2 * Unix SMB/CIFS implementation.
3 * Routines to operate on various trust relationships
4 * Copyright (C) Andrew Bartlett 2001
5 * Copyright (C) Rafal Szczesniak 2003
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 #include "../libcli/auth/libcli_auth.h"
23 #include "../libcli/auth/netlogon_creds_cli.h"
24 #include "rpc_client/cli_netlogon.h"
25 #include "rpc_client/cli_pipe.h"
26 #include "../librpc/gen_ndr/ndr_netlogon.h"
29 #include "libsmb/libsmb.h"
30 #include "source3/include/messages.h"
31 #include "source3/include/g_lock.h"
33 /*********************************************************
34 Change the domain password on the PDC.
35 Do most of the legwork ourselfs. Caller must have
36 already setup the connection to the NETLOGON pipe
37 **********************************************************/
39 NTSTATUS
trust_pw_find_change_and_store_it(struct rpc_pipe_client
*cli
,
43 unsigned char old_trust_passwd_hash
[16];
44 unsigned char new_trust_passwd_hash
[16];
45 enum netr_SchannelType sec_channel_type
= SEC_CHAN_NULL
;
46 const char *account_name
;
47 char *new_trust_passwd
;
50 if (!get_trust_pw_hash(domain
, old_trust_passwd_hash
, &account_name
,
52 DEBUG(0, ("could not fetch domain secrets for domain %s!\n", domain
));
53 return NT_STATUS_UNSUCCESSFUL
;
56 switch (sec_channel_type
) {
61 return NT_STATUS_NOT_SUPPORTED
;
64 /* Create a random machine account password */
65 new_trust_passwd
= generate_random_password(mem_ctx
,
66 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH
,
67 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH
);
68 if (new_trust_passwd
== NULL
) {
69 DEBUG(0, ("generate_random_password failed\n"));
70 return NT_STATUS_NO_MEMORY
;
73 E_md4hash(new_trust_passwd
, new_trust_passwd_hash
);
75 nt_status
= rpccli_netlogon_set_trust_password(cli
, mem_ctx
,
77 old_trust_passwd_hash
,
79 new_trust_passwd_hash
,
82 if (NT_STATUS_IS_OK(nt_status
)) {
83 DEBUG(3,("%s : trust_pw_change_and_store_it: Changed password.\n",
84 current_timestring(talloc_tos(), False
)));
86 * Return the result of trying to write the new password
87 * back into the trust account file.
90 switch (sec_channel_type
) {
93 if (!secrets_store_machine_password(new_trust_passwd
, domain
, sec_channel_type
)) {
94 nt_status
= NT_STATUS_UNSUCCESSFUL
;
98 case SEC_CHAN_DOMAIN
: {
101 time_t pass_last_set_time
;
103 /* we need to get the sid first for the
104 * pdb_set_trusteddom_pw call */
106 if (!pdb_get_trusteddom_pw(domain
, &pwd
, &sid
, &pass_last_set_time
)) {
107 nt_status
= NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE
;
109 if (!pdb_set_trusteddom_pw(domain
, new_trust_passwd
, &sid
)) {
110 nt_status
= NT_STATUS_INTERNAL_DB_CORRUPTION
;
120 struct trust_pw_change_state
{
121 struct g_lock_ctx
*g_ctx
;
125 static int trust_pw_change_state_destructor(struct trust_pw_change_state
*state
)
127 g_lock_unlock(state
->g_ctx
, state
->g_lock_key
);
131 NTSTATUS
trust_pw_change(struct netlogon_creds_cli_context
*context
,
132 struct messaging_context
*msg_ctx
,
133 struct dcerpc_binding_handle
*b
,
137 TALLOC_CTX
*frame
= talloc_stackframe();
138 struct trust_pw_change_state
*state
;
139 struct samr_Password current_nt_hash
;
140 const struct samr_Password
*previous_nt_hash
= NULL
;
141 enum netr_SchannelType sec_channel_type
= SEC_CHAN_NULL
;
142 const char *account_name
;
143 char *new_trust_passwd
;
146 time_t pass_last_set_time
;
147 struct timeval g_timeout
= { 0, };
149 struct timeval tv
= { 0, };
152 state
= talloc_zero(frame
, struct trust_pw_change_state
);
155 return NT_STATUS_NO_MEMORY
;
158 state
->g_ctx
= g_lock_ctx_init(state
, msg_ctx
);
159 if (state
->g_ctx
== NULL
) {
161 return NT_STATUS_NO_MEMORY
;
164 state
->g_lock_key
= talloc_asprintf(state
,
165 "trust_password_change_%s",
167 if (state
->g_lock_key
== NULL
) {
169 return NT_STATUS_NO_MEMORY
;
172 g_timeout
= timeval_current_ofs(10, 0);
173 status
= g_lock_lock(state
->g_ctx
,
175 G_LOCK_WRITE
, g_timeout
);
176 if (!NT_STATUS_IS_OK(status
)) {
177 DEBUG(1, ("could not get g_lock on [%s]!\n",
183 talloc_set_destructor(state
, trust_pw_change_state_destructor
);
185 if (!get_trust_pw_hash(domain
, current_nt_hash
.hash
,
187 &sec_channel_type
)) {
188 DEBUG(0, ("could not fetch domain secrets for domain %s!\n", domain
));
190 return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE
;
193 switch (sec_channel_type
) {
195 pwd
= secrets_fetch_machine_password(domain
,
200 return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE
;
203 case SEC_CHAN_DOMAIN
:
204 if (!pdb_get_trusteddom_pw(domain
, &pwd
, &sid
, &pass_last_set_time
)) {
206 return NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE
;
211 return NT_STATUS_NOT_SUPPORTED
;
214 timeout
= lp_machine_password_timeout();
217 DEBUG(10,("machine password never expires\n"));
223 tv
.tv_sec
= pass_last_set_time
;
224 DEBUG(10, ("password last changed %s\n",
225 timeval_string(talloc_tos(), &tv
, false)));
226 tv
.tv_sec
+= timeout
;
227 DEBUGADD(10, ("password valid until %s\n",
228 timeval_string(talloc_tos(), &tv
, false)));
230 if (!force
&& !timeval_expired(&tv
)) {
235 /* Create a random machine account password */
236 new_trust_passwd
= generate_random_password(frame
,
237 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH
,
238 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH
);
239 if (new_trust_passwd
== NULL
) {
240 DEBUG(0, ("generate_random_password failed\n"));
242 return NT_STATUS_NO_MEMORY
;
245 status
= netlogon_creds_cli_auth(context
, b
,
248 if (!NT_STATUS_IS_OK(status
)) {
253 status
= netlogon_creds_cli_ServerPasswordSet(context
, b
,
254 new_trust_passwd
, NULL
);
255 if (!NT_STATUS_IS_OK(status
)) {
260 DEBUG(3,("%s : trust_pw_change_and_store_it: Changed password.\n",
261 current_timestring(talloc_tos(), False
)));
264 * Return the result of trying to write the new password
265 * back into the trust account file.
268 switch (sec_channel_type
) {
271 if (!secrets_store_machine_password(new_trust_passwd
, domain
, sec_channel_type
)) {
273 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
277 case SEC_CHAN_DOMAIN
:
279 * we need to get the sid first for the
280 * pdb_set_trusteddom_pw call
282 if (!pdb_set_trusteddom_pw(domain
, new_trust_passwd
, &sid
)) {
284 return NT_STATUS_INTERNAL_DB_CORRUPTION
;