source: branches/samba-3.0/source/auth/pampass.c@ 140

Last change on this file since 140 was 1, checked in by Paul Smedley, 18 years ago

Initial code import
File size: 23.8 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 PAM Password checking
4 Copyright (C) Andrew Tridgell 1992-2001
5 Copyright (C) John H Terpsta 1999-2001
6 Copyright (C) Andrew Bartlett 2001
7 Copyright (C) Jeremy Allison 2001
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22*/
23
24/*
25 * This module provides PAM based functions for validation of
26 * username/password pairs, account managment, session and access control.
27 * Note: SMB password checking is done in smbpass.c
28 */
29
30#include "includes.h"
31
32#undef DBGC_CLASS
33#define DBGC_CLASS DBGC_AUTH
34
35#ifdef WITH_PAM
36
37/*******************************************************************
38 * Handle PAM authentication
39 * - Access, Authentication, Session, Password
40 * Note: See PAM Documentation and refer to local system PAM implementation
41 * which determines what actions/limitations/allowances become affected.
42 *********************************************************************/
43
44#include <security/pam_appl.h>
45
46/*
47 * Structure used to communicate between the conversation function
48 * and the server_login/change password functions.
49 */
50
51struct smb_pam_userdata {
52 const char *PAM_username;
53 const char *PAM_password;
54 const char *PAM_newpassword;
55};
56
57typedef int (*smb_pam_conv_fn)(int, const struct pam_message **, struct pam_response **, void *appdata_ptr);
58
59/*
60 * Macros to help make life easy
61 */
62#define COPY_STRING(s) (s) ? SMB_STRDUP(s) : NULL
63
64/*******************************************************************
65 PAM error handler.
66 *********************************************************************/
67
68static BOOL smb_pam_error_handler(pam_handle_t *pamh, int pam_error, const char *msg, int dbglvl)
69{
70
71 if( pam_error != PAM_SUCCESS) {
72 DEBUG(dbglvl, ("smb_pam_error_handler: PAM: %s : %s\n",
73 msg, pam_strerror(pamh, pam_error)));
74
75 return False;
76 }
77 return True;
78}
79
80/*******************************************************************
81 This function is a sanity check, to make sure that we NEVER report
82 failure as sucess.
83*********************************************************************/
84
85static BOOL smb_pam_nt_status_error_handler(pam_handle_t *pamh, int pam_error,
86 const char *msg, int dbglvl,
87 NTSTATUS *nt_status)
88{
89 *nt_status = pam_to_nt_status(pam_error);
90
91 if (smb_pam_error_handler(pamh, pam_error, msg, dbglvl))
92 return True;
93
94 if (NT_STATUS_IS_OK(*nt_status)) {
95 /* Complain LOUDLY */
96 DEBUG(0, ("smb_pam_nt_status_error_handler: PAM: BUG: PAM and NT_STATUS \
97error MISMATCH, forcing to NT_STATUS_LOGON_FAILURE"));
98 *nt_status = NT_STATUS_LOGON_FAILURE;
99 }
100 return False;
101}
102
103/*
104 * PAM conversation function
105 * Here we assume (for now, at least) that echo on means login name, and
106 * echo off means password.
107 */
108
109static int smb_pam_conv(int num_msg,
110 const struct pam_message **msg,
111 struct pam_response **resp,
112 void *appdata_ptr)
113{
114 int replies = 0;
115 struct pam_response *reply = NULL;
116 struct smb_pam_userdata *udp = (struct smb_pam_userdata *)appdata_ptr;
117
118 *resp = NULL;
119
120 if (num_msg <= 0)
121 return PAM_CONV_ERR;
122
123 /*
124 * Apparantly HPUX has a buggy PAM that doesn't support the
125 * appdata_ptr. Fail if this is the case. JRA.
126 */
127
128 if (udp == NULL) {
129 DEBUG(0,("smb_pam_conv: PAM on this system is broken - appdata_ptr == NULL !\n"));
130 return PAM_CONV_ERR;
131 }
132
133 reply = SMB_MALLOC_ARRAY(struct pam_response, num_msg);
134 if (!reply)
135 return PAM_CONV_ERR;
136
137 memset(reply, '\0', sizeof(struct pam_response) * num_msg);
138
139 for (replies = 0; replies < num_msg; replies++) {
140 switch (msg[replies]->msg_style) {
141 case PAM_PROMPT_ECHO_ON:
142 reply[replies].resp_retcode = PAM_SUCCESS;
143 reply[replies].resp = COPY_STRING(udp->PAM_username);
144 /* PAM frees resp */
145 break;
146
147 case PAM_PROMPT_ECHO_OFF:
148 reply[replies].resp_retcode = PAM_SUCCESS;
149 reply[replies].resp = COPY_STRING(udp->PAM_password);
150 /* PAM frees resp */
151 break;
152
153 case PAM_TEXT_INFO:
154 /* fall through */
155
156 case PAM_ERROR_MSG:
157 /* ignore it... */
158 reply[replies].resp_retcode = PAM_SUCCESS;
159 reply[replies].resp = NULL;
160 break;
161
162 default:
163 /* Must be an error of some sort... */
164 SAFE_FREE(reply);
165 return PAM_CONV_ERR;
166 }
167 }
168 if (reply)
169 *resp = reply;
170 return PAM_SUCCESS;
171}
172
173/*
174 * PAM password change conversation function
175 * Here we assume (for now, at least) that echo on means login name, and
176 * echo off means password.
177 */
178
179static void special_char_sub(char *buf)
180{
181 all_string_sub(buf, "\\n", "", 0);
182 all_string_sub(buf, "\\r", "", 0);
183 all_string_sub(buf, "\\s", " ", 0);
184 all_string_sub(buf, "\\t", "\t", 0);
185}
186
187static void pwd_sub(char *buf, const char *username, const char *oldpass, const char *newpass)
188{
189 fstring_sub(buf, "%u", username);
190 all_string_sub(buf, "%o", oldpass, sizeof(fstring));
191 all_string_sub(buf, "%n", newpass, sizeof(fstring));
192}
193
194
195struct chat_struct {
196 struct chat_struct *next, *prev;
197 fstring prompt;
198 fstring reply;
199};
200
201/**************************************************************
202 Create a linked list containing chat data.
203***************************************************************/
204
205static struct chat_struct *make_pw_chat(const char *p)
206{
207 fstring prompt;
208 fstring reply;
209 struct chat_struct *list = NULL;
210 struct chat_struct *t;
211
212 while (1) {
213 t = SMB_MALLOC_P(struct chat_struct);
214 if (!t) {
215 DEBUG(0,("make_pw_chat: malloc failed!\n"));
216 return NULL;
217 }
218
219 ZERO_STRUCTP(t);
220
221 DLIST_ADD_END(list, t, struct chat_struct*);
222
223 if (!next_token(&p, prompt, NULL, sizeof(fstring)))
224 break;
225
226 if (strequal(prompt,"."))
227 fstrcpy(prompt,"*");
228
229 special_char_sub(prompt);
230 fstrcpy(t->prompt, prompt);
231 strlower_m(t->prompt);
232 trim_char(t->prompt, ' ', ' ');
233
234 if (!next_token(&p, reply, NULL, sizeof(fstring)))
235 break;
236
237 if (strequal(reply,"."))
238 fstrcpy(reply,"");
239
240 special_char_sub(reply);
241 fstrcpy(t->reply, reply);
242 strlower_m(t->reply);
243 trim_char(t->reply, ' ', ' ');
244
245 }
246 return list;
247}
248
249static void free_pw_chat(struct chat_struct *list)
250{
251 while (list) {
252 struct chat_struct *old_head = list;
253 DLIST_REMOVE(list, list);
254 SAFE_FREE(old_head);
255 }
256}
257
258static int smb_pam_passchange_conv(int num_msg,
259 const struct pam_message **msg,
260 struct pam_response **resp,
261 void *appdata_ptr)
262{
263 int replies = 0;
264 struct pam_response *reply = NULL;
265 fstring current_prompt;
266 fstring current_reply;
267 struct smb_pam_userdata *udp = (struct smb_pam_userdata *)appdata_ptr;
268 struct chat_struct *pw_chat= make_pw_chat(lp_passwd_chat());
269 struct chat_struct *t;
270 BOOL found;
271 *resp = NULL;
272
273 DEBUG(10,("smb_pam_passchange_conv: starting converstation for %d messages\n", num_msg));
274
275 if (num_msg <= 0)
276 return PAM_CONV_ERR;
277
278 if (pw_chat == NULL)
279 return PAM_CONV_ERR;
280
281 /*
282 * Apparantly HPUX has a buggy PAM that doesn't support the
283 * appdata_ptr. Fail if this is the case. JRA.
284 */
285
286 if (udp == NULL) {
287 DEBUG(0,("smb_pam_passchange_conv: PAM on this system is broken - appdata_ptr == NULL !\n"));
288 free_pw_chat(pw_chat);
289 return PAM_CONV_ERR;
290 }
291
292 reply = SMB_MALLOC_ARRAY(struct pam_response, num_msg);
293 if (!reply) {
294 DEBUG(0,("smb_pam_passchange_conv: malloc for reply failed!\n"));
295 free_pw_chat(pw_chat);
296 return PAM_CONV_ERR;
297 }
298
299 for (replies = 0; replies < num_msg; replies++) {
300 found = False;
301 DEBUG(10,("smb_pam_passchange_conv: Processing message %d\n", replies));
302 switch (msg[replies]->msg_style) {
303 case PAM_PROMPT_ECHO_ON:
304 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: PAM said: %s\n", msg[replies]->msg));
305 fstrcpy(current_prompt, msg[replies]->msg);
306 trim_char(current_prompt, ' ', ' ');
307 for (t=pw_chat; t; t=t->next) {
308
309 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: trying to match |%s| to |%s|\n",
310 t->prompt, current_prompt ));
311
312 if (unix_wild_match(t->prompt, current_prompt)) {
313 fstrcpy(current_reply, t->reply);
314 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We sent: %s\n", current_reply));
315 pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
316#ifdef DEBUG_PASSWORD
317 DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We actualy sent: %s\n", current_reply));
318#endif
319 reply[replies].resp_retcode = PAM_SUCCESS;
320 reply[replies].resp = COPY_STRING(current_reply);
321 found = True;
322 break;
323 }
324 }
325 /* PAM frees resp */
326 if (!found) {
327 DEBUG(3,("smb_pam_passchange_conv: Could not find reply for PAM prompt: %s\n",msg[replies]->msg));
328 free_pw_chat(pw_chat);
329 SAFE_FREE(reply);
330 return PAM_CONV_ERR;
331 }
332 break;
333
334 case PAM_PROMPT_ECHO_OFF:
335 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: PAM said: %s\n", msg[replies]->msg));
336 fstrcpy(current_prompt, msg[replies]->msg);
337 trim_char(current_prompt, ' ', ' ');
338 for (t=pw_chat; t; t=t->next) {
339
340 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: trying to match |%s| to |%s|\n",
341 t->prompt, current_prompt ));
342
343 if (unix_wild_match(t->prompt, current_prompt)) {
344 fstrcpy(current_reply, t->reply);
345 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We sent: %s\n", current_reply));
346 pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
347 reply[replies].resp_retcode = PAM_SUCCESS;
348 reply[replies].resp = COPY_STRING(current_reply);
349#ifdef DEBUG_PASSWORD
350 DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We actualy sent: %s\n", current_reply));
351#endif
352 found = True;
353 break;
354 }
355 }
356 /* PAM frees resp */
357
358 if (!found) {
359 DEBUG(3,("smb_pam_passchange_conv: Could not find reply for PAM prompt: %s\n",msg[replies]->msg));
360 free_pw_chat(pw_chat);
361 SAFE_FREE(reply);
362 return PAM_CONV_ERR;
363 }
364 break;
365
366 case PAM_TEXT_INFO:
367 /* fall through */
368
369 case PAM_ERROR_MSG:
370 /* ignore it... */
371 reply[replies].resp_retcode = PAM_SUCCESS;
372 reply[replies].resp = NULL;
373 break;
374
375 default:
376 /* Must be an error of some sort... */
377 free_pw_chat(pw_chat);
378 SAFE_FREE(reply);
379 return PAM_CONV_ERR;
380 }
381 }
382
383 free_pw_chat(pw_chat);
384 if (reply)
385 *resp = reply;
386 return PAM_SUCCESS;
387}
388
389/***************************************************************************
390 Free up a malloced pam_conv struct.
391****************************************************************************/
392
393static void smb_free_pam_conv(struct pam_conv *pconv)
394{
395 if (pconv)
396 SAFE_FREE(pconv->appdata_ptr);
397
398 SAFE_FREE(pconv);
399}
400
401/***************************************************************************
402 Allocate a pam_conv struct.
403****************************************************************************/
404
405static struct pam_conv *smb_setup_pam_conv(smb_pam_conv_fn smb_pam_conv_fnptr, const char *user,
406 const char *passwd, const char *newpass)
407{
408 struct pam_conv *pconv = SMB_MALLOC_P(struct pam_conv);
409 struct smb_pam_userdata *udp = SMB_MALLOC_P(struct smb_pam_userdata);
410
411 if (pconv == NULL || udp == NULL) {
412 SAFE_FREE(pconv);
413 SAFE_FREE(udp);
414 return NULL;
415 }
416
417 udp->PAM_username = user;
418 udp->PAM_password = passwd;
419 udp->PAM_newpassword = newpass;
420
421 pconv->conv = smb_pam_conv_fnptr;
422 pconv->appdata_ptr = (void *)udp;
423 return pconv;
424}
425
426/*
427 * PAM Closing out cleanup handler
428 */
429
430static BOOL smb_pam_end(pam_handle_t *pamh, struct pam_conv *smb_pam_conv_ptr)
431{
432 int pam_error;
433
434 smb_free_pam_conv(smb_pam_conv_ptr);
435
436 if( pamh != NULL ) {
437 pam_error = pam_end(pamh, 0);
438 if(smb_pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
439 DEBUG(4, ("smb_pam_end: PAM: PAM_END OK.\n"));
440 return True;
441 }
442 }
443 DEBUG(2,("smb_pam_end: PAM: not initialised"));
444 return False;
445}
446
447/*
448 * Start PAM authentication for specified account
449 */
450
451static BOOL smb_pam_start(pam_handle_t **pamh, const char *user, const char *rhost, struct pam_conv *pconv)
452{
453 int pam_error;
454 const char *our_rhost;
455
456 *pamh = (pam_handle_t *)NULL;
457
458 DEBUG(4,("smb_pam_start: PAM: Init user: %s\n", user));
459
460 pam_error = pam_start("samba", user, pconv, pamh);
461 if( !smb_pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
462 *pamh = (pam_handle_t *)NULL;
463 return False;
464 }
465
466 if (rhost == NULL) {
467 our_rhost = client_name();
468 if (strequal(our_rhost,"UNKNOWN"))
469 our_rhost = client_addr();
470 } else {
471 our_rhost = rhost;
472 }
473
474#ifdef PAM_RHOST
475 DEBUG(4,("smb_pam_start: PAM: setting rhost to: %s\n", our_rhost));
476 pam_error = pam_set_item(*pamh, PAM_RHOST, our_rhost);
477 if(!smb_pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
478 smb_pam_end(*pamh, pconv);
479 *pamh = (pam_handle_t *)NULL;
480 return False;
481 }
482#endif
483#ifdef PAM_TTY
484 DEBUG(4,("smb_pam_start: PAM: setting tty\n"));
485 pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
486 if (!smb_pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
487 smb_pam_end(*pamh, pconv);
488 *pamh = (pam_handle_t *)NULL;
489 return False;
490 }
491#endif
492 DEBUG(4,("smb_pam_start: PAM: Init passed for user: %s\n", user));
493 return True;
494}
495
496/*
497 * PAM Authentication Handler
498 */
499static NTSTATUS smb_pam_auth(pam_handle_t *pamh, const char *user)
500{
501 int pam_error;
502 NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
503
504 /*
505 * To enable debugging set in /etc/pam.d/samba:
506 * auth required /lib/security/pam_pwdb.so nullok shadow audit
507 */
508
509 DEBUG(4,("smb_pam_auth: PAM: Authenticate User: %s\n", user));
510 pam_error = pam_authenticate(pamh, PAM_SILENT | lp_null_passwords() ? 0 : PAM_DISALLOW_NULL_AUTHTOK);
511 switch( pam_error ){
512 case PAM_AUTH_ERR:
513 DEBUG(2, ("smb_pam_auth: PAM: Authentication Error for user %s\n", user));
514 break;
515 case PAM_CRED_INSUFFICIENT:
516 DEBUG(2, ("smb_pam_auth: PAM: Insufficient Credentials for user %s\n", user));
517 break;
518 case PAM_AUTHINFO_UNAVAIL:
519 DEBUG(2, ("smb_pam_auth: PAM: Authentication Information Unavailable for user %s\n", user));
520 break;
521 case PAM_USER_UNKNOWN:
522 DEBUG(2, ("smb_pam_auth: PAM: Username %s NOT known to Authentication system\n", user));
523 break;
524 case PAM_MAXTRIES:
525 DEBUG(2, ("smb_pam_auth: PAM: One or more authentication modules reports user limit for user %s exceeeded\n", user));
526 break;
527 case PAM_ABORT:
528 DEBUG(0, ("smb_pam_auth: PAM: One or more PAM modules failed to load for user %s\n", user));
529 break;
530 case PAM_SUCCESS:
531 DEBUG(4, ("smb_pam_auth: PAM: User %s Authenticated OK\n", user));
532 break;
533 default:
534 DEBUG(0, ("smb_pam_auth: PAM: UNKNOWN ERROR while authenticating user %s\n", user));
535 break;
536 }
537
538 smb_pam_nt_status_error_handler(pamh, pam_error, "Authentication Failure", 2, &nt_status);
539 return nt_status;
540}
541
542/*
543 * PAM Account Handler
544 */
545static NTSTATUS smb_pam_account(pam_handle_t *pamh, const char * user)
546{
547 int pam_error;
548 NTSTATUS nt_status = NT_STATUS_ACCOUNT_DISABLED;
549
550 DEBUG(4,("smb_pam_account: PAM: Account Management for User: %s\n", user));
551 pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
552 switch( pam_error ) {
553 case PAM_AUTHTOK_EXPIRED:
554 DEBUG(2, ("smb_pam_account: PAM: User %s is valid but password is expired\n", user));
555 break;
556 case PAM_ACCT_EXPIRED:
557 DEBUG(2, ("smb_pam_account: PAM: User %s no longer permitted to access system\n", user));
558 break;
559 case PAM_AUTH_ERR:
560 DEBUG(2, ("smb_pam_account: PAM: There was an authentication error for user %s\n", user));
561 break;
562 case PAM_PERM_DENIED:
563 DEBUG(0, ("smb_pam_account: PAM: User %s is NOT permitted to access system at this time\n", user));
564 break;
565 case PAM_USER_UNKNOWN:
566 DEBUG(0, ("smb_pam_account: PAM: User \"%s\" is NOT known to account management\n", user));
567 break;
568 case PAM_SUCCESS:
569 DEBUG(4, ("smb_pam_account: PAM: Account OK for User: %s\n", user));
570 break;
571 default:
572 DEBUG(0, ("smb_pam_account: PAM: UNKNOWN PAM ERROR (%d) during Account Management for User: %s\n", pam_error, user));
573 break;
574 }
575
576 smb_pam_nt_status_error_handler(pamh, pam_error, "Account Check Failed", 2, &nt_status);
577 return nt_status;
578}
579
580/*
581 * PAM Credential Setting
582 */
583
584static NTSTATUS smb_pam_setcred(pam_handle_t *pamh, const char * user)
585{
586 int pam_error;
587 NTSTATUS nt_status = NT_STATUS_NO_TOKEN;
588
589 /*
590 * This will allow samba to aquire a kerberos token. And, when
591 * exporting an AFS cell, be able to /write/ to this cell.
592 */
593
594 DEBUG(4,("PAM: Account Management SetCredentials for User: %s\n", user));
595 pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED|PAM_SILENT));
596 switch( pam_error ) {
597 case PAM_CRED_UNAVAIL:
598 DEBUG(0, ("smb_pam_setcred: PAM: Credentials not found for user:%s\n", user ));
599 break;
600 case PAM_CRED_EXPIRED:
601 DEBUG(0, ("smb_pam_setcred: PAM: Credentials for user: \"%s\" EXPIRED!\n", user ));
602 break;
603 case PAM_USER_UNKNOWN:
604 DEBUG(0, ("smb_pam_setcred: PAM: User: \"%s\" is NOT known so can not set credentials!\n", user ));
605 break;
606 case PAM_CRED_ERR:
607 DEBUG(0, ("smb_pam_setcred: PAM: Unknown setcredentials error - unable to set credentials for %s\n", user ));
608 break;
609 case PAM_SUCCESS:
610 DEBUG(4, ("smb_pam_setcred: PAM: SetCredentials OK for User: %s\n", user));
611 break;
612 default:
613 DEBUG(0, ("smb_pam_setcred: PAM: UNKNOWN PAM ERROR (%d) during SetCredentials for User: %s\n", pam_error, user));
614 break;
615 }
616
617 smb_pam_nt_status_error_handler(pamh, pam_error, "Set Credential Failure", 2, &nt_status);
618 return nt_status;
619}
620
621/*
622 * PAM Internal Session Handler
623 */
624static BOOL smb_internal_pam_session(pam_handle_t *pamh, const char *user, const char *tty, BOOL flag)
625{
626 int pam_error;
627
628#ifdef PAM_TTY
629 DEBUG(4,("smb_internal_pam_session: PAM: tty set to: %s\n", tty));
630 pam_error = pam_set_item(pamh, PAM_TTY, tty);
631 if (!smb_pam_error_handler(pamh, pam_error, "set tty failed", 0))
632 return False;
633#endif
634
635 if (flag) {
636 pam_error = pam_open_session(pamh, PAM_SILENT);
637 if (!smb_pam_error_handler(pamh, pam_error, "session setup failed", 0))
638 return False;
639 } else {
640 pam_setcred(pamh, (PAM_DELETE_CRED|PAM_SILENT)); /* We don't care if this fails */
641 pam_error = pam_close_session(pamh, PAM_SILENT); /* This will probably pick up the error anyway */
642 if (!smb_pam_error_handler(pamh, pam_error, "session close failed", 0))
643 return False;
644 }
645 return (True);
646}
647
648/*
649 * Internal PAM Password Changer.
650 */
651
652static BOOL smb_pam_chauthtok(pam_handle_t *pamh, const char * user)
653{
654 int pam_error;
655
656 DEBUG(4,("smb_pam_chauthtok: PAM: Password Change for User: %s\n", user));
657
658 pam_error = pam_chauthtok(pamh, PAM_SILENT); /* Change Password */
659
660 switch( pam_error ) {
661 case PAM_AUTHTOK_ERR:
662 DEBUG(2, ("PAM: unable to obtain the new authentication token - is password to weak?\n"));
663 break;
664
665 /* This doesn't seem to be defined on Solaris. JRA */
666#ifdef PAM_AUTHTOK_RECOVER_ERR
667 case PAM_AUTHTOK_RECOVER_ERR:
668 DEBUG(2, ("PAM: unable to obtain the old authentication token - was the old password wrong?.\n"));
669 break;
670#endif
671
672 case PAM_AUTHTOK_LOCK_BUSY:
673 DEBUG(2, ("PAM: unable to change the authentication token since it is currently locked.\n"));
674 break;
675 case PAM_AUTHTOK_DISABLE_AGING:
676 DEBUG(2, ("PAM: Authentication token aging has been disabled.\n"));
677 break;
678 case PAM_PERM_DENIED:
679 DEBUG(0, ("PAM: Permission denied.\n"));
680 break;
681 case PAM_TRY_AGAIN:
682 DEBUG(0, ("PAM: Could not update all authentication token(s). No authentication tokens were updated.\n"));
683 break;
684 case PAM_USER_UNKNOWN:
685 DEBUG(0, ("PAM: User not known to PAM\n"));
686 break;
687 case PAM_SUCCESS:
688 DEBUG(4, ("PAM: Account OK for User: %s\n", user));
689 break;
690 default:
691 DEBUG(0, ("PAM: UNKNOWN PAM ERROR (%d) for User: %s\n", pam_error, user));
692 }
693
694 if(!smb_pam_error_handler(pamh, pam_error, "Password Change Failed", 2)) {
695 return False;
696 }
697
698 /* If this point is reached, the password has changed. */
699 return True;
700}
701
702/*
703 * PAM Externally accessible Session handler
704 */
705
706BOOL smb_pam_claim_session(char *user, char *tty, char *rhost)
707{
708 pam_handle_t *pamh = NULL;
709 struct pam_conv *pconv = NULL;
710
711 /* Ignore PAM if told to. */
712
713 if (!lp_obey_pam_restrictions())
714 return True;
715
716 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
717 return False;
718
719 if (!smb_pam_start(&pamh, user, rhost, pconv))
720 return False;
721
722 if (!smb_internal_pam_session(pamh, user, tty, True)) {
723 smb_pam_end(pamh, pconv);
724 return False;
725 }
726
727 return smb_pam_end(pamh, pconv);
728}
729
730/*
731 * PAM Externally accessible Session handler
732 */
733
734BOOL smb_pam_close_session(char *user, char *tty, char *rhost)
735{
736 pam_handle_t *pamh = NULL;
737 struct pam_conv *pconv = NULL;
738
739 /* Ignore PAM if told to. */
740
741 if (!lp_obey_pam_restrictions())
742 return True;
743
744 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
745 return False;
746
747 if (!smb_pam_start(&pamh, user, rhost, pconv))
748 return False;
749
750 if (!smb_internal_pam_session(pamh, user, tty, False)) {
751 smb_pam_end(pamh, pconv);
752 return False;
753 }
754
755 return smb_pam_end(pamh, pconv);
756}
757
758/*
759 * PAM Externally accessible Account handler
760 */
761
762NTSTATUS smb_pam_accountcheck(const char * user)
763{
764 NTSTATUS nt_status = NT_STATUS_ACCOUNT_DISABLED;
765 pam_handle_t *pamh = NULL;
766 struct pam_conv *pconv = NULL;
767
768 /* Ignore PAM if told to. */
769
770 if (!lp_obey_pam_restrictions())
771 return NT_STATUS_OK;
772
773 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
774 return NT_STATUS_NO_MEMORY;
775
776 if (!smb_pam_start(&pamh, user, NULL, pconv))
777 return NT_STATUS_ACCOUNT_DISABLED;
778
779 if (!NT_STATUS_IS_OK(nt_status = smb_pam_account(pamh, user)))
780 DEBUG(0, ("smb_pam_accountcheck: PAM: Account Validation Failed - Rejecting User %s!\n", user));
781
782 smb_pam_end(pamh, pconv);
783 return nt_status;
784}
785
786/*
787 * PAM Password Validation Suite
788 */
789
790NTSTATUS smb_pam_passcheck(const char * user, const char * password)
791{
792 pam_handle_t *pamh = NULL;
793 NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
794 struct pam_conv *pconv = NULL;
795
796 /*
797 * Note we can't ignore PAM here as this is the only
798 * way of doing auths on plaintext passwords when
799 * compiled --with-pam.
800 */
801
802 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, password, NULL)) == NULL)
803 return NT_STATUS_LOGON_FAILURE;
804
805 if (!smb_pam_start(&pamh, user, NULL, pconv))
806 return NT_STATUS_LOGON_FAILURE;
807
808 if (!NT_STATUS_IS_OK(nt_status = smb_pam_auth(pamh, user))) {
809 DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_auth failed - Rejecting User %s !\n", user));
810 smb_pam_end(pamh, pconv);
811 return nt_status;
812 }
813
814 if (!NT_STATUS_IS_OK(nt_status = smb_pam_account(pamh, user))) {
815 DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_account failed - Rejecting User %s !\n", user));
816 smb_pam_end(pamh, pconv);
817 return nt_status;
818 }
819
820 if (!NT_STATUS_IS_OK(nt_status = smb_pam_setcred(pamh, user))) {
821 DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_setcred failed - Rejecting User %s !\n", user));
822 smb_pam_end(pamh, pconv);
823 return nt_status;
824 }
825
826 smb_pam_end(pamh, pconv);
827 return nt_status;
828}
829
830/*
831 * PAM Password Change Suite
832 */
833
834BOOL smb_pam_passchange(const char * user, const char * oldpassword, const char * newpassword)
835{
836 /* Appropriate quantities of root should be obtained BEFORE calling this function */
837 struct pam_conv *pconv = NULL;
838 pam_handle_t *pamh = NULL;
839
840 if ((pconv = smb_setup_pam_conv(smb_pam_passchange_conv, user, oldpassword, newpassword)) == NULL)
841 return False;
842
843 if(!smb_pam_start(&pamh, user, NULL, pconv))
844 return False;
845
846 if (!smb_pam_chauthtok(pamh, user)) {
847 DEBUG(0, ("smb_pam_passchange: PAM: Password Change Failed for user %s!\n", user));
848 smb_pam_end(pamh, pconv);
849 return False;
850 }
851
852 return smb_pam_end(pamh, pconv);
853}
854
855#else
856
857/* If PAM not used, no PAM restrictions on accounts. */
858NTSTATUS smb_pam_accountcheck(const char * user)
859{
860 return NT_STATUS_OK;
861}
862
863/* If PAM not used, also no PAM restrictions on sessions. */
864BOOL smb_pam_claim_session(char *user, char *tty, char *rhost)
865{
866 return True;
867}
868
869/* If PAM not used, also no PAM restrictions on sessions. */
870BOOL smb_pam_close_session(char *in_user, char *tty, char *rhost)
871{
872 return True;
873}
874#endif /* WITH_PAM */
Note: See TracBrowser for help on using the repository browser.