3 Copyright Andrew Tridgell <tridge@samba.org> 2000
4 Copyright Tim Potter <tpot@samba.org> 2000
5 Copyright Andrew Bartlett <abartlet@samba.org> 2002
7 largely based on pam_userdb by Christian Gafton <gafton@redhat.com>
8 also contains large slabs of code from pam_unix by Elliot Lee <sopwith@redhat.com>
9 (see copyright below for full details)
12 #include "pam_winbind.h"
16 #define MAX_PASSWD_TRIES 3
19 static void _pam_log(int err
, const char *format
, ...)
23 va_start(args
, format
);
24 openlog(MODULE_NAME
, LOG_CONS
|LOG_PID
, LOG_AUTH
);
25 vsyslog(err
, format
, args
);
30 static int _pam_parse(int argc
, const char **argv
)
33 /* step through arguments */
34 for (ctrl
= 0; argc
-- > 0; ++argv
) {
38 if (!strcmp(*argv
,"debug"))
39 ctrl
|= WINBIND_DEBUG_ARG
;
40 else if (!strcasecmp(*argv
, "use_authtok"))
41 ctrl
|= WINBIND_USE_AUTHTOK_ARG
;
42 else if (!strcasecmp(*argv
, "use_first_pass"))
43 ctrl
|= WINBIND_USE_FIRST_PASS_ARG
;
44 else if (!strcasecmp(*argv
, "try_first_pass"))
45 ctrl
|= WINBIND_TRY_FIRST_PASS_ARG
;
46 else if (!strcasecmp(*argv
, "unknown_ok"))
47 ctrl
|= WINBIND_UNKNOWN_OK_ARG
;
49 _pam_log(LOG_ERR
, "pam_parse: unknown option; %s", *argv
);
56 /* --- authentication management functions --- */
58 /* Attempt a conversation */
60 static int converse(pam_handle_t
*pamh
, int nargs
,
61 struct pam_message
**message
,
62 struct pam_response
**response
)
65 struct pam_conv
*conv
;
67 retval
= pam_get_item(pamh
, PAM_CONV
, (const void **) &conv
) ;
68 if (retval
== PAM_SUCCESS
) {
69 retval
= conv
->conv(nargs
, (const struct pam_message
**)message
,
70 response
, conv
->appdata_ptr
);
73 return retval
; /* propagate error status */
77 static int _make_remark(pam_handle_t
* pamh
, int type
, const char *text
)
79 int retval
= PAM_SUCCESS
;
81 struct pam_message
*pmsg
[1], msg
[1];
82 struct pam_response
*resp
;
86 msg
[0].msg_style
= type
;
89 retval
= converse(pamh
, 1, pmsg
, &resp
);
92 _pam_drop_reply(resp
, 1);
97 static int pam_winbind_request(enum winbindd_cmd req_type
,
98 struct winbindd_request
*request
,
99 struct winbindd_response
*response
)
102 /* Fill in request and send down pipe */
103 init_request(request
, req_type
);
105 if (write_sock(request
, sizeof(*request
)) == -1) {
106 _pam_log(LOG_ERR
, "write to socket failed!");
108 return PAM_SERVICE_ERR
;
112 if (read_reply(response
) == -1) {
113 _pam_log(LOG_ERR
, "read from socket failed!");
115 return PAM_SERVICE_ERR
;
118 /* We are done with the socket - close it and avoid mischeif */
121 /* Copy reply data from socket */
122 if (response
->result
!= WINBINDD_OK
) {
123 if (response
->data
.auth
.pam_error
!= PAM_SUCCESS
) {
124 _pam_log(LOG_ERR
, "request failed: %s, PAM error was %d, NT error was %s",
125 response
->data
.auth
.error_string
,
126 response
->data
.auth
.pam_error
,
127 response
->data
.auth
.nt_status_string
);
128 return response
->data
.auth
.pam_error
;
130 _pam_log(LOG_ERR
, "request failed, but PAM error 0!");
131 return PAM_SERVICE_ERR
;
138 static int pam_winbind_request_log(enum winbindd_cmd req_type
,
139 struct winbindd_request
*request
,
140 struct winbindd_response
*response
,
146 retval
= pam_winbind_request(req_type
, request
, response
);
150 /* incorrect password */
151 _pam_log(LOG_WARNING
, "user `%s' denied access (incorrect password)", user
);
153 case PAM_ACCT_EXPIRED
:
154 /* account expired */
155 _pam_log(LOG_WARNING
, "user `%s' account expired", user
);
157 case PAM_AUTHTOK_EXPIRED
:
158 /* password expired */
159 _pam_log(LOG_WARNING
, "user `%s' password expired", user
);
161 case PAM_NEW_AUTHTOK_REQD
:
162 /* password expired */
163 _pam_log(LOG_WARNING
, "user `%s' new password required", user
);
165 case PAM_USER_UNKNOWN
:
166 /* the user does not exist */
167 if (ctrl
& WINBIND_DEBUG_ARG
)
168 _pam_log(LOG_NOTICE
, "user `%s' not found",
170 if (ctrl
& WINBIND_UNKNOWN_OK_ARG
) {
175 if (req_type
== WINBINDD_PAM_AUTH
) {
176 /* Otherwise, the authentication looked good */
177 _pam_log(LOG_NOTICE
, "user '%s' granted acces", user
);
178 } else if (req_type
== WINBINDD_PAM_CHAUTHTOK
) {
179 /* Otherwise, the authentication looked good */
180 _pam_log(LOG_NOTICE
, "user '%s' password changed", user
);
182 /* Otherwise, the authentication looked good */
183 _pam_log(LOG_NOTICE
, "user '%s' OK", user
);
187 /* we don't know anything about this return value */
188 _pam_log(LOG_ERR
, "internal module error (retval = %d, user = `%s'",
194 /* talk to winbindd */
195 static int winbind_auth_request(const char *user
, const char *pass
, int ctrl
)
197 struct winbindd_request request
;
198 struct winbindd_response response
;
200 ZERO_STRUCT(request
);
202 strncpy(request
.data
.auth
.user
, user
,
203 sizeof(request
.data
.auth
.user
)-1);
205 strncpy(request
.data
.auth
.pass
, pass
,
206 sizeof(request
.data
.auth
.pass
)-1);
209 return pam_winbind_request_log(WINBINDD_PAM_AUTH
, &request
, &response
, ctrl
, user
);
212 /* talk to winbindd */
213 static int winbind_chauthtok_request(const char *user
, const char *oldpass
,
214 const char *newpass
, int ctrl
)
216 struct winbindd_request request
;
217 struct winbindd_response response
;
219 ZERO_STRUCT(request
);
221 if (request
.data
.chauthtok
.user
== NULL
) return -2;
223 strncpy(request
.data
.chauthtok
.user
, user
,
224 sizeof(request
.data
.chauthtok
.user
) - 1);
226 if (oldpass
!= NULL
) {
227 strncpy(request
.data
.chauthtok
.oldpass
, oldpass
,
228 sizeof(request
.data
.chauthtok
.oldpass
) - 1);
230 request
.data
.chauthtok
.oldpass
[0] = '\0';
233 if (newpass
!= NULL
) {
234 strncpy(request
.data
.chauthtok
.newpass
, newpass
,
235 sizeof(request
.data
.chauthtok
.newpass
) - 1);
237 request
.data
.chauthtok
.newpass
[0] = '\0';
240 return pam_winbind_request_log(WINBINDD_PAM_CHAUTHTOK
, &request
, &response
, ctrl
, user
);
244 * Checks if a user has an account
251 static int valid_user(const char *user
)
253 if (getpwnam(user
)) return 0;
257 static char *_pam_delete(register char *xx
)
265 * obtain a password from the user
268 static int _winbind_read_password(pam_handle_t
* pamh
281 * make sure nothing inappropriate gets returned
284 *pass
= token
= NULL
;
287 * which authentication token are we getting?
290 authtok_flag
= on(WINBIND__OLD_PASSWORD
, ctrl
) ? PAM_OLDAUTHTOK
: PAM_AUTHTOK
;
293 * should we obtain the password from a PAM item ?
296 if (on(WINBIND_TRY_FIRST_PASS_ARG
, ctrl
) || on(WINBIND_USE_FIRST_PASS_ARG
, ctrl
)) {
297 retval
= pam_get_item(pamh
, authtok_flag
, (const void **) &item
);
298 if (retval
!= PAM_SUCCESS
) {
301 "pam_get_item returned error to unix-read-password"
304 } else if (item
!= NULL
) { /* we have a password! */
308 } else if (on(WINBIND_USE_FIRST_PASS_ARG
, ctrl
)) {
309 return PAM_AUTHTOK_RECOVER_ERR
; /* didn't work */
310 } else if (on(WINBIND_USE_AUTHTOK_ARG
, ctrl
)
311 && off(WINBIND__OLD_PASSWORD
, ctrl
)) {
312 return PAM_AUTHTOK_RECOVER_ERR
;
316 * getting here implies we will have to get the password from the
321 struct pam_message msg
[3], *pmsg
[3];
322 struct pam_response
*resp
;
325 /* prepare to converse */
327 if (comment
!= NULL
) {
329 msg
[0].msg_style
= PAM_TEXT_INFO
;
330 msg
[0].msg
= comment
;
337 msg
[i
].msg_style
= PAM_PROMPT_ECHO_OFF
;
338 msg
[i
++].msg
= prompt1
;
341 if (prompt2
!= NULL
) {
343 msg
[i
].msg_style
= PAM_PROMPT_ECHO_OFF
;
344 msg
[i
++].msg
= prompt2
;
347 /* so call the conversation expecting i responses */
349 retval
= converse(pamh
, i
, pmsg
, &resp
);
353 /* interpret the response */
355 if (retval
== PAM_SUCCESS
) { /* a good conversation */
357 token
= x_strdup(resp
[i
- replies
].resp
);
361 /* verify that password entered correctly */
362 if (!resp
[i
- 1].resp
363 || strcmp(token
, resp
[i
- 1].resp
)) {
364 _pam_delete(token
); /* mistyped */
365 retval
= PAM_AUTHTOK_RECOVER_ERR
;
366 _make_remark(pamh
,PAM_ERROR_MSG
, MISTYPED_PASS
);
371 ,"could not recover authentication token");
376 * tidy up the conversation (resp_retcode) is ignored
377 * -- what is it for anyway? AGM
380 _pam_drop_reply(resp
, i
);
383 retval
= (retval
== PAM_SUCCESS
)
384 ? PAM_AUTHTOK_RECOVER_ERR
: retval
;
388 if (retval
!= PAM_SUCCESS
) {
389 if (on(WINBIND_DEBUG_ARG
, ctrl
))
391 "unable to obtain a password");
394 /* 'token' is the entered password */
396 /* we store this password as an item */
398 retval
= pam_set_item(pamh
, authtok_flag
, token
);
399 _pam_delete(token
); /* clean it up */
400 if (retval
!= PAM_SUCCESS
401 || (retval
= pam_get_item(pamh
, authtok_flag
402 ,(const void **) &item
))
405 _pam_log(LOG_CRIT
, "error manipulating password");
411 item
= NULL
; /* break link to password */
417 int pam_sm_authenticate(pam_handle_t
*pamh
, int flags
,
418 int argc
, const char **argv
)
420 const char *username
;
421 const char *password
;
422 int retval
= PAM_AUTH_ERR
;
424 /* parse arguments */
425 int ctrl
= _pam_parse(argc
, argv
);
427 /* Get the username */
428 retval
= pam_get_user(pamh
, &username
, NULL
);
429 if ((retval
!= PAM_SUCCESS
) || (!username
)) {
430 if (ctrl
& WINBIND_DEBUG_ARG
)
431 _pam_log(LOG_DEBUG
,"can not get the username");
432 return PAM_SERVICE_ERR
;
435 retval
= _winbind_read_password(pamh
, ctrl
, NULL
,
439 if (retval
!= PAM_SUCCESS
) {
440 _pam_log(LOG_ERR
, "Could not retrieve user's password");
441 return PAM_AUTHTOK_ERR
;
444 if (ctrl
& WINBIND_DEBUG_ARG
) {
446 /* Let's not give too much away in the log file */
448 #ifdef DEBUG_PASSWORD
449 _pam_log(LOG_INFO
, "Verify user `%s' with password `%s'",
452 _pam_log(LOG_INFO
, "Verify user `%s'", username
);
456 /* Now use the username to look up password */
457 return winbind_auth_request(username
, password
, ctrl
);
461 int pam_sm_setcred(pam_handle_t
*pamh
, int flags
,
462 int argc
, const char **argv
)
468 * Account management. We want to verify that the account exists
469 * before returning PAM_SUCCESS
472 int pam_sm_acct_mgmt(pam_handle_t
*pamh
, int flags
,
473 int argc
, const char **argv
)
475 const char *username
;
476 int retval
= PAM_USER_UNKNOWN
;
478 /* parse arguments */
479 int ctrl
= _pam_parse(argc
, argv
);
481 /* Get the username */
482 retval
= pam_get_user(pamh
, &username
, NULL
);
483 if ((retval
!= PAM_SUCCESS
) || (!username
)) {
484 if (ctrl
& WINBIND_DEBUG_ARG
)
485 _pam_log(LOG_DEBUG
,"can not get the username");
486 return PAM_SERVICE_ERR
;
489 /* Verify the username */
490 retval
= valid_user(username
);
493 /* some sort of system error. The log was already printed */
494 return PAM_SERVICE_ERR
;
496 /* the user does not exist */
497 if (ctrl
& WINBIND_DEBUG_ARG
)
498 _pam_log(LOG_NOTICE
, "user `%s' not found",
500 if (ctrl
& WINBIND_UNKNOWN_OK_ARG
)
502 return PAM_USER_UNKNOWN
;
504 /* Otherwise, the authentication looked good */
505 _pam_log(LOG_NOTICE
, "user '%s' granted acces", username
);
508 /* we don't know anything about this return value */
509 _pam_log(LOG_ERR
, "internal module error (retval = %d, user = `%s'",
511 return PAM_SERVICE_ERR
;
514 /* should not be reached */
518 int pam_sm_open_session(pam_handle_t
*pamh
, int flags
,
519 int argc
, const char **argv
)
521 /* parse arguments */
522 int ctrl
= _pam_parse(argc
, argv
);
523 if (ctrl
& WINBIND_DEBUG_ARG
)
524 _pam_log(LOG_DEBUG
,"libpam_winbind:pam_sm_open_session handler");
528 int pam_sm_close_session(pam_handle_t
*pamh
, int flags
,
529 int argc
, const char **argv
)
531 /* parse arguments */
532 int ctrl
= _pam_parse(argc
, argv
);
533 if (ctrl
& WINBIND_DEBUG_ARG
)
534 _pam_log(LOG_DEBUG
,"libpam_winbind:pam_sm_close_session handler");
540 PAM_EXTERN
int pam_sm_chauthtok(pam_handle_t
* pamh
, int flags
,
541 int argc
, const char **argv
)
545 unsigned int ctrl
= _pam_parse(argc
, argv
);
547 /* <DO NOT free() THESE> */
549 char *pass_old
, *pass_new
;
550 /* </DO NOT free() THESE> */
557 * First get the name of a user
559 retval
= pam_get_user(pamh
, &user
, "Username: ");
560 if (retval
== PAM_SUCCESS
) {
562 _pam_log(LOG_ERR
, "username was NULL!");
563 return PAM_USER_UNKNOWN
;
565 if (retval
== PAM_SUCCESS
&& on(WINBIND_DEBUG_ARG
, ctrl
))
566 _pam_log(LOG_DEBUG
, "username [%s] obtained",
569 if (on(WINBIND_DEBUG_ARG
, ctrl
))
571 "password - could not identify user");
576 * obtain and verify the current password (OLDAUTHTOK) for
580 if (flags
& PAM_PRELIM_CHECK
) {
582 /* instruct user what is happening */
583 #define greeting "Changing password for "
584 Announce
= (char *) malloc(sizeof(greeting
) + strlen(user
));
585 if (Announce
== NULL
) {
587 "password - out of memory");
590 (void) strcpy(Announce
, greeting
);
591 (void) strcpy(Announce
+ sizeof(greeting
) - 1, user
);
594 lctrl
= ctrl
| WINBIND__OLD_PASSWORD
;
595 retval
= _winbind_read_password(pamh
, lctrl
597 ,"(current) NT password: "
599 ,(const char **) &pass_old
);
602 if (retval
!= PAM_SUCCESS
) {
604 ,"password - (old) token not obtained");
607 /* verify that this is the password for this user */
609 retval
= winbind_auth_request(user
, pass_old
, ctrl
);
611 if (retval
!= PAM_ACCT_EXPIRED
612 && retval
!= PAM_AUTHTOK_EXPIRED
613 && retval
!= PAM_NEW_AUTHTOK_REQD
614 && retval
!= PAM_SUCCESS
) {
619 retval
= pam_set_item(pamh
, PAM_OLDAUTHTOK
, (const void *) pass_old
);
621 if (retval
!= PAM_SUCCESS
) {
623 "failed to set PAM_OLDAUTHTOK");
625 } else if (flags
& PAM_UPDATE_AUTHTOK
) {
628 * obtain the proposed password
632 * get the old token back.
635 retval
= pam_get_item(pamh
, PAM_OLDAUTHTOK
636 ,(const void **) &pass_old
);
638 if (retval
!= PAM_SUCCESS
) {
639 _pam_log(LOG_NOTICE
, "user not authenticated");
645 if (on(WINBIND_USE_AUTHTOK_ARG
, lctrl
)) {
646 ctrl
= WINBIND_USE_FIRST_PASS_ARG
| lctrl
;
649 retval
= PAM_AUTHTOK_ERR
;
650 while ((retval
!= PAM_SUCCESS
) && (retry
++ < MAX_PASSWD_TRIES
)) {
652 * use_authtok is to force the use of a previously entered
653 * password -- needed for pluggable password strength checking
656 retval
= _winbind_read_password(pamh
, lctrl
658 ,"Enter new NT password: "
659 ,"Retype new NT password: "
660 ,(const char **) &pass_new
);
662 if (retval
!= PAM_SUCCESS
) {
663 if (on(WINBIND_DEBUG_ARG
, ctrl
)) {
665 ,"password - new password not obtained");
667 pass_old
= NULL
;/* tidy up */
672 * At this point we know who the user is and what they
673 * propose as their new password. Verify that the new
674 * password is acceptable.
677 if (pass_new
[0] == '\0') {/* "\0" password = NULL */
683 * By reaching here we have approved the passwords and must now
684 * rebuild the password database file.
687 retval
= winbind_chauthtok_request(user
, pass_old
, pass_new
, ctrl
);
688 _pam_overwrite(pass_new
);
689 _pam_overwrite(pass_old
);
690 pass_old
= pass_new
= NULL
;
692 retval
= PAM_SERVICE_ERR
;
700 /* static module data */
702 struct pam_module _pam_winbind_modstruct
= {
708 pam_sm_close_session
,
715 * Copyright (c) Andrew Tridgell <tridge@samba.org> 2000
716 * Copyright (c) Tim Potter <tpot@samba.org> 2000
717 * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
718 * Copyright (c) Jan Rêkorajski 1999.
719 * Copyright (c) Andrew G. Morgan 1996-8.
720 * Copyright (c) Alex O. Yuriev, 1996.
721 * Copyright (c) Cristian Gafton 1996.
722 * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
724 * Redistribution and use in source and binary forms, with or without
725 * modification, are permitted provided that the following conditions
727 * 1. Redistributions of source code must retain the above copyright
728 * notice, and the entire permission notice in its entirety,
729 * including the disclaimer of warranties.
730 * 2. Redistributions in binary form must reproduce the above copyright
731 * notice, this list of conditions and the following disclaimer in the
732 * documentation and/or other materials provided with the distribution.
733 * 3. The name of the author may not be used to endorse or promote
734 * products derived from this software without specific prior
735 * written permission.
737 * ALTERNATIVELY, this product may be distributed under the terms of
738 * the GNU Public License, in which case the provisions of the GPL are
739 * required INSTEAD OF the above restrictions. (This clause is
740 * necessary due to a potential bad interaction between the GPL and
741 * the restrictions contained in a BSD-style copyright.)
743 * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
744 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
745 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
746 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
747 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
748 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
749 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
750 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
751 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
752 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
753 * OF THE POSSIBILITY OF SUCH DAMAGE.