source/nsswitch/pam_winbind.c

   1 /* pam_winbind module
   2
   3    Copyright Andrew Tridgell <tridge@samba.org> 2000
   4    Copyright Tim Potter <tpot@samba.org> 2000
   5    Copyright Andrew Bartlett <abartlet@samba.org> 2002
   6    Copyright Guenther Deschner <gd@samba.org> 2005-2006
   7
   8    largely based on pam_userdb by Cristian Gafton <gafton@redhat.com>
   9    also contains large slabs of code from pam_unix by Elliot Lee <sopwith@redhat.com>
  10    (see copyright below for full details)
  11 */
  12
  13 #include "includes.h"
  14 #include "pam_winbind.h"
  15
  16 /* data tokens */
  17
  18 #define MAX_PASSWD_TRIES        3
  19
  20 /* some syslogging */
  21 static void _pam_log(int err, const char *format, ...)
  22 {
  23         va_list args;
  24
  25         va_start(args, format);
  26         openlog(MODULE_NAME, LOG_CONS|LOG_PID, LOG_AUTH);
  27         vsyslog(err, format, args);
  28         va_end(args);
  29         closelog();
  30 }
  31
  32 static void _pam_log_debug(int ctrl, int err, const char *format, ...)
  33 {
  34         va_list args;
  35
  36         if (!(ctrl & WINBIND_DEBUG_ARG)) {
  37                 return;
  38         }
  39
  40         va_start(args, format);
  41         openlog(MODULE_NAME, LOG_CONS|LOG_PID, LOG_AUTH);
  42         vsyslog(err, format, args);
  43         va_end(args);
  44         closelog();
  45 }
  46
  47 static int _pam_parse(int argc, const char **argv)
  48 {
  49         int ctrl = 0;
  50
  51         load_case_tables();
  52
  53         if (!lp_load(dyn_CONFIGFILE,True,False,False,True)) {
  54                 return -1;
  55         }
  56
  57         if (lp_parm_bool(-1, "pam_winbind", "cached_login", False)) {
  58                 ctrl |= WINBIND_CACHED_LOGIN;
  59         }
  60         if (lp_parm_bool(-1, "pam_winbind", "krb5_auth", False)) {
  61                 ctrl |= WINBIND_KRB5_AUTH;
  62         }
  63         if (lp_parm_const_string(-1, "pam_winbind", "krb5_ccache_type", NULL) != NULL) {
  64                 ctrl |= WINBIND_KRB5_CCACHE_TYPE;
  65         }
  66         if ((lp_parm_const_string(-1, "pam_winbind", "require-membership-of", NULL) != NULL) ||
  67             (lp_parm_const_string(-1, "pam_winbind", "require_membership_of", NULL) != NULL)) {
  68                 ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
  69         }
  70         if (lp_parm_bool(-1, "pam_winbind", "create_homedir", False)) {
  71                 ctrl |= WINBIND_CREATE_HOMEDIR;
  72         }
  73
  74         /* step through arguments */
  75         for (; argc-- > 0; ++argv) {
  76
  77                 /* generic options */
  78
  79                 if (!StrCaseCmp(*argv, "debug"))
  80                         ctrl |= WINBIND_DEBUG_ARG;
  81                 else if (strequal(*argv, "use_authtok"))
  82                         ctrl |= WINBIND_USE_AUTHTOK_ARG;
  83                 else if (strequal(*argv, "use_first_pass"))
  84                         ctrl |= WINBIND_USE_FIRST_PASS_ARG;
  85                 else if (strequal(*argv, "try_first_pass"))
  86                         ctrl |= WINBIND_TRY_FIRST_PASS_ARG;
  87                 else if (strequal(*argv, "unknown_ok"))
  88                         ctrl |= WINBIND_UNKNOWN_OK_ARG;
  89                 else if (strnequal(*argv, "require_membership_of", strlen("require_membership_of")))
  90                         ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
  91                 else if (strnequal(*argv, "require-membership-of", strlen("require-membership-of")))
  92                         ctrl |= WINBIND_REQUIRED_MEMBERSHIP;
  93                 else if (strequal(*argv, "krb5_auth"))
  94                         ctrl |= WINBIND_KRB5_AUTH;
  95                 else if (strnequal(*argv, "krb5_ccache_type", strlen("krb5_ccache_type")))
  96                         ctrl |= WINBIND_KRB5_CCACHE_TYPE;
  97                 else if (strequal(*argv, "cached_login"))
  98                         ctrl |= WINBIND_CACHED_LOGIN;
  99                 else if (strequal(*argv, "create_homedir"))
 100                         ctrl |= WINBIND_CREATE_HOMEDIR;
 101                 else {
 102                         _pam_log(LOG_ERR, "pam_parse: unknown option; %s", *argv);
 103                 }
 104
 105         }
 106         return ctrl;
 107 };
 108
 109 static void _pam_winbind_cleanup_func(pam_handle_t *pamh, void *data, int error_status)
 110 {
 111         SAFE_FREE(data);
 112 }
 113
 114 static const struct ntstatus_errors {
 115         const char *ntstatus_string;
 116         const char *error_string;
 117 } ntstatus_errors[] = {
 118         {"NT_STATUS_OK", "Success"},
 119         {"NT_STATUS_BACKUP_CONTROLLER", "No primary Domain Controler available"},
 120         {"NT_STATUS_PWD_TOO_SHORT", "Password too short"},
 121         {"NT_STATUS_PWD_TOO_RECENT", "The password of this user is too recent to change"},
 122         {"NT_STATUS_PWD_HISTORY_CONFLICT", "Password is already in password history"},
 123         {"NT_STATUS_PASSWORD_EXPIRED", "Your password has expired"},
 124         {"NT_STATUS_PASSWORD_MUST_CHANGE", "You need to change your password now"},
 125         {"NT_STATUS_INVALID_WORKSTATION", "You are not allowed to logon from this workstation"},
 126         {"NT_STATUS_INVALID_LOGON_HOURS", "You are not allowed to logon at this time"},
 127         {"NT_STATUS_ACCOUNT_EXPIRED", "Your account has expired. Please contact your System administrator"}, /* SCNR */
 128         {"NT_STATUS_ACCOUNT_DISABLED", "Your account is disabled. Please contact your System administrator"}, /* SCNR */
 129         {"NT_STATUS_ACCOUNT_LOCKED_OUT", "Your account has been locked. Please contact your System administrator"}, /* SCNR */
 130         {"NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT", "Invalid Trust Account"},
 131         {"NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT", "Invalid Trust Account"},
 132         {"NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT", "Invalid Trust Account"},
 133         {"NT_STATUS_ACCESS_DENIED", "Access is denied"},
 134         {NULL, NULL}
 135 };
 136
 137 const char *_get_ntstatus_error_string(const char *nt_status_string)
 138 {
 139         int i;
 140         for (i=0; ntstatus_errors[i].ntstatus_string != NULL; i++) {
 141                 if (strequal(ntstatus_errors[i].ntstatus_string, nt_status_string)) {
 142                         return ntstatus_errors[i].error_string;
 143                 }
 144         }
 145         return NULL;
 146 }
 147
 148 /* --- authentication management functions --- */
 149
 150 /* Attempt a conversation */
 151
 152 static int converse(pam_handle_t *pamh, int nargs,
 153                     struct pam_message **message,
 154                     struct pam_response **response)
 155 {
 156         int retval;
 157         struct pam_conv *conv;
 158
 159         retval = pam_get_item(pamh, PAM_CONV, (const void **) &conv );
 160         if (retval == PAM_SUCCESS) {
 161                 retval = conv->conv(nargs, (const struct pam_message **)message,
 162                                     response, conv->appdata_ptr);
 163         }
 164
 165         return retval; /* propagate error status */
 166 }
 167
 168
 169 static int _make_remark(pam_handle_t * pamh, int type, const char *text)
 170 {
 171         int retval = PAM_SUCCESS;
 172
 173         struct pam_message *pmsg[1], msg[1];
 174         struct pam_response *resp;
 175
 176         pmsg[0] = &msg[0];
 177         msg[0].msg = text;
 178         msg[0].msg_style = type;
 179
 180         resp = NULL;
 181         retval = converse(pamh, 1, pmsg, &resp);
 182
 183         if (resp) {
 184                 _pam_drop_reply(resp, 1);
 185         }
 186         return retval;
 187 }
 188
 189 static int _make_remark_format(pam_handle_t * pamh, int type, const char *format, ...)
 190 {
 191         va_list args;
 192         char *var;
 193
 194         va_start(args, format);
 195         vasprintf(&var, format, args);
 196         va_end(args);
 197
 198         return _make_remark(pamh, type, var);
 199 }
 200
 201 static int pam_winbind_request(pam_handle_t * pamh, int ctrl,
 202                                enum winbindd_cmd req_type,
 203                                struct winbindd_request *request,
 204                                struct winbindd_response *response)
 205 {
 206         /* Fill in request and send down pipe */
 207         init_request(request, req_type);
 208
 209         if (write_sock(request, sizeof(*request), 0) == -1) {
 210                 _pam_log(LOG_ERR, "write to socket failed!");
 211                 close_sock();
 212                 return PAM_SERVICE_ERR;
 213         }
 214
 215         /* Wait for reply */
 216         if (read_reply(response) == -1) {
 217                 _pam_log(LOG_ERR, "read from socket failed!");
 218                 close_sock();
 219                 return PAM_SERVICE_ERR;
 220         }
 221
 222         /* We are done with the socket - close it and avoid mischeif */
 223         close_sock();
 224
 225         /* Copy reply data from socket */
 226         if (response->result != WINBINDD_OK) {
 227                 if (response->data.auth.pam_error != PAM_SUCCESS) {
 228                         _pam_log(LOG_ERR, "request failed: %s, PAM error was %d, NT error was %s",
 229                                  response->data.auth.error_string,
 230                                  response->data.auth.pam_error,
 231                                  response->data.auth.nt_status_string);
 232                         return response->data.auth.pam_error;
 233                 } else {
 234                         _pam_log(LOG_ERR, "request failed, but PAM error 0!");
 235                         return PAM_SERVICE_ERR;
 236                 }
 237         }
 238
 239         return PAM_SUCCESS;
 240 }
 241
 242 static int pam_winbind_request_log(pam_handle_t * pamh,
 243                                    int ctrl,
 244                                    enum winbindd_cmd req_type,
 245                                    struct winbindd_request *request,
 246                                    struct winbindd_response *response,
 247                                    const char *user)
 248 {
 249         int retval;
 250
 251         retval = pam_winbind_request(pamh, ctrl, req_type, request, response);
 252
 253         switch (retval) {
 254         case PAM_AUTH_ERR:
 255                 /* incorrect password */
 256                 _pam_log(LOG_WARNING, "user `%s' denied access (incorrect password or invalid membership)", user);
 257                 return retval;
 258         case PAM_ACCT_EXPIRED:
 259                 /* account expired */
 260                 _pam_log(LOG_WARNING, "user `%s' account expired", user);
 261                 return retval;
 262         case PAM_AUTHTOK_EXPIRED:
 263                 /* password expired */
 264                 _pam_log(LOG_WARNING, "user `%s' password expired", user);
 265                 return retval;
 266         case PAM_NEW_AUTHTOK_REQD:
 267                 /* new password required */
 268                 _pam_log(LOG_WARNING, "user `%s' new password required", user);
 269                 return retval;
 270         case PAM_USER_UNKNOWN:
 271                 /* the user does not exist */
 272                 _pam_log_debug(ctrl, LOG_NOTICE, "user `%s' not found",
 273                                  user);
 274                 if (ctrl & WINBIND_UNKNOWN_OK_ARG) {
 275                         return PAM_IGNORE;
 276                 }
 277                 return retval;
 278         case PAM_SUCCESS:
 279                 if (req_type == WINBINDD_PAM_AUTH) {
 280                         /* Otherwise, the authentication looked good */
 281                         _pam_log(LOG_NOTICE, "user '%s' granted access", user);
 282                 } else if (req_type == WINBINDD_PAM_CHAUTHTOK) {
 283                         /* Otherwise, the authentication looked good */
 284                         _pam_log(LOG_NOTICE, "user '%s' password changed", user);
 285                 } else {
 286                         /* Otherwise, the authentication looked good */
 287                         _pam_log(LOG_NOTICE, "user '%s' OK", user);
 288                 }
 289
 290                 return retval;
 291         default:
 292                 /* we don't know anything about this return value */
 293                 _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s')",
 294                          retval, user);
 295                 return retval;
 296         }
 297 }
 298
 299 /* talk to winbindd */
 300 static int winbind_auth_request(pam_handle_t * pamh,
 301                                 int ctrl,
 302                                 const char *user,
 303                                 const char *pass,
 304                                 const char *member,
 305                                 const char *cctype,
 306                                 int process_result)
 307 {
 308         struct winbindd_request request;
 309         struct winbindd_response response;
 310         int ret;
 311
 312         ZERO_STRUCT(request);
 313         ZERO_STRUCT(response);
 314
 315         strncpy(request.data.auth.user, user,
 316                 sizeof(request.data.auth.user)-1);
 317
 318         strncpy(request.data.auth.pass, pass,
 319                 sizeof(request.data.auth.pass)-1);
 320
 321         request.data.auth.krb5_cc_type[0] = '\0';
 322         request.data.auth.uid = -1;
 323
 324         request.flags = WBFLAG_PAM_INFO3_TEXT | WBFLAG_PAM_GET_PWD_POLICY;
 325
 326         if (ctrl & WINBIND_KRB5_AUTH) {
 327
 328                 struct passwd *pwd = NULL;
 329
 330                 _pam_log_debug(ctrl, LOG_DEBUG, "enabling krb5 login flag\n");
 331
 332                 request.flags |= WBFLAG_PAM_KRB5 | WBFLAG_PAM_FALLBACK_AFTER_KRB5;
 333
 334                 pwd = getpwnam(user);
 335                 if (pwd == NULL) {
 336                         return PAM_USER_UNKNOWN;
 337                 }
 338                 request.data.auth.uid = pwd->pw_uid;
 339         }
 340
 341         if (ctrl & WINBIND_CACHED_LOGIN) {
 342                 _pam_log_debug(ctrl, LOG_DEBUG, "enabling cached login flag\n");
 343                 request.flags |= WBFLAG_PAM_CACHED_LOGIN;
 344         }
 345
 346         if (cctype != NULL) {
 347                 strncpy(request.data.auth.krb5_cc_type, cctype,
 348                         sizeof(request.data.auth.krb5_cc_type) - 1);
 349                 _pam_log_debug(ctrl, LOG_DEBUG, "enabling request for a %s krb5 ccache\n", cctype);
 350         }
 351
 352         request.data.auth.require_membership_of_sid[0] = '\0';
 353
 354         if (member != NULL) {
 355                 strncpy(request.data.auth.require_membership_of_sid, member,
 356                         sizeof(request.data.auth.require_membership_of_sid)-1);
 357         }
 358
 359         /* lookup name? */
 360         if ( (member != NULL) && (strncmp("S-", member, 2) != 0) ) {
 361
 362                 struct winbindd_request sid_request;
 363                 struct winbindd_response sid_response;
 364
 365                 ZERO_STRUCT(sid_request);
 366                 ZERO_STRUCT(sid_response);
 367
 368                 _pam_log_debug(ctrl, LOG_DEBUG, "no sid given, looking up: %s\n", member);
 369
 370                 /* fortunatly winbindd can handle non-separated names */
 371                 fstrcpy(sid_request.data.name.name, member);
 372
 373                 if (pam_winbind_request_log(pamh, ctrl, WINBINDD_LOOKUPNAME, &sid_request, &sid_response, user)) {
 374                         _pam_log(LOG_INFO, "could not lookup name: %s\n", member);
 375                         return PAM_AUTH_ERR;
 376                 }
 377
 378                 member = sid_response.data.sid.sid;
 379
 380                 strncpy(request.data.auth.require_membership_of_sid, member,
 381                         sizeof(request.data.auth.require_membership_of_sid)-1);
 382         }
 383
 384         ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_PAM_AUTH, &request, &response, user);
 385
 386         if ((ctrl & WINBIND_KRB5_AUTH) &&
 387             response.data.auth.krb5ccname[0] != '\0') {
 388
 389                 char var[PATH_MAX];
 390
 391                 _pam_log_debug(ctrl, LOG_DEBUG, "request returned KRB5CCNAME: %s",
 392                                response.data.auth.krb5ccname);
 393
 394                 snprintf(var, sizeof(var), "KRB5CCNAME=%s", response.data.auth.krb5ccname);
 395
 396                 ret = pam_putenv(pamh, var);
 397                 if (ret != PAM_SUCCESS) {
 398                         _pam_log(LOG_ERR, "failed to set KRB5CCNAME to %s", var);
 399                         return ret;
 400                 }
 401         }
 402
 403         if (!process_result) {
 404                 return ret;
 405         }
 406
 407         if (ret) {
 408                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PASSWORD_EXPIRED");
 409                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PASSWORD_MUST_CHANGE");
 410                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_INVALID_WORKSTATION");
 411                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_INVALID_LOGON_HOURS");
 412                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCOUNT_EXPIRED");
 413                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCOUNT_DISABLED");
 414                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCOUNT_LOCKED_OUT");
 415                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT");
 416                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT");
 417                 PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT");
 418         }
 419
 420         /* handle the case where the auth was ok, but the password must expire right now */
 421         /* good catch from Ralf Haferkamp: an expiry of "never" is translated to -1 */
 422         if ( ! (response.data.auth.info3.acct_flags & ACB_PWNOEXP) &&
 423             (response.data.auth.policy.expire > 0) &&
 424             (response.data.auth.info3.pass_last_set_time + response.data.auth.policy.expire < time(NULL))) {
 425
 426                 ret = PAM_AUTHTOK_EXPIRED;
 427
 428                 _pam_log_debug(ctrl, LOG_DEBUG,"Password has expired (Password was last set: %d, "
 429                                "the policy says it should expire here %d (now it's: %d)\n",
 430                                response.data.auth.info3.pass_last_set_time,
 431                                response.data.auth.info3.pass_last_set_time + response.data.auth.policy.expire,
 432                                time(NULL));
 433
 434                 PAM_WB_REMARK_DIRECT_RET(pamh, "NT_STATUS_PASSWORD_EXPIRED");
 435
 436         }
 437
 438         /* warn a user if the password is about to expire soon */
 439         if ( ! (response.data.auth.info3.acct_flags & ACB_PWNOEXP) &&
 440             (response.data.auth.policy.expire) &&
 441             (response.data.auth.info3.pass_last_set_time + response.data.auth.policy.expire > time(NULL) ) ) {
 442
 443                 int days = response.data.auth.policy.expire / SECONDS_PER_DAY;
 444                 if (days <= DAYS_TO_WARN_BEFORE_PWD_EXPIRES) {
 445                         _make_remark_format(pamh, PAM_TEXT_INFO, "Your password will expire in %d days", days);
 446                 }
 447         }
 448
 449         if (response.data.auth.info3.user_flgs & LOGON_CACHED_ACCOUNT) {
 450                 _make_remark(pamh, PAM_ERROR_MSG, "Logging on using cached account. Network ressources can be unavailable");
 451         }
 452
 453         /* save the CIFS homedir for pam_cifs / pam_mount */
 454         if (response.data.auth.info3.home_dir[0] != '\0') {
 455                 char *buf;
 456
 457                 if (!asprintf(&buf, "%s", response.data.auth.info3.home_dir)) {
 458                         return PAM_BUF_ERR;
 459                 }
 460
 461                 pam_set_data( pamh, PAM_WINBIND_HOMEDIR, (void *)buf, _pam_winbind_cleanup_func);
 462         }
 463
 464         return ret;
 465 }
 466
 467 /* talk to winbindd */
 468 static int winbind_chauthtok_request(pam_handle_t * pamh,
 469                                      int ctrl,
 470                                      const char *user,
 471                                      const char *oldpass,
 472                                      const char *newpass)
 473 {
 474         struct winbindd_request request;
 475         struct winbindd_response response;
 476         int ret;
 477
 478         ZERO_STRUCT(request);
 479         ZERO_STRUCT(response);
 480
 481         if (request.data.chauthtok.user == NULL) return -2;
 482
 483         strncpy(request.data.chauthtok.user, user,
 484                 sizeof(request.data.chauthtok.user) - 1);
 485
 486         if (oldpass != NULL) {
 487                 strncpy(request.data.chauthtok.oldpass, oldpass,
 488                         sizeof(request.data.chauthtok.oldpass) - 1);
 489         } else {
 490                 request.data.chauthtok.oldpass[0] = '\0';
 491         }
 492
 493         if (newpass != NULL) {
 494                 strncpy(request.data.chauthtok.newpass, newpass,
 495                         sizeof(request.data.chauthtok.newpass) - 1);
 496         } else {
 497                 request.data.chauthtok.newpass[0] = '\0';
 498         }
 499
 500         if (ctrl & WINBIND_KRB5_AUTH) {
 501                 request.flags = WBFLAG_PAM_KRB5;
 502         }
 503
 504         ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_PAM_CHAUTHTOK, &request, &response, user);
 505
 506         if (ret == PAM_SUCCESS) {
 507                 return ret;
 508         }
 509
 510         PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_BACKUP_CONTROLLER");
 511         PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_ACCESS_DENIED");
 512
 513         /* TODO: tell the min pwd length ? */
 514         PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PWD_TOO_SHORT");
 515
 516         /* TODO: tell the minage ? */
 517         PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PWD_TOO_RECENT");
 518
 519         /* TODO: tell the history length ? */
 520         PAM_WB_REMARK_CHECK_RESPONSE_RET(pamh, response, "NT_STATUS_PWD_HISTORY_CONFLICT");
 521
 522         if (strequal(response.data.auth.nt_status_string, "NT_STATUS_PASSWORD_RESTRICTION")) {
 523
 524                 /* FIXME: avoid to send multiple PAM messages after another */
 525                 switch (response.data.auth.reject_reason) {
 526                         case 0:
 527                                 break;
 528                         case REJECT_REASON_TOO_SHORT:
 529                                 PAM_WB_REMARK_DIRECT(pamh, "NT_STATUS_PWD_TOO_SHORT");
 530                                 break;
 531                         case REJECT_REASON_IN_HISTORY:
 532                                 PAM_WB_REMARK_DIRECT(pamh, "NT_STATUS_PWD_HISTORY_CONFLICT");
 533                                 break;
 534                         case REJECT_REASON_NOT_COMPLEX:
 535                                 _make_remark(pamh, PAM_ERROR_MSG, "Password does not meet complexity requirements");
 536                                 break;
 537                         default:
 538                                 _pam_log_debug(ctrl, LOG_DEBUG,
 539                                                "unknown password change reject reason: %d",
 540                                                response.data.auth.reject_reason);
 541                                 break;
 542                 }
 543
 544                 _make_remark_format(pamh, PAM_ERROR_MSG,
 545                         "Your password must be at least %d characters; "
 546                         "cannot repeat any of the your previous %d passwords"
 547                         "%s. "
 548                         "Please type a different password. "
 549                         "Type a password which meets these requirements in both text boxes.",
 550                         response.data.auth.policy.min_length_password,
 551                         response.data.auth.policy.password_history,
 552                         (response.data.auth.policy.password_properties & DOMAIN_PASSWORD_COMPLEX) ?
 553                                 "; must contain capitals, numerals or punctuation; and cannot contain your account or full name" :
 554                                 "");
 555
 556         }
 557
 558         return ret;
 559 }
 560
 561 /*
 562  * Checks if a user has an account
 563  *
 564  * return values:
 565  *       1  = User not found
 566  *       0  = OK
 567  *      -1  = System error
 568  */
 569 static int valid_user(const char *user, pam_handle_t *pamh, int ctrl)
 570 {
 571         /* check not only if the user is available over NSS calls, also make
 572          * sure it's really a winbind user, this is important when stacking PAM
 573          * modules in the 'account' or 'password' facility. */
 574
 575         struct passwd *pwd = NULL;
 576         struct winbindd_request request;
 577         struct winbindd_response response;
 578         int ret;
 579
 580         ZERO_STRUCT(request);
 581         ZERO_STRUCT(response);
 582
 583         pwd = getpwnam(user);
 584         if (pwd == NULL) {
 585                 return 1;
 586         }
 587
 588         fstrcpy(request.data.username, user);
 589
 590         ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_GETPWNAM, &request, &response, user);
 591
 592         switch (ret) {
 593                 case PAM_USER_UNKNOWN:
 594                         return 1;
 595                 case PAM_SUCCESS:
 596                         return 0;
 597                 default:
 598                         break;
 599         }
 600         return -1;
 601 }
 602
 603 static char *_pam_delete(register char *xx)
 604 {
 605         _pam_overwrite(xx);
 606         _pam_drop(xx);
 607         return NULL;
 608 }
 609
 610 /*
 611  * obtain a password from the user
 612  */
 613
 614 static int _winbind_read_password(pam_handle_t * pamh,
 615                                   unsigned int ctrl,
 616                                   const char *comment,
 617                                   const char *prompt1,
 618                                   const char *prompt2,
 619                                   const char **pass)
 620 {
 621         int authtok_flag;
 622         int retval;
 623         const char *item;
 624         char *token;
 625
 626         /*
 627          * make sure nothing inappropriate gets returned
 628          */
 629
 630         *pass = token = NULL;
 631
 632         /*
 633          * which authentication token are we getting?
 634          */
 635
 636         authtok_flag = on(WINBIND__OLD_PASSWORD, ctrl) ? PAM_OLDAUTHTOK : PAM_AUTHTOK;
 637
 638         /*
 639          * should we obtain the password from a PAM item ?
 640          */
 641
 642         if (on(WINBIND_TRY_FIRST_PASS_ARG, ctrl) || on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
 643                 retval = pam_get_item(pamh, authtok_flag, (const void **) &item);
 644                 if (retval != PAM_SUCCESS) {
 645                         /* very strange. */
 646                         _pam_log(LOG_ALERT,
 647                                  "pam_get_item returned error to unix-read-password"
 648                             );
 649                         return retval;
 650                 } else if (item != NULL) {      /* we have a password! */
 651                         *pass = item;
 652                         item = NULL;
 653                         return PAM_SUCCESS;
 654                 } else if (on(WINBIND_USE_FIRST_PASS_ARG, ctrl)) {
 655                         return PAM_AUTHTOK_RECOVER_ERR;         /* didn't work */
 656                 } else if (on(WINBIND_USE_AUTHTOK_ARG, ctrl)
 657                            && off(WINBIND__OLD_PASSWORD, ctrl)) {
 658                         return PAM_AUTHTOK_RECOVER_ERR;
 659                 }
 660         }
 661         /*
 662          * getting here implies we will have to get the password from the
 663          * user directly.
 664          */
 665
 666         {
 667                 struct pam_message msg[3], *pmsg[3];
 668                 struct pam_response *resp;
 669                 int i, replies;
 670
 671                 /* prepare to converse */
 672
 673                 if (comment != NULL) {
 674                         pmsg[0] = &msg[0];
 675                         msg[0].msg_style = PAM_TEXT_INFO;
 676                         msg[0].msg = comment;
 677                         i = 1;
 678                 } else {
 679                         i = 0;
 680                 }
 681
 682                 pmsg[i] = &msg[i];
 683                 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
 684                 msg[i++].msg = prompt1;
 685                 replies = 1;
 686
 687                 if (prompt2 != NULL) {
 688                         pmsg[i] = &msg[i];
 689                         msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
 690                         msg[i++].msg = prompt2;
 691                         ++replies;
 692                 }
 693                 /* so call the conversation expecting i responses */
 694                 resp = NULL;
 695                 retval = converse(pamh, i, pmsg, &resp);
 696
 697                 if (resp != NULL) {
 698
 699                         /* interpret the response */
 700
 701                         if (retval == PAM_SUCCESS) {    /* a good conversation */
 702
 703                                 token = SMB_STRDUP(resp[i - replies].resp);
 704                                 if (token != NULL) {
 705                                         if (replies == 2) {
 706                                                 /* verify that password entered correctly */
 707                                                 if (!resp[i - 1].resp
 708                                                     || StrCaseCmp(token, resp[i - 1].resp)) {
 709                                                         _pam_delete(token);     /* mistyped */
 710                                                         retval = PAM_AUTHTOK_RECOVER_ERR;
 711                                                         _make_remark(pamh, PAM_ERROR_MSG, MISTYPED_PASS);
 712                                                 }
 713                                         }
 714                                 } else {
 715                                         _pam_log(LOG_NOTICE
 716                                                  ,"could not recover authentication token");
 717                                 }
 718
 719                         }
 720                         /*
 721                          * tidy up the conversation (resp_retcode) is ignored
 722                          * -- what is it for anyway? AGM
 723                          */
 724
 725                         _pam_drop_reply(resp, i);
 726
 727                 } else {
 728                         retval = (retval == PAM_SUCCESS)
 729                             ? PAM_AUTHTOK_RECOVER_ERR : retval;
 730                 }
 731         }
 732
 733         if (retval != PAM_SUCCESS) {
 734                 _pam_log_debug(ctrl, LOG_DEBUG,
 735                                  "unable to obtain a password");
 736                 return retval;
 737         }
 738         /* 'token' is the entered password */
 739
 740         /* we store this password as an item */
 741
 742         retval = pam_set_item(pamh, authtok_flag, token);
 743         _pam_delete(token);     /* clean it up */
 744         if (retval != PAM_SUCCESS ||
 745             (retval = pam_get_item(pamh, authtok_flag, (const void **) &item)) != PAM_SUCCESS) {
 746
 747                 _pam_log(LOG_CRIT, "error manipulating password");
 748                 return retval;
 749
 750         }
 751
 752         *pass = item;
 753         item = NULL;            /* break link to password */
 754
 755         return PAM_SUCCESS;
 756 }
 757
 758 const char *get_conf_item_string(int argc,
 759                                  const char **argv,
 760                                  int ctrl,
 761                                  const char *item,
 762                                  int flag)
 763 {
 764         int i = 0;
 765         char *parm = NULL;
 766         const char *parm_opt = NULL;
 767
 768         if (!(ctrl & flag)) {
 769                 goto out;
 770         }
 771
 772         /* let the pam opt take precedence over the smb.conf option */
 773         parm_opt = lp_parm_const_string(-1, "pam_winbind", item, NULL);
 774
 775         for ( i=0; i<argc; i++ ) {
 776
 777                 if ((strncmp(argv[i], item, strlen(item)) == 0)) {
 778                         char *p;
 779
 780                         parm = SMB_STRDUP(argv[i]);
 781
 782                         if ( (p = strchr( parm, '=' )) == NULL) {
 783                                 _pam_log(LOG_INFO, "no \"=\" delimiter for \"%s\" found\n", item);
 784                                 goto out;
 785                         }
 786                         SAFE_FREE(parm);
 787                         _pam_log_debug(ctrl, LOG_INFO, "PAM config: %s '%s'\n", item, p+1);
 788                         return p + 1;
 789                 }
 790         }
 791
 792         _pam_log_debug(ctrl, LOG_INFO, "CONFIG file: %s '%s'\n", item, parm_opt);
 793 out:
 794         SAFE_FREE(parm);
 795         return parm_opt;
 796 }
 797
 798 const char *get_krb5_cc_type_from_config(int argc, const char **argv, int ctrl)
 799 {
 800         return get_conf_item_string(argc, argv, ctrl, "krb5_ccache_type", WINBIND_KRB5_CCACHE_TYPE);
 801 }
 802
 803 const char *get_member_from_config(int argc, const char **argv, int ctrl)
 804 {
 805         const char *ret = NULL;
 806         ret = get_conf_item_string(argc, argv, ctrl, "require_membership_of", WINBIND_REQUIRED_MEMBERSHIP);
 807         if (ret) {
 808                 return ret;
 809         }
 810         return get_conf_item_string(argc, argv, ctrl, "require-membership-of", WINBIND_REQUIRED_MEMBERSHIP);
 811 }
 812
 813 PAM_EXTERN
 814 int pam_sm_authenticate(pam_handle_t *pamh, int flags,
 815                         int argc, const char **argv)
 816 {
 817         const char *username;
 818         const char *password;
 819         const char *member = NULL;
 820         const char *cctype = NULL;
 821         int retval = PAM_AUTH_ERR;
 822
 823         /* parse arguments */
 824         int ctrl = _pam_parse(argc, argv);
 825         if (ctrl == -1) {
 826                 return PAM_SYSTEM_ERR;
 827         }
 828
 829         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_authenticate");
 830
 831         /* Get the username */
 832         retval = pam_get_user(pamh, &username, NULL);
 833         if ((retval != PAM_SUCCESS) || (!username)) {
 834                 _pam_log_debug(ctrl, LOG_DEBUG, "can not get the username");
 835                 return PAM_SERVICE_ERR;
 836         }
 837
 838         retval = _winbind_read_password(pamh, ctrl, NULL,
 839                                         "Password: ", NULL,
 840                                         &password);
 841
 842         if (retval != PAM_SUCCESS) {
 843                 _pam_log(LOG_ERR, "Could not retrieve user's password");
 844                 return PAM_AUTHTOK_ERR;
 845         }
 846
 847         /* Let's not give too much away in the log file */
 848
 849 #ifdef DEBUG_PASSWORD
 850         _pam_log_debug(ctrl, LOG_INFO, "Verify user `%s' with password `%s'",
 851                        username, password);
 852 #else
 853         _pam_log_debug(ctrl, LOG_INFO, "Verify user `%s'", username);
 854 #endif
 855
 856         member = get_member_from_config(argc, argv, ctrl);
 857
 858         cctype = get_krb5_cc_type_from_config(argc, argv, ctrl);
 859
 860         /* Now use the username to look up password */
 861         retval = winbind_auth_request(pamh, ctrl, username, password, member, cctype, True);
 862
 863         if (retval == PAM_NEW_AUTHTOK_REQD ||
 864             retval == PAM_AUTHTOK_EXPIRED) {
 865
 866                 char *buf;
 867
 868                 if (!asprintf(&buf, "%d", retval)) {
 869                         return PAM_BUF_ERR;
 870                 }
 871
 872                 pam_set_data( pamh, PAM_WINBIND_NEW_AUTHTOK_REQD, (void *)buf, _pam_winbind_cleanup_func);
 873
 874                 return PAM_SUCCESS;
 875         }
 876
 877         return retval;
 878 }
 879
 880 PAM_EXTERN
 881 int pam_sm_setcred(pam_handle_t *pamh, int flags,
 882                    int argc, const char **argv)
 883 {
 884         /* parse arguments */
 885         int ctrl = _pam_parse(argc, argv);
 886         if (ctrl == -1) {
 887                 return PAM_SYSTEM_ERR;
 888         }
 889
 890         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_setcred");
 891
 892         if (flags & PAM_DELETE_CRED) {
 893                 return pam_sm_close_session(pamh, flags, argc, argv);
 894         }
 895
 896         return PAM_SUCCESS;
 897 }
 898
 899 /*
 900  * Account management. We want to verify that the account exists
 901  * before returning PAM_SUCCESS
 902  */
 903 PAM_EXTERN
 904 int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
 905                    int argc, const char **argv)
 906 {
 907         const char *username;
 908         int retval = PAM_USER_UNKNOWN;
 909         void *tmp = NULL;
 910
 911         /* parse arguments */
 912         int ctrl = _pam_parse(argc, argv);
 913         if (ctrl == -1) {
 914                 return PAM_SYSTEM_ERR;
 915         }
 916
 917         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_acct_mgmt");
 918
 919
 920         /* Get the username */
 921         retval = pam_get_user(pamh, &username, NULL);
 922         if ((retval != PAM_SUCCESS) || (!username)) {
 923                 _pam_log_debug(ctrl, LOG_DEBUG,"can not get the username");
 924                 return PAM_SERVICE_ERR;
 925         }
 926
 927         /* Verify the username */
 928         retval = valid_user(username, pamh, ctrl);
 929         switch (retval) {
 930         case -1:
 931                 /* some sort of system error. The log was already printed */
 932                 return PAM_SERVICE_ERR;
 933         case 1:
 934                 /* the user does not exist */
 935                 _pam_log_debug(ctrl, LOG_NOTICE, "user `%s' not found", username);
 936                 if (ctrl & WINBIND_UNKNOWN_OK_ARG) {
 937                         return PAM_IGNORE;
 938                 }
 939                 return PAM_USER_UNKNOWN;
 940         case 0:
 941                 pam_get_data( pamh, PAM_WINBIND_NEW_AUTHTOK_REQD, (const void **)&tmp);
 942                 if (tmp != NULL) {
 943                         retval = atoi(tmp);
 944                         switch (retval) {
 945                         case PAM_AUTHTOK_EXPIRED:
 946                                 /* fall through, since new token is required in this case */
 947                         case PAM_NEW_AUTHTOK_REQD:
 948                                 _pam_log(LOG_WARNING, "pam_sm_acct_mgmt success but %s is set",
 949                                          PAM_WINBIND_NEW_AUTHTOK_REQD);
 950                                 _pam_log(LOG_NOTICE, "user '%s' needs new password", username);
 951                                 /* PAM_AUTHTOKEN_REQD does not exist, but is documented in the manpage */
 952                                 return PAM_NEW_AUTHTOK_REQD;
 953                         default:
 954                                 _pam_log(LOG_WARNING, "pam_sm_acct_mgmt success");
 955                                 _pam_log(LOG_NOTICE, "user '%s' granted access", username);
 956                                 return PAM_SUCCESS;
 957                         }
 958                 }
 959
 960                 /* Otherwise, the authentication looked good */
 961                 _pam_log(LOG_NOTICE, "user '%s' granted access", username);
 962                 return PAM_SUCCESS;
 963         default:
 964                 /* we don't know anything about this return value */
 965                 _pam_log(LOG_ERR, "internal module error (retval = %d, user = `%s')",
 966                          retval, username);
 967                 return PAM_SERVICE_ERR;
 968         }
 969
 970         /* should not be reached */
 971         return PAM_IGNORE;
 972 }
 973
 974 PAM_EXTERN
 975 int pam_sm_open_session(pam_handle_t *pamh, int flags,
 976                         int argc, const char **argv)
 977 {
 978         /* parse arguments */
 979         int ctrl = _pam_parse(argc, argv);
 980         if (ctrl == -1) {
 981                 return PAM_SYSTEM_ERR;
 982         }
 983
 984         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_open_session handler");
 985
 986
 987         if (ctrl & WINBIND_CREATE_HOMEDIR) {
 988
 989                 struct passwd *pwd = NULL;
 990                 const char *username;
 991                 int ret;
 992                 fstring tok;
 993                 fstring create_dir;
 994                 SMB_STRUCT_STAT sbuf;
 995
 996                 /* Get the username */
 997                 ret = pam_get_user(pamh, &username, NULL);
 998                 if ((ret != PAM_SUCCESS) || (!username)) {
 999                         _pam_log_debug(ctrl, LOG_DEBUG, "can not get the username");
1000                         return PAM_SERVICE_ERR;
1001                 }
1002
1003                 pwd = getpwnam(username);
1004                 if (pwd == NULL) {
1005                         _pam_log_debug(ctrl, LOG_DEBUG, "can not get the username");
1006                         return PAM_SERVICE_ERR;
1007                 }
1008
1009                 _pam_log_debug(ctrl, LOG_DEBUG, "homedir is: %s", pwd->pw_dir);
1010
1011                 if (directory_exist(pwd->pw_dir, &sbuf)) {
1012                         return PAM_SUCCESS;
1013                 }
1014
1015                 fstrcpy(create_dir, "/");
1016                 while (next_token((const char **)&pwd->pw_dir, tok, "/", sizeof(tok))) {
1017
1018                         mode_t mode = 0755;
1019
1020                         fstrcat(create_dir, tok);
1021                         fstrcat(create_dir, "/");
1022
1023                         if (!directory_exist(create_dir, &sbuf)) {
1024                                 if (mkdir(create_dir, mode) != 0) {
1025                                         _pam_log(LOG_ERR, "could not create dir: %s (%s)",
1026                                                  create_dir, strerror(errno));
1027                                         return PAM_SERVICE_ERR;
1028                                 }
1029                         }
1030                 }
1031
1032                 if (sys_chown(create_dir, pwd->pw_uid, pwd->pw_gid) != 0) {
1033                         _pam_log(LOG_ERR, "failed to chown user homedir: %s (%s)",
1034                                  create_dir, strerror(errno));
1035                         return PAM_SERVICE_ERR;
1036                 }
1037         }
1038
1039         return PAM_SUCCESS;
1040 }
1041
1042 PAM_EXTERN
1043 int pam_sm_close_session(pam_handle_t *pamh, int flags,
1044                          int argc, const char **argv)
1045 {
1046         /* parse arguments */
1047         int ctrl = _pam_parse(argc, argv);
1048         if (ctrl == -1) {
1049                 return PAM_SYSTEM_ERR;
1050         }
1051
1052         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_close_session handler");
1053
1054         if (!(flags & PAM_DELETE_CRED)) {
1055                 return PAM_SUCCESS;
1056         }
1057
1058         if (ctrl & WINBIND_KRB5_AUTH) {
1059
1060                 /* destroy the ccache here */
1061                 struct winbindd_request request;
1062                 struct winbindd_response response;
1063                 const char *user;
1064                 const char *ccname = NULL;
1065                 struct passwd *pwd = NULL;
1066
1067                 int retval;
1068
1069                 ZERO_STRUCT(request);
1070                 ZERO_STRUCT(response);
1071
1072                 retval = pam_get_user(pamh, &user, "Username: ");
1073                 if (retval == PAM_SUCCESS) {
1074                         if (user == NULL) {
1075                                 _pam_log(LOG_ERR, "username was NULL!");
1076                                 return PAM_USER_UNKNOWN;
1077                         }
1078                         if (retval == PAM_SUCCESS) {
1079                                 _pam_log_debug(ctrl, LOG_DEBUG, "username [%s] obtained", user);
1080                         }
1081                 } else {
1082                         _pam_log_debug(ctrl, LOG_DEBUG, "could not identify user");
1083                         return retval;
1084                 }
1085
1086                 ccname = pam_getenv(pamh, "KRB5CCNAME");
1087                 if (ccname == NULL) {
1088                         _pam_log_debug(ctrl, LOG_DEBUG, "user has no KRB5CCNAME environment");
1089                         return PAM_BUF_ERR;
1090                 }
1091
1092                 fstrcpy(request.data.logoff.user, user);
1093                 fstrcpy(request.data.logoff.krb5ccname, ccname);
1094
1095                 pwd = getpwnam(user);
1096                 if (pwd == NULL) {
1097                         return PAM_USER_UNKNOWN;
1098                 }
1099                 request.data.logoff.uid = pwd->pw_uid;
1100
1101                 request.flags = WBFLAG_PAM_KRB5;
1102
1103                 return pam_winbind_request_log(pamh, ctrl, WINBINDD_PAM_LOGOFF, &request, &response, user);
1104         }
1105
1106         return PAM_SUCCESS;
1107 }
1108
1109
1110
1111 PAM_EXTERN
1112 int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
1113                      int argc, const char **argv)
1114 {
1115         unsigned int lctrl;
1116         int retval;
1117         unsigned int ctrl;
1118
1119         /* <DO NOT free() THESE> */
1120         const char *user;
1121         char *pass_old, *pass_new;
1122         /* </DO NOT free() THESE> */
1123
1124         fstring Announce;
1125
1126         int retry = 0;
1127
1128         ctrl = _pam_parse(argc, argv);
1129         if (ctrl == -1) {
1130                 return PAM_SYSTEM_ERR;
1131         }
1132
1133         _pam_log_debug(ctrl, LOG_DEBUG,"pam_winbind: pam_sm_chauthtok");
1134
1135         /*
1136          * First get the name of a user
1137          */
1138         retval = pam_get_user(pamh, &user, "Username: ");
1139         if (retval == PAM_SUCCESS) {
1140                 if (user == NULL) {
1141                         _pam_log(LOG_ERR, "username was NULL!");
1142                         return PAM_USER_UNKNOWN;
1143                 }
1144                 if (retval == PAM_SUCCESS) {
1145                         _pam_log_debug(ctrl, LOG_DEBUG, "username [%s] obtained",
1146                                  user);
1147                 }
1148         } else {
1149                 _pam_log_debug(ctrl, LOG_DEBUG,
1150                          "password - could not identify user");
1151                 return retval;
1152         }
1153
1154         /* check if this is really a user in winbindd, not only in NSS */
1155         retval = valid_user(user, pamh, ctrl);
1156         switch (retval) {
1157                 case 1:
1158                         return PAM_USER_UNKNOWN;
1159                 case -1:
1160                         return PAM_SYSTEM_ERR;
1161                 default:
1162                         break;
1163         }
1164
1165         /*
1166          * obtain and verify the current password (OLDAUTHTOK) for
1167          * the user.
1168          */
1169
1170         if (flags & PAM_PRELIM_CHECK) {
1171
1172                 /* instruct user what is happening */
1173 #define greeting "Changing password for "
1174                 fstrcpy(Announce, greeting);
1175                 fstrcat(Announce, user);
1176 #undef greeting
1177
1178                 lctrl = ctrl | WINBIND__OLD_PASSWORD;
1179                 retval = _winbind_read_password(pamh, lctrl,
1180                                                 Announce,
1181                                                 "(current) NT password: ",
1182                                                 NULL,
1183                                                 (const char **) &pass_old);
1184                 if (retval != PAM_SUCCESS) {
1185                         _pam_log(LOG_NOTICE, "password - (old) token not obtained");
1186                         return retval;
1187                 }
1188                 /* verify that this is the password for this user */
1189
1190                 retval = winbind_auth_request(pamh, ctrl, user, pass_old, NULL, NULL, False);
1191
1192                 if (retval != PAM_ACCT_EXPIRED
1193                     && retval != PAM_AUTHTOK_EXPIRED
1194                     && retval != PAM_NEW_AUTHTOK_REQD
1195                     && retval != PAM_SUCCESS) {
1196                         pass_old = NULL;
1197                         return retval;
1198                 }
1199
1200                 retval = pam_set_item(pamh, PAM_OLDAUTHTOK, (const void *) pass_old);
1201                 pass_old = NULL;
1202                 if (retval != PAM_SUCCESS) {
1203                         _pam_log(LOG_CRIT, "failed to set PAM_OLDAUTHTOK");
1204                 }
1205         } else if (flags & PAM_UPDATE_AUTHTOK) {
1206
1207                 /*
1208                  * obtain the proposed password
1209                  */
1210
1211                 /*
1212                  * get the old token back.
1213                  */
1214
1215                 retval = pam_get_item(pamh, PAM_OLDAUTHTOK,
1216                                       (const void **) &pass_old);
1217
1218                 if (retval != PAM_SUCCESS) {
1219                         _pam_log(LOG_NOTICE, "user not authenticated");
1220                         return retval;
1221                 }
1222
1223                 lctrl = ctrl;
1224
1225                 if (on(WINBIND_USE_AUTHTOK_ARG, lctrl)) {
1226                         lctrl |= WINBIND_USE_FIRST_PASS_ARG;
1227                 }
1228                 retry = 0;
1229                 retval = PAM_AUTHTOK_ERR;
1230                 while ((retval != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
1231                         /*
1232                          * use_authtok is to force the use of a previously entered
1233                          * password -- needed for pluggable password strength checking
1234                          */
1235
1236                         retval = _winbind_read_password(pamh, lctrl,
1237                                                         NULL,
1238                                                         "Enter new NT password: ",
1239                                                         "Retype new NT password: ",
1240                                                         (const char **) &pass_new);
1241
1242                         if (retval != PAM_SUCCESS) {
1243                                 _pam_log_debug(ctrl, LOG_ALERT
1244                                          ,"password - new password not obtained");
1245                                 pass_old = NULL;/* tidy up */
1246                                 return retval;
1247                         }
1248
1249                         /*
1250                          * At this point we know who the user is and what they
1251                          * propose as their new password. Verify that the new
1252                          * password is acceptable.
1253                          */
1254
1255                         if (pass_new[0] == '\0') {/* "\0" password = NULL */
1256                                 pass_new = NULL;
1257                         }
1258                 }
1259
1260                 /*
1261                  * By reaching here we have approved the passwords and must now
1262                  * rebuild the password database file.
1263                  */
1264
1265                 retval = winbind_chauthtok_request(pamh, ctrl, user, pass_old, pass_new);
1266                 if (retval) {
1267                         _pam_overwrite(pass_new);
1268                         _pam_overwrite(pass_old);
1269                         pass_old = pass_new = NULL;
1270                         return retval;
1271                 }
1272
1273                 /* just in case we need krb5 creds after a password change over msrpc */
1274
1275                 if (ctrl & WINBIND_KRB5_AUTH) {
1276
1277                         const char *member = get_member_from_config(argc, argv, ctrl);
1278                         const char *cctype = get_krb5_cc_type_from_config(argc, argv, ctrl);
1279
1280                         retval = winbind_auth_request(pamh, ctrl, user, pass_new, member, cctype, False);
1281                         _pam_overwrite(pass_new);
1282                         _pam_overwrite(pass_old);
1283                         pass_old = pass_new = NULL;
1284                 }
1285         } else {
1286                 retval = PAM_SERVICE_ERR;
1287         }
1288
1289         return retval;
1290 }
1291
1292 #ifdef PAM_STATIC
1293
1294 /* static module data */
1295
1296 struct pam_module _pam_winbind_modstruct = {
1297         MODULE_NAME,
1298         pam_sm_authenticate,
1299         pam_sm_setcred,
1300         pam_sm_acct_mgmt,
1301         pam_sm_open_session,
1302         pam_sm_close_session,
1303         pam_sm_chauthtok
1304 };
1305
1306 #endif
1307
1308 /*
1309  * Copyright (c) Andrew Tridgell  <tridge@samba.org>   2000
1310  * Copyright (c) Tim Potter       <tpot@samba.org>     2000
1311  * Copyright (c) Andrew Bartlettt <abartlet@samba.org> 2002
1312  * Copyright (c) Guenther Deschner <gd@samba.org>      2005-2006
1313  * Copyright (c) Jan Rêkorajski 1999.
1314  * Copyright (c) Andrew G. Morgan 1996-8.
1315  * Copyright (c) Alex O. Yuriev, 1996.
1316  * Copyright (c) Cristian Gafton 1996.
1317  * Copyright (C) Elliot Lee <sopwith@redhat.com> 1996, Red Hat Software.
1318  *
1319  * Redistribution and use in source and binary forms, with or without
1320  * modification, are permitted provided that the following conditions
1321  * are met:
1322  * 1. Redistributions of source code must retain the above copyright
1323  *    notice, and the entire permission notice in its entirety,
1324  *    including the disclaimer of warranties.
1325  * 2. Redistributions in binary form must reproduce the above copyright
1326  *    notice, this list of conditions and the following disclaimer in the
1327  *    documentation and/or other materials provided with the distribution.
1328  * 3. The name of the author may not be used to endorse or promote
1329  *    products derived from this software without specific prior
1330  *    written permission.
1331  *
1332  * ALTERNATIVELY, this product may be distributed under the terms of
1333  * the GNU Public License, in which case the provisions of the GPL are
1334  * required INSTEAD OF the above restrictions.  (This clause is
1335  * necessary due to a potential bad interaction between the GPL and
1336  * the restrictions contained in a BSD-style copyright.)
1337  *
1338  * THIS SOFTWARE IS PROVIDED `AS IS'' AND ANY EXPRESS OR IMPLIED
1339  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1340  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
1341  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
1342  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
1343  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
1344  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
1345  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
1346  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
1347  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
1348  * OF THE POSSIBILITY OF SUCH DAMAGE.
1349  */