summaryrefslogtreecommitdiffstats
path: root/source/auth/auth_sam.c
Commit message (Collapse)AuthorAgeFilesLines
* Add support for the new modules system to auth/ (merge from HEAD)Jelmer Vernooij2003-04-161-1/+6
|
* Merge from HEAD - allow "" as a domain in the NLTMv2 hash calculations. FixesAndrew Bartlett2003-02-161-2/+22
| | | | | | interop with clients not in our domain. Andrew Bartlett
* Merge HEAD: check both the account and password...Andrew Bartlett2003-02-041-2/+2
| | | | Andrew Bartlett
* Merge from HEAD - updates to correctly recognise LMv2, and NT# in LM feild.Andrew Bartlett2003-01-051-33/+58
| | | | Andrew Bartlett
* Updates from HEAD:Andrew Bartlett2002-11-151-2/+2
| | | | | | | | | | - const for PACKS() in lanman.c - change auth to 'account before password' - add help to net rpc {vampire,samsync} - configure updates for sun workshop cc - become_root() around pdb_ calls in auth_util for guest login. Andrew Bartlett
* Removed global_myworkgroup, global_myname, global_myscope. Added liberalJeremy Allison2002-11-121-2/+2
| | | | | | dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy.
* Merge from HEAD:Andrew Bartlett2002-11-081-8/+9
| | | | | | | | | | | | | - change auth_sam to use the initialisation flags to determine if the password attributes are set - add const to secrets.c, cliconnect.c - passdb: fix spelling in pdb_ldap, add group mapping back to smbpasswd - SAMR: add debugs to show what fails for group enum. Andrew Bartlett
* sync'ing up for 3.0alpha20 releaseGerald Carter2002-09-251-8/+11
|
* sync 3.0 branch with headJelmer Vernooij2002-08-171-2/+17
|
* updated the 3.0 branch from the head branch - ready for alpha18Andrew Tridgell2002-07-151-7/+12
|
* "user doesn't exist" isn't worthy of a level 1 debug. Make it level 3.Andrew Bartlett2002-02-271-1/+1
|
* Removed version number from file header.Tim Potter2002-01-301-2/+1
| | | | Changed "SMB/Netbios" to "SMB/CIFS" in file header.
* Commit the auth associated changes I missed from the last commit.Andrew Bartlett2002-01-151-2/+4
| | | | | | | | Also set the default value of all the allocated strings to "" to avoid changing the interface (becouse pdb_get...() would point to a null string, rather than a null pointer and parts of samba rely on that). Andrew Bartlett
* Back out the crazy notion that the NTLMSSP flags actually mean anything...Andrew Bartlett2002-01-111-7/+7
| | | | | | | | Replace this with some flags that *we* define. We can do a mapping later if we actually get some more reliable info about what passwords are actually valid. Andrew Bartlett
* I've decided to move the auth code around a bit more...Andrew Bartlett2002-01-051-28/+30
| | | | | | | | | | | | | | | | | | | | | | | | The auth_authsupplied_info typedef is now just a plain struct - auth_context, but it has been modified to contain the function pointers to the rest of the auth subsystem's components. (Who needs non-static functions anyway?) In working all this mess out, I fixed a number of memory leaks and moved the entire auth subsystem over to talloc(). Note that the TALLOC_CTX attached to the auth_context can be rather long-lived, it is provided for things that are intended to live as long. (The global_negprot_auth_context lasts the whole life of the smbd). I've also adjusted a few things in auth_domain.c, mainly passing the domain as a paramater to a few functions instead of looking up lp_workgroup(). I'm hopign to make this entire thing a bit more trusted domains (as PDC) freindly in the near future. Other than that, I moved a bit of the code around, hence the rather messy diff. Andrew Bartlett
* debug statement fixups.Jeremy Allison2002-01-021-16/+16
| | | | | Merge SAFE_FREE fix in tdb from 2.2, and IRIX fix. Jeremy.
* A farily large commit:Andrew Bartlett2002-01-011-15/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Move rpc_client/cli_trust.c to smbd/change_trust_pw.c - It hasn't been used by anything else since smbpasswd lost its -j - Add a TALLOC_CTX to the auth subsytem. These are only valid for the length of the calls to the individual modules, if you want a longer context hide it in your private data. Similarly, all returns (like the server_info) should still be malloced. - Move the 'ntdomain' module (security=domain in oldspeak) over to use the new libsmb domain logon code. Also rework much of the code to use some better helper functions for the connection - getting us much better error returns (the new code is NTSTATUS). The only remaining thing to do is to figure out if tpot's 0xdead 0xbeef for the LUID feilds is sufficient, or if we should do random LUIDs as per the old code. Similarly, I'll move winbind over to this when I get a chance. This leaves the SPOOLSS code and some cli_pipe code as the only stuff still in rpc_client, at least as far as smbd is concerned. While I've given this a basic rundown, any testing is as always appriciated. Andrew Bartlett
* A number of things to clean up the auth subsytem a bit...Andrew Bartlett2001-11-261-1/+36
| | | | | | | | | | | | | | | | | | | | | | | We now default encrypt passwords = yes We now check plaintext passwords (however aquired) with the 'sam' backend rather than unix, if encrypt passwords = yes. (this kills off the 'local' backed. The sam backend may be renamed in its place) The new 'samstrict' wrapper backend checks that the user's domain is one of our netbios aliases - this ensures that we don't get fallback crazies with security = domain. Similarly, the code in the 'ntdomain' and 'smbserver' backends now checks that the user was not local before contacting the DC. The default ordering has changed, we now check the local stuff first - but becouse of the changes above, we will really only ever contact one auth source. Andrew Bartlett
* challange -> challengeTim Potter2001-11-261-4/+4
|
* This is another rather major change to the samba authenticaionAndrew Bartlett2001-11-241-31/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | subystem. The particular aim is to modularized the interface - so that we can have arbitrary password back-ends. This code adds one such back-end, a 'winbind' module to authenticate against the winbind_auth_crap functionality. While fully-functional this code is mainly useful as a demonstration, because we don't get back the info3 as we would for direct ntdomain authentication. This commit introduced the new 'auth methods' parameter, in the spirit of the 'auth order' discussed on the lists. It is renamed because not all the methods may be consulted, even if previous methods fail - they may not have a suitable challenge for example. Also, we have a 'local' authentication method, for old-style 'unix if plaintext, sam if encrypted' authentication and a 'guest' module to handle guest logins in a single place. While this current design is not ideal, I feel that it does provide a better infrastructure than the current design, and can be built upon. The following parameters have changed: - use rhosts = This has been replaced by the 'rhosts' authentication method, and can be specified like 'auth methods = guest rhosts' - hosts equiv = This needs both this parameter and an 'auth methods' entry to be effective. (auth methods = guest hostsequiv ....) - plaintext to smbpasswd = This is replaced by specifying 'sam' rather than 'local' in the auth methods. The security = parameter is unchanged, and now provides defaults for the 'auth methods' parameter. The available auth methods are: guest rhosts hostsequiv sam (passdb direct hash access) unix (PAM, crypt() etc) local (the combination of the above, based on encryption) smbserver (old security=server) ntdomain (old security=domain) winbind (use winbind to cache DC connections) Assistance in testing, or the production of new and interesting authentication modules is always appreciated. Andrew Bartlett
* Add back the not null checks in a better place.Andrew Bartlett2001-11-111-1/+7
| | | | Check the pdb_init_sam() for failure.
* make sam_account_ok static.Andrew Bartlett2001-11-111-32/+29
| | | | | | remove rudundent not null checks fix indenting
* Minor cleanups/fixes in the NTLMv2 codeAndrew Bartlett2001-11-031-6/+2
|
* This is a farily large patch (3300 lines) and reworks most of the AuthRewriteAndrew Bartlett2001-10-311-75/+153
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | code. In particular this assists tpot in some of his work, becouse it provides the connection between the authenticaion and the vuid generation. Major Changes: - Fully malloc'ed structures. - Massive rework of the code so that all structures are made and destroyed using malloc and free, rather than hanging around on the stack. - SAM_ACCOUNT unix uids and gids are now pointers to the same, to allow them to be declared 'invalid' without the chance that people might get ROOT by default. - kill off some of the "DOMAIN\user" lookups. These can be readded at a more appropriate place (probably domain_client_validate.c) in the future. They don't belong in session setups. - Massive introduction of DATA_BLOB structures, particularly for passwords. - Use NTLMSSP flags to tell the backend what its getting, rather than magic lenghths. - Fix winbind back up again, but tpot is redoing this soon anyway. - Abstract much of the work in srv_netlog_nt back into auth helper functions. This is a LARGE change, and any assistance is testing it is appriciated. Domain logons are still broken (as far as I can tell) but other functionality seems intact. Needs testing with a wide variety of MS clients. Andrew Bartlett
* Fix up auth_smbpasswd.c to use the password interface, rather than theAndrew Bartlett2001-10-291-8/+8
| | | | | | structures directly. Andrew Bartlett
* This commit is number 4 of 4.Andrew Bartlett2001-10-291-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular this commit focuses on: Actually adding the 'const' to the passdb interface, and the flow-on changes. Also kill off the 'disp_info' stuff, as its no longer used. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes introduces a large dose of 'const' to the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username --- This finishes this line of commits off, your tree should now compile again :-) Andrew Bartlett
* more compiler warningsHerb Lewis2001-10-231-1/+1
|
* print in a human readable format when the password expired.Jean-François Micouleau2001-10-191-1/+1
| | | | J.F.
* Fix up indenting in out SAM password check code.Andrew Bartlett2001-10-061-46/+49
|
* Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter2001-10-021-5/+0
|
* honor the ACB_PWNOEXP flag in smbpasswdAndrew Tridgell2001-10-011-2/+1
|
* - fix handling of 0 last_change_time and must_change_timeAndrew Tridgell2001-10-011-31/+32
| | | | - move the arbitrary 21 day timeout to local.h
* Fix up a number of intertwined issues:Andrew Bartlett2001-09-291-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The big one is a global change to allow us to NULLify the free'ed pointer to a former passdb object. This was done to allow idra's SAFE_FREE() macro to do its magic, and to satisfy the input test in pdb_init_sam() for a NULL pointer to start with. This NULL pointer test was what was breaking the adding of accounts up until now, and this code has been reworked to avoid duplicating work - I hope this will avoid a similar mess-up in future. Finally, I fixed a few nasty bugs where the pdb_ fuctions's return codes were being ignored. Some of these functions malloc() and are permitted to fail. Also, this caught a nasty bug where pdb_set_lanman_password(sam, NULL) acheived precisely didilly-squat, just returning False. Now that we check the returns this bug was spotted. This could allow different LM and NT passwords. - the pdbedit code needs to start checking these too, but I havn't had a chance to fix it. I have also fixed up where some of the password changing code was using the pdb_set functions to store *internal* data. I assume this is from a previous lot of mass conversion work... Most likally (and going on past experience) I have missed somthing, probably in the LanMan password change code which I havn't yet been able to test, but this lot is in much better shape than it was before. If all this is too much to swallow (particularly for 2.2.2) then just adding a sam_pass = NULL to the particular line of passdb.c should do the trick for the ovbious bug. Andrew Bartlett
* Process the workstation trust account code INSIDE the authenticaion subsystem,Andrew Bartlett2001-09-261-5/+20
| | | | | | just like any other logon. Matching code removal in reply.c to follow. Andrew Bartlett
* Rearrange the order of the checks in auth_smbpasswd.c, always check passwordsAndrew Bartlett2001-09-261-73/+111
| | | | | | | first. Add password expiry and 'must change before first logon' support. - This requires that the passdb be up to the job to supply the info.
* Revert this one: The NTLMv2 checks need the original username as foundAndrew Bartlett2001-09-201-1/+1
| | | | on the wire.
* - Fix up to use sampass->username insted of user_info->smb_usernameAndrew Bartlett2001-09-191-7/+7
| | | | - Fix initial lookup to use the mapped username.
* move to SAFE_FREE()Simo Sorce2001-09-171-2/+2
|
* Fix up workstaion and kickoff time checks, moved to auth_smbpasswd.c whereAndrew Bartlett2001-09-161-3/+42
| | | | | | | | | they can have general effect. Fixed up workstaion support in the rest of samba, so that we can do these checks. Pass through the workstation for cli_net_logon(), if supplied.
* Some patches to authentication:Tim Potter2001-09-121-1/+1
| | | | | | | | | - the usersupplied_info now contains a smb_username (as it comes across on the wire) and a unix_username (after being passed through mapping functions) - when doing security={server,domain} use the smb_username, otherwise use the unix_username
* the next stage in the NTSTATUS/WERROR change. smbd and nmbd now compile, but ↵Andrew Tridgell2001-09-041-4/+4
| | | | the client code still needs some work
* converted another bunch of stuff to NTSTATUSAndrew Tridgell2001-08-271-4/+4
|
* get rid of compiler warningsHerb Lewis2001-08-241-3/+3
|
* Style cleanup for the last vuid change.Andrew Bartlett2001-08-171-5/+8
| | | | | | | Style, doco and DEBUG() fixes for auth_smbpasswd.c (In particular for the account control call). Andrew Bartlett
* This patch does a number of things, mostly smaller than they look :-)Andrew Bartlett2001-08-121-5/+5
| | | | | | | | | | | | | | | In particuar, it moves the domain_client_validate stuff out of auth_domain.c to somwhere where they (I hope) they can be shared with winbind better. (This may need some work) The main purpose of this patch was however to improve some of the internal documentation and to correctly place become_root()/unbecome_root() calls within the code. Finally this patch moves some more of auth.c into other files, auth_unix.c in this case. Andrew Bartlett
* This is my 'Authentication Rewrite' version 1.01, mostly as submitted toAndrew Bartlett2001-08-031-0/+229
samba-technical a few weeks ago. The idea here is to standardize the checking of user names and passwords, thereby ensuring that all authtentications pass the same standards. The interface currently implemented in as nt_status = check_password(user_info, server_info) where user_info contains (mostly) the authentication data, and server_info contains things like the user-id they got, and their resolved user name. The current ugliness with the way the structures are created will be killed the next revision, when they will be created and malloced by creator functions. This patch also includes the first implementation of NTLMv2 in HEAD, but which needs some more testing. We also add a hack to allow plaintext passwords to be compared with smbpasswd, not the system password database. Finally, this patch probably reintroduces the PAM accounts bug we had in 2.2.0, I'll fix that once this hits the tree. (I've just finished testing it on a wide variety of platforms, so I want to get this patch in).
generated by cgit (git 2.34.1) at 2024-10-09 02:26:51 +0000