summaryrefslogtreecommitdiffstats
path: root/source3/libnet/libnet_samsync_keytab.c
Commit message (Collapse)AuthorAgeFilesLines
* s3-dsgetdcname: always pass in messaging context.Günther Deschner2010-09-231-10/+12
| | | | | | Volker, please check. Guenther
* s3-build: only include krb5 environment variables where required.Günther Deschner2010-08-261-0/+1
| | | | Guenther
* s3-krb5 Only build ADS support if arcfour-hmac-md5 is availableAndrew Bartlett2010-08-131-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Modern Kerberos implementations have either defines or enums for these key types, which makes doing #ifdef difficult. This shows up in files such as libnet_samsync_keytab.c, the bulk of which is not compiled on current Fedora 12, for example. The downside is that this makes Samba unconditionally depend on the arcfour-hmac-md5 encryption type at build time. We will no longer support libraries that only support the DES based encryption types. However, the single-DES types that are supported in common with AD are already painfully weak - so much so that they are disabled by default in modern Kerberos libraries. If not found, ADS support will not be compiled in. This means that our 'net ads join' will no longer set the ACB_USE_DES_KEY_ONLY flag, and we will always try to use arcfour-hmac-md5. A future improvement would be to remove the use of the DES encryption types totally, but this would require that any ACB_USE_DES_KEY_ONLY flag be removed from existing joins. Andrew Bartlett Signed-off-by: Simo Sorce <idra@samba.org>
* s3:libnet Add other required headers for libnet_samsync_keytab.cAndrew Bartlett2010-08-131-0/+3
| | | | | | | | | Due to missing defines in modern kerberos libraries, this code was not compiled and so this wasn't noticed. Andrew Bartlett Signed-off-by: Simo Sorce <idra@samba.org>
* s3-libnet: better separate headers.Günther Deschner2010-07-131-1/+1
| | | | Guenther
* s3-libnet: fix coverity #848 (UNINIT).Günther Deschner2009-02-191-1/+1
| | | | Guenther
* s3-libnet-samsync: store samsync sequence number state in keytab.Günther Deschner2008-11-181-1/+52
| | | | Guenther
* s3-libnet-samsync: pass back sequence number from fetch_sam_entries_keytab.Günther Deschner2008-11-181-1/+16
| | | | Guenther
* s3-libnet-samsync: pass sequence number pointer to process routine.Günther Deschner2008-11-181-0/+2
| | | | Guenther
* s3-libnet-samsync: move all modules to startup,process,finish callbacks.Günther Deschner2008-11-181-36/+76
| | | | Guenther
* s3-libnet-samsync: use samsync_ops.Günther Deschner2008-11-181-10/+10
| | | | Guenther
* s3-libnet-samsync: add samsync_ops to all samsync modules.Günther Deschner2008-11-181-0/+4
| | | | Guenther
* s3-libnet: move add_to_keytab_entries to libnet_keytab.Günther Deschner2008-11-181-15/+14
| | | | Guenther
* s3-libnet-samsync: use enctype 23 for vampired keytab entries.Günther Deschner2008-11-171-1/+1
| | | | Guenther
* Fix net rpc vampire, based on an *amazing* piece of debugging work by ↵Jeremy Allison2008-10-221-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "Cooper S. Blake" <the_analogkid@yahoo.com>. "I believe I have found two bugs in the 3.2 code and one bug that carried on to the 3.3 branch. In the 3.2 code, everything is located in the utils/net_rpc_samsync.c file. What I believe is the first problem is that fetch_database() is calling samsync_fix_delta_array() with rid_crypt set to true, which means the password hashes are unencrypted from the RID encryption. However, I believe this call is redundant, and the corresponding call for samdump has rid_crypt set to false. So I think the rid_crypt param should be false in fetch_database(). If you follow the code, it makes its way to sam_account_from_delta() where the password hashes are decrypted a second time by calling sam_pwd_hash(). I believe this is what is scrambling my passwords. These methods were refactored somewhere in the 3.3 branch. Now the net_rpc_samsync.c class calls rpc_vampire_internals, which calls libnet/libnet_samsync.c, which calls samsync_fix_delta_array() with rid_crypt always set to false. I think that's correct. But the second bug has carried through in the sam_account_from_delta() function: 208 if (memcmp(r->ntpassword.hash, zero_buf, 16) != 0) { 209 sam_pwd_hash(r->rid, r->ntpassword.hash, lm_passwd, 0); 210 pdb_set_lanman_passwd(account, lm_passwd, PDB_CHANGED); 211 } 212 213 if (memcmp(r->lmpassword.hash, zero_buf, 16) != 0) { 214 sam_pwd_hash(r->rid, r->lmpassword.hash, nt_passwd, 0); 215 pdb_set_nt_passwd(account, nt_passwd, PDB_CHANGED); If you look closely you'll see that the nt hash is going into the lm_passwd variable and the decrypted value is being set in the lanman hash, and the lanman hash is being decrypted and put into the nt hash field. So the LanMan and NT hashes look like they're being put in the opposite fields." Fix this by removing the rid_crypt parameter. Jeremy.
* Fixed "uninitialized variable" build warningSteven Danneman2008-09-151-0/+1
| | | | | | | | | | | With gcc 4.1.3 on Ubuntu 7.10 the following build warning occurs: Compiling libnet/libnet_samsync_keytab.c cc1: warnings being treated as errors libnet/libnet_samsync_keytab.c: In function ‘fetch_sam_entries_keytab’: libnet/libnet_samsync_keytab.c:102: warning: ‘entry.enctype’ is used uninitialized in this function Fixed by initializing to ENCTYPE_NULL
* net_vampire: keep keytab context and flush keytab only after the last query.Günther Deschner2008-07-011-14/+19
| | | | | Guenther (This used to be commit 48efe7dbce1cde6689f94fafe2d7756f673bc050)
* Fix the non-LDAP, non-krb5 build, fix gcc -O3 warnings.Jeremy Allison2008-06-261-1/+1
| | | | | Jeremy. (This used to be commit 9e2ab30d3cf6950fc79152b2169e7aeae8d6a366)
* net_vampire: use bool for last_query information in samsync.Günther Deschner2008-06-271-7/+12
| | | | | Guenther (This used to be commit fa1976e23a33bd3fab17c3f6ab5573ee1fdf9e31)
* net_vampire: separate keytab code from samsync code.Günther Deschner2008-06-271-154/+18
| | | | | Guenther (This used to be commit 69d8442bf3248f97ad23def424901d7fa87bfe48)
* net_vampire: add code to vampire a SAM database to a keytab file.Günther Deschner2008-06-241-0/+319
Guenther (This used to be commit ee6e422c0e035aa4779fa718bb6f142827cc2de0)
generated by cgit (git 2.34.1) at 2024-06-21 12:53:03 +0000