s3-utils: net - Fix one error/usage message
[Samba/gebeck_regimport.git] / source3 / libsmb / passchange.c
blob58997e4c821666f69108aefde3be19f9480213ce
1 /*
2 Unix SMB/CIFS implementation.
3 SMB client password change routine
4 Copyright (C) Andrew Tridgell 1994-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 #include "includes.h"
21 #include "../librpc/gen_ndr/ndr_samr.h"
22 #include "rpc_client/cli_pipe.h"
23 #include "rpc_client/cli_samr.h"
24 #include "libsmb/libsmb.h"
25 #include "libsmb/clirap.h"
26 #include "libsmb/nmblib.h"
28 /*************************************************************
29 Change a password on a remote machine using IPC calls.
30 *************************************************************/
32 NTSTATUS remote_password_change(const char *remote_machine, const char *user_name,
33 const char *old_passwd, const char *new_passwd,
34 char **err_str)
36 struct cli_state *cli = NULL;
37 struct rpc_pipe_client *pipe_hnd = NULL;
38 char *user, *domain, *p;
40 NTSTATUS result;
41 bool pass_must_change = False;
43 user = talloc_strdup(talloc_tos(), user_name);
44 SMB_ASSERT(user != NULL);
45 domain = talloc_strdup(talloc_tos(), "");
46 SMB_ASSERT(domain != NULL);
48 /* allow usernames of the form domain\\user or domain/user */
49 if ((p = strchr_m(user,'\\')) || (p = strchr_m(user,'/')) ||
50 (p = strchr_m(user,*lp_winbind_separator()))) {
51 *p = 0;
52 domain = user;
53 user = p+1;
56 *err_str = NULL;
58 result = cli_connect_nb(remote_machine, NULL, 0, 0x20, NULL,
59 Undefined, 0, &cli);
60 if (!NT_STATUS_IS_OK(result)) {
61 if (asprintf(err_str, "Unable to connect to SMB server on "
62 "machine %s. Error was : %s.\n",
63 remote_machine, nt_errstr(result))==-1) {
64 *err_str = NULL;
66 return result;
69 result = cli_negprot(cli, PROTOCOL_NT1);
71 if (!NT_STATUS_IS_OK(result)) {
72 if (asprintf(err_str, "machine %s rejected the negotiate "
73 "protocol. Error was : %s.\n",
74 remote_machine, nt_errstr(result)) == -1) {
75 *err_str = NULL;
77 result = cli_nt_error(cli);
78 cli_shutdown(cli);
79 return result;
82 /* Given things like SMB signing, restrict anonymous and the like,
83 try an authenticated connection first */
84 result = cli_session_setup(cli, user_name,
85 old_passwd, strlen(old_passwd)+1,
86 old_passwd, strlen(old_passwd)+1, "");
88 if (!NT_STATUS_IS_OK(result)) {
90 /* Password must change or Password expired are the only valid
91 * error conditions here from where we can proceed, the rest like
92 * account locked out or logon failure will lead to errors later
93 * anyway */
95 if (!NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) &&
96 !NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED)) {
97 if (asprintf(err_str, "Could not connect to machine %s: "
98 "%s\n", remote_machine, nt_errstr(result)) == -1) {
99 *err_str = NULL;
101 cli_shutdown(cli);
102 return result;
105 pass_must_change = True;
108 * We should connect as the anonymous user here, in case
109 * the server has "must change password" checked...
110 * Thanks to <Nicholas.S.Jenkins@cdc.com> for this fix.
113 result = cli_session_setup(cli, "", "", 0, "", 0, "");
115 if (!NT_STATUS_IS_OK(result)) {
116 if (asprintf(err_str, "machine %s rejected the session "
117 "setup. Error was : %s.\n",
118 remote_machine, nt_errstr(result)) == -1) {
119 *err_str = NULL;
121 cli_shutdown(cli);
122 return result;
125 result = cli_init_creds(cli, "", "", NULL);
126 if (!NT_STATUS_IS_OK(result)) {
127 cli_shutdown(cli);
128 return result;
130 } else {
131 result = cli_init_creds(cli, user, domain, old_passwd);
132 if (!NT_STATUS_IS_OK(result)) {
133 cli_shutdown(cli);
134 return result;
138 result = cli_tcon_andx(cli, "IPC$", "IPC", "", 1);
139 if (!NT_STATUS_IS_OK(result)) {
140 if (asprintf(err_str, "machine %s rejected the tconX on the "
141 "IPC$ share. Error was : %s.\n",
142 remote_machine, nt_errstr(result))) {
143 *err_str = NULL;
145 cli_shutdown(cli);
146 return result;
149 /* Try not to give the password away too easily */
151 if (!pass_must_change) {
152 result = cli_rpc_pipe_open_ntlmssp(cli,
153 &ndr_table_samr.syntax_id,
154 NCACN_NP,
155 DCERPC_AUTH_LEVEL_PRIVACY,
156 domain, user,
157 old_passwd,
158 &pipe_hnd);
159 } else {
161 * If the user password must be changed the ntlmssp bind will
162 * fail the same way as the session setup above did. The
163 * difference ist that with a pipe bind we don't get a good
164 * error message, the result will be that the rpc call below
165 * will just fail. So we do it anonymously, there's no other
166 * way.
168 result = cli_rpc_pipe_open_noauth(
169 cli, &ndr_table_samr.syntax_id, &pipe_hnd);
172 if (!NT_STATUS_IS_OK(result)) {
173 if (lp_client_lanman_auth()) {
174 /* Use the old RAP method. */
175 if (!cli_oem_change_password(cli, user_name, new_passwd, old_passwd)) {
176 result = cli_nt_error(cli);
177 if (asprintf(err_str, "machine %s rejected the "
178 "password change: Error was : %s.\n",
179 remote_machine, nt_errstr(result)) == -1) {
180 *err_str = NULL;
182 cli_shutdown(cli);
183 return result;
185 } else {
186 if (asprintf(err_str, "SAMR connection to machine %s "
187 "failed. Error was %s, but LANMAN password "
188 "changes are disabled\n",
189 remote_machine, nt_errstr(result)) == -1) {
190 *err_str = NULL;
192 result = cli_nt_error(cli);
193 cli_shutdown(cli);
194 return result;
198 result = rpccli_samr_chgpasswd_user2(pipe_hnd, talloc_tos(),
199 user_name, new_passwd, old_passwd);
200 if (NT_STATUS_IS_OK(result)) {
201 /* Great - it all worked! */
202 cli_shutdown(cli);
203 return NT_STATUS_OK;
205 } else if (!(NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)
206 || NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL))) {
207 /* it failed, but for reasons such as wrong password, too short etc ... */
209 if (asprintf(err_str, "machine %s rejected the password change: "
210 "Error was : %s.\n",
211 remote_machine, get_friendly_nt_error_msg(result)) == -1) {
212 *err_str = NULL;
214 cli_shutdown(cli);
215 return result;
218 /* OK, that failed, so try again... */
219 TALLOC_FREE(pipe_hnd);
221 /* Try anonymous NTLMSSP... */
222 result = cli_init_creds(cli, "", "", NULL);
223 if (!NT_STATUS_IS_OK(result)) {
224 cli_shutdown(cli);
225 return result;
228 result = NT_STATUS_UNSUCCESSFUL;
230 /* OK, this is ugly, but... try an anonymous pipe. */
231 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
232 &pipe_hnd);
234 if ( NT_STATUS_IS_OK(result) &&
235 (NT_STATUS_IS_OK(result = rpccli_samr_chgpasswd_user2(
236 pipe_hnd, talloc_tos(), user_name,
237 new_passwd, old_passwd)))) {
238 /* Great - it all worked! */
239 cli_shutdown(cli);
240 return NT_STATUS_OK;
241 } else {
242 if (!(NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)
243 || NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL))) {
244 /* it failed, but again it was due to things like new password too short */
246 if (asprintf(err_str, "machine %s rejected the "
247 "(anonymous) password change: Error was : "
248 "%s.\n", remote_machine,
249 get_friendly_nt_error_msg(result)) == -1) {
250 *err_str = NULL;
252 cli_shutdown(cli);
253 return result;
256 /* We have failed to change the user's password, and we think the server
257 just might not support SAMR password changes, so fall back */
259 if (lp_client_lanman_auth()) {
260 /* Use the old RAP method. */
261 if (cli_oem_change_password(cli, user_name, new_passwd, old_passwd)) {
262 /* SAMR failed, but the old LanMan protocol worked! */
264 cli_shutdown(cli);
265 return NT_STATUS_OK;
268 result = cli_nt_error(cli);
269 if (asprintf(err_str, "machine %s rejected the password "
270 "change: Error was : %s.\n",
271 remote_machine, nt_errstr(result)) == -1) {
272 *err_str = NULL;
274 cli_shutdown(cli);
275 return result;
276 } else {
277 if (asprintf(err_str, "SAMR connection to machine %s "
278 "failed. Error was %s, but LANMAN password "
279 "changes are disabled\n",
280 nt_errstr(result), remote_machine) == -1) {
281 *err_str = NULL;
283 cli_shutdown(cli);
284 return NT_STATUS_UNSUCCESSFUL;