source: branches/samba-3.0/source/pam_smbpass/pam_smb_passwd.c@ 140

Last change on this file since 140 was 134, checked in by Paul Smedley, 18 years ago

Update source to 3.0.29
File size: 10.8 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Use PAM to update user passwords in the local SAM
4 Copyright (C) Steve Langasek 1998-2003
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 2 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program; if not, write to the Free Software
18 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19
20*/
21
22/* indicate the following groups are defined */
23#define PAM_SM_PASSWORD
24
25#include "includes.h"
26
27/* This is only used in the Sun implementation. FIXME: we really
28 want a define here that distinguishes between the Solaris PAM
29 and others (including FreeBSD). */
30
31#ifndef LINUX
32#include <security/pam_appl.h>
33#endif
34
35#include <security/pam_modules.h>
36
37#include "general.h"
38
39#include "support.h"
40
41int smb_update_db( pam_handle_t *pamh, int ctrl, const char *user, const char *pass_new )
42{
43 int retval;
44 pstring err_str;
45 pstring msg_str;
46
47 err_str[0] = '\0';
48 msg_str[0] = '\0';
49
50 retval = NT_STATUS_IS_OK(local_password_change( user, LOCAL_SET_PASSWORD, pass_new,
51 err_str, sizeof(err_str),
52 msg_str, sizeof(msg_str) ));
53
54 if (!retval) {
55 if (*err_str) {
56 err_str[PSTRING_LEN-1] = '\0';
57 make_remark( pamh, ctrl, PAM_ERROR_MSG, err_str );
58 }
59
60 /* FIXME: what value is appropriate here? */
61 retval = PAM_AUTHTOK_ERR;
62 } else {
63 if (*msg_str) {
64 msg_str[PSTRING_LEN-1] = '\0';
65 make_remark( pamh, ctrl, PAM_TEXT_INFO, msg_str );
66 }
67 retval = PAM_SUCCESS;
68 }
69
70 return retval;
71}
72
73
74/* data tokens */
75
76#define _SMB_OLD_AUTHTOK "-SMB-OLD-PASS"
77#define _SMB_NEW_AUTHTOK "-SMB-NEW-PASS"
78
79/*
80 * FUNCTION: pam_sm_chauthtok()
81 *
82 * This function is called twice by the PAM library, once with
83 * PAM_PRELIM_CHECK set, and then again with PAM_UPDATE_AUTHTOK set. With
84 * Linux-PAM, these two passes generally involve first checking the old
85 * token and then changing the token. This is what we do here.
86 *
87 * Having obtained a new password. The function updates the
88 * SMB_PASSWD_FILE file (normally, $(LIBDIR)/smbpasswd).
89 */
90
91int pam_sm_chauthtok(pam_handle_t *pamh, int flags,
92 int argc, const char **argv)
93{
94 unsigned int ctrl;
95 int retval;
96
97 extern BOOL in_client;
98
99 struct samu *sampass = NULL;
100 void (*oldsig_handler)(int);
101 const char *user;
102 char *pass_old;
103 char *pass_new;
104
105 /* Samba initialization. */
106 load_case_tables();
107 setup_logging( "pam_smbpass", False );
108 in_client = True;
109
110 ctrl = set_ctrl(flags, argc, argv);
111
112 /*
113 * First get the name of a user. No need to do anything if we can't
114 * determine this.
115 */
116
117 retval = pam_get_user( pamh, &user, "Username: " );
118 if (retval != PAM_SUCCESS) {
119 if (on( SMB_DEBUG, ctrl )) {
120 _log_err( LOG_DEBUG, "password: could not identify user" );
121 }
122 return retval;
123 }
124 if (on( SMB_DEBUG, ctrl )) {
125 _log_err( LOG_DEBUG, "username [%s] obtained", user );
126 }
127
128 if (geteuid() != 0) {
129 _log_err( LOG_DEBUG, "Cannot access samba password database, not running as root.");
130 return PAM_AUTHINFO_UNAVAIL;
131 }
132
133 /* Getting into places that might use LDAP -- protect the app
134 from a SIGPIPE it's not expecting */
135 oldsig_handler = CatchSignal(SIGPIPE, SIGNAL_CAST SIG_IGN);
136
137 if (!initialize_password_db(False)) {
138 _log_err( LOG_ALERT, "Cannot access samba password database" );
139 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
140 return PAM_AUTHINFO_UNAVAIL;
141 }
142
143 /* obtain user record */
144 if ( !(sampass = samu_new( NULL )) ) {
145 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
146 return nt_status_to_pam(NT_STATUS_NO_MEMORY);
147 }
148
149 if (!pdb_getsampwnam(sampass,user)) {
150 _log_err( LOG_ALERT, "Failed to find entry for user %s.", user );
151 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
152 return PAM_USER_UNKNOWN;
153 }
154 if (on( SMB_DEBUG, ctrl )) {
155 _log_err( LOG_DEBUG, "Located account for %s", user );
156 }
157
158 if (flags & PAM_PRELIM_CHECK) {
159 /*
160 * obtain and verify the current password (OLDAUTHTOK) for
161 * the user.
162 */
163
164 char *Announce;
165
166 if (_smb_blankpasswd( ctrl, sampass )) {
167
168 TALLOC_FREE(sampass);
169 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
170 return PAM_SUCCESS;
171 }
172
173 /* Password change by root, or for an expired token, doesn't
174 require authentication. Is this a good choice? */
175 if (getuid() != 0 && !(flags & PAM_CHANGE_EXPIRED_AUTHTOK)) {
176
177 /* tell user what is happening */
178#define greeting "Changing password for "
179 Announce = SMB_MALLOC_ARRAY(char, sizeof(greeting)+strlen(user));
180 if (Announce == NULL) {
181 _log_err(LOG_CRIT, "password: out of memory");
182 TALLOC_FREE(sampass);
183 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
184 return PAM_BUF_ERR;
185 }
186 strncpy( Announce, greeting, sizeof(greeting) );
187 strncpy( Announce+sizeof(greeting)-1, user, strlen(user)+1 );
188#undef greeting
189
190 set( SMB__OLD_PASSWD, ctrl );
191 retval = _smb_read_password( pamh, ctrl, Announce, "Current SMB password: ",
192 NULL, _SMB_OLD_AUTHTOK, &pass_old );
193 SAFE_FREE( Announce );
194
195 if (retval != PAM_SUCCESS) {
196 _log_err( LOG_NOTICE
197 , "password - (old) token not obtained" );
198 TALLOC_FREE(sampass);
199 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
200 return retval;
201 }
202
203 /* verify that this is the password for this user */
204
205 retval = _smb_verify_password( pamh, sampass, pass_old, ctrl );
206
207 } else {
208 pass_old = NULL;
209 retval = PAM_SUCCESS; /* root doesn't have to */
210 }
211
212 pass_old = NULL;
213 TALLOC_FREE(sampass);
214 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
215 return retval;
216
217 } else if (flags & PAM_UPDATE_AUTHTOK) {
218
219 /*
220 * obtain the proposed password
221 */
222
223 /*
224 * get the old token back. NULL was ok only if root [at this
225 * point we assume that this has already been enforced on a
226 * previous call to this function].
227 */
228
229 if (off( SMB_NOT_SET_PASS, ctrl )) {
230 retval = pam_get_item( pamh, PAM_OLDAUTHTOK,
231 (const void **)&pass_old );
232 } else {
233 retval = pam_get_data( pamh, _SMB_OLD_AUTHTOK,
234 (const void **)&pass_old );
235 if (retval == PAM_NO_MODULE_DATA) {
236 pass_old = NULL;
237 retval = PAM_SUCCESS;
238 }
239 }
240
241 if (retval != PAM_SUCCESS) {
242 _log_err( LOG_NOTICE, "password: user not authenticated" );
243 TALLOC_FREE(sampass);
244 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
245 return retval;
246 }
247
248 /*
249 * use_authtok is to force the use of a previously entered
250 * password -- needed for pluggable password strength checking
251 * or other module stacking
252 */
253
254 if (on( SMB_USE_AUTHTOK, ctrl )) {
255 set( SMB_USE_FIRST_PASS, ctrl );
256 }
257
258 retval = _smb_read_password( pamh, ctrl
259 , NULL
260 , "Enter new SMB password: "
261 , "Retype new SMB password: "
262 , _SMB_NEW_AUTHTOK
263 , &pass_new );
264
265 if (retval != PAM_SUCCESS) {
266 if (on( SMB_DEBUG, ctrl )) {
267 _log_err( LOG_ALERT
268 , "password: new password not obtained" );
269 }
270 pass_old = NULL; /* tidy up */
271 TALLOC_FREE(sampass);
272 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
273 return retval;
274 }
275
276 /*
277 * At this point we know who the user is and what they
278 * propose as their new password. Verify that the new
279 * password is acceptable.
280 */
281
282 if (pass_new[0] == '\0') { /* "\0" password = NULL */
283 pass_new = NULL;
284 }
285
286 retval = _pam_smb_approve_pass(pamh, ctrl, pass_old, pass_new);
287
288 if (retval != PAM_SUCCESS) {
289 _log_err(LOG_NOTICE, "new password not acceptable");
290 pass_new = pass_old = NULL; /* tidy up */
291 TALLOC_FREE(sampass);
292 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
293 return retval;
294 }
295
296 /*
297 * By reaching here we have approved the passwords and must now
298 * rebuild the smb password file.
299 */
300
301 /* update the password database */
302
303 retval = smb_update_db(pamh, ctrl, user, pass_new);
304 if (retval == PAM_SUCCESS) {
305 uid_t uid;
306
307 /* password updated */
308 if (!sid_to_uid(pdb_get_user_sid(sampass), &uid)) {
309 _log_err( LOG_NOTICE, "Unable to get uid for user %s",
310 pdb_get_username(sampass));
311 _log_err( LOG_NOTICE, "password for (%s) changed by (%s/%d)",
312 user, uidtoname(getuid()), getuid());
313 } else {
314 _log_err( LOG_NOTICE, "password for (%s/%d) changed by (%s/%d)",
315 user, uid, uidtoname(getuid()), getuid());
316 }
317 } else {
318 _log_err( LOG_ERR, "password change failed for user %s", user);
319 }
320
321 pass_old = pass_new = NULL;
322 if (sampass) {
323 TALLOC_FREE(sampass);
324 sampass = NULL;
325 }
326
327 } else { /* something has broken with the library */
328
329 _log_err( LOG_ALERT, "password received unknown request" );
330 retval = PAM_ABORT;
331
332 }
333
334 if (sampass) {
335 TALLOC_FREE(sampass);
336 sampass = NULL;
337 }
338
339 TALLOC_FREE(sampass);
340 CatchSignal(SIGPIPE, SIGNAL_CAST oldsig_handler);
341 return retval;
342}
343
344/* static module data */
345#ifdef PAM_STATIC
346struct pam_module _pam_smbpass_passwd_modstruct = {
347 "pam_smbpass",
348 NULL,
349 NULL,
350 NULL,
351 NULL,
352 NULL,
353 pam_sm_chauthtok
354};
355#endif
356
Note: See TracBrowser for help on using the repository browser.