r560: Fix bugzilla 1279: cannot control individual print jobs using cups
[Samba/gebeck_regimport.git] / source3 / smbd / chgpasswd.c
blobca13a167fb0670df6ab8ae43413fd1ed8b95e353
1 /*
2 Unix SMB/CIFS implementation.
3 Samba utility functions
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Andrew Bartlett 2001-2004
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 /* These comments regard the code to change the user's unix password: */
24 /* fork a child process to exec passwd and write to its
25 * tty to change a users password. This is running as the
26 * user who is attempting to change the password.
29 /*
30 * This code was copied/borrowed and stolen from various sources.
31 * The primary source was the poppasswd.c from the authors of POPMail. This software
32 * was included as a client to change passwords using the 'passwd' program
33 * on the remote machine.
35 * This code has been hacked by Bob Nance (nance@niehs.nih.gov) and Evan Patterson
36 * (patters2@niehs.nih.gov) at the National Institute of Environmental Health Sciences
37 * and rights to modify, distribute or incorporate this change to the CAP suite or
38 * using it for any other reason are granted, so long as this disclaimer is left intact.
42 This code was hacked considerably for inclusion in Samba, primarily
43 by Andrew.Tridgell@anu.edu.au. The biggest change was the addition
44 of the "password chat" option, which allows the easy runtime
45 specification of the expected sequence of events to change a
46 password.
49 #include "includes.h"
51 extern struct passdb_ops pdb_ops;
53 static NTSTATUS check_oem_password(const char *user,
54 uchar password_encrypted_with_lm_hash[516],
55 const uchar old_lm_hash_encrypted[16],
56 uchar password_encrypted_with_nt_hash[516],
57 const uchar old_nt_hash_encrypted[16],
58 SAM_ACCOUNT **hnd, char *new_passwd,
59 int new_passwd_size);
61 #if ALLOW_CHANGE_PASSWORD
63 static int findpty(char **slave)
65 int master;
66 static fstring line;
67 DIR *dirp;
68 const char *dpname;
70 #if defined(HAVE_GRANTPT)
71 /* Try to open /dev/ptmx. If that fails, fall through to old method. */
72 if ((master = sys_open("/dev/ptmx", O_RDWR, 0)) >= 0)
74 grantpt(master);
75 unlockpt(master);
76 *slave = (char *)ptsname(master);
77 if (*slave == NULL)
79 DEBUG(0,
80 ("findpty: Unable to create master/slave pty pair.\n"));
81 /* Stop fd leak on error. */
82 close(master);
83 return -1;
85 else
87 DEBUG(10,
88 ("findpty: Allocated slave pty %s\n", *slave));
89 return (master);
92 #endif /* HAVE_GRANTPT */
94 fstrcpy(line, "/dev/ptyXX");
96 dirp = opendir("/dev");
97 if (!dirp)
98 return (-1);
99 while ((dpname = readdirname(dirp)) != NULL)
101 if (strncmp(dpname, "pty", 3) == 0 && strlen(dpname) == 5)
103 DEBUG(3,
104 ("pty: try to open %s, line was %s\n", dpname,
105 line));
106 line[8] = dpname[3];
107 line[9] = dpname[4];
108 if ((master = sys_open(line, O_RDWR, 0)) >= 0)
110 DEBUG(3, ("pty: opened %s\n", line));
111 line[5] = 't';
112 *slave = line;
113 closedir(dirp);
114 return (master);
118 closedir(dirp);
119 return (-1);
122 static int dochild(int master, const char *slavedev, const struct passwd *pass,
123 const char *passwordprogram, BOOL as_root)
125 int slave;
126 struct termios stermios;
127 gid_t gid;
128 uid_t uid;
130 if (pass == NULL)
132 DEBUG(0,
133 ("dochild: user doesn't exist in the UNIX password database.\n"));
134 return False;
137 gid = pass->pw_gid;
138 uid = pass->pw_uid;
140 gain_root_privilege();
142 /* Start new session - gets rid of controlling terminal. */
143 if (setsid() < 0)
145 DEBUG(3,
146 ("Weirdness, couldn't let go of controlling terminal\n"));
147 return (False);
150 /* Open slave pty and acquire as new controlling terminal. */
151 if ((slave = sys_open(slavedev, O_RDWR, 0)) < 0)
153 DEBUG(3, ("More weirdness, could not open %s\n", slavedev));
154 return (False);
156 #ifdef I_PUSH
157 ioctl(slave, I_PUSH, "ptem");
158 ioctl(slave, I_PUSH, "ldterm");
159 #elif defined(TIOCSCTTY)
160 if (ioctl(slave, TIOCSCTTY, 0) < 0)
162 DEBUG(3, ("Error in ioctl call for slave pty\n"));
163 /* return(False); */
165 #endif
167 /* Close master. */
168 close(master);
170 /* Make slave stdin/out/err of child. */
172 if (sys_dup2(slave, STDIN_FILENO) != STDIN_FILENO)
174 DEBUG(3, ("Could not re-direct stdin\n"));
175 return (False);
177 if (sys_dup2(slave, STDOUT_FILENO) != STDOUT_FILENO)
179 DEBUG(3, ("Could not re-direct stdout\n"));
180 return (False);
182 if (sys_dup2(slave, STDERR_FILENO) != STDERR_FILENO)
184 DEBUG(3, ("Could not re-direct stderr\n"));
185 return (False);
187 if (slave > 2)
188 close(slave);
190 /* Set proper terminal attributes - no echo, canonical input processing,
191 no map NL to CR/NL on output. */
193 if (tcgetattr(0, &stermios) < 0)
195 DEBUG(3,
196 ("could not read default terminal attributes on pty\n"));
197 return (False);
199 stermios.c_lflag &= ~(ECHO | ECHOE | ECHOK | ECHONL);
200 stermios.c_lflag |= ICANON;
201 #ifdef ONLCR
202 stermios.c_oflag &= ~(ONLCR);
203 #endif
204 if (tcsetattr(0, TCSANOW, &stermios) < 0)
206 DEBUG(3, ("could not set attributes of pty\n"));
207 return (False);
210 /* make us completely into the right uid */
211 if (!as_root)
213 become_user_permanently(uid, gid);
216 DEBUG(10,
217 ("Invoking '%s' as password change program.\n",
218 passwordprogram));
220 /* execl() password-change application */
221 if (execl("/bin/sh", "sh", "-c", passwordprogram, NULL) < 0)
223 DEBUG(3, ("Bad status returned from %s\n", passwordprogram));
224 return (False);
226 return (True);
229 static int expect(int master, char *issue, char *expected)
231 pstring buffer;
232 int attempts, timeout, nread, len;
233 BOOL match = False;
235 for (attempts = 0; attempts < 2; attempts++) {
236 if (!strequal(issue, ".")) {
237 if (lp_passwd_chat_debug())
238 DEBUG(100, ("expect: sending [%s]\n", issue));
240 if ((len = write(master, issue, strlen(issue))) != strlen(issue)) {
241 DEBUG(2,("expect: (short) write returned %d\n", len ));
242 return False;
246 if (strequal(expected, "."))
247 return True;
249 /* Initial timeout. */
250 timeout = lp_passwd_chat_timeout() * 1000;
251 nread = 0;
252 buffer[nread] = 0;
254 while ((len = read_socket_with_timeout(master, buffer + nread, 1,
255 sizeof(buffer) - nread - 1,
256 timeout)) > 0) {
257 nread += len;
258 buffer[nread] = 0;
261 /* Eat leading/trailing whitespace before match. */
262 pstring str;
263 pstrcpy( str, buffer);
264 trim_char( str, ' ', ' ');
266 if ((match = (unix_wild_match(expected, str) == 0))) {
267 /* Now data has started to return, lower timeout. */
268 timeout = lp_passwd_chat_timeout() * 100;
273 if (lp_passwd_chat_debug())
274 DEBUG(100, ("expect: expected [%s] received [%s] match %s\n",
275 expected, buffer, match ? "yes" : "no" ));
277 if (match)
278 break;
280 if (len < 0) {
281 DEBUG(2, ("expect: %s\n", strerror(errno)));
282 return False;
286 DEBUG(10,("expect: returning %s\n", match ? "True" : "False" ));
287 return match;
290 static void pwd_sub(char *buf)
292 all_string_sub(buf, "\\n", "\n", 0);
293 all_string_sub(buf, "\\r", "\r", 0);
294 all_string_sub(buf, "\\s", " ", 0);
295 all_string_sub(buf, "\\t", "\t", 0);
298 static int talktochild(int master, const char *seq)
300 int count = 0;
301 fstring issue, expected;
303 fstrcpy(issue, ".");
305 while (next_token(&seq, expected, NULL, sizeof(expected)))
307 pwd_sub(expected);
308 count++;
310 if (!expect(master, issue, expected))
312 DEBUG(3, ("Response %d incorrect\n", count));
313 return False;
316 if (!next_token(&seq, issue, NULL, sizeof(issue)))
317 fstrcpy(issue, ".");
319 pwd_sub(issue);
321 if (!strequal(issue, ".")) {
322 /* we have one final issue to send */
323 fstrcpy(expected, ".");
324 if (!expect(master, issue, expected))
325 return False;
328 return (count > 0);
331 static BOOL chat_with_program(char *passwordprogram, struct passwd *pass,
332 char *chatsequence, BOOL as_root)
334 char *slavedev;
335 int master;
336 pid_t pid, wpid;
337 int wstat;
338 BOOL chstat = False;
340 if (pass == NULL) {
341 DEBUG(0, ("chat_with_program: user doesn't exist in the UNIX password database.\n"));
342 return False;
345 /* allocate a pseudo-terminal device */
346 if ((master = findpty(&slavedev)) < 0) {
347 DEBUG(3, ("chat_with_program: Cannot Allocate pty for password change: %s\n", pass->pw_name));
348 return (False);
352 * We need to temporarily stop CatchChild from eating
353 * SIGCLD signals as it also eats the exit status code. JRA.
356 CatchChildLeaveStatus();
358 if ((pid = sys_fork()) < 0) {
359 DEBUG(3, ("chat_with_program: Cannot fork() child for password change: %s\n", pass->pw_name));
360 close(master);
361 CatchChild();
362 return (False);
365 /* we now have a pty */
366 if (pid > 0) { /* This is the parent process */
367 if ((chstat = talktochild(master, chatsequence)) == False) {
368 DEBUG(3, ("chat_with_program: Child failed to change password: %s\n", pass->pw_name));
369 kill(pid, SIGKILL); /* be sure to end this process */
372 while ((wpid = sys_waitpid(pid, &wstat, 0)) < 0) {
373 if (errno == EINTR) {
374 errno = 0;
375 continue;
377 break;
380 if (wpid < 0) {
381 DEBUG(3, ("chat_with_program: The process is no longer waiting!\n\n"));
382 close(master);
383 CatchChild();
384 return (False);
388 * Go back to ignoring children.
390 CatchChild();
392 close(master);
394 if (pid != wpid) {
395 DEBUG(3, ("chat_with_program: We were waiting for the wrong process ID\n"));
396 return (False);
398 if (WIFEXITED(wstat) && (WEXITSTATUS(wstat) != 0)) {
399 DEBUG(3, ("chat_with_program: The process exited with status %d \
400 while we were waiting\n", WEXITSTATUS(wstat)));
401 return (False);
403 #if defined(WIFSIGNALLED) && defined(WTERMSIG)
404 else if (WIFSIGNALLED(wstat)) {
405 DEBUG(3, ("chat_with_program: The process was killed by signal %d \
406 while we were waiting\n", WTERMSIG(wstat)));
407 return (False);
409 #endif
410 } else {
411 /* CHILD */
414 * Lose any oplock capabilities.
416 oplock_set_capability(False, False);
418 /* make sure it doesn't freeze */
419 alarm(20);
421 if (as_root)
422 become_root();
424 DEBUG(3, ("chat_with_program: Dochild for user %s (uid=%d,gid=%d) (as_root = %s)\n", pass->pw_name,
425 (int)getuid(), (int)getgid(), BOOLSTR(as_root) ));
426 chstat = dochild(master, slavedev, pass, passwordprogram, as_root);
428 if (as_root)
429 unbecome_root();
432 * The child should never return from dochild() ....
435 DEBUG(0, ("chat_with_program: Error: dochild() returned %d\n", chstat));
436 exit(1);
439 if (chstat)
440 DEBUG(3, ("chat_with_program: Password change %ssuccessful for user %s\n",
441 (chstat ? "" : "un"), pass->pw_name));
442 return (chstat);
445 BOOL chgpasswd(const char *name, const struct passwd *pass,
446 const char *oldpass, const char *newpass, BOOL as_root)
448 pstring passwordprogram;
449 pstring chatsequence;
450 size_t i;
451 size_t len;
453 if (!oldpass) {
454 oldpass = "";
457 DEBUG(3, ("chgpasswd: Password change (as_root=%s) for user: %s\n", BOOLSTR(as_root), name));
459 #if DEBUG_PASSWORD
460 DEBUG(100, ("chgpasswd: Passwords: old=%s new=%s\n", oldpass, newpass));
461 #endif
463 /* Take the passed information and test it for minimum criteria */
465 /* Password is same as old password */
466 if (strcmp(oldpass, newpass) == 0) {
467 /* don't allow same password */
468 DEBUG(2, ("chgpasswd: Password Change: %s, New password is same as old\n", name)); /* log the attempt */
469 return (False); /* inform the user */
473 * Check the old and new passwords don't contain any control
474 * characters.
477 len = strlen(oldpass);
478 for (i = 0; i < len; i++) {
479 if (iscntrl((int)oldpass[i])) {
480 DEBUG(0, ("chgpasswd: oldpass contains control characters (disallowed).\n"));
481 return False;
485 len = strlen(newpass);
486 for (i = 0; i < len; i++) {
487 if (iscntrl((int)newpass[i])) {
488 DEBUG(0, ("chgpasswd: newpass contains control characters (disallowed).\n"));
489 return False;
493 #ifdef WITH_PAM
494 if (lp_pam_password_change()) {
495 BOOL ret;
497 if (as_root)
498 become_root();
500 if (pass) {
501 ret = smb_pam_passchange(pass->pw_name, oldpass, newpass);
502 } else {
503 ret = smb_pam_passchange(name, oldpass, newpass);
506 if (as_root)
507 unbecome_root();
509 return ret;
511 #endif
513 /* A non-PAM password change just doen't make sense without a valid local user */
515 if (pass == NULL) {
516 DEBUG(0, ("chgpasswd: user %s doesn't exist in the UNIX password database.\n", name));
517 return False;
520 pstrcpy(passwordprogram, lp_passwd_program());
521 pstrcpy(chatsequence, lp_passwd_chat());
523 if (!*chatsequence) {
524 DEBUG(2, ("chgpasswd: Null chat sequence - no password changing\n"));
525 return (False);
528 if (!*passwordprogram) {
529 DEBUG(2, ("chgpasswd: Null password program - no password changing\n"));
530 return (False);
533 if (as_root) {
534 /* The password program *must* contain the user name to work. Fail if not. */
535 if (strstr_m(passwordprogram, "%u") == NULL) {
536 DEBUG(0,("chgpasswd: Running as root the 'passwd program' parameter *MUST* contain \
537 the string %%u, and the given string %s does not.\n", passwordprogram ));
538 return False;
542 pstring_sub(passwordprogram, "%u", name);
543 /* note that we do NOT substitute the %o and %n in the password program
544 as this would open up a security hole where the user could use
545 a new password containing shell escape characters */
547 pstring_sub(chatsequence, "%u", name);
548 all_string_sub(chatsequence, "%o", oldpass, sizeof(pstring));
549 all_string_sub(chatsequence, "%n", newpass, sizeof(pstring));
550 return (chat_with_program
551 (passwordprogram, pass, chatsequence, as_root));
554 #else /* ALLOW_CHANGE_PASSWORD */
556 BOOL chgpasswd(const char *name, const struct passwd *pass,
557 const char *oldpass, const char *newpass, BOOL as_root)
559 DEBUG(0, ("chgpasswd: Unix Password changing not compiled in (user=%s)\n", name));
560 return (False);
562 #endif /* ALLOW_CHANGE_PASSWORD */
564 /***********************************************************
565 Code to check the lanman hashed password.
566 ************************************************************/
568 BOOL check_lanman_password(char *user, uchar * pass1,
569 uchar * pass2, SAM_ACCOUNT **hnd)
571 uchar unenc_new_pw[16];
572 uchar unenc_old_pw[16];
573 SAM_ACCOUNT *sampass = NULL;
574 uint16 acct_ctrl;
575 const uint8 *lanman_pw;
576 BOOL ret;
578 become_root();
579 ret = pdb_getsampwnam(sampass, user);
580 unbecome_root();
582 if (ret == False) {
583 DEBUG(0,("check_lanman_password: getsampwnam returned NULL\n"));
584 pdb_free_sam(&sampass);
585 return False;
588 acct_ctrl = pdb_get_acct_ctrl (sampass);
589 lanman_pw = pdb_get_lanman_passwd (sampass);
591 if (acct_ctrl & ACB_DISABLED) {
592 DEBUG(0,("check_lanman_password: account %s disabled.\n", user));
593 pdb_free_sam(&sampass);
594 return False;
597 if (lanman_pw == NULL) {
598 if (acct_ctrl & ACB_PWNOTREQ) {
599 /* this saves the pointer for the caller */
600 *hnd = sampass;
601 return True;
602 } else {
603 DEBUG(0, ("check_lanman_password: no lanman password !\n"));
604 pdb_free_sam(&sampass);
605 return False;
609 /* Get the new lanman hash. */
610 D_P16(lanman_pw, pass2, unenc_new_pw);
612 /* Use this to get the old lanman hash. */
613 D_P16(unenc_new_pw, pass1, unenc_old_pw);
615 /* Check that the two old passwords match. */
616 if (memcmp(lanman_pw, unenc_old_pw, 16)) {
617 DEBUG(0,("check_lanman_password: old password doesn't match.\n"));
618 pdb_free_sam(&sampass);
619 return False;
622 /* this saves the pointer for the caller */
623 *hnd = sampass;
624 return True;
627 /***********************************************************
628 Code to change the lanman hashed password.
629 It nulls out the NT hashed password as it will
630 no longer be valid.
631 NOTE this function is designed to be called as root. Check the old password
632 is correct before calling. JRA.
633 ************************************************************/
635 BOOL change_lanman_password(SAM_ACCOUNT *sampass, uchar *pass2)
637 static uchar null_pw[16];
638 uchar unenc_new_pw[16];
639 BOOL ret;
640 uint16 acct_ctrl;
641 const uint8 *pwd;
643 if (sampass == NULL) {
644 DEBUG(0,("change_lanman_password: no smb password entry.\n"));
645 return False;
648 acct_ctrl = pdb_get_acct_ctrl(sampass);
649 pwd = pdb_get_lanman_passwd(sampass);
651 if (acct_ctrl & ACB_DISABLED) {
652 DEBUG(0,("change_lanman_password: account %s disabled.\n",
653 pdb_get_username(sampass)));
654 return False;
657 if (pwd == NULL) {
658 if (acct_ctrl & ACB_PWNOTREQ) {
659 uchar no_pw[14];
660 memset(no_pw, '\0', 14);
661 E_P16(no_pw, null_pw);
663 /* Get the new lanman hash. */
664 D_P16(null_pw, pass2, unenc_new_pw);
665 } else {
666 DEBUG(0,("change_lanman_password: no lanman password !\n"));
667 return False;
669 } else {
670 /* Get the new lanman hash. */
671 D_P16(pwd, pass2, unenc_new_pw);
674 if (!pdb_set_lanman_passwd(sampass, unenc_new_pw, PDB_CHANGED)) {
675 return False;
678 if (!pdb_set_nt_passwd (sampass, NULL, PDB_CHANGED)) {
679 return False; /* We lose the NT hash. Sorry. */
682 if (!pdb_set_pass_changed_now (sampass)) {
683 pdb_free_sam(&sampass);
684 /* Not quite sure what this one qualifies as, but this will do */
685 return False;
688 /* Now flush the sam_passwd struct to persistent storage */
689 ret = pdb_update_sam_account (sampass);
691 return ret;
694 /***********************************************************
695 Code to check and change the OEM hashed password.
696 ************************************************************/
698 NTSTATUS pass_oem_change(char *user,
699 uchar password_encrypted_with_lm_hash[516],
700 const uchar old_lm_hash_encrypted[16],
701 uchar password_encrypted_with_nt_hash[516],
702 const uchar old_nt_hash_encrypted[16])
704 pstring new_passwd;
705 SAM_ACCOUNT *sampass = NULL;
706 NTSTATUS nt_status = check_oem_password(user, password_encrypted_with_lm_hash,
707 old_lm_hash_encrypted,
708 password_encrypted_with_nt_hash,
709 old_nt_hash_encrypted,
710 &sampass, new_passwd, sizeof(new_passwd));
712 if (!NT_STATUS_IS_OK(nt_status))
713 return nt_status;
715 /* We've already checked the old password here.... */
716 become_root();
717 nt_status = change_oem_password(sampass, NULL, new_passwd, True);
718 unbecome_root();
720 memset(new_passwd, 0, sizeof(new_passwd));
722 pdb_free_sam(&sampass);
724 return nt_status;
727 /***********************************************************
728 Decrypt and verify a user password change.
730 The 516 byte long buffers are encrypted with the old NT and
731 old LM passwords, and if the NT passwords are present, both
732 buffers contain a unicode string.
734 After decrypting the buffers, check the password is correct by
735 matching the old hashed passwords with the passwords in the passdb.
737 ************************************************************/
739 static NTSTATUS check_oem_password(const char *user,
740 uchar password_encrypted_with_lm_hash[516],
741 const uchar old_lm_hash_encrypted[16],
742 uchar password_encrypted_with_nt_hash[516],
743 const uchar old_nt_hash_encrypted[16],
744 SAM_ACCOUNT **hnd, char *new_passwd,
745 int new_passwd_size)
747 static uchar null_pw[16];
748 static uchar null_ntpw[16];
749 SAM_ACCOUNT *sampass = NULL;
750 char *password_encrypted;
751 const char *encryption_key;
752 const uint8 *lanman_pw, *nt_pw;
753 uint16 acct_ctrl;
754 uint32 new_pw_len;
755 uchar new_nt_hash[16];
756 uchar old_nt_hash_plain[16];
757 uchar new_lm_hash[16];
758 uchar old_lm_hash_plain[16];
759 char no_pw[2];
760 BOOL ret;
762 BOOL nt_pass_set = (password_encrypted_with_nt_hash && old_nt_hash_encrypted);
763 BOOL lm_pass_set = (password_encrypted_with_lm_hash && old_lm_hash_encrypted);
765 *hnd = NULL;
767 pdb_init_sam(&sampass);
769 become_root();
770 ret = pdb_getsampwnam(sampass, user);
771 unbecome_root();
773 if (ret == False) {
774 DEBUG(0, ("check_oem_password: getsmbpwnam returned NULL\n"));
775 pdb_free_sam(&sampass);
776 return NT_STATUS_NO_SUCH_USER;
779 acct_ctrl = pdb_get_acct_ctrl(sampass);
781 if (acct_ctrl & ACB_DISABLED) {
782 DEBUG(2,("check_lanman_password: account %s disabled.\n", user));
783 pdb_free_sam(&sampass);
784 return NT_STATUS_ACCOUNT_DISABLED;
787 if (acct_ctrl & ACB_PWNOTREQ && lp_null_passwords()) {
788 /* construct a null password (in case one is needed */
789 no_pw[0] = 0;
790 no_pw[1] = 0;
791 nt_lm_owf_gen(no_pw, null_ntpw, null_pw);
792 lanman_pw = null_pw;
793 nt_pw = null_pw;
795 } else {
796 /* save pointers to passwords so we don't have to keep looking them up */
797 if (lp_lanman_auth()) {
798 lanman_pw = pdb_get_lanman_passwd(sampass);
799 } else {
800 lanman_pw = NULL;
802 nt_pw = pdb_get_nt_passwd(sampass);
805 if (nt_pw && nt_pass_set) {
806 /* IDEAL Case: passwords are in unicode, and we can
807 * read use the password encrypted with the NT hash
809 password_encrypted = password_encrypted_with_nt_hash;
810 encryption_key = nt_pw;
811 } else if (lanman_pw && lm_pass_set) {
812 /* password may still be in unicode, but use LM hash version */
813 password_encrypted = password_encrypted_with_lm_hash;
814 encryption_key = lanman_pw;
815 } else if (nt_pass_set) {
816 DEBUG(1, ("NT password change supplied for user %s, but we have no NT password to check it with\n",
817 user));
818 pdb_free_sam(&sampass);
819 return NT_STATUS_WRONG_PASSWORD;
820 } else if (lm_pass_set) {
821 DEBUG(1, ("LM password change supplied for user %s, but we have no LanMan password to check it with\n",
822 user));
823 pdb_free_sam(&sampass);
824 return NT_STATUS_WRONG_PASSWORD;
825 } else {
826 DEBUG(1, ("password change requested for user %s, but no password supplied!\n",
827 user));
828 pdb_free_sam(&sampass);
829 return NT_STATUS_WRONG_PASSWORD;
833 * Decrypt the password with the key
835 SamOEMhash( password_encrypted, encryption_key, 516);
837 if ( !decode_pw_buffer(password_encrypted, new_passwd, new_passwd_size, &new_pw_len,
838 nt_pass_set ? STR_UNICODE : STR_ASCII)) {
839 pdb_free_sam(&sampass);
840 return NT_STATUS_WRONG_PASSWORD;
844 * To ensure we got the correct new password, hash it and
845 * use it as a key to test the passed old password.
848 if (nt_pass_set) {
849 /* NT passwords, verify the NT hash. */
851 /* Calculate the MD4 hash (NT compatible) of the password */
852 memset(new_nt_hash, '\0', 16);
853 E_md4hash(new_passwd, new_nt_hash);
855 if (nt_pw) {
857 * Now use new_nt_hash as the key to see if the old
858 * password matches.
860 D_P16(new_nt_hash, old_nt_hash_encrypted, old_nt_hash_plain);
862 if (memcmp(nt_pw, old_nt_hash_plain, 16)) {
863 DEBUG(0,("check_oem_password: old lm password doesn't match.\n"));
864 pdb_free_sam(&sampass);
865 return NT_STATUS_WRONG_PASSWORD;
868 /* We could check the LM password here, but there is
869 * little point, we already know the password is
870 * correct, and the LM password might not even be
871 * present. */
873 /* Further, LM hash generation algorithms
874 * differ with charset, so we could
875 * incorrectly fail a perfectly valid password
876 * change */
877 #ifdef DEBUG_PASSWORD
878 DEBUG(100,
879 ("check_oem_password: password %s ok\n", new_passwd));
880 #endif
881 *hnd = sampass;
882 return NT_STATUS_OK;
885 if (lanman_pw) {
887 * Now use new_nt_hash as the key to see if the old
888 * LM password matches.
890 D_P16(new_nt_hash, old_lm_hash_encrypted, old_lm_hash_plain);
892 if (memcmp(lanman_pw, old_lm_hash_plain, 16)) {
893 DEBUG(0,("check_oem_password: old lm password doesn't match.\n"));
894 pdb_free_sam(&sampass);
895 return NT_STATUS_WRONG_PASSWORD;
897 #ifdef DEBUG_PASSWORD
898 DEBUG(100,
899 ("check_oem_password: password %s ok\n", new_passwd));
900 #endif
901 *hnd = sampass;
902 return NT_STATUS_OK;
906 if (lanman_pw && lm_pass_set) {
908 E_deshash(new_passwd, new_lm_hash);
911 * Now use new_lm_hash as the key to see if the old
912 * password matches.
914 D_P16(new_lm_hash, old_lm_hash_encrypted, old_lm_hash_plain);
916 if (memcmp(lanman_pw, old_lm_hash_plain, 16)) {
917 DEBUG(0,("check_oem_password: old lm password doesn't match.\n"));
918 pdb_free_sam(&sampass);
919 return NT_STATUS_WRONG_PASSWORD;
922 #ifdef DEBUG_PASSWORD
923 DEBUG(100,
924 ("check_oem_password: password %s ok\n", new_passwd));
925 #endif
926 *hnd = sampass;
927 return NT_STATUS_OK;
930 /* should not be reached */
931 pdb_free_sam(&sampass);
932 return NT_STATUS_WRONG_PASSWORD;
935 /***********************************************************
936 Code to change the oem password. Changes both the lanman
937 and NT hashes. Old_passwd is almost always NULL.
938 NOTE this function is designed to be called as root. Check the old password
939 is correct before calling. JRA.
940 ************************************************************/
942 NTSTATUS change_oem_password(SAM_ACCOUNT *hnd, char *old_passwd, char *new_passwd, BOOL as_root)
944 struct passwd *pass;
946 BOOL ret;
947 uint32 min_len;
949 if (time(NULL) < pdb_get_pass_can_change_time(hnd)) {
950 DEBUG(1, ("user %s cannot change password now, must wait until %s\n",
951 pdb_get_username(hnd), http_timestring(pdb_get_pass_can_change_time(hnd))));
952 return NT_STATUS_PASSWORD_RESTRICTION;
955 if (account_policy_get(AP_MIN_PASSWORD_LEN, &min_len) && (strlen(new_passwd) < min_len)) {
956 DEBUG(1, ("user %s cannot change password - password too short\n",
957 pdb_get_username(hnd)));
958 DEBUGADD(1, (" account policy min password len = %d\n", min_len));
959 return NT_STATUS_PASSWORD_RESTRICTION;
960 /* return NT_STATUS_PWD_TOO_SHORT; */
963 /* Take the passed information and test it for minimum criteria */
964 /* Minimum password length */
965 if (strlen(new_passwd) < lp_min_passwd_length()) {
966 /* too short, must be at least MINPASSWDLENGTH */
967 DEBUG(1, ("Password Change: user %s, New password is shorter than minimum password length = %d\n",
968 pdb_get_username(hnd), lp_min_passwd_length()));
969 return NT_STATUS_PASSWORD_RESTRICTION;
970 /* return NT_STATUS_PWD_TOO_SHORT; */
973 pass = Get_Pwnam(pdb_get_username(hnd));
974 if (!pass) {
975 DEBUG(1, ("check_oem_password: Username does not exist in system !?!\n"));
979 * If unix password sync was requested, attempt to change
980 * the /etc/passwd database first. Return failure if this cannot
981 * be done.
983 * This occurs before the oem change, because we don't want to
984 * update it if chgpasswd failed.
986 * Conditional on lp_unix_password_sync() because we don't want
987 * to touch the unix db unless we have admin permission.
990 if(lp_unix_password_sync() &&
991 !chgpasswd(pdb_get_username(hnd), pass, old_passwd, new_passwd, as_root)) {
992 return NT_STATUS_ACCESS_DENIED;
995 if (!pdb_set_plaintext_passwd (hnd, new_passwd)) {
996 return NT_STATUS_ACCESS_DENIED;
999 /* Now write it into the file. */
1000 ret = pdb_update_sam_account (hnd);
1002 if (!ret) {
1003 return NT_STATUS_ACCESS_DENIED;
1006 return NT_STATUS_OK;