auth/credentials/credentials_secrets.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    User credentials handling (as regards on-disk files)
   5
   6    Copyright (C) Jelmer Vernooij 2005
   7    Copyright (C) Tim Potter 2001
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "lib/events/events.h"
  26 #include <ldb.h>
  27 #include "librpc/gen_ndr/samr.h" /* for struct samrPassword */
  28 #include "param/secrets.h"
  29 #include "system/filesys.h"
  30 #include "auth/credentials/credentials.h"
  31 #include "auth/credentials/credentials_proto.h"
  32 #include "auth/credentials/credentials_krb5.h"
  33 #include "auth/kerberos/kerberos_util.h"
  34 #include "param/param.h"
  35 #include "lib/events/events.h"
  36 #include "dsdb/samdb/samdb.h"
  37
  38 /**
  39  * Fill in credentials for the machine trust account, from the secrets database.
  40  *
  41  * @param cred Credentials structure to fill in
  42  * @retval NTSTATUS error detailing any failure
  43  */
  44 _PUBLIC_ NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred,
  45                                               struct loadparm_context *lp_ctx,
  46                                               struct ldb_context *ldb,
  47                                               const char *base,
  48                                               const char *filter,
  49                                               char **error_string)
  50 {
  51         TALLOC_CTX *mem_ctx;
  52
  53         int ldb_ret;
  54         struct ldb_message *msg;
  55
  56         const char *machine_account;
  57         const char *password;
  58         const char *domain;
  59         const char *realm;
  60         enum netr_SchannelType sct;
  61         const char *salt_principal;
  62         char *keytab;
  63         const struct ldb_val *whenChanged;
  64
  65         /* ok, we are going to get it now, don't recurse back here */
  66         cred->machine_account_pending = false;
  67
  68         /* some other parts of the system will key off this */
  69         cred->machine_account = true;
  70
  71         mem_ctx = talloc_named(cred, 0, "cli_credentials fetch machine password");
  72
  73         if (!ldb) {
  74                 /* Local secrets are stored in secrets.ldb */
  75                 ldb = secrets_db_connect(mem_ctx, lp_ctx);
  76                 if (!ldb) {
  77                         /* set anonymous as the fallback, if the machine account won't work */
  78                         cli_credentials_set_anonymous(cred);
  79                         *error_string = talloc_strdup(cred, "Could not open secrets.ldb");
  80                         talloc_free(mem_ctx);
  81                         return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
  82                 }
  83         }
  84
  85         ldb_ret = dsdb_search_one(ldb, mem_ctx, &msg,
  86                                   ldb_dn_new(mem_ctx, ldb, base),
  87                                   LDB_SCOPE_SUBTREE,
  88                                   NULL, 0, "%s", filter);
  89
  90         if (ldb_ret != LDB_SUCCESS) {
  91                 *error_string = talloc_asprintf(cred, "Could not find entry to match filter: '%s' base: '%s': %s: %s\n",
  92                                                 filter, base ? base : "",
  93                                                 ldb_strerror(ldb_ret), ldb_errstring(ldb));
  94                 /* set anonymous as the fallback, if the machine account won't work */
  95                 cli_credentials_set_anonymous(cred);
  96                 talloc_free(mem_ctx);
  97                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
  98         }
  99
 100         password = ldb_msg_find_attr_as_string(msg, "secret", NULL);
 101
 102         machine_account = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
 103
 104         if (!machine_account) {
 105                 machine_account = ldb_msg_find_attr_as_string(msg, "servicePrincipalName", NULL);
 106
 107                 if (!machine_account) {
 108                         const char *ldap_bind_dn = ldb_msg_find_attr_as_string(msg, "ldapBindDn", NULL);
 109                         if (!ldap_bind_dn) {
 110                                 *error_string = talloc_asprintf(cred,
 111                                                                 "Could not find 'samAccountName', "
 112                                                                 "'servicePrincipalName' or "
 113                                                                 "'ldapBindDn' in secrets record: %s",
 114                                                                 ldb_dn_get_linearized(msg->dn));
 115                                 /* set anonymous as the fallback, if the machine account won't work */
 116                                 cli_credentials_set_anonymous(cred);
 117                                 talloc_free(mem_ctx);
 118                                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
 119                         } else {
 120                                 /* store bind dn in credentials */
 121                                 cli_credentials_set_bind_dn(cred, ldap_bind_dn);
 122                         }
 123                 }
 124         }
 125
 126         salt_principal = ldb_msg_find_attr_as_string(msg, "saltPrincipal", NULL);
 127         cli_credentials_set_salt_principal(cred, salt_principal);
 128
 129         sct = ldb_msg_find_attr_as_int(msg, "secureChannelType", 0);
 130         if (sct) {
 131                 cli_credentials_set_secure_channel_type(cred, sct);
 132         }
 133
 134         if (!password) {
 135                 const struct ldb_val *nt_password_hash = ldb_msg_find_ldb_val(msg, "unicodePwd");
 136                 struct samr_Password hash;
 137                 ZERO_STRUCT(hash);
 138                 if (nt_password_hash) {
 139                         memcpy(hash.hash, nt_password_hash->data,
 140                                MIN(nt_password_hash->length, sizeof(hash.hash)));
 141
 142                         cli_credentials_set_nt_hash(cred, &hash, CRED_SPECIFIED);
 143                 } else {
 144                         cli_credentials_set_password(cred, NULL, CRED_SPECIFIED);
 145                 }
 146         } else {
 147                 cli_credentials_set_password(cred, password, CRED_SPECIFIED);
 148         }
 149
 150
 151         domain = ldb_msg_find_attr_as_string(msg, "flatname", NULL);
 152         if (domain) {
 153                 cli_credentials_set_domain(cred, domain, CRED_SPECIFIED);
 154         }
 155
 156         realm = ldb_msg_find_attr_as_string(msg, "realm", NULL);
 157         if (realm) {
 158                 cli_credentials_set_realm(cred, realm, CRED_SPECIFIED);
 159         }
 160
 161         if (machine_account) {
 162                 cli_credentials_set_username(cred, machine_account, CRED_SPECIFIED);
 163         }
 164
 165         cli_credentials_set_kvno(cred, ldb_msg_find_attr_as_int(msg, "msDS-KeyVersionNumber", 0));
 166
 167         whenChanged = ldb_msg_find_ldb_val(msg, "whenChanged");
 168         if (whenChanged) {
 169                 time_t lct;
 170                 if (ldb_val_to_time(whenChanged, &lct) == LDB_SUCCESS) {
 171                         cli_credentials_set_password_last_changed_time(cred, lct);
 172                 }
 173         }
 174
 175         /* If there was an external keytab specified by reference in
 176          * the LDB, then use this.  Otherwise we will make one up
 177          * (chewing CPU time) from the password */
 178         keytab = keytab_name_from_msg(cred, ldb, msg);
 179         if (keytab) {
 180                 cli_credentials_set_keytab_name(cred, lp_ctx, keytab, CRED_SPECIFIED);
 181                 talloc_free(keytab);
 182         }
 183         talloc_free(mem_ctx);
 184
 185         return NT_STATUS_OK;
 186 }
 187
 188 /**
 189  * Fill in credentials for the machine trust account, from the secrets database.
 190  *
 191  * @param cred Credentials structure to fill in
 192  * @retval NTSTATUS error detailing any failure
 193  */
 194 _PUBLIC_ NTSTATUS cli_credentials_set_machine_account(struct cli_credentials *cred,
 195                                                       struct loadparm_context *lp_ctx)
 196 {
 197         NTSTATUS status;
 198         char *filter;
 199         char *error_string;
 200         /* Bleh, nasty recursion issues: We are setting a machine
 201          * account here, so we don't want the 'pending' flag around
 202          * any more */
 203         cred->machine_account_pending = false;
 204         filter = talloc_asprintf(cred, SECRETS_PRIMARY_DOMAIN_FILTER,
 205                                  cli_credentials_get_domain(cred));
 206         status = cli_credentials_set_secrets(cred, lp_ctx, NULL,
 207                                              SECRETS_PRIMARY_DOMAIN_DN,
 208                                              filter, &error_string);
 209         if (!NT_STATUS_IS_OK(status)) {
 210                 DEBUG(1, ("Could not find machine account in secrets database: %s: %s\n", nt_errstr(status), error_string));
 211                 talloc_free(error_string);
 212         }
 213         return status;
 214 }
 215
 216 /**
 217  * Fill in credentials for the machine trust account, from the secrets database.
 218  *
 219  * @param cred Credentials structure to fill in
 220  * @retval NTSTATUS error detailing any failure
 221  */
 222 NTSTATUS cli_credentials_set_krbtgt(struct cli_credentials *cred,
 223                                     struct loadparm_context *lp_ctx)
 224 {
 225         NTSTATUS status;
 226         char *filter;
 227         char *error_string;
 228         /* Bleh, nasty recursion issues: We are setting a machine
 229          * account here, so we don't want the 'pending' flag around
 230          * any more */
 231         cred->machine_account_pending = false;
 232         filter = talloc_asprintf(cred, SECRETS_KRBTGT_SEARCH,
 233                                        cli_credentials_get_realm(cred),
 234                                        cli_credentials_get_domain(cred));
 235         status = cli_credentials_set_secrets(cred, lp_ctx, NULL,
 236                                              SECRETS_PRINCIPALS_DN,
 237                                              filter, &error_string);
 238         if (!NT_STATUS_IS_OK(status)) {
 239                 DEBUG(1, ("Could not find krbtgt (master Kerberos) account in secrets database: %s: %s\n", nt_errstr(status), error_string));
 240                 talloc_free(error_string);
 241         }
 242         return status;
 243 }
 244
 245 /**
 246  * Fill in credentials for a particular prinicpal, from the secrets database.
 247  *
 248  * @param cred Credentials structure to fill in
 249  * @retval NTSTATUS error detailing any failure
 250  */
 251 _PUBLIC_ NTSTATUS cli_credentials_set_stored_principal(struct cli_credentials *cred,
 252                                               struct loadparm_context *lp_ctx,
 253                                               const char *serviceprincipal)
 254 {
 255         NTSTATUS status;
 256         char *filter;
 257         char *error_string;
 258         /* Bleh, nasty recursion issues: We are setting a machine
 259          * account here, so we don't want the 'pending' flag around
 260          * any more */
 261         cred->machine_account_pending = false;
 262         filter = talloc_asprintf(cred, SECRETS_PRINCIPAL_SEARCH,
 263                                  cli_credentials_get_realm(cred),
 264                                  cli_credentials_get_domain(cred),
 265                                  serviceprincipal);
 266         status = cli_credentials_set_secrets(cred, lp_ctx, NULL,
 267                                              SECRETS_PRINCIPALS_DN, filter,
 268                                              &error_string);
 269         if (!NT_STATUS_IS_OK(status)) {
 270                 DEBUG(1, ("Could not find %s principal in secrets database: %s: %s\n", serviceprincipal, nt_errstr(status), error_string));
 271         }
 272         return status;
 273 }
 274
 275 /**
 276  * Ask that when required, the credentials system will be filled with
 277  * machine trust account, from the secrets database.
 278  *
 279  * @param cred Credentials structure to fill in
 280  * @note This function is used to call the above function after, rather
 281  *       than during, popt processing.
 282  *
 283  */
 284 _PUBLIC_ void cli_credentials_set_machine_account_pending(struct cli_credentials *cred,
 285                                                  struct loadparm_context *lp_ctx)
 286 {
 287         cred->machine_account_pending = true;
 288         cred->machine_account_pending_lp_ctx = lp_ctx;
 289 }
 290
 291