2 Unix SMB/CIFS implementation.
3 SMB client password change routine
4 Copyright (C) Andrew Tridgell 1994-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "../librpc/gen_ndr/ndr_samr.h"
22 #include "rpc_client/cli_pipe.h"
23 #include "rpc_client/cli_samr.h"
24 #include "libsmb/libsmb.h"
25 #include "libsmb/clirap.h"
26 #include "libsmb/nmblib.h"
28 /*************************************************************
29 Change a password on a remote machine using IPC calls.
30 *************************************************************/
32 NTSTATUS
remote_password_change(const char *remote_machine
, const char *user_name
,
33 const char *old_passwd
, const char *new_passwd
,
36 struct cli_state
*cli
= NULL
;
37 struct rpc_pipe_client
*pipe_hnd
= NULL
;
38 char *user
, *domain
, *p
;
41 bool pass_must_change
= False
;
43 user
= talloc_strdup(talloc_tos(), user_name
);
44 SMB_ASSERT(user
!= NULL
);
45 domain
= talloc_strdup(talloc_tos(), "");
46 SMB_ASSERT(domain
!= NULL
);
48 /* allow usernames of the form domain\\user or domain/user */
49 if ((p
= strchr_m(user
,'\\')) || (p
= strchr_m(user
,'/')) ||
50 (p
= strchr_m(user
,*lp_winbind_separator()))) {
58 result
= cli_connect_nb(remote_machine
, NULL
, 0, 0x20, NULL
,
59 SMB_SIGNING_DEFAULT
, 0, &cli
);
60 if (!NT_STATUS_IS_OK(result
)) {
61 if (asprintf(err_str
, "Unable to connect to SMB server on "
62 "machine %s. Error was : %s.\n",
63 remote_machine
, nt_errstr(result
))==-1) {
69 result
= cli_negprot(cli
, PROTOCOL_NT1
);
71 if (!NT_STATUS_IS_OK(result
)) {
72 if (asprintf(err_str
, "machine %s rejected the negotiate "
73 "protocol. Error was : %s.\n",
74 remote_machine
, nt_errstr(result
)) == -1) {
81 /* Given things like SMB signing, restrict anonymous and the like,
82 try an authenticated connection first */
83 result
= cli_session_setup(cli
, user_name
,
84 old_passwd
, strlen(old_passwd
)+1,
85 old_passwd
, strlen(old_passwd
)+1, "");
87 if (!NT_STATUS_IS_OK(result
)) {
89 /* Password must change or Password expired are the only valid
90 * error conditions here from where we can proceed, the rest like
91 * account locked out or logon failure will lead to errors later
94 if (!NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_MUST_CHANGE
) &&
95 !NT_STATUS_EQUAL(result
, NT_STATUS_PASSWORD_EXPIRED
)) {
96 if (asprintf(err_str
, "Could not connect to machine %s: "
97 "%s\n", remote_machine
, nt_errstr(result
)) == -1) {
104 pass_must_change
= True
;
107 * We should connect as the anonymous user here, in case
108 * the server has "must change password" checked...
109 * Thanks to <Nicholas.S.Jenkins@cdc.com> for this fix.
112 result
= cli_session_setup(cli
, "", "", 0, "", 0, "");
114 if (!NT_STATUS_IS_OK(result
)) {
115 if (asprintf(err_str
, "machine %s rejected the session "
116 "setup. Error was : %s.\n",
117 remote_machine
, nt_errstr(result
)) == -1) {
124 result
= cli_init_creds(cli
, "", "", NULL
);
125 if (!NT_STATUS_IS_OK(result
)) {
130 result
= cli_init_creds(cli
, user
, domain
, old_passwd
);
131 if (!NT_STATUS_IS_OK(result
)) {
137 result
= cli_tree_connect(cli
, "IPC$", "IPC", "", 1);
138 if (!NT_STATUS_IS_OK(result
)) {
139 if (asprintf(err_str
, "machine %s rejected the tconX on the "
140 "IPC$ share. Error was : %s.\n",
141 remote_machine
, nt_errstr(result
))) {
148 /* Try not to give the password away too easily */
150 if (!pass_must_change
) {
151 result
= cli_rpc_pipe_open_ntlmssp(cli
,
152 &ndr_table_samr
.syntax_id
,
154 DCERPC_AUTH_LEVEL_PRIVACY
,
160 * If the user password must be changed the ntlmssp bind will
161 * fail the same way as the session setup above did. The
162 * difference ist that with a pipe bind we don't get a good
163 * error message, the result will be that the rpc call below
164 * will just fail. So we do it anonymously, there's no other
167 result
= cli_rpc_pipe_open_noauth(
168 cli
, &ndr_table_samr
.syntax_id
, &pipe_hnd
);
171 if (!NT_STATUS_IS_OK(result
)) {
172 if (lp_client_lanman_auth()) {
173 /* Use the old RAP method. */
174 if (!cli_oem_change_password(cli
, user_name
, new_passwd
, old_passwd
)) {
175 result
= cli_nt_error(cli
);
176 if (asprintf(err_str
, "machine %s rejected the "
177 "password change: Error was : %s.\n",
178 remote_machine
, nt_errstr(result
)) == -1) {
185 if (asprintf(err_str
, "SAMR connection to machine %s "
186 "failed. Error was %s, but LANMAN password "
187 "changes are disabled\n",
188 remote_machine
, nt_errstr(result
)) == -1) {
196 result
= rpccli_samr_chgpasswd_user2(pipe_hnd
, talloc_tos(),
197 user_name
, new_passwd
, old_passwd
);
198 if (NT_STATUS_IS_OK(result
)) {
199 /* Great - it all worked! */
203 } else if (!(NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
)
204 || NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
))) {
205 /* it failed, but for reasons such as wrong password, too short etc ... */
207 if (asprintf(err_str
, "machine %s rejected the password change: "
209 remote_machine
, get_friendly_nt_error_msg(result
)) == -1) {
216 /* OK, that failed, so try again... */
217 TALLOC_FREE(pipe_hnd
);
219 /* Try anonymous NTLMSSP... */
220 result
= cli_init_creds(cli
, "", "", NULL
);
221 if (!NT_STATUS_IS_OK(result
)) {
226 result
= NT_STATUS_UNSUCCESSFUL
;
228 /* OK, this is ugly, but... try an anonymous pipe. */
229 result
= cli_rpc_pipe_open_noauth(cli
, &ndr_table_samr
.syntax_id
,
232 if ( NT_STATUS_IS_OK(result
) &&
233 (NT_STATUS_IS_OK(result
= rpccli_samr_chgpasswd_user2(
234 pipe_hnd
, talloc_tos(), user_name
,
235 new_passwd
, old_passwd
)))) {
236 /* Great - it all worked! */
240 if (!(NT_STATUS_EQUAL(result
, NT_STATUS_ACCESS_DENIED
)
241 || NT_STATUS_EQUAL(result
, NT_STATUS_UNSUCCESSFUL
))) {
242 /* it failed, but again it was due to things like new password too short */
244 if (asprintf(err_str
, "machine %s rejected the "
245 "(anonymous) password change: Error was : "
246 "%s.\n", remote_machine
,
247 get_friendly_nt_error_msg(result
)) == -1) {
254 /* We have failed to change the user's password, and we think the server
255 just might not support SAMR password changes, so fall back */
257 if (lp_client_lanman_auth()) {
258 /* Use the old RAP method. */
259 if (cli_oem_change_password(cli
, user_name
, new_passwd
, old_passwd
)) {
260 /* SAMR failed, but the old LanMan protocol worked! */
266 result
= cli_nt_error(cli
);
267 if (asprintf(err_str
, "machine %s rejected the password "
268 "change: Error was : %s.\n",
269 remote_machine
, nt_errstr(result
)) == -1) {
275 if (asprintf(err_str
, "SAMR connection to machine %s "
276 "failed. Error was %s, but LANMAN password "
277 "changes are disabled\n",
278 nt_errstr(result
), remote_machine
) == -1) {
282 return NT_STATUS_UNSUCCESSFUL
;