summaryrefslogtreecommitdiffstats
path: root/source/passdb/smbpass.c
Commit message (Collapse)AuthorAgeFilesLines
* code from bertl to allow remap of default built-in names to anything.Luke Leighton1999-07-141-0/+6
| | | | | parameter is "builtin rid file". Copyright 1999 Bertl <bp@vpnet.at>
* renamed getfilepwent() and endfilepwent() to getfileent() and endfileent()Luke Leighton1999-07-131-2/+2
| | | | | | as they are generic "file line-by-line" reading routines. lines with "#" at the front are ignored (as comments). this code started out as the password file reading code.
* SAM database "set user info".Luke Leighton1999-03-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | ---------------------------- - removed DOM_RID4 - removed SAMR_UNKNOWN_32 - added SAMR_SET_USERINFO (opcode 0x32) - added level 0x1 to SAMR_QUERY_DOM_INFO (needed for create user) - fixed pwdb_gethexpwd() it was failing on XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX - added mod_sam21pwd_entry() - preparing to call mod_sam21pwd_entry() - added "user session key" to user_struct.dc. this is md4(nt#) and is needed to decode user's clear-text passwords in SAMR_SET_USERINFO. - split code out in chgpasswd.c to decode 516 byte password buffers.
* mods to allow inter-domain trust accounts to be added to SAM databaseLuke Leighton1999-03-091-12/+20
| | | | using smbpasswd command.
* spelling mistake, #ifdef'd out for non-developers (oops!)Luke Leighton1999-03-051-0/+5
|
* iteration of sam passwd entries was an order n-cubed algorithm dueLuke Leighton1999-02-081-1/+4
| | | | | to resolution of unix name to nt name being unnecessarily _inside_ another loop.
* Fixed the "You password will expire in 0 days. Would you like toGerald Carter1999-01-131-0/+4
| | | | | | | | | | | | | | | change it now?" message when you login to a Samba Controlled domain. The fix is a hard coded 42 days from right now until you need to change you pasword again time (see passdb/sampassdb.c:pwdb_smb_to_sam()) Also fixed getsmbfilepwent() so that it will read in the last password change time correctly. * Related to this lib/util_pwdb.c:StrnCaseCmp() returns 0 if the strings match. Chouldn't this be the pther way? Oh well. I didn't change the return code as it was used in several other cases (see lib/util_pwdb.c:pwdb_get_last_set_time())
* - adding builtin[alias]db.Luke Leighton1998-11-301-20/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | - lib/sids.c: generate_sam_sid() modified to take a domain name: it now generates "DOMAIN_NAME.SID". reasons: 1) if you run multiple samba servers on the same machine under different netbios names as members of a domain, they won't all use the same SID, which is a _big_ mistake but it would happen _by default_. 2) we have (had) a problem with sid_to_string() and string_to_sid() which cause SIDs to be incorrectly read. one of the major reasons for *NOT* making this change was so as not to disrupt existing users. but as they will be anyway by this bug, we might as well go ahead. - passdb/smbpass.c: wanted to change the meaning of the name in the smbpasswd file to an "nt" name not a "unix" name. this is probably not a good idea: reverted this. - output formatting / bug-fixing in rpcclient query_useraliases code.
* weekend work. user / group database API.Luke Leighton1998-11-291-196/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - split sam_passwd and smb_passwd into separate higher-order function tables - renamed struct smb_passwd's "smb_user" to "unix_user". added "nt_user" plus user_rid, and added a "wrap" function in both sam_passwd and smb_passwd password databases to fill in the blank entries that are not obtained from whatever password database API instance is being used. NOTE: whenever a struct smb_passwd or struct sam_passwd is used, it MUST be initialised with pwdb_sam_init() or pwd_smb_init(), see chgpasswd.c for the only example outside of the password database APIs i could find. - added query_useraliases code to rpcclient. - dealt with some nasty interdependencies involving non-smbd programs and the password database API. this is still not satisfactorily resolved completelely, but it's the best i can do for now. - #ifdef'd out some password database options so that people don't mistakenly set them unless they recompile to _use_ those options. lots of debugging done, it's still not finished. the unix/NT uid/gid and user-rid/group-rid issues are better, but not perfect. the "BUILTIN" domain is still missing: users cannot be added to "BUILTIN" groups yet, as we only have an "alias" db API and a "group" db API but not "builtin-alias" db API...
* we have a problem: resolution of "Primary Group RID" which we assumedLuke Leighton1998-11-261-1/+14
| | | | | | | | | would only be a domain group rid. it can also be a local group rid, which causes us problems in attempting to turn a unix gid into the correct rid (domain group or local group). sooo.... the fix is _in_ there, we just can't use it because it causes link / knock-on problems in nmbd.
* fixing group database issuesLuke Leighton1998-11-251-1/+1
|
* unix instance of group database APILuke Leighton1998-11-231-12/+12
|
* Added the same open()/fopen()/creat()/mmap() -> sys_XXX calls.Jeremy Allison1998-11-171-4/+4
| | | | | | | | | | Tidied up some of the mess (no other word for it). Still doesn't compile cleanly. There are calls with incorrect parameters that don't seem to be doing the right thing. This code still needs surgery :-(. Jeremy.
* - group database API. oops and oh dear, the threat has been carried out:Luke Leighton1998-11-171-295/+225
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the pre-alpha "domain group" etc parameters have disappeared. - interactive debug detection - re-added mem_man (andrew's memory management, detects memory corruption) - american spellings of "initialise" replaced with english spelling of "initialise". - started on "lookup_name()" and "lookup_sid()" functions. proper ones. - moved lots of functions around. created some modules of commonly used code. e.g the password file locking code, which is used in groupfile.c and aliasfile.c and smbpass.c - moved RID_TYPE_MASK up another bit. this is really unfortunate, but there is no other "fast" way to identify users from groups from aliases. i do not believe that this code saves us anything (the multipliers) and puts us at a disadvantage (reduces the useable rid space). the designers of NT aren't silly: if they can get away with a user- interface-speed LsaLookupNames / LsaLookupSids, then so can we. i spoke with isaac at the cifs conference, the only time for example that they do a security context check is on file create. certainly not on individual file reads / writes, which would drastically hit their performance and ours, too. - renamed myworkgroup to global_sam_name, amongst other things, when used in the rpc code. there is also a global_member_name, as we are always responsible for a SAM database, the scope of which is limited by the role of the machine (e.g if a member of a workgroup, your SAM is for _local_ logins only, and its name is the name of your server. you even still have a SID. see LsaQueryInfoPolicy, levels 3 and 5). - updated functionality of groupname.c to be able to cope with names like DOMAIN\group and SERVER\alias. used this code to be able to do aliases as well as groups. this code may actually be better off being used in username mapping, too. - created a connect to serverlist function in clientgen.c and used it in password.c - initialisation in server.c depends on the role of the server. well, it does now. - rpctorture. smbtorture. EXERCISE EXTREME CAUTION.
* the next dialog: user-groups. it's not very sensible what appears, but hey:Luke Leighton1998-10-211-0/+1
| | | | it appears!
* rpcclient interactive login (with trust account changing if you are root)Luke Leighton1998-10-151-2/+2
| | | | cli_session_setup handles null sessions correctly
* getpwnam() failing is a serious error (corrupt smbpasswd database)Luke Leighton1998-10-151-1/+6
|
* bug-fixing against:Luke Leighton1998-10-151-0/+2
| | | | | | | | | | | | | | | | | | AS/U: it returns dce/rpc "first" and "last" bits _clear_ in a bind/ack response, when they should be set in a (small) packet. they also, in the bind/ack do not set a secondary address string at all, so we can't check against that... Win95: client-side dce/rpc code is a bit odd. it does a "WaitNamedPipeState" and has slightly different pipe-naming (\PIPE\LANMAN is joined by \PIPE\SRVSVC, \PIPE\WINREG etc whereas nt just has \PIPE\LANMAN and \PIPE\). Win95-USRMGR.EXE: added LsaOpenPolicy (renamed existing to LsaOpenPolicy2). added SamrConnect (renamed existing to SamrConnect2).
* anders blomdell spotted an unititialised fstring causing strlen to goLuke Leighton1998-10-091-0/+1
| | | | awry (ascii_p16)
* Added fix from gildea@intouchsys.com - smbpasswd file could be leftJeremy Allison1998-09-281-1/+5
| | | | | locked. Jeremy.
* Changes to test in configure if capabilities are enabled on a system.Jeremy Allison1998-09-281-2/+2
| | | | | | | | | | Changes to get Samba to compile cleanly with the IRIX compiler with the options : -fullwarn -woff 1209,1174 (the -woff options are to turn off warnings about unused function parameters and controlling loop expressions being constants). Split prototype generation as we hit a limit in IRIX nawk. Removed "." code in smbd/filename.c (yet again :-). Jeremy.
* Makefile.in: Fixed bug with continuation line causing proto to fail.Jeremy Allison1998-09-251-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added $(PROGS) $(SPROGS) as targets for make clean. acconfig.h: Added HAVE_IRIX_SPECIFIC_CAPABILITIES. configure.in: Added sys/capability.h header check. Added function checks for srandom random srand rand. Added HAVE_IRIX_SPECIFIC_CAPABILITIES test. includes.h: Added #include <sys/capability.h>. ntdomain.h: Moved struct acct_info into here from smb.h smb.h: Added KERNEL_OPLOCK_CAPABILITY define. Moved enum action_type into rpcclient.h Moved struct cli_state into client.h Moved struct nt_client_info, struct tar_client_info, struct client_info into rpcclient.h lib/genrand.c: Changed to use sys_random() & friends. lib/smbrun.c: Lose capabilities after fork. lib/system.c: Added set_process_capability(), set_inherited_process_capability() sys_random(), sys_srandom(). lib/util.c: Added Ander's EFBIG lock check to fcntl_lock for 64 bit access to an 32 bit mounted NFS filesystem. nmbd/nmbd.c: Changed to use sys_random() & friends. nmbd/nmbd_browsesync.c: Changed to use sys_random() & friends. passdb/ldap.c: Missed one pdb_encode_acct_ctrl call. passdb/passdb.c: Changed to Ander's code for ' ' characters. passdb/smbpass.c: Added Ander's code to reset ACB_PWNOTREQ. script/mkproto.awk: Added 'long' to prototypes. smbd/chgpasswd.c: Lose capabilities after fork. smbd/open.c: Do the mmap *after* the kernel oplock. smbd/oplock.c: Removed stub code from kernel oplock path. Added set_process_capability(), set_inherited_process_capability() calls. smbd/reply.c: Initialize count = 0, offset = 0. smbd/server.c: Added set_process_capability(), set_inherited_process_capability() calls. tests/summary.c: Ensure we have RANDOM or RAND. utils/smbpasswd.c: Added Ander's code to reset ACB_PWNOTREQ. utils/torture.c: Changed to use sys_random() & friends. Jeremy.
* Integration of Anders Blomdell <anders.blomdell@control.lth.se>'sJeremy Allison1998-09-241-44/+80
| | | | | | smbpasswd changes. Not exactly the same as his code - several changes. Jeremy.
* configure configure.in: Added checks for statvfs64. Last bit of 64 bit ↵Jeremy Allison1998-09-171-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | widening (I hope :-). include/config.h.in: Added #undef STAT_STATVFS64. include/includes.h: Added SMB_STRUCT_STATVFS type, Changed SMB_BIG_INTEGER to SMB_BIG_UINT and SMB_BIG_INT types. include/smb.h: Added flag defines from CIFS spec. lib/debug.c: Fixed one more mode_t issue. lib/system.c: Added sys_statvfs wrapper. lib/util.c: Changed trim_string to use size_t. param/loadparm.c: Moved "blocking locks" into locking section. Alphabetised locking options. Question - shuld we do this for all options ? passdb/ldap.c: Changed SMB_BIG_INTEGER to SMB_BIG_UINT. passdb/nispass.c: Changed SMB_BIG_INTEGER to SMB_BIG_UINT. passdb/smbpass.c: Changed SMB_BIG_INTEGER to SMB_BIG_UINT. smbd/dfree.c: Changed to use 64 bit types if available. Moved to use unsigned types. smbd/dosmode.c: Fixed one more mode_t issue. smbd/negprot.c: Changed literals to be FLAG_ #defines. smbd/nttrans.c: Removed dead code. smbd/open.c: Changed disk_free call. smbd/process.c: Changed literals to be FLAG_ #defines. smbd/reply.c: Changed disk_free call. smbd/trans2.c: Fixed but in SMB_QUERY_FS_VOLUME_INFO call. Was using UNICODE - should use ascii. tests/summary.c: Added STAT_STATVFS64 check. Jeremy.
* configure configure.in: Added tests for fseek64 and ftell64.Jeremy Allison1998-09-171-7/+7
| | | | | | | | | | | | | | | | | | | | | | | config.h.in: Added fseek64 and ftell64. includes.h: Added definition of SMB_BIG_INTEGER. smb.h: Changed (*getsmbpwpos) and (*setsmbpwpos) to use SMB_BIG_INTEGER. access.c: Tidyup of dbug statement. system.c: Added sys_fseek and sys_ftell. Changed mode calls to use mode_t. asyncdns.c: Tidyup of comment. loadparm.c: Tidyup of set_default_server_announce_type() function definition. ldap.c: Changed (*getsmbpwpos) and (*setsmbpwpos) to use SMB_BIG_INTEGER. nispass.c: Changed (*getsmbpwpos) and (*setsmbpwpos) to use SMB_BIG_INTEGER. smbpass.c: Changed (*getsmbpwpos) and (*setsmbpwpos) to use SMB_BIG_INTEGER. smbpassfile.c: Use sys_fseek(). chgpasswd.c: Tidyup of debug statement. dosmode.c: Changed mode calls to use mode_t. ipc.c: Removal of dead code. nttrans.c: Changed mode calls to use mode_t. open.c: Changed mode calls to use mode_t. pipes.c: Removal of dead code. reply.c: Removal of dead code. trans2.c: Removal of dead code. Changed mode calls to use mode_t. Jeremy.
* Ok - this is the 64 bit widening check in. It changes the configureJeremy Allison1998-09-031-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | to check for stat64 and friends, and then changes much of Samba to use the data type SMB_OFF_T for file size information. stat/fstat/lstat/lseek/ftruncate have now become sys_stat etc. to hide the 64 bit calls if needed. Note that this still does not expose 64 bit functionality to the client, as the changes to the reply_xxx smb's are not yet done. This code change should make these changes possible. Still to do before full 64 bit-ness to the client: fcntl lock code. statfs code widening of dev_t and ino_t (now possible due to SMB_DEV_T and SMB_OFF_T types being in place). Let me know if wierd things happen after this check-in and I'll fix them :-). Jeremy.
* moved connection_struct handling code into smbd/conn.c and changed itAndrew Tridgell1998-08-171-4/+4
| | | | to a linked list with bitmap format.
* this is the bug change to using connection_struct* instead of cnum.Andrew Tridgell1998-08-141-2/+2
| | | | | | | | Connections[] is now a local array in server.c I might have broken something with this change. In particular the oplock code is suspect and some .dll files aren't being oplocked when I expected them to be. I'll look at it after I've got some sleep.
* merge from the autoconf2 branch to the main branchAndrew Tridgell1998-07-291-1/+1
|
* includes.h: Fixes for NetBSD and BSDI.Jeremy Allison1998-06-041-2/+2
| | | | | smbpass.c: Fixed irix warnings. Jeremy.
* clientutil.c: Don't core dump if no controlling terminal available for password.Jeremy Allison1998-06-011-2/+2
| | | | | | | passdb.c: lib/rpc/include/rpc_misc.h: First cut at automatic uid/gid to rid mapping. We can change this at a later date to make more bits available if neccessary. Jeremy.
* smb.h: More NT SMB stuff (just defines).Jeremy Allison1998-05-261-1/+2
| | | | | | | | | | | smbpass.c: Do *NOT* make this function static. It breaks the compile on gcc util.c: Getting closer to MS wildcard semantics. A trailing '*' matches any trailing dot-separated components. trans2.c: Removed hacks that change multiple '?' -> '*' as this breaks things now. trans2.h: Removed NT_FILE_ATTRIBUTE_NORMAL - now FILE_ATTRIBUTE_NORMAL is defined in smb.h. Jeremy.
* - created pdb_sethexpwd(), to be called from all pwd apis that need toLuke Leighton1998-05-241-2/+2
| | | | | | store passwords in ascii format - dealt with lots of signed/unsigned char thingies spotted by Tim Winders.
* fixed signed / unsigned warnings spotted by tim winders. also fixedLuke Leighton1998-05-211-1/+1
| | | | unnecessary "address of" warnings.
* passdb.c: Fixed typo in coment.Jeremy Allison1998-05-191-1/+5
| | | | | | | | smb.h: Removed comments no longer valid. smbpass.c: Stopped dummy function from being prototyped. util.c: Fix for multibyte char problems with strlower, strupper and string_replace. Jeremy.
* made mod_smbfilepwd_entry() and getsmbfilepwent() static. they need notLuke Leighton1998-05-191-98/+97
| | | | be exposed.
* oops - got some of the default (conversion) functions wrong.Luke Leighton1998-05-191-32/+19
|
* removed "default" system for password database api: all functions mustLuke Leighton1998-05-191-0/+18
| | | | | | | be supported. there are some stub routines in passdb.c which can be copied into a password database api which do conversion. the module writer can choose which of these to provide full support for instead of using the conversion routines.
* ldap.c :Luke Leighton1998-05-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - added support for some of the new passdb_ops functions. - removed functions that are supported "indirectly" through passdb.c nisppass.c : - modified make_nisname_from_xxx() functions to take a "file" arg. - turned getnisp21pwuid() into getnisp21pwrid(). getnisp21pwuid() functionality is available through "indirect" support in passdb.c - removed functions that are supported "indirectly" through passdb.c - added support for some of the new passdb_ops functions. passdb.c : - created getsam21pwrid() function to go alongside getsam21pwuid. it is not expected that getsam21pwuid ever be used, certainly not from the lib/rpc code. - created getsamdisprid() and getsamdispent(). these are primarily for support of SamrQueryDisplayInfo, however given that they [struct sam_disp_info] return username, rid and fullname, there may be further instances where these functions will be useful. - added support where either the get/add/mod-smb or get/add/mod-sam21 functions are optional. this can be done very easily by checking whether the struct passdb_ops table functions are NULL or not. documented this capability in the notes at the top of the module. - where unix uid was referenced, use uid_t. - where unix gid was referenced, use gid_t. smb.h : - added sam_disp_info functions to passdb_ops. - added getsam21pwrid() function. smbpass.c : - added reference to iterate_getsam21pwrid(). lib/rpc/server/srv_samr.c : - removed group rid code added to get_user_info_21() code: this had been added in the wrong place. the client / server should already know whether it wants to do a lookup by user rid or by group rid. the test of whether the rid is a user or group rid has been left in because this may become useful consistency-check code. - converted back to getsam21pwrid() not getsam21pwuid(pdb_user_rid_to_uid()). this is because the unix uid to user rid mapping can be non-monotonic in some password database systems, and monotonic in others. imposing the restriction by converting immediately from rid to uid at this point is inadviseable, and will place this potential restriction on _all_ password database systems, not just some which, for whatever reason, do not support user rids. it should be up to the individual password database writer to convert from user rid to unix uid, should that module not support rids. lib/rpc/server/srv_util.c : - got lookup_user_name() to call getsamdisprid() not getsmbpwuid(). a bug was introduced (or at least the bug already there was not fixed) whereby the nt user rid was converted to a unix uid, and then not used.
* Abstracted all the crappy password interfaces through an indirectJeremy Allison1998-05-181-34/+40
| | | | | | | | function table, selectable at compile time. This should make the code that implements all the password functions much cleaner, as it's now very clear exactly what a particular password database needs to provide to Samba. Jeremy.
* chgpasswd.c: Changed back to getsmb... from getsam...Jeremy Allison1998-05-181-63/+63
| | | | | | | | | | | | | | | | | | | | ldap.c: Stoped dummy_function being prototyped. loadparm.c: Fixed slprintf sizes. nisppass.c: Fixed safe_strcpy sizes. nmbd_processlogon.c: Changed back to getsmb... from getsam... nttrans.c: Just a dump of new code. passdb.c: Moved stuff around a lot - stopped any lookups by rid. This needs to be indirected through a function table (soon). password.c: Changed back to getsmb... from getsam... reply.c: Changed back to getsmb... from getsam... slprintf.c: Fixed prototype problems. smb.h: Fixed prototype problems. smbpass.c: Changed to getsmbfile.... smbpasswd.c: Changed back to getsmb... from getsam... lib/rpc/server/srv_netlog.c: Changed back to getsmb... from getsam... lib/rpc/server/srv_samr.c: Fixed rid lookup - use uid or gid lookup. lib/rpc/server/srv_util.c: Changed back to getsmb... from getsam... Jeremy.
* creating and using some pdb_init_(sam/smb) routines. putting ldap headersLuke Leighton1998-05-181-9/+3
| | | | | back in (they had been taken out of includes.h because they are only local to ldap.c.
* resolving compilation errorsLuke Leighton1998-05-181-1/+2
|
* - renamed some of the passdb.c functions: they have a prefix pdb_ on themLuke Leighton1998-05-181-297/+9
| | | | | - split smbpass.c "password file lock" routines into smbpassfile.c: moved trust account routines into smbpassfile.c as well
* Makefile:Luke Leighton1998-05-181-3/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - added nisppass.c and NISPLUS_FLAGS includes.h: - renamed USE_LDAP to USE_LDAP_DB. renamed NISPLUS to USE_NISPLUS_DB. added default define of USE_SMBPASS_DB. - removed ldap headers: they are local only to ldap.c ldap.c : - made all ldap-specific functions static. - added dummy sam21 functions loadparm.c : - renamed NISPLUS to NISPLUS_HOME mkproto.awk - commented out ldap-specific #ifdef generation code: it's not needed now that ldap-specific functions in ldap.c are static nisppass.c : - first attempt at an add function from
* namequery.c: Fixed SGI IRIX 5.x compiler problem.Jeremy Allison1998-05-141-4/+4
| | | | | | server.c: Added MACHINE.SID file generation - use lp_domain_sid() be default. smbpass.c: Exposed do_file_lock() as I now use it in server.c Jeremy.
* initialise a variableAndrew Tridgell1998-05-131-1/+1
|
* removed lp_domain_workstation() parameterLuke Leighton1998-05-121-1/+1
|
* This is a security audit change of the main source.Jeremy Allison1998-05-121-21/+22
| | | | | | | | | | | | | | | | | | It removed all ocurrences of the following functions : sprintf strcpy strcat The replacements are slprintf, safe_strcpy and safe_strcat. It should not be possible to use code in Samba that uses sprintf, strcpy or strcat, only the safe_equivalents. Once Andrew has fixed the slprintf implementation then this code will be moved back to the 1.9.18 code stream. Jeremy.
* password back-end database supportLuke Leighton1998-05-111-1/+108
| | | | | | | | | | | | | | | | | | | | | ldap.c : - added getldap21pwent() function passdb.c : - getsam21pwent() no longer a stub: calls ldap21 or smb21 smbpass.c : - added getsmb21pwent() function (he he :-) lib/rpc/server/srv_samr.c : - removed "specific" calls to ldap functions; replaced with call to get_sampwd_entries instead (which is unfinished). - rewrote get_user_info_21 function to call getsam21pwrid.
generated by cgit (git 2.34.1) at 2025-09-26 15:49:02 +0000