summaryrefslogtreecommitdiffstats
path: root/source/passdb
Commit message (Collapse)AuthorAgeFilesLines
...
* update the ldap support code. it compiles.Jean-François Micouleau2001-12-131-0/+41
| | | | | | | | Ignacio you can update your howto ;-) samsync: a small patch to try chaning challenges. J.F.
* again an intrusive patch:Jean-François Micouleau2001-12-065-45/+10
| | | | | | | | | | | | | | | - removed the ugly as hell sam_logon_in_ssb variable, I changed a bit the definition of standard_sub_basic() to cope with that. - removed the smb.conf: 'domain admin group' and 'domain guest group' parameters ! We're not playing anymore with the user's group RIDs ! - in get_domain_user_groups(), if the user's gid is a group, put it first in the group RID list. I just have to write an HOWTO now ;-) J.F.
* Add a couple of extra debugs for the secrets.tdb stuffAndrew Bartlett2001-12-051-2/+8
|
* auto-init secrets.tdbAndrew Tridgell2001-12-051-0/+5
|
* added a boolean to the group mapping functions to specify if we need orJean-François Micouleau2001-12-045-35/+23
| | | | | | | | | | | | | | | | | | | | | not the privileges. Usually we don't need them, so the memory is free early. lib/util_sid.c: added some helper functions to check an SID. passdb/passdb.c: renamed local_lookup_rid() to local_lookup_sid() and pass an RID all the way. If the group doesn't exist on the domain SID, don't return a faked one as it can collide with a builtin one. Some rpc structures have been badly designed, they return only rids and force the client to do subsequent lsa_lookup_sid() on the domain sid and the builtin sid ! rpc_server/srv_util.c: wrote a new version of get_domain_user_groups(). Only the samr code uses it atm. It uses the group mapping code instead of a bloody hard coded crap. The netlogon code will use it too, but I have to do some test first. J.F.
* This comment no longer applies.Andrew Bartlett2001-12-041-1/+0
|
* added a tdb to store the account policy informations.Jean-François Micouleau2001-12-031-3/+11
| | | | | | | | | | | | | | You can change them with either usermanager->policies->account or from a command prompt on NT/W2K: net accounts /domain we can add a rpc accounts to the net command. As the net_rpc.c is still empty, I did not start. How should I add command to it ? Should I take the rpcclient/cmd_xxx functions and call them from there ? alse changed the SAM_UNK_INFO_3 parser, it's an NTTIME. This one is more for jeremy ;-) J.F.
* added mapping of primary gid to rid thru the group mapping code.Jean-François Micouleau2001-12-025-29/+143
| | | | | | | and cleanup and comments in passdb/passdb.c J.F.
* Changed again how the privilege list is handled in the group mapping code.Jean-François Micouleau2001-11-291-0/+2
| | | | | | | | | | | | | | | | This time it's a PRIVILEGE_SET struct instead of a simple uint32 array. It makes much more sense. Also added a uint32 systemaccount to the GROUP_MAP struct as some privilege showing in USRMGR.EXE are not real privs but a bitmask flag. I guess it's an heritage from NT 3.0 ! I could setup an NT 3.1 box to verify, but I'm too lazy (yes I still have my CDs). Added 3 more LSA calls: SetSystemAccount, AddPrivileges and RemovePrivileges, we can manage all this privilege from UserManager. Time to change the NT_USER_TOKEN struct and add checks in all the rpc functions. Fun, fun, fun. J.F.
* add .po32 files to ignore listHerb Lewis2001-11-281-1/+2
|
* unable to open smbpasswd on initial create should only be a warningAndrew Tridgell2001-11-271-1/+1
|
* Ignore *.po files.Tim Potter2001-11-261-0/+1
|
* Don't close tdb twice.Volker Lendecke2001-11-251-1/+0
|
* added "net join" commandAndrew Tridgell2001-11-241-3/+33
| | | | this completes the first stage of the smbd ADS support
* This is another rather major change to the samba authenticaionAndrew Bartlett2001-11-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | subystem. The particular aim is to modularized the interface - so that we can have arbitrary password back-ends. This code adds one such back-end, a 'winbind' module to authenticate against the winbind_auth_crap functionality. While fully-functional this code is mainly useful as a demonstration, because we don't get back the info3 as we would for direct ntdomain authentication. This commit introduced the new 'auth methods' parameter, in the spirit of the 'auth order' discussed on the lists. It is renamed because not all the methods may be consulted, even if previous methods fail - they may not have a suitable challenge for example. Also, we have a 'local' authentication method, for old-style 'unix if plaintext, sam if encrypted' authentication and a 'guest' module to handle guest logins in a single place. While this current design is not ideal, I feel that it does provide a better infrastructure than the current design, and can be built upon. The following parameters have changed: - use rhosts = This has been replaced by the 'rhosts' authentication method, and can be specified like 'auth methods = guest rhosts' - hosts equiv = This needs both this parameter and an 'auth methods' entry to be effective. (auth methods = guest hostsequiv ....) - plaintext to smbpasswd = This is replaced by specifying 'sam' rather than 'local' in the auth methods. The security = parameter is unchanged, and now provides defaults for the 'auth methods' parameter. The available auth methods are: guest rhosts hostsequiv sam (passdb direct hash access) unix (PAM, crypt() etc) local (the combination of the above, based on encryption) smbserver (old security=server) ntdomain (old security=domain) winbind (use winbind to cache DC connections) Assistance in testing, or the production of new and interesting authentication modules is always appreciated. Andrew Bartlett
* Kill off that crazy copy_sam_passwd(). You simply can't do that if theAndrew Bartlett2001-11-241-12/+0
| | | | | | | | | | structre contains pointers (well not if you intend of free those pointers at some stage) There is no reason (given the new passdb interface) that you can't modify a SAM_ACCOUNT in any case. Andrew Bartlett
* Changed how the privileges are stored in the group mapping code. It's nowJean-François Micouleau2001-11-231-7/+32
| | | | | | | | | | | | | | | | | | | | an array of uint32. That's not perfect but that's better. Added more privileges too. Changed the local_lookup_rid/name functions in passdb.c to check if the group is mapped. Makes the LSA rpc calls return correct groups Corrected the return code in the LSA server code enum_sids. Only enumerate well known aliases if they are mapped to real unix groups. Won't confuse user seeing groups not available. Added a short/long view to smbgroupedit. now decoding rpc calls to add/remove privileges to sid. J.F.
* Tidyups when I was doing the big merge...Jeremy Allison2001-11-171-5/+10
| | | | Jeremy.
* Minor updates. A small dose of const.Andrew Bartlett2001-11-111-1/+1
|
* Remove built-in support for clear-text kerberos authentication.Andrew Bartlett2001-11-111-123/+3
| | | | | | | | | | This should remove some confusion from the ./configure, but does not affect the 'real' kerberos support currently residing in smbd/sesssetup.c. This code is vunerable to a spoofed KDC, and is best replaced by --with-pam and the pam_krb5 module. This module includes measures to prevent such spoofing. Andrew Bartlett
* As pdb_ldap.c does not compile in HEAD anyway, a not-compiled mergeVolker Lendecke2001-11-091-2/+6
| | | | | | from 2_2. Volker
* Added debug in truncate, fixed warning with gcc3.Jeremy Allison2001-11-071-2/+1
| | | | Jeremy.
* UGLY HACK to get machines to join tdbsam domains again.Andrew Bartlett2001-11-071-2/+4
| | | | | | | | | | | The problem is that we don't use the bitmap field, and so have to guess what feilds to change. NT4 sets the RID to NULL in its reply, (as a no-change value) and we were attempting to set that as a RID. jfm: Can you get me the info on that bitmap, so I can construct a proper fix to all this? Thanks!
* Fixup for accounts without a local /etc/passwd entry.Andrew Bartlett2001-11-041-9/+5
| | | | - Now perfectly valid.
* Various post AuthRewrite cleanups, fixups and tidyups.Andrew Bartlett2001-11-013-12/+8
| | | | | | | | | | | | | | | | | Zero out some of the plaintext passwords for paranoia Fix up some of the other passdb backends with the change to *uid_t rather than uid_t. Make some of the code in srv_netlog_nt.c clearer, is passing an array around, so pass its lenght in is definition, not as a seperate paramater. Use sizeof() rather than magic numbers, it makes things easier to read. Cope with a PAM authenticated user who is not in /etc/passwd - currently by saying NO_SUCH_USER, but this can change in future. Andrew Bartlett
* This is a farily large patch (3300 lines) and reworks most of the AuthRewriteAndrew Bartlett2001-10-312-16/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | code. In particular this assists tpot in some of his work, becouse it provides the connection between the authenticaion and the vuid generation. Major Changes: - Fully malloc'ed structures. - Massive rework of the code so that all structures are made and destroyed using malloc and free, rather than hanging around on the stack. - SAM_ACCOUNT unix uids and gids are now pointers to the same, to allow them to be declared 'invalid' without the chance that people might get ROOT by default. - kill off some of the "DOMAIN\user" lookups. These can be readded at a more appropriate place (probably domain_client_validate.c) in the future. They don't belong in session setups. - Massive introduction of DATA_BLOB structures, particularly for passwords. - Use NTLMSSP flags to tell the backend what its getting, rather than magic lenghths. - Fix winbind back up again, but tpot is redoing this soon anyway. - Abstract much of the work in srv_netlog_nt back into auth helper functions. This is a LARGE change, and any assistance is testing it is appriciated. Domain logons are still broken (as far as I can tell) but other functionality seems intact. Needs testing with a wide variety of MS clients. Andrew Bartlett
* Small 'const' updates ahead of some AuthRewrite merging.Andrew Bartlett2001-10-311-5/+5
|
* Fix up smbpasswd -e/-d so that it doesn't change the password under you anyAndrew Bartlett2001-10-301-20/+1
| | | | | | | | | | | | | more. (Previously it set them to 'XXXX' or similar when only the flags were being changed - a bug I must have introduced when I reworked the passdb end of things a few weeks back.) Adds a new local flag: LOCAL_SET_PASSWORD to specify that the password is actually to be changed. Andrew Bartlett
* This commit is number 4 of 4.Andrew Bartlett2001-10-298-185/+128
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular this commit focuses on: Actually adding the 'const' to the passdb interface, and the flow-on changes. Also kill off the 'disp_info' stuff, as its no longer used. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes introduces a large dose of 'const' to the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username --- This finishes this line of commits off, your tree should now compile again :-) Andrew Bartlett
* This commit is number 3 of 4.Andrew Bartlett2001-10-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular this commit focuses on: Changing the Get_Pwnam code so that it can work in a const-enforced environment. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes allow for 'const' in the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username
* This commit is number 2 of 4.Andrew Bartlett2001-10-293-65/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular this commit focuses on: The guts of the moving about inside passdb. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes allow for the introduction of a large dose of 'const' to the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username passdb/ - Kill off disp_info stuff, it isn't used any more - Kill off support for writing to the old smbpasswd format, it isn't relevent to Samba 3.0 - Move around and modify the pdb_...() helper functions, adding one that sets the last changed time to 'now' and that sets the must change time appropriately. - Remove the ugly forced update of the LCT- value in pdb_smbpasswd. - Remove the implicit modification of the ACB flags when both NT and LM passwords are set. - Removed substation in pdb_getsampwnam output, as a single password change will render them inoperable in any case (they will be substituted and stored) - Added a default RID to the init_sam_from_pw() function, based on our rid algorithm. - Added checks that an smbpasswd stored user has a uid-based RID. - Fail to store tdb based users without a RID lib/ - Change the substituion code to use global_myname if there is no connection (and therefore no called name) at the present time.
* This commit is number 1 of 4.Andrew Bartlett2001-10-291-23/+54
| | | | | | | | | In particular this commit focusses on: Adding the new 'pass changed now' helper function. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated.
* Merge the become_XXX -> change_to_XXX fixes from 2.2.2 to HEAD.Jeremy Allison2001-10-182-2/+2
| | | | | Ensure make_conection() can only be called as root. Jeremy.
* merge from 2.2Gerald Carter2001-10-101-11/+32
|
* Fixes from John Trostel (modified somewhat by me) to ensure that all lookup_XXJeremy Allison2001-10-091-0/+10
| | | | | | functions correctly deal with the SID_NAME_TYPE. One fix for connection user lookup in LSA. Jeremy.
* Added a comment about not changing the magic timestamp values withoutTim Potter2001-10-032-0/+7
| | | | knowing what you are doing!
* Ensure accessing NT member servers works with a Samba PDC. Don'tJeremy Allison2001-10-033-7/+7
| | | | | | change these timestamp settings without good reason. Remove CLEAR_IF_FIRST flag is tdb is read-only. Jeremy.
* set ACB_PWNOEXP by default on new accounts.Andrew Tridgell2001-10-031-2/+2
|
* Fixed up the change password bug when not using PAM.Jeremy Allison2001-10-021-2/+2
| | | | | | | | | | | | The problem is we were trying to use mask_match as a generic wildcard matcher for UNIX strings (like the password prompts). We can't do that - we need a unix_wild_match (re-added into lib/util.c) as the ms_fnmatch semantics for empty strings are completely wrong. This caused partial reads to be accepted as correct passwd change responses when they were not.... Also added paranioa test to stop passwd change being done as root with no %u in the passwd program string. Jeremy.
* Fixed the bug with member servers in a Samba PDC hosted domain not allowingJeremy Allison2001-10-023-25/+22
| | | | | | other access. Problem was max time was being set to 0xffffffff, instead of 0x7fffffff. Jeremy.
* Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter2001-10-028-19/+0
|
* - fix handling of 0 last_change_time and must_change_timeAndrew Tridgell2001-10-013-12/+10
| | | | - move the arbitrary 21 day timeout to local.h
* This is the passdb section of the previously mentioned commit.Andrew Bartlett2001-09-292-65/+111
| | | | | | | | | | | | | | Of particular note is the change to pdb_free_sam() to take its sam argument by reference, allowing it to be NULLified by the SAFE_FREE() macro, and the changed to local_password_change() both to make it work and to remove the duplicate code that caused so much breakage over the last few days. - Small change in behaviour: when LOCAL_ADD_USER is set, the user doesn't actually exist locally but does exist in the passdb we don't attempt to do a GetPwnam(). (How the entry got there is another matter, and most passdbs won't allow this anyway). Andrew Bartlett
* How the heck I missed this I don't know, but somehow I got a copy-and-pasteAndrew Bartlett2001-09-281-16/+12
| | | | | | | | | | | | | | | error in here... Now you can change local passwords again. There is stil somthing broken about remote (via windows/sampasswd) password changing. I shall have to revise my testing, I honestly don't know how this slipped through the net. MERGE for 2.2.2. Sorry, Andrew Bartlett
* Merge HEAD and 2.2 - try frantically to keep in sync.Jeremy Allison2001-09-271-13/+13
| | | | Jeremy.
* Fix memory leak in get_sampwd_entries(), reindent for clarity.Andrew Bartlett2001-09-271-35/+107
| | | | | | | | | | | | | | | | | - call pdb_reset_sam() after each getent call. Fix bug in get_group_alias_entries(), were if num_entries was zero this caused talloc() to return NULL, failing a test below with NT_STATUS_NO_MEMORY. Fix pdb_reset_sam() to correctly initalise the sam structure. Move default value code into a single place, likewise for sam freeing code. - should make things easier if we decide to malloc other strings, or get more non-zero default values. Finally, add a function in init a sam struct from a getpwnam() return. Andrew Bartlett
* minor fixesSimo Sorce2001-09-271-22/+10
|
* merge from 2.2Gerald Carter2001-09-262-3/+3
|
* Fix the uninitialised variable, but more importantly fix the SEGFAULT.Andrew Bartlett2001-09-261-2/+4
| | | | | | | | Merge for 2.2.2 Should TDB cope with TDB pointers itself? Andrew Bartlett
* Fix up TDB_SAM with repect to case sensitvity. (need to use unix_strlower)Andrew Bartlett2001-09-261-7/+9
| | | | | | | Also attempt to make some of the syntax clearer, its confusing enought for the compiler... (it thinks that there is use of an unitilaised variable) In fact there is, see next patch...
generated by cgit (git 2.34.1) at 2025-09-26 20:40:42 +0000