the last name failed..
1168 * It results in require_member_of_sid ends with ','
1169 * It is malformated parameter here, overwrite the last ','.
1170 */
1171 len = strlen(sid_list_buffer);
1172 if ((len != 0) && (sid_list_buffer[len - 1] == ',')) {
1173 sid_list_buffer[len - 1] = '\0';
1174 }
1175 }
1176
1177 result = true;
1178
1179 out:
1180 SAFE_FREE(current_name);
1181 return result;
1182 }
1183
1184 /**
1185 * put krb5ccname variable into environment
1186 *
1187 * @param ctx PAM winbind context.
1188 * @param krb5ccname env variable retrieved from winbindd.
1189 *
1190 * @return void.
1191 */
1192
1193 static void _pam_setup_krb5_env(struct pwb_context *ctx,
1194 struct wbcLogonUserInfo *info)
1195 {
1196 char *var = NULL;
1197 int ret;
1198 uint32_t i;
1199 const char *krb5ccname = NULL;
1200
1201 if (off(ctx->ctrl, WINBIND_KRB5_AUTH)) {
1202 return;
1203 }
1204
1205 if (!info) {
1206 return;
1207 }
1208
1209 for (i=0; i < info->num_blobs; i++) {
1210 if (strcasecmp(info->blobs[i].name, "krb5ccname") == 0) {
1211 krb5ccname = (const char *)info->blobs[i].blob.data;
1212 break;
1213 }
1214 }
1215
1216 if (!krb5ccname || (strlen(krb5ccname) == 0)) {
1217 return;
1218 }
1219
1220 _pam_log_debug(ctx, LOG_DEBUG,
1221 "request returned KRB5CCNAME: %s", krb5ccname);
1222
1223 if (asprintf(&var, "KRB5CCNAME=%s", krb5ccname) == -1) {
1224 return;
1225 }
1226
1227 ret = pam_putenv(ctx->pamh, var);
1228 if (ret) {
1229 _pam_log(ctx, LOG_ERR,
1230 "failed to set KRB5CCNAME to %s: %s",
1231 var, pam_strerror(ctx->pamh, ret));
1232 }
1233 free(var);
1234 }
1235
1236 /**
1237 * Copy unix username if available (further processed in PAM).
1238 *
1239 * @param ctx PAM winbind context
1240 * @param user_ret A pointer that holds a pointer to a string
1241 * @param unix_username A username
1242 *
1243 * @return void.
1244 */
1245
1246 static void _pam_setup_unix_username(struct pwb_context *ctx,
1247 char **user_ret,
1248 struct wbcLogonUserInfo *info)
1249 {
1250 const char *unix_username = NULL;
1251 uint32_t i;
1252
1253 if (!user_ret || !info) {
1254 return;
1255 }
1256
1257 for (i=0; i < info->num_blobs; i++) {
1258 if (strcasecmp(info->blobs[i].name, "unix_username") == 0) {
1259 unix_username = (const char *)info->blobs[i].blob.data;
1260 break;
1261 }
1262 }
1263
1264 if (!unix_username || !unix_username[0]) {
1265 return;
1266 }
1267
1268 *user_ret = strdup(unix_username);
1269 }
1270
1271 /**
1272 * Set string into the PAM stack.
1273 *
1274 * @param ctx PAM winbind context.
1275 * @param data_name Key name for pam_set_data.
1276 * @param value String value.
1277 *
1278 * @return void.
1279 */
1280
1281 static void _pam_set_data_string(struct pwb_context *ctx,
1282 const char *data_name,
1283 const char *value)
1284 {
1285 int ret;
1286
1287 if (!data_name || !value || (strlen(data_name) == 0) ||
1288 (strlen(value) == 0)) {
1289 return;
1290 }
1291
1292 ret = pam_set_data(ctx->pamh, data_name, talloc_strdup(NULL, value),
1293 _pam_winbind_cleanup_func);
1294 if (ret) {
1295 _pam_log_debug(ctx, LOG_DEBUG,
1296 "Could not set data %s: %s\n",
1297 data_name, pam_strerror(ctx->pamh, ret));
1298 }
1299 }
1300
1301 /**
1302 * Set info3 strings into the PAM stack.
1303 *
1304 * @param ctx PAM winbind context.
1305 * @param data_name Key name for pam_set_data.
1306 * @param value String value.
1307 *
1308 * @return void.
1309 */
1310
1311 static void _pam_set_data_info3(struct pwb_context *ctx,
1312 const struct wbcAuthUserInfo *info)
1313 {
1314 _pam_set_data_string(ctx, PAM_WINBIND_HOMEDIR,
1315 info->home_directory);
1316 _pam_set_data_string(ctx, PAM_WINBIND_LOGONSCRIPT,
1317 info->logon_script);
1318 _pam_set_data_string(ctx, PAM_WINBIND_LOGONSERVER,
1319 info->logon_server);
1320 _pam_set_data_string(ctx, PAM_WINBIND_PROFILEPATH,
1321 info->profile_path);
1322 }
1323
1324 /**
1325 * Free info3 strings in the PAM stack.
1326 *
1327 * @param pamh PAM handle
1328 *
1329 * @return void.
1330 */
1331
1332 static void _pam_free_data_info3(pam_handle_t *pamh)
1333 {
1334 pam_set_data(pamh, PAM_WINBIND_HOMEDIR, NULL, NULL);
1335 pam_set_data(pamh, PAM_WINBIND_LOGONSCRIPT, NULL, NULL);
1336 pam_set_data(pamh, PAM_WINBIND_LOGONSERVER, NULL, NULL);
1337 pam_set_data(pamh, PAM_WINBIND_PROFILEPATH, NULL, NULL);
1338 }
1339
1340 /**
1341 * Send PAM_ERROR_MSG for cached or grace logons.
1342 *
1343 * @param ctx PAM winbind context.
1344 * @param username User in PAM request.
1345 * @param info3_user_flgs Info3 flags containing logon type bits.
1346 *
1347 * @return void.
1348 */
1349
1350 static void _pam_warn_logon_type(struct pwb_context *ctx,
1351 const char *username,
1352 uint32_t info3_user_flgs)
1353 {
1354 /* inform about logon type */
1355 if (PAM_WB_GRACE_LOGON(info3_user_flgs)) {
1356
1357 _make_remark(ctx, PAM_ERROR_MSG,
1358 _("Grace login. "
1359 "Please change your password as soon you're "
1360 "online again"));
1361 _pam_log_debug(ctx, LOG_DEBUG,
1362 "User %s logged on using grace logon\n",
1363 username);
1364
1365 } else if (PAM_WB_CACHED_LOGON(info3_user_flgs)) {
1366
1367 _make_remark(ctx, PAM_ERROR_MSG,
1368 _("Domain Controller unreachable, "
1369 "using cached credentials instead. "
1370 "Network resources may be unavailable"));
1371 _pam_log_debug(ctx, LOG_DEBUG,
1372 "User %s logged on using cached credentials\n",
1373 username);
1374 }
1375 }
1376
1377 /**
1378 * Send PAM_ERROR_MSG for krb5 errors.
1379 *
1380 * @param ctx PAM winbind context.
1381 * @param username User in PAM request.
1382 * @param info3_user_flgs Info3 flags containing logon type bits.
1383 *
1384 * @return void.
1385 */
1386
1387 static void _pam_warn_krb5_failure(struct pwb_context *ctx,
1388 const char *username,
1389 uint32_t info3_user_flgs)
1390 {
1391 if (PAM_WB_KRB5_CLOCK_SKEW(info3_user_flgs)) {
1392 _make_remark(ctx, PAM_ERROR_MSG,
1393 _("Failed to establish your Kerberos Ticket cache "
1394 "due time differences\n"
1395 "with the domain controller. "
1396 "Please verify the system time.\n"));
1397 _pam_log_debug(ctx, LOG_DEBUG,
1398 "User %s: Clock skew when getting Krb5 TGT\n",
1399 username);
1400 }
1401 }
1402
1403 static bool _pam_check_remark_auth_err(struct pwb_context *ctx,
1404 const struct wbcAuthErrorInfo *e,
1405 const char *nt_status_string,
1406 int *pam_err)
1407 {
1408 const char *ntstatus = NULL;
1409 const char *error_string = NULL;
1410
1411 if (!e || !pam_err) {
1412 return false;
1413 }
1414
1415 ntstatus = e->nt_string;
1416 if (!ntstatus) {
1417 return false;
1418 }
1419
1420 if (strcasecmp(ntstatus, nt_status_string) == 0) {
1421
1422 error_string = _get_ntstatus_error_string(nt_status_string);
1423 if (error_string) {
1424 _make_remark(ctx, PAM_ERROR_MSG, error_string);
1425 *pam_err = e->pam_error;
1426 return true;
1427 }
1428
1429 if (e->display_string) {
1430 _make_remark(ctx, PAM_ERROR_MSG, _(e->display_string));
1431 *pam_err = e->pam_error;
1432 return true;
1433 }
1434
1435 _make_remark(ctx, PAM_ERROR_MSG, nt_status_string);
1436 *pam_err = e->pam_error;
1437
1438 return true;
1439 }
1440
1441 return false;
1442 };
1443
1444 /**
1445 * Compose Password Restriction String for a PAM_ERROR_MSG conversation.
1446 *
1447 * @param i The wbcUserPasswordPolicyInfo struct.
1448 *
1449 * @return string (caller needs to talloc_free).
1450 */
1451
1452 static char *_pam_compose_pwd_restriction_string(struct pwb_context *ctx,
1453 struct wbcUserPasswordPolicyInfo *i)
1454 {
1455 char *str = NULL;
1456
1457 if (!i) {
1458 goto failed;
1459 }
1460
1461 str = talloc_asprintf(ctx, _("Your password "));
1462 if (!str) {
1463 goto failed;
1464 }
1465
1466 if (i->min_length_password > 0) {
1467 str = talloc_asprintf_append(str,
1468 _("must be at least %d characters; "),
1469 i->min_length_password);
1470 if (!str) {
1471 goto failed;
1472 }
1473 }
1474
1475 if (i->password_history > 0) {
1476 str = talloc_asprintf_append(str,
1477 _("cannot repeat any of your previous %d "
1478 "passwords; "),
1479 i->password_history);
1480 if (!str) {
1481 goto failed;
1482 }
1483 }
1484
1485 if (i->password_properties & WBC_DOMAIN_PASSWORD_COMPLEX) {
1486 str = talloc_asprintf_append(str,
1487 _("must contain capitals, numerals "
1488 "or punctuation; "
1489 "and cannot contain your account "
1490 "or full name; "));
1491 if (!str) {
1492 goto failed;
1493 }
1494 }
1495
1496 str = talloc_asprintf_append(str,
1497 _("Please type a different password. "
1498 "Type a password which meets these requirements in "
1499 "both text boxes."));
1500 if (!str) {
1501 goto failed;
1502 }
1503
1504 return str;
1505
1506 failed:
1507 TALLOC_FREE(str);
1508 return NULL;
1509 }
1510
1511 static int _pam_create_homedir(struct pwb_context *ctx,
1512 const char *dirname,
1513 mode_t mode)
1514 {
1515 struct stat sbuf;
1516
1517 if (stat(dirname, &sbuf) == 0) {
1518 return PAM_SUCCESS;
1519 }
1520
1521 if (mkdir(dirname, mode) != 0) {
1522
1523 _make_remark_format(ctx, PAM_TEXT_INFO,
1524 _("Creating directory: %s failed: %s"),
1525 dirname, strerror(errno));
1526 _pam_log(ctx, LOG_ERR, "could not create dir: %s (%s)",
1527 dirname, strerror(errno));
1528 return PAM_PERM_DENIED;
1529 }
1530
1531 return PAM_SUCCESS;
1532 }
1533
1534 static int _pam_chown_homedir(struct pwb_context *ctx,
1535 const char *dirname,
1536 uid_t uid,
1537 gid_t gid)
1538 {
1539 if (chown(dirname, uid, gid) != 0) {
1540 _pam_log(ctx, LOG_ERR, "failed to chown user homedir: %s (%s)",
1541 dirname, strerror(errno));
1542 return PAM_PERM_DENIED;
1543 }
1544
1545 return PAM_SUCCESS;
1546 }
1547
1548 static int _pam_mkhomedir(struct pwb_context *ctx)
1549 {
1550 struct passwd *pwd = NULL;
1551 char *token = NULL;
1552 char *create_dir = NULL;
1553 char *user_dir = NULL;
1554 int ret;
1555 const char *username;
1556 mode_t mode = 0700;
1557 char *safe_ptr = NULL;
1558 char *p = NULL;
1559
1560 /* Get the username */
1561 ret = pam_get_user(ctx->pamh, &username, NULL);
1562 if ((ret != PAM_SUCCESS) || (!username)) {
1563 _pam_log_debug(ctx, LOG_DEBUG, "can not get the username");
1564 return PAM_SERVICE_ERR;
1565 }
1566
1567 pwd = getpwnam(username);
1568 if (pwd == NULL) {
1569 _pam_log_debug(ctx, LOG_DEBUG, "can not get the username");
1570 return PAM_USER_UNKNOWN;
1571 }
1572 _pam_log_debug(ctx, LOG_DEBUG, "homedir is: %s", pwd->pw_dir);
1573
1574 ret = _pam_create_homedir(ctx, pwd->pw_dir, 0700);
1575 if (ret == PAM_SUCCESS) {
1576 ret = _pam_chown_homedir(ctx, pwd->pw_dir,
1577 pwd->pw_uid,
1578 pwd->pw_gid);
1579 }
1580
1581 if (ret == PAM_SUCCESS) {
1582 return ret;
1583 }
1584
1585 /* maybe we need to create parent dirs */
1586 create_dir = talloc_strdup(ctx, "/");
1587 if (!create_dir) {
1588 return PAM_BUF_ERR;
1589 }
1590
1591 /* find final directory */
1592 user_dir = strrchr(pwd->pw_dir, '/');
1593 if (!user_dir) {
1594 return PAM_BUF_ERR;
1595 }
1596 user_dir++;
1597
1598 _pam_log(ctx, LOG_DEBUG, "final directory: %s", user_dir);
1599
1600 p = pwd->pw_dir;
1601
1602 while ((token = strtok_r(p, "/", &safe_ptr)) != NULL) {
1603
1604 mode = 0755;
1605
1606 p = NULL;
1607
1608 _pam_log_debug(ctx, LOG_DEBUG, "token is %s", token);
1609
1610 create_dir = talloc_asprintf_append(create_dir, "%s/", token);
1611 if (!create_dir) {
1612 return PAM_BUF_ERR;
1613 }
1614 _pam_log_debug(ctx, LOG_DEBUG, "current_dir is %s", create_dir);
1615
1616 if (strcmp(token, user_dir) == 0) {
1617 _pam_log_debug(ctx, LOG_DEBUG, "assuming last directory: %s", token);
1618 mode = 0700;
1619 }
1620
1621 ret = _pam_create_homedir(ctx, create_dir, mode);
1622 if (ret) {
1623 return ret;
1624 }
1625 }
1626
1627 return _pam_chown_homedir(ctx, create_dir,
1628 pwd->pw_uid,
1629 pwd->pw_gid);
1630 }
1631
1632 /* talk to winbindd */
1633 static int winbind_auth_request(struct pwb_context *ctx,
1634 const char *user,
1635 const char *pass,
1636 const char *member,
1637 const char *cctype,
1638 const int warn_pwd_expire,
1639 struct wbcAuthErrorInfo **p_error,
1640 struct wbcLogonUserInfo **p_info,
1641 struct wbcUserPasswordPolicyInfo **p_policy,
1642 time_t *pwd_last_set,
1643 char **user_ret)
1644 {
1645 wbcErr wbc_status;
1646
1647 struct wbcLogonUserParams logon;
1648 char membership_of[1024];
1649 uid_t user_uid = -1;
1650 uint32_t flags = WBFLAG_PAM_INFO3_TEXT |
1651 WBFLAG_PAM_GET_PWD_POLICY;
1652
1653 struct wbcLogonUserInfo *info = NULL;
1654 struct wbcAuthUserInfo *user_info = NULL;
1655 struct wbcAuthErrorInfo *error = NULL;
1656 struct wbcUserPasswordPolicyInfo *policy = NULL;
1657
1658 int ret = PAM_AUTH_ERR;
1659 int i;
1660 const char *codes[] = {
1661 "NT_STATUS_PASSWORD_EXPIRED",
1662 "NT_STATUS_PASSWORD_MUST_CHANGE",
1663 "NT_STATUS_INVALID_WORKSTATION",
1664 "NT_STATUS_INVALID_LOGON_HOURS",
1665 "NT_STATUS_ACCOUNT_EXPIRED",
1666 "NT_STATUS_ACCOUNT_DISABLED",
1667 "NT_STATUS_ACCOUNT_LOCKED_OUT",
1668 "NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT",
1669 "NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT",
1670 "NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT",
1671 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
1672 "NT_STATUS_NO_LOGON_SERVERS",
1673 "NT_STATUS_WRONG_PASSWORD",
1674 "NT_STATUS_ACCESS_DENIED"
1675 };
1676
1677 if (pwd_last_set) {
1678 *pwd_last_set = 0;
1679 }
1680
1681 /* Krb5 auth always has to go against the KDC of the user's realm */
1682
1683 if (ctx->ctrl & WINBIND_KRB5_AUTH) {
1684 flags |= WBFLAG_PAM_CONTACT_TRUSTDOM;
1685 }
1686
1687 if (ctx->ctrl & (WINBIND_KRB5_AUTH|WINBIND_CACHED_LOGIN)) {
1688 struct passwd *pwd = NULL;
1689
1690 pwd = getpwnam(user);
1691 if (pwd == NULL) {
1692 return PAM_USER_UNKNOWN;
1693 }
1694 user_uid = pwd->pw_uid;
1695 }
1696
1697 if (ctx->ctrl & WINBIND_KRB5_AUTH) {
1698
1699 _pam_log_debug(ctx, LOG_DEBUG,
1700 "enabling krb5 login flag\n");
1701
1702 flags |= WBFLAG_PAM_KRB5 |
1703 WBFLAG_PAM_FALLBACK_AFTER_KRB5;
1704 }
1705
1706 if (ctx->ctrl & WINBIND_CACHED_LOGIN) {
1707 _pam_log_debug(ctx, LOG_DEBUG,
1708 "enabling cached login flag\n");
1709 flags |= WBFLAG_PAM_CACHED_LOGIN;
1710 }
1711
1712 if (user_ret) {
1713 *user_ret = NULL;
1714 flags |= WBFLAG_PAM_UNIX_NAME;
1715 }
1716
1717 if (cctype != NULL) {
1718 _pam_log_debug(ctx, LOG_DEBUG,
1719 "enabling request for a %s krb5 ccache\n",
1720 cctype);
1721 }
1722
1723 if (member != NULL) {
1724
1725 ZERO_STRUCT(membership_of);
1726
1727 if (!winbind_name_list_to_sid_string_list(ctx, user, member,
1728 membership_of,
1729 sizeof(membership_of))) {
1730 _pam_log_debug(ctx, LOG_ERR,
1731 "failed to serialize membership of sid "
1732 "\"%s\"\n", member);
1733 return PAM_AUTH_ERR;
1734 }
1735 }
1736
1737 ZERO_STRUCT(logon);
1738
1739 logon.username = user;
1740 logon.password = pass;
1741
1742 if (cctype) {
1743 wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1744 &logon.blobs,
1745 "krb5_cc_type",
1746 0,
1747 discard_const_p(uint8_t, cctype),
1748 strlen(cctype)+1);
1749 if (!WBC_ERROR_IS_OK(wbc_status)) {
1750 goto done;
1751 }
1752 }
1753
1754 wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1755 &logon.blobs,
1756 "flags",
1757 0,
1758 (uint8_t *)&flags,
1759 sizeof(flags));
1760 if (!WBC_ERROR_IS_OK(wbc_status)) {
1761 goto done;
1762 }
1763
1764 wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1765 &logon.blobs,
1766 "user_uid",
1767 0,
1768 (uint8_t *)&user_uid,
1769 sizeof(user_uid));
1770 if (!WBC_ERROR_IS_OK(wbc_status)) {
1771 goto done;
1772 }
1773
1774 if (member) {
1775 wbc_status = wbcAddNamedBlob(&logon.num_blobs,
1776 &logon.blobs,
1777 "membership_of",
1778 0,
1779 (uint8_t *)membership_of,
1780 sizeof(membership_of));
1781 if (!WBC_ERROR_IS_OK(wbc_status)) {
1782 goto done;
1783 }
1784 }
1785
1786 wbc_status = wbcLogonUser(&logon, &info, &error, &policy);
1787 ret = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
1788 user, "wbcLogonUser");
1789 wbcFreeMemory(logon.blobs);
1790 logon.blobs = NULL;
1791
1792 if (info && info->info) {
1793 user_info = info->info;
1794 }
1795
1796 if (pwd_last_set && user_info) {
1797 *pwd_last_set = user_info->pass_last_set_time;
1798 }
1799
1800 if (p_info && info) {
1801 *p_info = info;
1802 }
1803
1804 if (p_policy && policy) {
1805 *p_policy = policy;
1806 }
1807
1808 if (p_error && error) {
1809 /* We want to process the error in the caller. */
1810 *p_error = error;
1811 return ret;
1812 }
1813
1814 for (i=0; i<ARRAY_SIZE(codes); i++) {
1815 int _ret = ret;
1816 if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
1817 ret = _ret;
1818 goto done;
1819 }
1820 }
1821
1822 if ((ret == PAM_SUCCESS) && user_info && policy && info) {
1823
1824 bool already_expired = false;
1825 bool change_pwd = false;
1826
1827 /* warn a user if the password is about to expire soon */
1828 _pam_warn_password_expiry(ctx, user_info, policy,
1829 warn_pwd_expire,
1830 &already_expired,
1831 &change_pwd);
1832
1833 if (already_expired == true) {
1834
1835 SMB_TIME_T last_set = user_info->pass_last_set_time;
1836
1837 _pam_log_debug(ctx, LOG_DEBUG,
1838 "Password has expired "
1839 "(Password was last set: %lld, "
1840 "the policy says it should expire here "
1841 "%lld (now it's: %ld))\n",
1842 (long long int)last_set,
1843 (long long int)last_set +
1844 policy->expire,
1845 (long)time(NULL));
1846
1847 return PAM_AUTHTOK_EXPIRED;
1848 }
1849
1850 if (change_pwd) {
1851 ret = PAM_NEW_AUTHTOK_REQD;
1852 goto done;
1853 }
1854
1855 /* inform about logon type */
1856 _pam_warn_logon_type(ctx, user, user_info->user_flags);
1857
1858 /* inform about krb5 failures */
1859 _pam_warn_krb5_failure(ctx, user, user_info->user_flags);
1860
1861 /* set some info3 info for other modules in the stack */
1862 _pam_set_data_info3(ctx, user_info);
1863
1864 /* put krb5ccname into env */
1865 _pam_setup_krb5_env(ctx, info);
1866
1867 /* If winbindd returned a username, return the pointer to it
1868 * here. */
1869 _pam_setup_unix_username(ctx, user_ret, info);
1870 }
1871
1872 done:
1873 wbcFreeMemory(logon.blobs);
1874 if (info && info->blobs && !p_info) {
1875 wbcFreeMemory(info->blobs);
1876 }
1877 if (error && !p_error) {
1878 wbcFreeMemory(error);
1879 }
1880 if (info && !p_info) {
1881 wbcFreeMemory(info);
1882 }
1883 if (policy && !p_policy) {
1884 wbcFreeMemory(policy);
1885 }
1886
1887 return ret;
1888 }
1889
1890 /* talk to winbindd */
1891 static int winbind_chauthtok_request(struct pwb_context *ctx,
1892 const char *user,
1893 const char *oldpass,
1894 const char *newpass,
1895 time_t pwd_last_set)
1896 {
1897 wbcErr wbc_status;
1898 struct wbcChangePasswordParams params;
1899 struct wbcAuthErrorInfo *error = NULL;
1900 struct wbcUserPasswordPolicyInfo *policy = NULL;
1901 enum wbcPasswordChangeRejectReason reject_reason = -1;
1902 uint32_t flags = 0;
1903
1904 int i;
1905 const char *codes[] = {
1906 "NT_STATUS_BACKUP_CONTROLLER",
1907 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
1908 "NT_STATUS_NO_LOGON_SERVERS",
1909 "NT_STATUS_ACCESS_DENIED",
1910 "NT_STATUS_PWD_TOO_SHORT", /* TODO: tell the min pwd length ? */
1911 "NT_STATUS_PWD_TOO_RECENT", /* TODO: tell the minage ? */
1912 "NT_STATUS_PWD_HISTORY_CONFLICT" /* TODO: tell the history length ? */
1913 };
1914 int ret = PAM_AUTH_ERR;
1915
1916 ZERO_STRUCT(params);
1917
1918 if (ctx->ctrl & WINBIND_KRB5_AUTH) {
1919 flags |= WBFLAG_PAM_KRB5 |
1920 WBFLAG_PAM_CONTACT_TRUSTDOM;
1921 }
1922
1923 if (ctx->ctrl & WINBIND_CACHED_LOGIN) {
1924 flags |= WBFLAG_PAM_CACHED_LOGIN;
1925 }
1926
1927 params.account_name = user;
1928 params.level = WBC_CHANGE_PASSWORD_LEVEL_PLAIN;
1929 params.old_password.plaintext = oldpass;
1930 params.new_password.plaintext = newpass;
1931 params.flags = flags;
1932
1933 wbc_status = wbcChangeUserPasswordEx(&params, &error, &reject_reason, &policy);
1934 ret = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
1935 user, "wbcChangeUserPasswordEx");
1936
1937 if (WBC_ERROR_IS_OK(wbc_status)) {
1938 _pam_log(ctx, LOG_NOTICE,
1939 "user '%s' password changed", user);
1940 return PAM_SUCCESS;
1941 }
1942
1943 if (!error) {
1944 wbcFreeMemory(policy);
1945 return ret;
1946 }
1947
1948 for (i=0; i<ARRAY_SIZE(codes); i++) {
1949 int _ret = ret;
1950 if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
1951 ret = _ret;
1952 goto done;
1953 }
1954 }
1955
1956 if (!strcasecmp(error->nt_string,
1957 "NT_STATUS_PASSWORD_RESTRICTION")) {
1958
1959 char *pwd_restriction_string = NULL;
1960 SMB_TIME_T min_pwd_age = 0;
1961
1962 if (policy) {
1963 min_pwd_age = policy->min_passwordage;
1964 }
1965
1966 /* FIXME: avoid to send multiple PAM messages after another */
1967 switch (reject_reason) {
1968 case -1:
1969 break;
1970 case WBC_PWD_CHANGE_NO_ERROR:
1971 if ((min_pwd_age > 0) &&
1972 (pwd_last_set + min_pwd_age > time(NULL))) {
1973 PAM_WB_REMARK_DIRECT(ctx,
1974 "NT_STATUS_PWD_TOO_RECENT");
1975 }
1976 break;
1977 case WBC_PWD_CHANGE_PASSWORD_TOO_SHORT:
1978 PAM_WB_REMARK_DIRECT(ctx,
1979 "NT_STATUS_PWD_TOO_SHORT");
1980 break;
1981 case WBC_PWD_CHANGE_PWD_IN_HISTORY:
1982 PAM_WB_REMARK_DIRECT(ctx,
1983 "NT_STATUS_PWD_HISTORY_CONFLICT");
1984 break;
1985 case WBC_PWD_CHANGE_NOT_COMPLEX:
1986 _make_remark(ctx, PAM_ERROR_MSG,
1987 _("Password does not meet "
1988 "complexity requirements"));
1989 break;
1990 default:
1991 _pam_log_debug(ctx, LOG_DEBUG,
1992 "unknown password change "
1993 "reject reason: %d",
1994 reject_reason);
1995 break;
1996 }
1997
1998 pwd_restriction_string =
1999 _pam_compose_pwd_restriction_string(ctx, policy);
2000 if (pwd_restriction_string) {
2001 _make_remark(ctx, PAM_ERROR_MSG,
2002 pwd_restriction_string);
2003 TALLOC_FREE(pwd_restriction_string);
2004 }
2005 }
2006 done:
2007 wbcFreeMemory(error);
2008 wbcFreeMemory(policy);
2009
2010 return ret;
2011 }
2012
2013 /*
2014 * Checks if a user has an account
2015 *
2016 * return values:
2017 * 1 = User not found
2018 * 0 = OK
2019 * -1 = System error
2020 */
2021 static int valid_user(struct pwb_context *ctx,
2022 const char *user)
2023 {
2024 /* check not only if the user is available over NSS calls, also make
2025 * sure it's really a winbind user, this is important when stacking PAM
2026 * modules in the 'account' or 'password' facility. */
2027
2028 wbcErr wbc_status;
2029 struct passwd *pwd = NULL;
2030 struct passwd *wb_pwd = NULL;
2031
2032 pwd = getpwnam(user);
2033 if (pwd == NULL) {
2034 return 1;
2035 }
2036
2037 wbc_status = wbcGetpwnam(user, &wb_pwd);
2038 wbcFreeMemory(wb_pwd);
2039 if (!WBC_ERROR_IS_OK(wbc_status)) {
2040 _pam_log(ctx, LOG_DEBUG, "valid_user: wbcGetpwnam gave %s\n",
2041 wbcErrorString(wbc_status));
2042 }
2043
2044 switch (wbc_status) {
2045 case WBC_ERR_UNKNOWN_USER:
2046 /* match other insane libwbclient return codes */
2047 case WBC_ERR_WINBIND_NOT_AVAILABLE:
2048 case WBC_ERR_DOMAIN_NOT_FOUND:
2049 return 1;
2050 case WBC_ERR_SUCCESS:
2051 return 0;
2052 default:
2053 break;
2054 }
2055 return -1;
2056 }
2057
2058 static char *_pam_delete(register char *xx)
2059 {
2060 _pam_overwrite(xx);
2061 _pam_drop(xx);
2062 return NULL;
2063 }
2064
2065 /*
2066 * obtain a password from the user
2067 */
2068
2069 static int _winbind_read_password(struct pwb_context *ctx,
2070 unsigned int ctrl,
2071 const char *comment,
2072 const char *prompt1,
2073 const char *prompt2,
2074 const char **pass)
2075 {
2076 int authtok_flag;
2077 int retval;
2078 const char *item;
2079 char *token;
2080
2081 _pam_log(ctx, LOG_DEBUG, "getting password (0x%08x)", ctrl);
2082
2083 /*
2084 * make sure nothing inappropriate gets returned
2085 */
2086
2087 *pass = token = NULL;
2088
2089 /*
2090 * which authentication token are we getting?
2091 */
2092
2093 if (on(WINBIND__OLD_PASSWORD, ctrl)) {
2094 authtok_flag = PAM_OLDAUTHTOK;
2095 } else {
2096 authtok_flag = PAM_AUTHTOK;
2097 }
2098
2099 /*
2100 * should we obtain the password from a PAM item ?
2101 */
2102
2103 if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) ||
2104 on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
2105 retval = pam_get_item(ctx->pamh,
2106 authtok_flag,
2107 (const void **) &item);
2108 if (retval != PAM_SUCCESS) {
2109 /* very strange. */
2110 _pam_log(ctx, LOG_ALERT,
2111 "pam_get_item returned error "
2112 "to unix-read-password");
2113 return retval;
2114 } else if (item != NULL) { /* we have a password! */
2115 *pass = item;
2116 item = NULL;
2117 _pam_log(ctx, LOG_DEBUG,
2118 "pam_get_item returned a password");
2119 return PAM_SUCCESS;
2120 } else if (on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
2121 return PAM_AUTHTOK_RECOVER_ERR; /* didn't work */
2122 } else if (on(WINBIND_USE_AUTHTOK_ARG, ctrl)
2123 && off(WINBIND__OLD_PASSWORD, ctrl)) {
2124 return PAM_AUTHTOK_RECOVER_ERR;
2125 }
2126 }
2127 /*
2128 * getting here implies we will have to get the password from the
2129 * user directly.
2130 */
2131
2132 {
2133 struct pam_message msg[3], *pmsg[3];
2134 struct pam_response *resp;
2135 int i, replies;
2136
2137 /* prepare to converse */
2138
2139 if (comment != NULL && off(ctrl, WINBIND_SILENT)) {
2140 pmsg[0] = &msg[0];
2141 msg[0].msg_style = PAM_TEXT_INFO;
2142 msg[0].msg = discard_const_p(char, comment);
2143 i = 1;
2144 } else {
2145 i = 0;
2146 }
2147
2148 pmsg[i] = &msg[i];
2149 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
2150 msg[i++].msg = discard_const_p(char, prompt1);
2151 replies = 1;
2152
2153 if (prompt2 != NULL) {
2154 pmsg[i] = &msg[i];
2155 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
2156 msg[i++].msg = discard_const_p(char, prompt2);
2157 ++replies;
2158 }
2159 /* so call the conversation expecting i responses */
2160 resp = NULL;
2161 retval = converse(ctx->pamh, i, pmsg, &resp);
2162 if (resp == NULL) {
2163 if (retval == PAM_SUCCESS) {
2164 retval = PAM_AUTHTOK_RECOVER_ERR;
2165 }
2166 goto done;
2167 }
2168 if (retval != PAM_SUCCESS) {
2169 _pam_drop_reply(resp, i);
2170 goto done;
2171 }
2172
2173 /* interpret the response */
2174
2175 token = x_strdup(resp[i - replies].resp);
2176 if (!token) {
2177 _pam_log(ctx, LOG_NOTICE,
2178 "could not recover "
2179 "authentication token");
2180 retval = PAM_AUTHTOK_RECOVER_ERR;
2181 goto done;
2182 }
2183
2184 if (replies == 2) {
2185 /* verify that password entered correctly */
2186 if (!resp[i - 1].resp ||
2187 strcmp(token, resp[i - 1].resp)) {
2188 _pam_delete(token); /* mistyped */
2189 retval = PAM_AUTHTOK_RECOVER_ERR;
2190 _make_remark(ctx, PAM_ERROR_MSG,
2191 MISTYPED_PASS);
2192 }
2193 }
2194
2195 /*
2196 * tidy up the conversation (resp_retcode) is ignored
2197 * -- what is it for anyway? AGM
2198 */
2199 _pam_drop_reply(resp, i);
2200 }
2201
2202 done:
2203 if (retval != PAM_SUCCESS) {
2204 _pam_log_debug(ctx, LOG_DEBUG,
2205 "unable to obtain a password");
2206 return retval;
2207 }
2208 /* 'token' is the entered password */
2209
2210 /* we store this password as an item */
2211
2212 retval = pam_set_item(ctx->pamh, authtok_flag, token);
2213 _pam_delete(token); /* clean it up */
2214 if (retval != PAM_SUCCESS ||
2215 (retval = pam_get_item(ctx->pamh, authtok_flag, (const void **) &item)) != PAM_SUCCESS) {
2216
2217 _pam_log(ctx, LOG_CRIT, "error manipulating password");
2218 return retval;
2219
2220 }
2221
2222 *pass = item;
2223 item = NULL; /* break link to password */
2224
2225 return PAM_SUCCESS;
2226 }
2227
2228 static const char *get_conf_item_string(struct pwb_context *ctx,
2229 const char *item,
2230 int config_flag)
2231 {
2232 int i = 0;
2233 const char *parm_opt = NULL;
2234
2235 if (!(ctx->ctrl & config_flag)) {
2236 goto out;
2237 }
2238
2239 /* let the pam opt take precedence over the pam_winbind.conf option */
2240 for (i=0; i<ctx->argc; i++) {
2241
2242 if ((strncmp(ctx->argv[i], item, strlen(item)) == 0)) {
2243 char *p;
2244
2245 if ((p = strchr(ctx->argv[i], '=')) == NULL) {
2246 _pam_log(ctx, LOG_INFO,
2247 "no \"=\" delimiter for \"%s\" found\n",
2248 item);
2249 goto out;
2250 }
2251 _pam_log_debug(ctx, LOG_INFO,
2252 "PAM config: %s '%s'\n", item, p+1);
2253 return p + 1;
2254 }
2255 }
2256
2257 if (ctx->dict) {
2258 char *key = NULL;
2259
2260 key = talloc_asprintf(ctx, "global:%s", item);
2261 if (!key) {
2262 goto out;
2263 }
2264
2265 parm_opt = iniparser_getstring(ctx->dict, key, NULL);
2266 TALLOC_FREE(key);
2267
2268 _pam_log_debug(ctx, LOG_INFO, "CONFIG file: %s '%s'\n",
2269 item, parm_opt);
2270 }
2271 out:
2272 return parm_opt;
2273 }
2274
2275 static int get_config_item_int(struct pwb_context *ctx,
2276 const char *item,
2277 int config_flag)
2278 {
2279 int i, parm_opt = -1;
2280
2281 if (!(ctx->ctrl & config_flag)) {
2282 goto out;
2283 }
2284
2285 /* let the pam opt take precedence over the pam_winbind.conf option */
2286 for (i = 0; i < ctx->argc; i++) {
2287
2288 if ((strncmp(ctx->argv[i], item, strlen(item)) == 0)) {
2289 char *p;
2290
2291 if ((p = strchr(ctx->argv[i], '=')) == NULL) {
2292 _pam_log(ctx, LOG_INFO,
2293 "no \"=\" delimiter for \"%s\" found\n",
2294 item);
2295 goto out;
2296 }
2297 parm_opt = atoi(p + 1);
2298 _pam_log_debug(ctx, LOG_INFO,
2299 "PAM config: %s '%d'\n",
2300 item, parm_opt);
2301 return parm_opt;
2302 }
2303 }
2304
2305 if (ctx->dict) {
2306 char *key = NULL;
2307
2308 key = talloc_asprintf(ctx, "global:%s", item);
2309 if (!key) {
2310 goto out;
2311 }
2312
2313 parm_opt = iniparser_getint(ctx->dict, key, -1);
2314 TALLOC_FREE(key);
2315
2316 _pam_log_debug(ctx, LOG_INFO,
2317 "CONFIG file: %s '%d'\n",
2318 item, parm_opt);
2319 }
2320 out:
2321 return parm_opt;
2322 }
2323
2324 static const char *get_krb5_cc_type_from_config(struct pwb_context *ctx)
2325 {
2326 return get_conf_item_string(ctx, "krb5_ccache_type",
2327 WINBIND_KRB5_CCACHE_TYPE);
2328 }
2329
2330 static const char *get_member_from_config(struct pwb_context *ctx)
2331 {
2332 const char *ret = NULL;
2333 ret = get_conf_item_string(ctx, "require_membership_of",
2334 WINBIND_REQUIRED_MEMBERSHIP);
2335 if (ret) {
2336 return ret;
2337 }
2338 return get_conf_item_string(ctx, "require-membership-of",
2339 WINBIND_REQUIRED_MEMBERSHIP);
2340 }
2341
2342 static int get_warn_pwd_expire_from_config(struct pwb_context *ctx)
2343 {
2344 int ret;
2345 ret = get_config_item_int(ctx, "warn_pwd_expire",
2346 WINBIND_WARN_PWD_EXPIRE);
2347 /* no or broken setting */
2348 if (ret <= 0) {
2349 return DEFAULT_DAYS_TO_WARN_BEFORE_PWD_EXPIRES;
2350 }
2351 return ret;
2352 }
2353
2354 /**
2355 * Retrieve the winbind separator.
2356 *
2357 * @param ctx PAM winbind context.
2358 *
2359 * @return string separator character. NULL on failure.
2360 */
2361
2362 static char winbind_get_separator(struct pwb_context *ctx)
2363 {
2364 wbcErr wbc_status;
2365 static struct wbcInterfaceDetails *details = NULL;
2366
2367 wbc_status = wbcInterfaceDetails(&details);
2368 if (!WBC_ERROR_IS_OK(wbc_status)) {
2369 _pam_log(ctx, LOG_ERR,
2370 "Could not retrieve winbind interface details: %s",
2371 wbcErrorString(wbc_status));
2372 return '\0';
2373 }
2374
2375 if (!details) {
2376 return '\0';
2377 }
2378
2379 return details->winbind_separator;
2380 }
2381
2382
2383 /**
2384 * Convert a upn to a name.
2385 *
2386 * @param ctx PAM winbind context.
2387 * @param upn USer UPN to be trabslated.
2388 *
2389 * @return converted name. NULL pointer on failure. Caller needs to free.
2390 */
2391
2392 static char* winbind_upn_to_username(struct pwb_context *ctx,
2393 const char *upn)
2394 {
2395 char sep;
2396 wbcErr wbc_status = WBC_ERR_UNKNOWN_FAILURE;
2397 struct wbcDomainSid sid;
2398 enum wbcSidType type;
2399 char *domain = NULL;
2400 char *name;
2401 char *p;
2402
2403 /* This cannot work when the winbind separator = @ */
2404
2405 sep = winbind_get_separator(ctx);
2406 if (!sep || sep == '@') {
2407 return NULL;
2408 }
2409
2410 name = talloc_strdup(ctx, upn);
2411 if (!name) {
2412 return NULL;
2413 }
2414 if ((p = strchr(name, '@')) != NULL) {
2415 *p = 0;
2416 domain = p + 1;
2417 }
2418
2419 /* Convert the UPN to a SID */
2420
2421 wbc_status = wbcLookupName(domain, name, &sid, &type);
2422 if (!WBC_ERROR_IS_OK(wbc_status)) {
2423 return NULL;
2424 }
2425
2426 /* Convert the the SID back to the sAMAccountName */
2427
2428 wbc_status = wbcLookupSid(&sid, &domain, &name, &type);
2429 if (!WBC_ERROR_IS_OK(wbc_status)) {
2430 return NULL;
2431 }
2432
2433 return talloc_asprintf(ctx, "%s\\%s", domain, name);
2434 }
2435
2436 static int _pam_delete_cred(pam_handle_t *pamh, int flags,
2437 int argc, const char **argv)
2438 {
2439 int retval = PAM_SUCCESS;
2440 struct pwb_context *ctx = NULL;
2441 struct wbcLogoffUserParams logoff;
2442 struct wbcAuthErrorInfo *error = NULL;
2443 const char *user;
2444 wbcErr wbc_status = WBC_ERR_SUCCESS;
2445
2446 ZERO_STRUCT(logoff);
2447
2448 retval = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2449 if (retval) {
2450 goto out;
2451 }
2452
2453 _PAM_LOG_FUNCTION_ENTER("_pam_delete_cred", ctx);
2454
2455 if (ctx->ctrl & WINBIND_KRB5_AUTH) {
2456
2457 /* destroy the ccache here */
2458
2459 uint32_t wbc_flags = 0;
2460 const char *ccname = NULL;
2461 struct passwd *pwd = NULL;
2462
2463 retval = pam_get_user(pamh, &user, _("Username: "));
2464 if (retval) {
2465 _pam_log(ctx, LOG_ERR,
2466 "could not identify user");
2467 goto out;
2468 }
2469
2470 if (user == NULL) {
2471 _pam_log(ctx, LOG_ERR,
2472 "username was NULL!");
2473 retval = PAM_USER_UNKNOWN;
2474 goto out;
2475 }
2476
2477 _pam_log_debug(ctx, LOG_DEBUG,
2478 "username [%s] obtained", user);
2479
2480 ccname = pam_getenv(pamh, "KRB5CCNAME");
2481 if (ccname == NULL) {
2482 _pam_log_debug(ctx, LOG_DEBUG,
2483 "user has no KRB5CCNAME environment");
2484 }
2485
2486 pwd = getpwnam(user);
2487 if (pwd == NULL) {
2488 retval = PAM_USER_UNKNOWN;
2489 goto out;
2490 }
2491
2492 wbc_flags = WBFLAG_PAM_KRB5 |
2493 WBFLAG_PAM_CONTACT_TRUSTDOM;
2494
2495 logoff.username = user;
2496
2497 if (ccname) {
2498 wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
2499 &logoff.blobs,
2500 "ccfilename",
2501 0,
2502 discard_const_p(uint8_t, ccname),
2503 strlen(ccname)+1);
2504 if (!WBC_ERROR_IS_OK(wbc_status)) {
2505 goto out;
2506 }
2507 }
2508
2509 wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
2510 &logoff.blobs,
2511 "flags",
2512 0,
2513 (uint8_t *)&wbc_flags,
2514 sizeof(wbc_flags));
2515 if (!WBC_ERROR_IS_OK(wbc_status)) {
2516 goto out;
2517 }
2518
2519 wbc_status = wbcAddNamedBlob(&logoff.num_blobs,
2520 &logoff.blobs,
2521 "user_uid",
2522 0,
2523 (uint8_t *)&pwd->pw_uid,
2524 sizeof(pwd->pw_uid));
2525 if (!WBC_ERROR_IS_OK(wbc_status)) {
2526 goto out;
2527 }
2528
2529 wbc_status = wbcLogoffUserEx(&logoff, &error);
2530 retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
2531 user, "wbcLogoffUser");
2532 wbcFreeMemory(error);
2533 wbcFreeMemory(logoff.blobs);
2534 logoff.blobs = NULL;
2535
2536 if (!WBC_ERROR_IS_OK(wbc_status)) {
2537 _pam_log(ctx, LOG_INFO,
2538 "failed to logoff user %s: %s\n",
2539 user, wbcErrorString(wbc_status));
2540 }
2541 }
2542
2543 out:
2544 if (logoff.blobs) {
2545 wbcFreeMemory(logoff.blobs);
2546 }
2547
2548 if (!WBC_ERROR_IS_OK(wbc_status)) {
2549 retval = wbc_auth_error_to_pam_error(ctx, error, wbc_status,
2550 user, "wbcLogoffUser");
2551 }
2552
2553 /*
2554 * Delete the krb5 ccname variable from the PAM environment
2555 * if it was set by winbind.
2556 */
2557 if ((ctx->ctrl & WINBIND_KRB5_AUTH) && pam_getenv(pamh, "KRB5CCNAME")) {
2558 pam_putenv(pamh, "KRB5CCNAME");
2559 }
2560
2561 _PAM_LOG_FUNCTION_LEAVE("_pam_delete_cred", ctx, retval);
2562
2563 TALLOC_FREE(ctx);
2564
2565 return retval;
2566 }
2567
2568 PAM_EXTERN
2569 int pam_sm_authenticate(pam_handle_t *pamh, int flags,
2570 int argc, const char **argv)
2571 {
2572 const char *username;
2573 const char *password;
2574 const char *member = NULL;
2575 const char *cctype = NULL;
2576 int warn_pwd_expire;
2577 int retval = PAM_AUTH_ERR;
2578 char *username_ret = NULL;
2579 char *new_authtok_required = NULL;
2580 char *real_username = NULL;
2581 struct pwb_context *ctx = NULL;
2582
2583 retval = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2584 if (retval) {
2585 goto out;
2586 }
2587
2588 _PAM_LOG_FUNCTION_ENTER("pam_sm_authenticate", ctx);
2589
2590 /* Get the username */
2591 retval = pam_get_user(pamh, &username, NULL);
2592 if ((retval != PAM_SUCCESS) || (!username)) {
2593 _pam_log_debug(ctx, LOG_DEBUG,
2594 "can not get the username");
2595 retval = PAM_SERVICE_ERR;
2596 goto out;
2597 }
2598
2599
2600 #if defined(AIX)
2601 /* Decode the user name since AIX does not support logn user
2602 names by default. The name is encoded as _#uid. */
2603
2604 if (username[0] == '_') {
2605 uid_t id = atoi(&username[1]);
2606 struct passwd *pw = NULL;
2607
2608 if ((id!=0) && ((pw = getpwuid(id)) != NULL)) {
2609 real_username = strdup(pw->pw_name);
2610 }
2611 }
2612 #endif
2613
2614 if (!real_username) {
2615 /* Just making a copy of the username we got from PAM */
2616 if ((real_username = strdup(username)) == NULL) {
2617 _pam_log_debug(ctx, LOG_DEBUG,
2618 "memory allocation failure when copying "
2619 "username");
2620 retval = PAM_SERVICE_ERR;
2621 goto out;
2622 }
2623 }
2624
2625 /* Maybe this was a UPN */
2626
2627 if (strchr(real_username, '@') != NULL) {
2628 char *samaccountname = NULL;
2629
2630 samaccountname = winbind_upn_to_username(ctx,
2631 real_username);
2632 if (samaccountname) {
2633 free(real_username);
2634 real_username = strdup(samaccountname);
2635 }
2636 }
2637
2638 retval = _winbind_read_password(ctx, ctx->ctrl, NULL,
2639 _("Password: "), NULL,
2640 &password);
2641
2642 if (retval != PAM_SUCCESS) {
2643 _pam_log(ctx, LOG_ERR,
2644 "Could not retrieve user's password");
2645 retval = PAM_AUTHTOK_ERR;
2646 goto out;
2647 }
2648
2649 /* Let's not give too much away in the log file */
2650
2651 #ifdef DEBUG_PASSWORD
2652 _pam_log_debug(ctx, LOG_INFO,
2653 "Verify user '%s' with password '%s'",
2654 real_username, password);
2655 #else
2656 _pam_log_debug(ctx, LOG_INFO,
2657 "Verify user '%s'", real_username);
2658 #endif
2659
2660 member = get_member_from_config(ctx);
2661 cctype = get_krb5_cc_type_from_config(ctx);
2662 warn_pwd_expire = get_warn_pwd_expire_from_config(ctx);
2663
2664 /* Now use the username to look up password */
2665 retval = winbind_auth_request(ctx, real_username, password,
2666 member, cctype, warn_pwd_expire,
2667 NULL, NULL, NULL,
2668 NULL, &username_ret);
2669
2670 if (retval == PAM_NEW_AUTHTOK_REQD ||
2671 retval == PAM_AUTHTOK_EXPIRED) {
2672
2673 char *new_authtok_required_during_auth = NULL;
2674
2675 new_authtok_required = talloc_asprintf(NULL, "%d", retval);
2676 if (!new_authtok_required) {
2677 retval = PAM_BUF_ERR;
2678 goto out;
2679 }
2680
2681 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD,
2682 new_authtok_required,
2683 _pam_winbind_cleanup_func);
2684
2685 retval = PAM_SUCCESS;
2686
2687 new_authtok_required_during_auth = talloc_asprintf(NULL, "%d", true);
2688 if (!new_authtok_required_during_auth) {
2689 retval = PAM_BUF_ERR;
2690 goto out;
2691 }
2692
2693 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
2694 new_authtok_required_during_auth,
2695 _pam_winbind_cleanup_func);
2696
2697 goto out;
2698 }
2699
2700 out:
2701 if (username_ret) {
2702 pam_set_item (pamh, PAM_USER, username_ret);
2703 _pam_log_debug(ctx, LOG_INFO,
2704 "Returned user was '%s'", username_ret);
2705 free(username_ret);
2706 }
2707
2708 if (real_username) {
2709 free(real_username);
2710 }
2711
2712 if (!new_authtok_required) {
2713 pam_set_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD, NULL, NULL);
2714 }
2715
2716 if (retval != PAM_SUCCESS) {
2717 _pam_free_data_info3(pamh);
2718 }
2719
2720 if (ctx != NULL) {
2721 _PAM_LOG_FUNCTION_LEAVE("pam_sm_authenticate", ctx, retval);
2722 TALLOC_FREE(ctx);
2723 }
2724
2725 return retval;
2726 }
2727
2728 PAM_EXTERN
2729 int pam_sm_setcred(pam_handle_t *pamh, int flags,
2730 int argc, const char **argv)
2731 {
2732 int ret = PAM_SYSTEM_ERR;
2733 struct pwb_context *ctx = NULL;
2734
2735 ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2736 if (ret) {
2737 goto out;
2738 }
2739
2740 _PAM_LOG_FUNCTION_ENTER("pam_sm_setcred", ctx);
2741
2742 switch (flags & ~PAM_SILENT) {
2743
2744 case PAM_DELETE_CRED:
2745 ret = _pam_delete_cred(pamh, flags, argc, argv);
2746 break;
2747 case PAM_REFRESH_CRED:
2748 _pam_log_debug(ctx, LOG_WARNING,
2749 "PAM_REFRESH_CRED not implemented");
2750 ret = PAM_SUCCESS;
2751 break;
2752 case PAM_REINITIALIZE_CRED:
2753 _pam_log_debug(ctx, LOG_WARNING,
2754 "PAM_REINITIALIZE_CRED not implemented");
2755 ret = PAM_SUCCESS;
2756 break;
2757 case PAM_ESTABLISH_CRED:
2758 _pam_log_debug(ctx, LOG_WARNING,
2759 "PAM_ESTABLISH_CRED not implemented");
2760 ret = PAM_SUCCESS;
2761 break;
2762 default:
2763 ret = PAM_SYSTEM_ERR;
2764 break;
2765 }
2766
2767 out:
2768
2769 _PAM_LOG_FUNCTION_LEAVE("pam_sm_setcred", ctx, ret);
2770
2771 TALLOC_FREE(ctx);
2772
2773 return ret;
2774 }
2775
2776 /*
2777 * Account management. We want to verify that the account exists
2778 * before returning PAM_SUCCESS
2779 */
2780 PAM_EXTERN
2781 int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
2782 int argc, const char **argv)
2783 {
2784 const char *username;
2785 int ret = PAM_USER_UNKNOWN;
2786 const char *tmp = NULL;
2787 struct pwb_context *ctx = NULL;
2788
2789 ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2790 if (ret) {
2791 goto out;
2792 }
2793
2794 _PAM_LOG_FUNCTION_ENTER("pam_sm_acct_mgmt", ctx);
2795
2796
2797 /* Get the username */
2798 ret = pam_get_user(pamh, &username, NULL);
2799 if ((ret != PAM_SUCCESS) || (!username)) {
2800 _pam_log_debug(ctx, LOG_DEBUG,
2801 "can not get the username");
2802 ret = PAM_SERVICE_ERR;
2803 goto out;
2804 }
2805
2806 /* Verify the username */
2807 ret = valid_user(ctx, username);
2808 switch (ret) {
2809 case -1:
2810 /* some sort of system error. The log was already printed */
2811 ret = PAM_SERVICE_ERR;
2812 goto out;
2813 case 1:
2814 /* the user does not exist */
2815 _pam_log_debug(ctx, LOG_NOTICE, "user '%s' not found",
2816 username);
2817 if (ctx->ctrl & WINBIND_UNKNOWN_OK_ARG) {
2818 ret = PAM_IGNORE;
2819 goto out;
2820 }
2821 ret = PAM_USER_UNKNOWN;
2822 goto out;
2823 case 0:
2824 pam_get_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD,
2825 (const void **)&tmp);
2826 if (tmp != NULL) {
2827 ret = atoi(tmp);
2828 switch (ret) {
2829 case PAM_AUTHTOK_EXPIRED:
2830 /* fall through, since new token is required in this case */
2831 case PAM_NEW_AUTHTOK_REQD:
2832 _pam_log(ctx, LOG_WARNING,
2833 "pam_sm_acct_mgmt success but %s is set",
2834 PAM_WINBIND_NEW_AUTHTOK_REQD);
2835 _pam_log(ctx, LOG_NOTICE,
2836 "user '%s' needs new password",
2837 username);
2838 /* PAM_AUTHTOKEN_REQD does not exist, but is documented in the manpage */
2839 ret = PAM_NEW_AUTHTOK_REQD;
2840 goto out;
2841 default:
2842 _pam_log(ctx, LOG_WARNING,
2843 "pam_sm_acct_mgmt success");
2844 _pam_log(ctx, LOG_NOTICE,
2845 "user '%s' granted access", username);
2846 ret = PAM_SUCCESS;
2847 goto out;
2848 }
2849 }
2850
2851 /* Otherwise, the authentication looked good */
2852 _pam_log(ctx, LOG_NOTICE,
2853 "user '%s' granted access", username);
2854 ret = PAM_SUCCESS;
2855 goto out;
2856 default:
2857 /* we don't know anything about this return value */
2858 _pam_log(ctx, LOG_ERR,
2859 "internal module error (ret = %d, user = '%s')",
2860 ret, username);
2861 ret = PAM_SERVICE_ERR;
2862 goto out;
2863 }
2864
2865 /* should not be reached */
2866 ret = PAM_IGNORE;
2867
2868 out:
2869
2870 _PAM_LOG_FUNCTION_LEAVE("pam_sm_acct_mgmt", ctx, ret);
2871
2872 TALLOC_FREE(ctx);
2873
2874 return ret;
2875 }
2876
2877 PAM_EXTERN
2878 int pam_sm_open_session(pam_handle_t *pamh, int flags,
2879 int argc, const char **argv)
2880 {
2881 int ret = PAM_SUCCESS;
2882 struct pwb_context *ctx = NULL;
2883
2884 ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2885 if (ret) {
2886 goto out;
2887 }
2888
2889 _PAM_LOG_FUNCTION_ENTER("pam_sm_open_session", ctx);
2890
2891 if (ctx->ctrl & WINBIND_MKHOMEDIR) {
2892 /* check and create homedir */
2893 ret = _pam_mkhomedir(ctx);
2894 }
2895 out:
2896 _PAM_LOG_FUNCTION_LEAVE("pam_sm_open_session", ctx, ret);
2897
2898 TALLOC_FREE(ctx);
2899
2900 return ret;
2901 }
2902
2903 PAM_EXTERN
2904 int pam_sm_close_session(pam_handle_t *pamh, int flags,
2905 int argc, const char **argv)
2906 {
2907 int ret = PAM_SUCCESS;
2908 struct pwb_context *ctx = NULL;
2909
2910 ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2911 if (ret) {
2912 goto out;
2913 }
2914
2915 _PAM_LOG_FUNCTION_ENTER("pam_sm_close_session", ctx);
2916
2917 out:
2918 _PAM_LOG_FUNCTION_LEAVE("pam_sm_close_session", ctx, ret);
2919
2920 TALLOC_FREE(ctx);
2921
2922 return ret;
2923 }
2924
2925 /**
2926 * evaluate whether we need to re-authenticate with kerberos after a
2927 * password change
2928 *
2929 * @param ctx PAM winbind context.
2930 * @param user The username
2931 *
2932 * @return boolean Returns true if required, false if not.
2933 */
2934
2935 static bool _pam_require_krb5_auth_after_chauthtok(struct pwb_context *ctx,
2936 const char *user)
2937 {
2938
2939 /* Make sure that we only do this if a) the chauthtok got initiated
2940 * during a logon attempt (authenticate->acct_mgmt->chauthtok) b) any
2941 * later password change via the "passwd" command if done by the user
2942 * itself
2943 * NB. If we login from gdm or xdm and the password expires,
2944 * we change the password, but there is no memory cache.
2945 * Thus, even for passthrough login, we should do the
2946 * authentication again to update memory cache.
2947 * --- BoYang
2948 * */
2949
2950 char *new_authtok_reqd_during_auth = NULL;
2951 struct passwd *pwd = NULL;
2952
2953 pam_get_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
2954 (const void **) &new_authtok_reqd_during_auth);
2955 pam_set_data(ctx->pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH,
2956 NULL, NULL);
2957
2958 if (new_authtok_reqd_during_auth) {
2959 return true;
2960 }
2961
2962 pwd = getpwnam(user);
2963 if (!pwd) {
2964 return false;
2965 }
2966
2967 if (getuid() == pwd->pw_uid) {
2968 return true;
2969 }
2970
2971 return false;
2972 }
2973
2974
2975 PAM_EXTERN
2976 int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
2977 int argc, const char **argv)
2978 {
2979 unsigned int lctrl;
2980 int ret;
2981 bool cached_login = false;
2982
2983 /* <DO NOT free() THESE> */
2984 const char *user;
2985 const char *pass_old;
2986 const char *pass_new;
2987 /* </DO NOT free() THESE> */
2988
2989 char *Announce;
2990
2991 int retry = 0;
2992 char *username_ret = NULL;
2993 struct wbcAuthErrorInfo *error = NULL;
2994 struct pwb_context *ctx = NULL;
2995
2996 ret = _pam_winbind_init_context(pamh, flags, argc, argv, &ctx);
2997 if (ret) {
2998 goto out;
2999 }
3000
3001 _PAM_LOG_FUNCTION_ENTER("pam_sm_chauthtok", ctx);
3002
3003 cached_login = (ctx->ctrl & WINBIND_CACHED_LOGIN);
3004
3005 /* clearing offline bit for auth */
3006 ctx->ctrl &= ~WINBIND_CACHED_LOGIN;
3007
3008 /*
3009 * First get the name of a user
3010 */
3011 ret = pam_get_user(pamh, &user, _("Username: "));
3012 if (ret) {
3013 _pam_log(ctx, LOG_ERR,
3014 "password - could not identify user");
3015 goto out;
3016 }
3017
3018 if (user == NULL) {
3019 _pam_log(ctx, LOG_ERR, "username was NULL!");
3020 ret = PAM_USER_UNKNOWN;
3021 goto out;
3022 }
3023
3024 _pam_log_debug(ctx, LOG_DEBUG, "username [%s] obtained", user);
3025
3026 /* check if this is really a user in winbindd, not only in NSS */
3027 ret = valid_user(ctx, user);
3028 switch (ret) {
3029 case 1:
3030 ret = PAM_USER_UNKNOWN;
3031 goto out;
3032 case -1:
3033 ret = PAM_SYSTEM_ERR;
3034 goto out;
3035 default:
3036 break;
3037 }
3038
3039 /*
3040 * obtain and verify the current password (OLDAUTHTOK) for
3041 * the user.
3042 */
3043
3044 if (flags & PAM_PRELIM_CHECK) {
3045 time_t pwdlastset_prelim = 0;
3046
3047 /* instruct user what is happening */
3048
3049 #define greeting _("Changing password for")
3050 Announce = talloc_asprintf(ctx, "%s %s", greeting, user);
3051 if (!Announce) {
3052 _pam_log(ctx, LOG_CRIT,
3053 "password - out of memory");
3054 ret = PAM_BUF_ERR;
3055 goto out;
3056 }
3057 #undef greeting
3058
3059 lctrl = ctx->ctrl | WINBIND__OLD_PASSWORD;
3060 ret = _winbind_read_password(ctx, lctrl,
3061 Announce,
3062 _("(current) NT password: "),
3063 NULL,
3064 (const char **) &pass_old);
3065 TALLOC_FREE(Announce);
3066 if (ret != PAM_SUCCESS) {
3067 _pam_log(ctx, LOG_NOTICE,
3068 "password - (old) token not obtained");
3069 goto out;
3070 }
3071
3072 /* verify that this is the password for this user */
3073
3074 ret = winbind_auth_request(ctx, user, pass_old,
3075 NULL, NULL, 0,
3076 &error, NULL, NULL,
3077 &pwdlastset_prelim, NULL);
3078
3079 if (ret != PAM_ACCT_EXPIRED &&
3080 ret != PAM_AUTHTOK_EXPIRED &&
3081 ret != PAM_NEW_AUTHTOK_REQD &&
3082 ret != PAM_SUCCESS) {
3083 pass_old = NULL;
3084 goto out;
3085 }
3086
3087 pam_set_data(pamh, PAM_WINBIND_PWD_LAST_SET,
3088 (void *)pwdlastset_prelim, NULL);
3089
3090 ret = pam_set_item(pamh, PAM_OLDAUTHTOK,
3091 (const void *) pass_old);
3092 pass_old = NULL;
3093 if (ret != PAM_SUCCESS) {
3094 _pam_log(ctx, LOG_CRIT,
3095 "failed to set PAM_OLDAUTHTOK");
3096 }
3097 } else if (flags & PAM_UPDATE_AUTHTOK) {
3098
3099 time_t pwdlastset_update = 0;
3100
3101 /*
3102 * obtain the proposed password
3103 */
3104
3105 /*
3106 * get the old token back.
3107 */
3108
3109 ret = pam_get_item(pamh, PAM_OLDAUTHTOK, (const void **) &pass_old);
3110
3111 if (ret != PAM_SUCCESS) {
3112 _pam_log(ctx, LOG_NOTICE,
3113 "user not authenticated");
3114 goto out;
3115 }
3116
3117 lctrl = ctx->ctrl & ~WINBIND_TRY_FIRST_PASS_ARG;
3118
3119 if (on(WINBIND_USE_AUTHTOK_ARG, lctrl)) {
3120 lctrl |= WINBIND_USE_FIRST_PASS_ARG;
3121 }
3122 retry = 0;
3123 ret = PAM_AUTHTOK_ERR;
3124 while ((ret != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
3125 /*
3126 * use_authtok is to force the use of a previously entered
3127 * password -- needed for pluggable password strength checking
3128 */
3129
3130 ret = _winbind_read_password(ctx, lctrl,
3131 NULL,
3132 _("Enter new NT password: "),
3133 _("Retype new NT password: "),
3134 (const char **)&pass_new);
3135
3136 if (ret != PAM_SUCCESS) {
3137 _pam_log_debug(ctx, LOG_ALERT,
3138 "password - "
3139 "new password not obtained");
3140 pass_old = NULL;/* tidy up */
3141 goto out;
3142 }
3143
3144 /*
3145 * At this point we know who the user is and what they
3146 * propose as their new password. Verify that the new
3147 * password is acceptable.
3148 */
3149
3150 if (pass_new[0] == '\0') {/* "\0" password = NULL */
3151 pass_new = NULL;
3152 }
3153 }
3154
3155 /*
3156 * By reaching here we have approved the passwords and must now
3157 * rebuild the password database file.
3158 */
3159 pam_get_data(pamh, PAM_WINBIND_PWD_LAST_SET,
3160 (const void **) &pwdlastset_update);
3161
3162 /*
3163 * if cached creds were enabled, make sure to set the
3164 * WINBIND_CACHED_LOGIN bit here in order to have winbindd
3165 * update the cached creds storage - gd
3166 */
3167 if (cached_login) {
3168 ctx->ctrl |= WINBIND_CACHED_LOGIN;
3169 }
3170
3171 ret = winbind_chauthtok_request(ctx, user, pass_old,
3172 pass_new, pwdlastset_update);
3173 if (ret) {
3174 pass_old = pass_new = NULL;
3175 goto out;
3176 }
3177
3178 if (_pam_require_krb5_auth_after_chauthtok(ctx, user)) {
3179
3180 const char *member = NULL;
3181 const char *cctype = NULL;
3182 int warn_pwd_expire;
3183 struct wbcLogonUserInfo *info = NULL;
3184 struct wbcUserPasswordPolicyInfo *policy = NULL;
3185
3186 member = get_member_from_config(ctx);
3187 cctype = get_krb5_cc_type_from_config(ctx);
3188 warn_pwd_expire = get_warn_pwd_expire_from_config(ctx);
3189
3190 /* Keep WINBIND_CACHED_LOGIN bit for
3191 * authentication after changing the password.
3192 * This will update the cached credentials in case
3193 * that winbindd_dual_pam_chauthtok() fails
3194 * to update them.
3195 * --- BoYang
3196 * */
3197
3198 ret = winbind_auth_request(ctx, user, pass_new,
3199 member, cctype, 0,
3200 &error, &info, &policy,
3201 NULL, &username_ret);
3202 pass_old = pass_new = NULL;
3203
3204 if (ret == PAM_SUCCESS) {
3205
3206 struct wbcAuthUserInfo *user_info = NULL;
3207
3208 if (info && info->info) {
3209 user_info = info->info;
3210 }
3211
3212 /* warn a user if the password is about to
3213 * expire soon */
3214 _pam_warn_password_expiry(ctx, user_info, policy,
3215 warn_pwd_expire,
3216 NULL, NULL);
3217
3218 /* set some info3 info for other modules in the
3219 * stack */
3220 _pam_set_data_info3(ctx, user_info);
3221
3222 /* put krb5ccname into env */
3223 _pam_setup_krb5_env(ctx, info);
3224
3225 if (username_ret) {
3226 pam_set_item(pamh, PAM_USER,
3227 username_ret);
3228 _pam_log_debug(ctx, LOG_INFO,
3229 "Returned user was '%s'",
3230 username_ret);
3231 free(username_ret);
3232 }
3233
3234 }
3235
3236 if (info && info->blobs) {
3237 wbcFreeMemory(info->blobs);
3238 }
3239 wbcFreeMemory(info);
3240 wbcFreeMemory(policy);
3241
3242 goto out;
3243 }
3244 } else {
3245 ret = PAM_SERVICE_ERR;
3246 }
3247
3248 out:
3249 {
3250 /* Deal with offline errors. */
3251 int i;
3252 const char *codes[] = {
3253 "NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND",
3254 "NT_STATUS_NO_LOGON_SERVERS",
3255 "NT_STATUS_ACCESS_DENIED"
3256 };
3257
3258 for (i=0; i<ARRAY_SIZE(codes); i++) {
3259 int _ret;
3260 if (_pam_check_remark_auth_err(ctx, error, codes[i], &_ret)) {
3261 break;
3262 }
3263 }
3264 }
3265
3266 wbcFreeMemory(error);
3267
3268 _PAM_LOG_FUNCTION_LEAVE("pam_sm_chauthtok", ctx, ret);
3269
3270 TALLOC_FREE(ctx);
3271
3272 return ret;
3273 }
3274
3275 #ifdef PAM_STATIC
3276
3277 /* static module data */
3278
3279 struct pam_module _pam_winbind_modstruct = {
3280 MODULE_NAME,
3281 pam_sm_authenticate,
3282 pam_sm_setcred,
3283 pam_sm_acct_mgmt,
3284 pam_sm_open_session,
3285 pam_sm_close_session,
3286 pam_sm_chauthtok
3287 };
3288
3289 #endif
3290
3291 /*
3292 * Copyright (c) Andrew Tridgell <tridge@samba.org> 2000
3293 * Copyright (c) Tim Potter <tpot@samba.org> 2000
3294 * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
3295 * Copyright (c) Guenther Deschner <gd@samba.org> 2005-2008
3296 * Copyright (c) Jan Rêkorajski 1999.
3297 * Copyright (c) Andrew G. Morgan 1996-8.
3298 * Copyright (c) Alex O. Yuriev, 1996.
3299 * Copyright (c) Cristian Gafton 1996.
3300 * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
3301 *
3302 * Redistribution and use in source and binary forms, with or without
3303 * modification, are permitted provided that the following conditions
3304 * are met:
3305 * 1. Redistributions of source code must retain the above copyright
3306 * notice, and the entire permission notice in its entirety,
3307 * including the disclaimer of warranties.
3308 * 2. Redistributions in binary form must reproduce the above copyright
3309 * notice, this list of conditions and the following disclaimer in the
3310 * documentation and/or other materials provided with the distribution.
3311 * 3. The name of the author may not be used to endorse or promote
3312 * products derived from this software without specific prior
3313 * written permission.
3314 *
3315 * ALTERNATIVELY, this product may be distributed under the terms of
3316 * the GNU Public License, in which case the provisions of the GPL are
3317 * required INSTEAD OF the above restrictions. (This clause is
3318 * necessary due to a potential bad interaction between the GPL and
3319 * the restrictions contained in a BSD-style copyright.)
3320 *
3321 * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
3322 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
3323 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
3324 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
3325 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
3326 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
3327 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
3328 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
3329 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
3330 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
3331 * OF THE POSSIBILITY OF SUCH DAMAGE.
3332 */
reg import