source: trunk/server/source3/auth/pampass.c@ 971

Last change on this file since 971 was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 25.0 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 PAM Password checking
4 Copyright (C) Andrew Tridgell 1992-2001
5 Copyright (C) John H Terpsta 1999-2001
6 Copyright (C) Andrew Bartlett 2001
7 Copyright (C) Jeremy Allison 2001
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23/*
24 * This module provides PAM based functions for validation of
25 * username/password pairs, account managment, session and access control.
26 * Note: SMB password checking is done in smbpass.c
27 */
28
29#include "includes.h"
30#include "auth.h"
31#include "../libcli/auth/pam_errors.h"
32
33#undef DBGC_CLASS
34#define DBGC_CLASS DBGC_AUTH
35
36#ifdef WITH_PAM
37
38/*******************************************************************
39 * Handle PAM authentication
40 * - Access, Authentication, Session, Password
41 * Note: See PAM Documentation and refer to local system PAM implementation
42 * which determines what actions/limitations/allowances become affected.
43 *********************************************************************/
44
45#if defined(HAVE_SECURITY_PAM_APPL_H)
46#include <security/pam_appl.h>
47#elif defined(HAVE_PAM_PAM_APPL_H)
48#include <pam/pam_appl.h>
49#endif
50
51/*
52 * Structure used to communicate between the conversation function
53 * and the server_login/change password functions.
54 */
55
56struct smb_pam_userdata {
57 const char *PAM_username;
58 const char *PAM_password;
59 const char *PAM_newpassword;
60};
61
62typedef int (*smb_pam_conv_fn)(int, const struct pam_message **, struct pam_response **, void *appdata_ptr);
63
64static char *smb_pam_copy_string(const char *s)
65{
66 if (s == NULL) {
67 return NULL;
68 }
69 return SMB_STRDUP(s);
70}
71
72static char *smb_pam_copy_fstring(const char *s)
73{
74 if (s[0] == '\0') {
75 return NULL;
76 }
77 return SMB_STRDUP(s);
78}
79
80/*******************************************************************
81 PAM error handler.
82 *********************************************************************/
83
84static bool smb_pam_error_handler(pam_handle_t *pamh, int pam_error, const char *msg, int dbglvl)
85{
86
87 if( pam_error != PAM_SUCCESS) {
88 DEBUG(dbglvl, ("smb_pam_error_handler: PAM: %s : %s\n",
89 msg, pam_strerror(pamh, pam_error)));
90 return False;
91 }
92 return True;
93}
94
95/*******************************************************************
96 This function is a sanity check, to make sure that we NEVER report
97 failure as sucess.
98*********************************************************************/
99
100static bool smb_pam_nt_status_error_handler(pam_handle_t *pamh, int pam_error,
101 const char *msg, int dbglvl,
102 NTSTATUS *nt_status)
103{
104 *nt_status = pam_to_nt_status(pam_error);
105
106 if (smb_pam_error_handler(pamh, pam_error, msg, dbglvl))
107 return True;
108
109 if (NT_STATUS_IS_OK(*nt_status)) {
110 /* Complain LOUDLY */
111 DEBUG(0, ("smb_pam_nt_status_error_handler: PAM: BUG: PAM and NT_STATUS \
112error MISMATCH, forcing to NT_STATUS_LOGON_FAILURE"));
113 *nt_status = NT_STATUS_LOGON_FAILURE;
114 }
115 return False;
116}
117
118/*
119 * PAM conversation function
120 * Here we assume (for now, at least) that echo on means login name, and
121 * echo off means password.
122 */
123
124static int smb_pam_conv(int num_msg,
125 const struct pam_message **msg,
126 struct pam_response **resp,
127 void *appdata_ptr)
128{
129 int replies = 0;
130 struct pam_response *reply = NULL;
131 struct smb_pam_userdata *udp = (struct smb_pam_userdata *)appdata_ptr;
132
133 *resp = NULL;
134
135 if (num_msg <= 0)
136 return PAM_CONV_ERR;
137
138 /*
139 * Apparantly HPUX has a buggy PAM that doesn't support the
140 * appdata_ptr. Fail if this is the case. JRA.
141 */
142
143 if (udp == NULL) {
144 DEBUG(0,("smb_pam_conv: PAM on this system is broken - appdata_ptr == NULL !\n"));
145 return PAM_CONV_ERR;
146 }
147
148 reply = SMB_MALLOC_ARRAY(struct pam_response, num_msg);
149 if (!reply)
150 return PAM_CONV_ERR;
151
152 memset(reply, '\0', sizeof(struct pam_response) * num_msg);
153
154 for (replies = 0; replies < num_msg; replies++) {
155 switch (msg[replies]->msg_style) {
156 case PAM_PROMPT_ECHO_ON:
157 reply[replies].resp_retcode = PAM_SUCCESS;
158 reply[replies].resp = smb_pam_copy_string(
159 udp->PAM_username);
160 /* PAM frees resp */
161 break;
162
163 case PAM_PROMPT_ECHO_OFF:
164 reply[replies].resp_retcode = PAM_SUCCESS;
165 reply[replies].resp = smb_pam_copy_string(
166 udp->PAM_password);
167 /* PAM frees resp */
168 break;
169
170 case PAM_TEXT_INFO:
171 /* fall through */
172
173 case PAM_ERROR_MSG:
174 /* ignore it... */
175 reply[replies].resp_retcode = PAM_SUCCESS;
176 reply[replies].resp = NULL;
177 break;
178
179 default:
180 /* Must be an error of some sort... */
181 SAFE_FREE(reply);
182 return PAM_CONV_ERR;
183 }
184 }
185 if (reply)
186 *resp = reply;
187 return PAM_SUCCESS;
188}
189
190/*
191 * PAM password change conversation function
192 * Here we assume (for now, at least) that echo on means login name, and
193 * echo off means password.
194 */
195
196static void special_char_sub(char *buf)
197{
198 all_string_sub(buf, "\\n", "", 0);
199 all_string_sub(buf, "\\r", "", 0);
200 all_string_sub(buf, "\\s", " ", 0);
201 all_string_sub(buf, "\\t", "\t", 0);
202}
203
204static void pwd_sub(char *buf, const char *username, const char *oldpass, const char *newpass)
205{
206 fstring_sub(buf, "%u", username);
207 all_string_sub(buf, "%o", oldpass, sizeof(fstring));
208 all_string_sub(buf, "%n", newpass, sizeof(fstring));
209}
210
211
212struct chat_struct {
213 struct chat_struct *next, *prev;
214 fstring prompt;
215 fstring reply;
216};
217
218/**************************************************************
219 Create a linked list containing chat data.
220***************************************************************/
221
222static struct chat_struct *make_pw_chat(const char *p)
223{
224 char *prompt;
225 char *reply;
226 struct chat_struct *list = NULL;
227 struct chat_struct *t;
228 TALLOC_CTX *frame = talloc_stackframe();
229
230 while (1) {
231 t = SMB_MALLOC_P(struct chat_struct);
232 if (!t) {
233 DEBUG(0,("make_pw_chat: malloc failed!\n"));
234 TALLOC_FREE(frame);
235 return NULL;
236 }
237
238 ZERO_STRUCTP(t);
239
240 DLIST_ADD_END(list, t, struct chat_struct*);
241
242 if (!next_token_talloc(frame, &p, &prompt, NULL)) {
243 break;
244 }
245
246 if (strequal(prompt,".")) {
247 fstrcpy(prompt,"*");
248 }
249
250 special_char_sub(prompt);
251 fstrcpy(t->prompt, prompt);
252 strlower_m(t->prompt);
253 trim_char(t->prompt, ' ', ' ');
254
255 if (!next_token_talloc(frame, &p, &reply, NULL)) {
256 break;
257 }
258
259 if (strequal(reply,".")) {
260 fstrcpy(reply,"");
261 }
262
263 special_char_sub(reply);
264 fstrcpy(t->reply, reply);
265 strlower_m(t->reply);
266 trim_char(t->reply, ' ', ' ');
267
268 }
269 TALLOC_FREE(frame);
270 return list;
271}
272
273static void free_pw_chat(struct chat_struct *list)
274{
275 while (list) {
276 struct chat_struct *old_head = list;
277 DLIST_REMOVE(list, list);
278 SAFE_FREE(old_head);
279 }
280}
281
282static int smb_pam_passchange_conv(int num_msg,
283 const struct pam_message **msg,
284 struct pam_response **resp,
285 void *appdata_ptr)
286{
287 int replies = 0;
288 struct pam_response *reply = NULL;
289 fstring current_prompt;
290 fstring current_reply;
291 struct smb_pam_userdata *udp = (struct smb_pam_userdata *)appdata_ptr;
292 struct chat_struct *pw_chat;
293 struct chat_struct *t;
294 bool found;
295 *resp = NULL;
296
297 DEBUG(10,("smb_pam_passchange_conv: starting converstation for %d messages\n", num_msg));
298
299 if (num_msg <= 0)
300 return PAM_CONV_ERR;
301
302 if ((pw_chat = make_pw_chat(lp_passwd_chat())) == NULL)
303 return PAM_CONV_ERR;
304
305 /*
306 * Apparantly HPUX has a buggy PAM that doesn't support the
307 * appdata_ptr. Fail if this is the case. JRA.
308 */
309
310 if (udp == NULL) {
311 DEBUG(0,("smb_pam_passchange_conv: PAM on this system is broken - appdata_ptr == NULL !\n"));
312 free_pw_chat(pw_chat);
313 return PAM_CONV_ERR;
314 }
315
316 reply = SMB_MALLOC_ARRAY(struct pam_response, num_msg);
317 if (!reply) {
318 DEBUG(0,("smb_pam_passchange_conv: malloc for reply failed!\n"));
319 free_pw_chat(pw_chat);
320 return PAM_CONV_ERR;
321 }
322
323 for (replies = 0; replies < num_msg; replies++) {
324 found = False;
325 DEBUG(10,("smb_pam_passchange_conv: Processing message %d\n", replies));
326 switch (msg[replies]->msg_style) {
327 case PAM_PROMPT_ECHO_ON:
328 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: PAM said: %s\n", msg[replies]->msg));
329 fstrcpy(current_prompt, msg[replies]->msg);
330 trim_char(current_prompt, ' ', ' ');
331 for (t=pw_chat; t; t=t->next) {
332
333 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: trying to match |%s| to |%s|\n",
334 t->prompt, current_prompt ));
335
336 if (unix_wild_match(t->prompt, current_prompt)) {
337 fstrcpy(current_reply, t->reply);
338 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We sent: %s\n", current_reply));
339 pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
340#ifdef DEBUG_PASSWORD
341 DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_ON: We actually sent: %s\n", current_reply));
342#endif
343 reply[replies].resp_retcode = PAM_SUCCESS;
344 reply[replies].resp = smb_pam_copy_fstring(
345 current_reply);
346 found = True;
347 break;
348 }
349 }
350 /* PAM frees resp */
351 if (!found) {
352 DEBUG(3,("smb_pam_passchange_conv: Could not find reply for PAM prompt: %s\n",msg[replies]->msg));
353 free_pw_chat(pw_chat);
354 SAFE_FREE(reply);
355 return PAM_CONV_ERR;
356 }
357 break;
358
359 case PAM_PROMPT_ECHO_OFF:
360 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: PAM said: %s\n", msg[replies]->msg));
361 fstrcpy(current_prompt, msg[replies]->msg);
362 trim_char(current_prompt, ' ', ' ');
363 for (t=pw_chat; t; t=t->next) {
364
365 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: trying to match |%s| to |%s|\n",
366 t->prompt, current_prompt ));
367
368 if (unix_wild_match(t->prompt, current_prompt)) {
369 fstrcpy(current_reply, t->reply);
370 DEBUG(10,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We sent: %s\n", current_reply));
371 pwd_sub(current_reply, udp->PAM_username, udp->PAM_password, udp->PAM_newpassword);
372 reply[replies].resp_retcode = PAM_SUCCESS;
373 reply[replies].resp = smb_pam_copy_fstring(
374 current_reply);
375#ifdef DEBUG_PASSWORD
376 DEBUG(100,("smb_pam_passchange_conv: PAM_PROMPT_ECHO_OFF: We actually sent: %s\n", current_reply));
377#endif
378 found = True;
379 break;
380 }
381 }
382 /* PAM frees resp */
383
384 if (!found) {
385 DEBUG(3,("smb_pam_passchange_conv: Could not find reply for PAM prompt: %s\n",msg[replies]->msg));
386 free_pw_chat(pw_chat);
387 SAFE_FREE(reply);
388 return PAM_CONV_ERR;
389 }
390 break;
391
392 case PAM_TEXT_INFO:
393 /* fall through */
394
395 case PAM_ERROR_MSG:
396 /* ignore it... */
397 reply[replies].resp_retcode = PAM_SUCCESS;
398 reply[replies].resp = NULL;
399 break;
400
401 default:
402 /* Must be an error of some sort... */
403 free_pw_chat(pw_chat);
404 SAFE_FREE(reply);
405 return PAM_CONV_ERR;
406 }
407 }
408
409 free_pw_chat(pw_chat);
410 if (reply)
411 *resp = reply;
412 return PAM_SUCCESS;
413}
414
415/***************************************************************************
416 Free up a malloced pam_conv struct.
417****************************************************************************/
418
419static void smb_free_pam_conv(struct pam_conv *pconv)
420{
421 if (pconv)
422 SAFE_FREE(pconv->appdata_ptr);
423
424 SAFE_FREE(pconv);
425}
426
427/***************************************************************************
428 Allocate a pam_conv struct.
429****************************************************************************/
430
431static struct pam_conv *smb_setup_pam_conv(smb_pam_conv_fn smb_pam_conv_fnptr, const char *user,
432 const char *passwd, const char *newpass)
433{
434 struct pam_conv *pconv = SMB_MALLOC_P(struct pam_conv);
435 struct smb_pam_userdata *udp = SMB_MALLOC_P(struct smb_pam_userdata);
436
437 if (pconv == NULL || udp == NULL) {
438 SAFE_FREE(pconv);
439 SAFE_FREE(udp);
440 return NULL;
441 }
442
443 udp->PAM_username = user;
444 udp->PAM_password = passwd;
445 udp->PAM_newpassword = newpass;
446
447 pconv->conv = smb_pam_conv_fnptr;
448 pconv->appdata_ptr = (void *)udp;
449 return pconv;
450}
451
452/*
453 * PAM Closing out cleanup handler
454 */
455
456static bool smb_pam_end(pam_handle_t *pamh, struct pam_conv *smb_pam_conv_ptr)
457{
458 int pam_error;
459
460 smb_free_pam_conv(smb_pam_conv_ptr);
461
462 if( pamh != NULL ) {
463 pam_error = pam_end(pamh, 0);
464 if(smb_pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
465 DEBUG(4, ("smb_pam_end: PAM: PAM_END OK.\n"));
466 return True;
467 }
468 }
469 DEBUG(2,("smb_pam_end: PAM: not initialised"));
470 return False;
471}
472
473/*
474 * Start PAM authentication for specified account
475 */
476
477static bool smb_pam_start(pam_handle_t **pamh, const char *user, const char *rhost, struct pam_conv *pconv)
478{
479 int pam_error;
480
481 *pamh = (pam_handle_t *)NULL;
482
483 DEBUG(4,("smb_pam_start: PAM: Init user: %s\n", user));
484
485 pam_error = pam_start("samba", user, pconv, pamh);
486 if( !smb_pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
487 *pamh = (pam_handle_t *)NULL;
488 return False;
489 }
490
491#if HAVE_PAM_RHOST
492 DEBUG(4,("smb_pam_start: PAM: setting rhost to: %s\n", rhost));
493 pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
494 if(!smb_pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
495 smb_pam_end(*pamh, pconv);
496 *pamh = (pam_handle_t *)NULL;
497 return False;
498 }
499#endif
500#if HAVE_PAM_TTY
501 DEBUG(4,("smb_pam_start: PAM: setting tty\n"));
502 pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
503 if (!smb_pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
504 smb_pam_end(*pamh, pconv);
505 *pamh = (pam_handle_t *)NULL;
506 return False;
507 }
508#endif
509 DEBUG(4,("smb_pam_start: PAM: Init passed for user: %s\n", user));
510 return True;
511}
512
513/*
514 * PAM Authentication Handler
515 */
516static NTSTATUS smb_pam_auth(pam_handle_t *pamh, const char *user)
517{
518 int pam_error;
519 NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
520
521 /*
522 * To enable debugging set in /etc/pam.d/samba:
523 * auth required /lib/security/pam_pwdb.so nullok shadow audit
524 */
525
526 DEBUG(4,("smb_pam_auth: PAM: Authenticate User: %s\n", user));
527 pam_error = pam_authenticate(pamh, PAM_SILENT | lp_null_passwords() ? 0 : PAM_DISALLOW_NULL_AUTHTOK);
528 switch( pam_error ){
529 case PAM_AUTH_ERR:
530 DEBUG(2, ("smb_pam_auth: PAM: Authentication Error for user %s\n", user));
531 break;
532 case PAM_CRED_INSUFFICIENT:
533 DEBUG(2, ("smb_pam_auth: PAM: Insufficient Credentials for user %s\n", user));
534 break;
535 case PAM_AUTHINFO_UNAVAIL:
536 DEBUG(2, ("smb_pam_auth: PAM: Authentication Information Unavailable for user %s\n", user));
537 break;
538 case PAM_USER_UNKNOWN:
539 DEBUG(2, ("smb_pam_auth: PAM: Username %s NOT known to Authentication system\n", user));
540 break;
541 case PAM_MAXTRIES:
542 DEBUG(2, ("smb_pam_auth: PAM: One or more authentication modules reports user limit for user %s exceeeded\n", user));
543 break;
544 case PAM_ABORT:
545 DEBUG(0, ("smb_pam_auth: PAM: One or more PAM modules failed to load for user %s\n", user));
546 break;
547 case PAM_SUCCESS:
548 DEBUG(4, ("smb_pam_auth: PAM: User %s Authenticated OK\n", user));
549 break;
550 default:
551 DEBUG(0, ("smb_pam_auth: PAM: UNKNOWN ERROR while authenticating user %s\n", user));
552 break;
553 }
554
555 smb_pam_nt_status_error_handler(pamh, pam_error, "Authentication Failure", 2, &nt_status);
556 return nt_status;
557}
558
559/*
560 * PAM Account Handler
561 */
562static NTSTATUS smb_pam_account(pam_handle_t *pamh, const char * user)
563{
564 int pam_error;
565 NTSTATUS nt_status = NT_STATUS_ACCOUNT_DISABLED;
566
567 DEBUG(4,("smb_pam_account: PAM: Account Management for User: %s\n", user));
568 pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
569 switch( pam_error ) {
570 case PAM_AUTHTOK_EXPIRED:
571 DEBUG(2, ("smb_pam_account: PAM: User %s is valid but password is expired\n", user));
572 break;
573 case PAM_ACCT_EXPIRED:
574 DEBUG(2, ("smb_pam_account: PAM: User %s no longer permitted to access system\n", user));
575 break;
576 case PAM_AUTH_ERR:
577 DEBUG(2, ("smb_pam_account: PAM: There was an authentication error for user %s\n", user));
578 break;
579 case PAM_PERM_DENIED:
580 DEBUG(0, ("smb_pam_account: PAM: User %s is NOT permitted to access system at this time\n", user));
581 break;
582 case PAM_USER_UNKNOWN:
583 DEBUG(0, ("smb_pam_account: PAM: User \"%s\" is NOT known to account management\n", user));
584 break;
585 case PAM_SUCCESS:
586 DEBUG(4, ("smb_pam_account: PAM: Account OK for User: %s\n", user));
587 break;
588 default:
589 DEBUG(0, ("smb_pam_account: PAM: UNKNOWN PAM ERROR (%d) during Account Management for User: %s\n", pam_error, user));
590 break;
591 }
592
593 smb_pam_nt_status_error_handler(pamh, pam_error, "Account Check Failed", 2, &nt_status);
594 return nt_status;
595}
596
597/*
598 * PAM Credential Setting
599 */
600
601static NTSTATUS smb_pam_setcred(pam_handle_t *pamh, const char * user)
602{
603 int pam_error;
604 NTSTATUS nt_status = NT_STATUS_NO_TOKEN;
605
606 /*
607 * This will allow samba to aquire a kerberos token. And, when
608 * exporting an AFS cell, be able to /write/ to this cell.
609 */
610
611 DEBUG(4,("PAM: Account Management SetCredentials for User: %s\n", user));
612 pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED|PAM_SILENT));
613 switch( pam_error ) {
614 case PAM_CRED_UNAVAIL:
615 DEBUG(0, ("smb_pam_setcred: PAM: Credentials not found for user:%s\n", user ));
616 break;
617 case PAM_CRED_EXPIRED:
618 DEBUG(0, ("smb_pam_setcred: PAM: Credentials for user: \"%s\" EXPIRED!\n", user ));
619 break;
620 case PAM_USER_UNKNOWN:
621 DEBUG(0, ("smb_pam_setcred: PAM: User: \"%s\" is NOT known so can not set credentials!\n", user ));
622 break;
623 case PAM_CRED_ERR:
624 DEBUG(0, ("smb_pam_setcred: PAM: Unknown setcredentials error - unable to set credentials for %s\n", user ));
625 break;
626 case PAM_SUCCESS:
627 DEBUG(4, ("smb_pam_setcred: PAM: SetCredentials OK for User: %s\n", user));
628 break;
629 default:
630 DEBUG(0, ("smb_pam_setcred: PAM: UNKNOWN PAM ERROR (%d) during SetCredentials for User: %s\n", pam_error, user));
631 break;
632 }
633
634 smb_pam_nt_status_error_handler(pamh, pam_error, "Set Credential Failure", 2, &nt_status);
635 return nt_status;
636}
637
638/*
639 * PAM Internal Session Handler
640 */
641static bool smb_internal_pam_session(pam_handle_t *pamh, const char *user, const char *tty, bool flag)
642{
643 int pam_error;
644
645#if HAVE_PAM_TTY
646 DEBUG(4,("smb_internal_pam_session: PAM: tty set to: %s\n", tty));
647 pam_error = pam_set_item(pamh, PAM_TTY, tty);
648 if (!smb_pam_error_handler(pamh, pam_error, "set tty failed", 0))
649 return False;
650#endif
651
652 if (flag) {
653 pam_error = pam_open_session(pamh, PAM_SILENT);
654 if (!smb_pam_error_handler(pamh, pam_error, "session setup failed", 0))
655 return False;
656 } else {
657 pam_setcred(pamh, (PAM_DELETE_CRED|PAM_SILENT)); /* We don't care if this fails */
658 pam_error = pam_close_session(pamh, PAM_SILENT); /* This will probably pick up the error anyway */
659 if (!smb_pam_error_handler(pamh, pam_error, "session close failed", 0))
660 return False;
661 }
662 return (True);
663}
664
665/*
666 * Internal PAM Password Changer.
667 */
668
669static bool smb_pam_chauthtok(pam_handle_t *pamh, const char * user)
670{
671 int pam_error;
672
673 DEBUG(4,("smb_pam_chauthtok: PAM: Password Change for User: %s\n", user));
674
675 pam_error = pam_chauthtok(pamh, PAM_SILENT); /* Change Password */
676
677 switch( pam_error ) {
678 case PAM_AUTHTOK_ERR:
679 DEBUG(2, ("PAM: unable to obtain the new authentication token - is password to weak?\n"));
680 break;
681
682 /* This doesn't seem to be defined on Solaris. JRA */
683#ifdef PAM_AUTHTOK_RECOVER_ERR
684 case PAM_AUTHTOK_RECOVER_ERR:
685 DEBUG(2, ("PAM: unable to obtain the old authentication token - was the old password wrong?.\n"));
686 break;
687#endif
688
689 case PAM_AUTHTOK_LOCK_BUSY:
690 DEBUG(2, ("PAM: unable to change the authentication token since it is currently locked.\n"));
691 break;
692 case PAM_AUTHTOK_DISABLE_AGING:
693 DEBUG(2, ("PAM: Authentication token aging has been disabled.\n"));
694 break;
695 case PAM_PERM_DENIED:
696 DEBUG(0, ("PAM: Permission denied.\n"));
697 break;
698 case PAM_TRY_AGAIN:
699 DEBUG(0, ("PAM: Could not update all authentication token(s). No authentication tokens were updated.\n"));
700 break;
701 case PAM_USER_UNKNOWN:
702 DEBUG(0, ("PAM: User not known to PAM\n"));
703 break;
704 case PAM_SUCCESS:
705 DEBUG(4, ("PAM: Account OK for User: %s\n", user));
706 break;
707 default:
708 DEBUG(0, ("PAM: UNKNOWN PAM ERROR (%d) for User: %s\n", pam_error, user));
709 }
710
711 if(!smb_pam_error_handler(pamh, pam_error, "Password Change Failed", 2)) {
712 return False;
713 }
714
715 /* If this point is reached, the password has changed. */
716 return True;
717}
718
719/*
720 * PAM Externally accessible Session handler
721 */
722
723bool smb_pam_claim_session(char *user, char *tty, char *rhost)
724{
725 pam_handle_t *pamh = NULL;
726 struct pam_conv *pconv = NULL;
727
728 /* Ignore PAM if told to. */
729
730 if (!lp_obey_pam_restrictions())
731 return True;
732
733 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
734 return False;
735
736 if (!smb_pam_start(&pamh, user, rhost, pconv))
737 return False;
738
739 if (!smb_internal_pam_session(pamh, user, tty, True)) {
740 smb_pam_end(pamh, pconv);
741 return False;
742 }
743
744 return smb_pam_end(pamh, pconv);
745}
746
747/*
748 * PAM Externally accessible Session handler
749 */
750
751bool smb_pam_close_session(char *user, char *tty, char *rhost)
752{
753 pam_handle_t *pamh = NULL;
754 struct pam_conv *pconv = NULL;
755
756 /* Ignore PAM if told to. */
757
758 if (!lp_obey_pam_restrictions())
759 return True;
760
761 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
762 return False;
763
764 if (!smb_pam_start(&pamh, user, rhost, pconv))
765 return False;
766
767 if (!smb_internal_pam_session(pamh, user, tty, False)) {
768 smb_pam_end(pamh, pconv);
769 return False;
770 }
771
772 return smb_pam_end(pamh, pconv);
773}
774
775/*
776 * PAM Externally accessible Account handler
777 */
778
779NTSTATUS smb_pam_accountcheck(const char *user, const char *rhost)
780{
781 NTSTATUS nt_status = NT_STATUS_ACCOUNT_DISABLED;
782 pam_handle_t *pamh = NULL;
783 struct pam_conv *pconv = NULL;
784
785 /* Ignore PAM if told to. */
786
787 if (!lp_obey_pam_restrictions())
788 return NT_STATUS_OK;
789
790 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, NULL, NULL)) == NULL)
791 return NT_STATUS_NO_MEMORY;
792
793 if (!smb_pam_start(&pamh, user, rhost, pconv))
794 return NT_STATUS_ACCOUNT_DISABLED;
795
796 if (!NT_STATUS_IS_OK(nt_status = smb_pam_account(pamh, user)))
797 DEBUG(0, ("smb_pam_accountcheck: PAM: Account Validation Failed - Rejecting User %s!\n", user));
798
799 smb_pam_end(pamh, pconv);
800 return nt_status;
801}
802
803/*
804 * PAM Password Validation Suite
805 */
806
807NTSTATUS smb_pam_passcheck(const char * user, const char * rhost,
808 const char * password)
809{
810 pam_handle_t *pamh = NULL;
811 NTSTATUS nt_status = NT_STATUS_LOGON_FAILURE;
812 struct pam_conv *pconv = NULL;
813
814 /*
815 * Note we can't ignore PAM here as this is the only
816 * way of doing auths on plaintext passwords when
817 * compiled --with-pam.
818 */
819
820 if ((pconv = smb_setup_pam_conv(smb_pam_conv, user, password, NULL)) == NULL)
821 return NT_STATUS_LOGON_FAILURE;
822
823 if (!smb_pam_start(&pamh, user, rhost, pconv))
824 return NT_STATUS_LOGON_FAILURE;
825
826 if (!NT_STATUS_IS_OK(nt_status = smb_pam_auth(pamh, user))) {
827 DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_auth failed - Rejecting User %s !\n", user));
828 smb_pam_end(pamh, pconv);
829 return nt_status;
830 }
831
832 if (!NT_STATUS_IS_OK(nt_status = smb_pam_account(pamh, user))) {
833 DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_account failed - Rejecting User %s !\n", user));
834 smb_pam_end(pamh, pconv);
835 return nt_status;
836 }
837
838 if (!NT_STATUS_IS_OK(nt_status = smb_pam_setcred(pamh, user))) {
839 DEBUG(0, ("smb_pam_passcheck: PAM: smb_pam_setcred failed - Rejecting User %s !\n", user));
840 smb_pam_end(pamh, pconv);
841 return nt_status;
842 }
843
844 smb_pam_end(pamh, pconv);
845 return nt_status;
846}
847
848/*
849 * PAM Password Change Suite
850 */
851
852bool smb_pam_passchange(const char *user, const char *rhost,
853 const char *oldpassword, const char *newpassword)
854{
855 /* Appropriate quantities of root should be obtained BEFORE calling this function */
856 struct pam_conv *pconv = NULL;
857 pam_handle_t *pamh = NULL;
858
859 if ((pconv = smb_setup_pam_conv(smb_pam_passchange_conv, user, oldpassword, newpassword)) == NULL)
860 return False;
861
862 if(!smb_pam_start(&pamh, user, rhost, pconv))
863 return False;
864
865 if (!smb_pam_chauthtok(pamh, user)) {
866 DEBUG(0, ("smb_pam_passchange: PAM: Password Change Failed for user %s!\n", user));
867 smb_pam_end(pamh, pconv);
868 return False;
869 }
870
871 return smb_pam_end(pamh, pconv);
872}
873
874#else
875
876/* If PAM not used, no PAM restrictions on accounts. */
877NTSTATUS smb_pam_accountcheck(const char *user, const char *rhost)
878{
879 return NT_STATUS_OK;
880}
881
882/* If PAM not used, also no PAM restrictions on sessions. */
883bool smb_pam_claim_session(char *user, char *tty, char *rhost)
884{
885 return True;
886}
887
888/* If PAM not used, also no PAM restrictions on sessions. */
889bool smb_pam_close_session(char *in_user, char *tty, char *rhost)
890{
891 return True;
892}
893#endif /* WITH_PAM */
Note: See TracBrowser for help on using the repository browser.