source/smbd/chgpasswd.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    Samba utility functions
   5    Copyright (C) Andrew Tridgell 1992-1998
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 /* fork a child process to exec passwd and write to its
  23 * tty to change a users password. This is running as the
  24 * user who is attempting to change the password.
  25 */
  26
  27 /*
  28  * This code was copied/borrowed and stolen from various sources.
  29  * The primary source was the poppasswd.c from the authors of POPMail. This software
  30  * was included as a client to change passwords using the 'passwd' program
  31  * on the remote machine.
  32  *
  33  * This routine is called by set_user_password() in password.c only if ALLOW_PASSWORD_CHANGE
  34  * is defined in the compiler directives located in the Makefile.
  35  *
  36  * This code has been hacked by Bob Nance (nance@niehs.nih.gov) and Evan Patterson
  37  * (patters2@niehs.nih.gov) at the National Institute of Environmental Health Sciences
  38  * and rights to modify, distribute or incorporate this change to the CAP suite or
  39  * using it for any other reason are granted, so long as this disclaimer is left intact.
  40  */
  41
  42 /*
  43    This code was hacked considerably for inclusion in Samba, primarily
  44    by Andrew.Tridgell@anu.edu.au. The biggest change was the addition
  45    of the "password chat" option, which allows the easy runtime
  46    specification of the expected sequence of events to change a
  47    password.
  48    */
  49
  50 #include "includes.h"
  51
  52 extern int DEBUGLEVEL;
  53
  54 #ifdef ALLOW_CHANGE_PASSWORD
  55
  56 #define MINPASSWDLENGTH 5
  57 #define BUFSIZE 512
  58
  59 static int findpty(char **slave)
  60 {
  61   int master;
  62 #if defined(USE_GRANTPT)
  63 #if defined(SVR4) || defined(SUNOS5)
  64   extern char *ptsname();
  65 #endif /* defined(SVR4) || defined(SUNOS5) */
  66 #else /* USE_GRANTPT */
  67   static fstring line;
  68   void *dirp;
  69   char *dpname;
  70 #endif /* USE_GRANTPT */
  71
  72 #if defined(USE_GRANTPT)
  73   if ((master = open("/dev/ptmx", O_RDWR)) >= 1) {
  74     grantpt(master);
  75     unlockpt(master);
  76     *slave = ptsname(master);
  77     if(*slave == NULL) {
  78       DEBUG(0,("findpty: Unable to create master/slave pty pair.\n"));
  79       return -1;
  80     } else {
  81       DEBUG(10, ("findpty: Allocated slave pty %s\n", *slave));
  82       return (master);
  83     }
  84   }
  85 #else /* USE_GRANTPT */
  86   fstrcpy( line, "/dev/ptyXX" );
  87
  88   dirp = OpenDir(-1, "/dev", False);
  89   if (!dirp) return(-1);
  90   while ((dpname = ReadDirName(dirp)) != NULL) {
  91     if (strncmp(dpname, "pty", 3) == 0 && strlen(dpname) == 5) {
  92       DEBUG(3,("pty: try to open %s, line was %s\n", dpname, line ) );
  93       line[8] = dpname[3];
  94       line[9] = dpname[4];
  95       if ((master = open(line, O_RDWR)) >= 0) {
  96         DEBUG(3,("pty: opened %s\n", line ) );
  97         line[5] = 't';
  98         *slave = line;
  99         CloseDir(dirp);
 100         return (master);
 101       }
 102     }
 103   }
 104   CloseDir(dirp);
 105 #endif /* USE_GRANTPT */
 106   return (-1);
 107 }
 108
 109 static int dochild(int master,char *slavedev, char *name, char *passwordprogram, BOOL as_root)
 110 {
 111   int slave;
 112   struct termios stermios;
 113   struct passwd *pass = Get_Pwnam(name,True);
 114   int gid;
 115   int uid;
 116
 117   if(pass == NULL) {
 118     DEBUG(0,("dochild: user name %s doesn't exist in the UNIX password database.\n",
 119               name));
 120     return False;
 121   }
 122
 123   gid = pass->pw_gid;
 124   uid = pass->pw_uid;
 125 #ifdef USE_SETRES
 126   setresuid(0,0,0);
 127 #else /* USE_SETRES */
 128   setuid(0);
 129 #endif /* USE_SETRES */
 130
 131   /* Start new session - gets rid of controlling terminal. */
 132   if (setsid() < 0) {
 133     DEBUG(3,("Weirdness, couldn't let go of controlling terminal\n"));
 134     return(False);
 135   }
 136
 137   /* Open slave pty and acquire as new controlling terminal. */
 138   if ((slave = open(slavedev, O_RDWR)) < 0) {
 139     DEBUG(3,("More weirdness, could not open %s\n",
 140              slavedev));
 141     return(False);
 142   }
 143 #if defined(SVR4) || defined(SUNOS5) || defined(SCO)
 144   ioctl(slave, I_PUSH, "ptem");
 145   ioctl(slave, I_PUSH, "ldterm");
 146 #else /* defined(SVR4) || defined(SUNOS5) || defined(SCO) */
 147 #if defined(TIOCSCTTY)
 148   if (ioctl(slave,TIOCSCTTY,0) <0) {
 149      DEBUG(3,("Error in ioctl call for slave pty\n"));
 150      /* return(False); */
 151   }
 152 #endif /* defined(TIOCSCTTY) */
 153 #endif /* defined(SVR4) || defined(SUNOS5) || defined(SCO) */
 154
 155   /* Close master. */
 156   close(master);
 157
 158   /* Make slave stdin/out/err of child. */
 159
 160   if (dup2(slave, STDIN_FILENO) != STDIN_FILENO) {
 161     DEBUG(3,("Could not re-direct stdin\n"));
 162     return(False);
 163   }
 164   if (dup2(slave, STDOUT_FILENO) != STDOUT_FILENO) {
 165     DEBUG(3,("Could not re-direct stdout\n"));
 166     return(False);
 167   }
 168   if (dup2(slave, STDERR_FILENO) != STDERR_FILENO) {
 169     DEBUG(3,("Could not re-direct stderr\n"));
 170     return(False);
 171   }
 172   if (slave > 2) close(slave);
 173
 174   /* Set proper terminal attributes - no echo, canonical input processing,
 175      no map NL to CR/NL on output. */
 176
 177   if (tcgetattr(0, &stermios) < 0) {
 178     DEBUG(3,("could not read default terminal attributes on pty\n"));
 179     return(False);
 180   }
 181   stermios.c_lflag &= ~(ECHO | ECHOE | ECHOK | ECHONL);
 182   stermios.c_lflag |= ICANON;
 183   stermios.c_oflag &= ~(ONLCR);
 184   if (tcsetattr(0, TCSANOW, &stermios) < 0) {
 185     DEBUG(3,("could not set attributes of pty\n"));
 186     return(False);
 187   }
 188
 189   /* make us completely into the right uid */
 190   if(!as_root) {
 191 #ifdef USE_SETRES
 192     setresgid(0,0,0);
 193     setresuid(0,0,0);
 194     setresgid(gid,gid,gid);
 195     setresuid(uid,uid,uid);
 196 #else
 197     setuid(0);
 198     seteuid(0);
 199     setgid(gid);
 200     setegid(gid);
 201     setuid(uid);
 202     seteuid(uid);
 203 #endif
 204   }
 205
 206   DEBUG(10, ("Invoking '%s' as password change program.\n", passwordprogram));
 207
 208   /* execl() password-change application */
 209   if (execl("/bin/sh","sh","-c",passwordprogram,NULL) < 0) {
 210     DEBUG(3,("Bad status returned from %s\n",passwordprogram));
 211     return(False);
 212   }
 213   return(True);
 214 }
 215
 216 static int expect(int master,char *expected,char *buf)
 217 {
 218   int n, m;
 219
 220   n = 0;
 221   buf[0] = 0;
 222   while (1) {
 223     if (n >= BUFSIZE-1) {
 224       return False;
 225     }
 226
 227     /* allow 4 seconds for some output to appear */
 228     m = read_with_timeout(master, buf+n, 1, BUFSIZE-1-n, 4000);
 229     if (m < 0)
 230       return False;
 231
 232     n += m;
 233     buf[n] = 0;
 234
 235     {
 236       pstring s1,s2;
 237       pstrcpy(s1,buf);
 238       pstrcpy(s2,expected);
 239       if (do_match(s1, s2, False))
 240         return(True);
 241     }
 242   }
 243 }
 244
 245 static void pwd_sub(char *buf)
 246 {
 247   string_sub(buf,"\\n","\n");
 248   string_sub(buf,"\\r","\r");
 249   string_sub(buf,"\\s"," ");
 250   string_sub(buf,"\\t","\t");
 251 }
 252
 253 static void writestring(int fd,char *s)
 254 {
 255   int l;
 256
 257   l = strlen (s);
 258   write (fd, s, l);
 259 }
 260
 261
 262 static int talktochild(int master, char *chatsequence)
 263 {
 264   char buf[BUFSIZE];
 265   int count=0;
 266   char *ptr=chatsequence;
 267   fstring chatbuf;
 268
 269   *buf = 0;
 270   sleep(1);
 271
 272   while (next_token(&ptr,chatbuf,NULL)) {
 273     BOOL ok=True;
 274     count++;
 275     pwd_sub(chatbuf);
 276     if (!strequal(chatbuf,"."))
 277       ok = expect(master,chatbuf,buf);
 278
 279     if(lp_passwd_chat_debug())
 280       DEBUG(100,("talktochild: chatbuf=[%s] responsebuf=[%s]\n",chatbuf,buf));
 281
 282     if (!ok) {
 283       DEBUG(3,("response %d incorrect\n",count));
 284       return(False);
 285     }
 286
 287     if (!next_token(&ptr,chatbuf,NULL)) break;
 288     pwd_sub(chatbuf);
 289     if (!strequal(chatbuf,"."))
 290       writestring(master,chatbuf);
 291
 292     if(lp_passwd_chat_debug())
 293       DEBUG(100,("talktochild: sendbuf=[%s]\n",chatbuf));
 294   }
 295
 296   if (count<1) return(False);
 297
 298   return (True);
 299 }
 300
 301
 302 BOOL chat_with_program(char *passwordprogram,char *name,char *chatsequence, BOOL as_root)
 303 {
 304   char *slavedev;
 305   int master;
 306   pid_t pid, wpid;
 307   int wstat;
 308   BOOL chstat = False;
 309
 310   /* allocate a pseudo-terminal device */
 311   if ((master = findpty (&slavedev)) < 0) {
 312     DEBUG(3,("Cannot Allocate pty for password change: %s",name));
 313     return(False);
 314   }
 315
 316   if ((pid = fork()) < 0) {
 317     DEBUG(3,("Cannot fork() child for password change: %s",name));
 318     return(False);
 319   }
 320
 321   /* we now have a pty */
 322   if (pid > 0){                 /* This is the parent process */
 323     if ((chstat = talktochild(master, chatsequence)) == False) {
 324       DEBUG(3,("Child failed to change password: %s\n",name));
 325       kill(pid, SIGKILL); /* be sure to end this process */
 326     }
 327     if ((wpid = sys_waitpid(pid, &wstat, 0)) < 0) {
 328       DEBUG(3,("The process is no longer waiting!\n\n"));
 329       return(False);
 330     }
 331     if (pid != wpid) {
 332       DEBUG(3,("We were waiting for the wrong process ID\n"));
 333       return(False);
 334     }
 335     if (WIFEXITED(wstat) == 0) {
 336       DEBUG(3,("The process exited while we were waiting\n"));
 337       return(False);
 338     }
 339     if (WEXITSTATUS(wstat) != 0) {
 340       DEBUG(3,("The status of the process exiting was %d\n", wstat));
 341       return(False);
 342     }
 343
 344   } else {
 345     /* CHILD */
 346
 347     /* make sure it doesn't freeze */
 348     alarm(20);
 349
 350     if(as_root)
 351       become_root(False);
 352     DEBUG(3,("Dochild for user %s (uid=%d,gid=%d)\n",name,getuid(),getgid()));
 353     chstat = dochild(master, slavedev, name, passwordprogram, as_root);
 354
 355     if(as_root)
 356       unbecome_root(False);
 357   }
 358
 359   if(chstat)
 360     DEBUG(3,("Password change %ssuccessful for user %s\n", (chstat?"":"un"), name));
 361   return (chstat);
 362 }
 363
 364
 365 BOOL chgpasswd(char *name,char *oldpass,char *newpass, BOOL as_root)
 366 {
 367   pstring passwordprogram;
 368   pstring chatsequence;
 369   int i;
 370   int len;
 371
 372   strlower(name);
 373   DEBUG(3,("Password change for user: %s\n",name));
 374
 375 #if DEBUG_PASSWORD
 376   DEBUG(100,("Passwords: old=%s new=%s\n",oldpass,newpass));
 377 #endif
 378
 379   /* Take the passed information and test it for minimum criteria */
 380   /* Minimum password length */
 381   if (strlen(newpass) < MINPASSWDLENGTH) /* too short, must be at least MINPASSWDLENGTH */
 382     {
 383       DEBUG(2,("Password Change: %s, New password is shorter than MINPASSWDLENGTH\n",name));
 384       return (False);           /* inform the user */
 385     }
 386
 387   /* Password is same as old password */
 388   if (strcmp(oldpass,newpass) == 0) /* don't allow same password */
 389     {
 390       DEBUG(2,("Password Change: %s, New password is same as old\n",name)); /* log the attempt */
 391       return (False);           /* inform the user */
 392     }
 393
 394 #if (defined(PASSWD_PROGRAM) && defined(PASSWD_CHAT))
 395   pstrcpy(passwordprogram,PASSWD_PROGRAM);
 396   pstrcpy(chatsequence,PASSWD_CHAT);
 397 #else
 398   pstrcpy(passwordprogram,lp_passwd_program());
 399   pstrcpy(chatsequence,lp_passwd_chat());
 400 #endif
 401
 402   if (!*chatsequence) {
 403     DEBUG(2,("Null chat sequence - no password changing\n"));
 404     return(False);
 405   }
 406
 407   if (!*passwordprogram) {
 408     DEBUG(2,("Null password program - no password changing\n"));
 409     return(False);
 410   }
 411
 412   /*
 413    * Check the old and new passwords don't contain any control
 414    * characters.
 415    */
 416
 417   len = strlen(oldpass);
 418   for(i = 0; i < len; i++) {
 419     if(iscntrl(oldpass[i])) {
 420       DEBUG(0,("chat_with_program: oldpass contains control characters (disallowed).\n"));
 421       return False;
 422     }
 423   }
 424
 425   len = strlen(newpass);
 426   for(i = 0; i < len; i++) {
 427     if(iscntrl(newpass[i])) {
 428       DEBUG(0,("chat_with_program: newpass contains control characters (disallowed).\n"));
 429       return False;
 430     }
 431   }
 432
 433   string_sub(passwordprogram,"%u",name);
 434   string_sub(passwordprogram,"%o",oldpass);
 435   string_sub(passwordprogram,"%n",newpass);
 436
 437   string_sub(chatsequence,"%u",name);
 438   string_sub(chatsequence,"%o",oldpass);
 439   string_sub(chatsequence,"%n",newpass);
 440   return(chat_with_program(passwordprogram,name,chatsequence, as_root));
 441 }
 442
 443 #else /* ALLOW_CHANGE_PASSWORD */
 444 BOOL chgpasswd(char *name,char *oldpass,char *newpass, BOOL as_root)
 445 {
 446   DEBUG(0,("Password changing not compiled in (user=%s)\n",name));
 447   return(False);
 448 }
 449 #endif /* ALLOW_CHANGE_PASSWORD */
 450
 451 /***********************************************************
 452  Code to check the lanman hashed password.
 453 ************************************************************/
 454
 455 BOOL check_lanman_password(char *user, unsigned char *pass1,
 456                            unsigned char *pass2, struct smb_passwd **psmbpw)
 457 {
 458   unsigned char unenc_new_pw[16];
 459   unsigned char unenc_old_pw[16];
 460   unsigned char null_pw[16];
 461   struct smb_passwd *smbpw;
 462
 463   *psmbpw = NULL;
 464
 465   become_root(0);
 466   smbpw = getsmbpwnam(user);
 467   unbecome_root(0);
 468
 469   if(smbpw == NULL)
 470   {
 471     DEBUG(0,("check_lanman_password: getsmbpwnam returned NULL\n"));
 472     return False;
 473   }
 474
 475   if(smbpw->acct_ctrl & ACB_DISABLED)
 476   {
 477     DEBUG(0,("check_lanman_password: account %s disabled.\n", user));
 478     return False;
 479   }
 480
 481   if((smbpw->smb_passwd == NULL) && (smbpw->acct_ctrl & ACB_PWNOTREQ))
 482   {
 483     unsigned char no_pw[14];
 484     memset(no_pw, '\0', 14);
 485     E_P16((uchar *)no_pw, (uchar *)null_pw);
 486     smbpw->smb_passwd = null_pw;
 487   } else if (smbpw->smb_passwd == NULL) {
 488     DEBUG(0,("check_lanman_password: no lanman password !\n"));
 489     return False;
 490   }
 491
 492   /* Get the new lanman hash. */
 493   D_P16(smbpw->smb_passwd, pass2, unenc_new_pw);
 494
 495   /* Use this to get the old lanman hash. */
 496   D_P16(unenc_new_pw, pass1, unenc_old_pw);
 497
 498   /* Check that the two old passwords match. */
 499   if(memcmp(smbpw->smb_passwd, unenc_old_pw, 16))
 500   {
 501     DEBUG(0,("check_lanman_password: old password doesn't match.\n"));
 502     return False;
 503   }
 504
 505   *psmbpw = smbpw;
 506   return True;
 507 }
 508
 509 /***********************************************************
 510  Code to change the lanman hashed password.
 511  It nulls out the NT hashed password as it will
 512  no longer be valid.
 513 ************************************************************/
 514
 515 BOOL change_lanman_password(struct smb_passwd *smbpw, unsigned char *pass1, unsigned char *pass2)
 516 {
 517   unsigned char unenc_new_pw[16];
 518   unsigned char null_pw[16];
 519   BOOL ret;
 520
 521   if(smbpw == NULL)
 522   {
 523     DEBUG(0,("change_lanman_password: no smb password entry.\n"));
 524     return False;
 525   }
 526
 527   if(smbpw->acct_ctrl & ACB_DISABLED)
 528   {
 529     DEBUG(0,("change_lanman_password: account %s disabled.\n", smbpw->smb_name));
 530     return False;
 531   }
 532
 533   if((smbpw->smb_passwd == NULL) && (smbpw->acct_ctrl & ACB_PWNOTREQ))
 534   {
 535     unsigned char no_pw[14];
 536     memset(no_pw, '\0', 14);
 537     E_P16((uchar *)no_pw, (uchar *)null_pw);
 538     smbpw->smb_passwd = null_pw;
 539   } else if (smbpw->smb_passwd == NULL) {
 540     DEBUG(0,("change_lanman_password: no lanman password !\n"));
 541     return False;
 542   }
 543
 544   /* Get the new lanman hash. */
 545   D_P16(smbpw->smb_passwd, pass2, unenc_new_pw);
 546
 547   smbpw->smb_passwd = unenc_new_pw;
 548   smbpw->smb_nt_passwd = NULL; /* We lose the NT hash. Sorry. */
 549
 550   /* Now write it into the file. */
 551   become_root(0);
 552   ret = mod_smbpwd_entry(smbpw,False);
 553   unbecome_root(0);
 554
 555   return ret;
 556 }
 557
 558 /***********************************************************
 559  Code to check the OEM hashed password.
 560 ************************************************************/
 561
 562 BOOL check_oem_password(char *user, unsigned char *data,
 563                         struct smb_passwd **psmbpw, char *new_passwd,
 564                         int new_passwd_size)
 565 {
 566   struct smb_passwd *smbpw = NULL;
 567   int new_pw_len;
 568   fstring upper_case_new_passwd;
 569   unsigned char new_p16[16];
 570   unsigned char unenc_old_pw[16];
 571   unsigned char null_pw[16];
 572
 573   become_root(0);
 574   *psmbpw = smbpw = getsmbpwnam(user);
 575   unbecome_root(0);
 576
 577   if(smbpw == NULL)
 578   {
 579     DEBUG(0,("check_oem_password: getsmbpwnam returned NULL\n"));
 580     return False;
 581   }
 582
 583   if(smbpw->acct_ctrl & ACB_DISABLED)
 584   {
 585     DEBUG(0,("check_lanman_password: account %s disabled.\n", user));
 586     return False;
 587   }
 588
 589   if((smbpw->smb_passwd == NULL) && (smbpw->acct_ctrl & ACB_PWNOTREQ))
 590   {
 591     unsigned char no_pw[14];
 592     memset(no_pw, '\0', 14);
 593     E_P16((uchar *)no_pw, (uchar *)null_pw);
 594     smbpw->smb_passwd = null_pw;
 595   } else if (smbpw->smb_passwd == NULL) {
 596     DEBUG(0,("check_oem_password: no lanman password !\n"));
 597     return False;
 598   }
 599
 600   /*
 601    * Call the hash function to get the new password.
 602    */
 603   SamOEMhash( (unsigned char *)data, (unsigned char *)smbpw->smb_passwd, True);
 604
 605   /*
 606    * The length of the new password is in the last 4 bytes of
 607    * the data buffer.
 608    */
 609   new_pw_len = IVAL(data,512);
 610   if(new_pw_len < 0 || new_pw_len > new_passwd_size - 1) {
 611     DEBUG(0,("check_oem_password: incorrect password length (%d).\n", new_pw_len));
 612     return False;
 613   }
 614
 615   memcpy(new_passwd, &data[512-new_pw_len], new_pw_len);
 616   new_passwd[new_pw_len] = '\0';
 617
 618   /*
 619    * To ensure we got the correct new password, hash it and
 620    * use it as a key to test the passed old password.
 621    */
 622
 623   memset(upper_case_new_passwd, '\0', sizeof(upper_case_new_passwd));
 624   fstrcpy(upper_case_new_passwd, new_passwd);
 625   strupper(upper_case_new_passwd);
 626
 627   E_P16((uchar *)upper_case_new_passwd, new_p16);
 628
 629   /*
 630    * Now use new_p16 as the key to see if the old
 631    * password matches.
 632    */
 633   D_P16(new_p16, &data[516], unenc_old_pw);
 634
 635   if(memcmp(smbpw->smb_passwd, unenc_old_pw, 16)) {
 636     DEBUG(0,("check_oem_password: old password doesn't match.\n"));
 637     return False;
 638   }
 639
 640   memset(upper_case_new_passwd, '\0', strlen(upper_case_new_passwd));
 641
 642   return True;
 643 }
 644
 645 /***********************************************************
 646  Code to change the oem password. Changes both the lanman
 647  and NT hashes.
 648  override = False, normal
 649  override = True, override XXXXXXXXXX'd password
 650 ************************************************************/
 651
 652 BOOL change_oem_password(struct smb_passwd *smbpw, char *new_passwd, BOOL override)
 653 {
 654   int ret;
 655   fstring upper_case_new_passwd;
 656   unsigned char new_nt_p16[16];
 657   unsigned char new_p16[16];
 658
 659   memset(upper_case_new_passwd, '\0', sizeof(upper_case_new_passwd));
 660   fstrcpy(upper_case_new_passwd, new_passwd);
 661   strupper(upper_case_new_passwd);
 662
 663   E_P16((uchar *)upper_case_new_passwd, new_p16);
 664
 665   smbpw->smb_passwd = new_p16;
 666
 667   E_md4hash((uchar *) new_passwd, new_nt_p16);
 668   smbpw->smb_nt_passwd = new_nt_p16;
 669
 670   /* Now write it into the file. */
 671   become_root(0);
 672   ret = mod_smbpwd_entry(smbpw,override);
 673   unbecome_root(0);
 674
 675   memset(upper_case_new_passwd, '\0', strlen(upper_case_new_passwd));
 676   memset(new_passwd, '\0', strlen(new_passwd));
 677
 678   return ret;
 679 }