source3/libads/kerberos.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    kerberos utility library
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Remus Koos 2001
   6    Copyright (C) Nalin Dahyabhai <nalin@redhat.com> 2004.
   7    Copyright (C) Jeremy Allison 2004.
   8    Copyright (C) Gerald Carter 2006.
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26
  27 #ifdef HAVE_KRB5
  28
  29 #define LIBADS_CCACHE_NAME "MEMORY:libads"
  30
  31 /*
  32   we use a prompter to avoid a crash bug in the kerberos libs when
  33   dealing with empty passwords
  34   this prompter is just a string copy ...
  35 */
  36 static krb5_error_code
  37 kerb_prompter(krb5_context ctx, void *data,
  38                const char *name,
  39                const char *banner,
  40                int num_prompts,
  41                krb5_prompt prompts[])
  42 {
  43         if (num_prompts == 0) return 0;
  44
  45         memset(prompts[0].reply->data, '\0', prompts[0].reply->length);
  46         if (prompts[0].reply->length > 0) {
  47                 if (data) {
  48                         strncpy(prompts[0].reply->data, (const char *)data,
  49                                 prompts[0].reply->length-1);
  50                         prompts[0].reply->length = strlen(prompts[0].reply->data);
  51                 } else {
  52                         prompts[0].reply->length = 0;
  53                 }
  54         }
  55         return 0;
  56 }
  57
  58 /*
  59   simulate a kinit, putting the tgt in the given cache location. If cache_name == NULL
  60   place in default cache location.
  61   remus@snapserver.com
  62 */
  63 int kerberos_kinit_password_ext(const char *principal,
  64                                 const char *password,
  65                                 int time_offset,
  66                                 time_t *expire_time,
  67                                 time_t *renew_till_time,
  68                                 const char *cache_name,
  69                                 BOOL request_pac,
  70                                 BOOL add_netbios_addr,
  71                                 time_t renewable_time)
  72 {
  73         krb5_context ctx = NULL;
  74         krb5_error_code code = 0;
  75         krb5_ccache cc = NULL;
  76         krb5_principal me;
  77         krb5_creds my_creds;
  78         krb5_get_init_creds_opt opt;
  79         smb_krb5_addresses *addr = NULL;
  80
  81         initialize_krb5_error_table();
  82         if ((code = krb5_init_context(&ctx)))
  83                 return code;
  84
  85         if (time_offset != 0) {
  86                 krb5_set_real_time(ctx, time(NULL) + time_offset, 0);
  87         }
  88
  89         DEBUG(10,("kerberos_kinit_password: using [%s] as ccache and config [%s]\n",
  90                         cache_name ? cache_name: krb5_cc_default_name(ctx),
  91                         getenv("KRB5_CONFIG")));
  92
  93         if ((code = krb5_cc_resolve(ctx, cache_name ? cache_name : krb5_cc_default_name(ctx), &cc))) {
  94                 krb5_free_context(ctx);
  95                 return code;
  96         }
  97
  98         if ((code = smb_krb5_parse_name(ctx, principal, &me))) {
  99                 krb5_free_context(ctx);
 100                 return code;
 101         }
 102
 103         krb5_get_init_creds_opt_init(&opt);
 104         krb5_get_init_creds_opt_set_renew_life(&opt, renewable_time);
 105         krb5_get_init_creds_opt_set_forwardable(&opt, 1);
 106
 107         if (request_pac) {
 108 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_PAC_REQUEST
 109                 code = krb5_get_init_creds_opt_set_pac_request(ctx, &opt, True);
 110                 if (code) {
 111                         krb5_free_principal(ctx, me);
 112                         krb5_free_context(ctx);
 113                         return code;
 114                 }
 115 #endif
 116         }
 117
 118         if (add_netbios_addr) {
 119                 code = smb_krb5_gen_netbios_krb5_address(&addr);
 120                 if (code) {
 121                         krb5_free_principal(ctx, me);
 122                         krb5_free_context(ctx);
 123                         return code;
 124                 }
 125                 krb5_get_init_creds_opt_set_address_list(&opt, addr->addrs);
 126         }
 127
 128         if ((code = krb5_get_init_creds_password(ctx, &my_creds, me, CONST_DISCARD(char *,password),
 129                                                  kerb_prompter, NULL, 0, NULL, &opt)))
 130         {
 131                 smb_krb5_free_addresses(ctx, addr);
 132                 krb5_free_principal(ctx, me);
 133                 krb5_free_context(ctx);
 134                 return code;
 135         }
 136
 137         if ((code = krb5_cc_initialize(ctx, cc, me))) {
 138                 smb_krb5_free_addresses(ctx, addr);
 139                 krb5_free_cred_contents(ctx, &my_creds);
 140                 krb5_free_principal(ctx, me);
 141                 krb5_free_context(ctx);
 142                 return code;
 143         }
 144
 145         if ((code = krb5_cc_store_cred(ctx, cc, &my_creds))) {
 146                 krb5_cc_close(ctx, cc);
 147                 smb_krb5_free_addresses(ctx, addr);
 148                 krb5_free_cred_contents(ctx, &my_creds);
 149                 krb5_free_principal(ctx, me);
 150                 krb5_free_context(ctx);
 151                 return code;
 152         }
 153
 154         if (expire_time) {
 155                 *expire_time = (time_t) my_creds.times.endtime;
 156         }
 157
 158         if (renew_till_time) {
 159                 *renew_till_time = (time_t) my_creds.times.renew_till;
 160         }
 161
 162         krb5_cc_close(ctx, cc);
 163         smb_krb5_free_addresses(ctx, addr);
 164         krb5_free_cred_contents(ctx, &my_creds);
 165         krb5_free_principal(ctx, me);
 166         krb5_free_context(ctx);
 167
 168         return 0;
 169 }
 170
 171
 172
 173 /* run kinit to setup our ccache */
 174 int ads_kinit_password(ADS_STRUCT *ads)
 175 {
 176         char *s;
 177         int ret;
 178         const char *account_name;
 179         fstring acct_name;
 180
 181         if ( IS_DC ) {
 182                 /* this will end up getting a ticket for DOMAIN@RUSTED.REA.LM */
 183                 account_name = lp_workgroup();
 184         } else {
 185                 /* always use the sAMAccountName for security = domain */
 186                 /* global_myname()$@REA.LM */
 187                 if ( lp_security() == SEC_DOMAIN ) {
 188                         fstr_sprintf( acct_name, "%s$", global_myname() );
 189                         account_name = acct_name;
 190                 }
 191                 else
 192                         /* This looks like host/global_myname()@REA.LM */
 193                         account_name = ads->auth.user_name;
 194         }
 195
 196         if (asprintf(&s, "%s@%s", account_name, ads->auth.realm) == -1) {
 197                 return KRB5_CC_NOMEM;
 198         }
 199
 200         if (!ads->auth.password) {
 201                 SAFE_FREE(s);
 202                 return KRB5_LIBOS_CANTREADPWD;
 203         }
 204
 205         ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset,
 206                         &ads->auth.expire, NULL, NULL, False, False, ads->auth.renewable);
 207
 208         if (ret) {
 209                 DEBUG(0,("kerberos_kinit_password %s failed: %s\n",
 210                          s, error_message(ret)));
 211         }
 212         SAFE_FREE(s);
 213         return ret;
 214 }
 215
 216 int ads_kdestroy(const char *cc_name)
 217 {
 218         krb5_error_code code;
 219         krb5_context ctx = NULL;
 220         krb5_ccache cc = NULL;
 221
 222         initialize_krb5_error_table();
 223         if ((code = krb5_init_context (&ctx))) {
 224                 DEBUG(3, ("ads_kdestroy: kdb5_init_context failed: %s\n",
 225                         error_message(code)));
 226                 return code;
 227         }
 228
 229         if (!cc_name) {
 230                 if ((code = krb5_cc_default(ctx, &cc))) {
 231                         krb5_free_context(ctx);
 232                         return code;
 233                 }
 234         } else {
 235                 if ((code = krb5_cc_resolve(ctx, cc_name, &cc))) {
 236                         DEBUG(3, ("ads_kdestroy: krb5_cc_resolve failed: %s\n",
 237                                   error_message(code)));
 238                         krb5_free_context(ctx);
 239                         return code;
 240                 }
 241         }
 242
 243         if ((code = krb5_cc_destroy (ctx, cc))) {
 244                 DEBUG(3, ("ads_kdestroy: krb5_cc_destroy failed: %s\n",
 245                         error_message(code)));
 246         }
 247
 248         krb5_free_context (ctx);
 249         return code;
 250 }
 251
 252 /************************************************************************
 253  Routine to fetch the salting principal for a service.  Active
 254  Directory may use a non-obvious principal name to generate the salt
 255  when it determines the key to use for encrypting tickets for a service,
 256  and hopefully we detected that when we joined the domain.
 257  ************************************************************************/
 258
 259 static char *kerberos_secrets_fetch_salting_principal(const char *service, int enctype)
 260 {
 261         char *key = NULL;
 262         char *ret = NULL;
 263
 264         asprintf(&key, "%s/%s/enctype=%d", SECRETS_SALTING_PRINCIPAL, service, enctype);
 265         if (!key) {
 266                 return NULL;
 267         }
 268         ret = (char *)secrets_fetch(key, NULL);
 269         SAFE_FREE(key);
 270         return ret;
 271 }
 272
 273 /************************************************************************
 274  Return the standard DES salt key
 275 ************************************************************************/
 276
 277 char* kerberos_standard_des_salt( void )
 278 {
 279         fstring salt;
 280
 281         fstr_sprintf( salt, "host/%s.%s@", global_myname(), lp_realm() );
 282         strlower_m( salt );
 283         fstrcat( salt, lp_realm() );
 284
 285         return SMB_STRDUP( salt );
 286 }
 287
 288 /************************************************************************
 289 ************************************************************************/
 290
 291 static char* des_salt_key( void )
 292 {
 293         char *key;
 294
 295         asprintf(&key, "%s/DES/%s", SECRETS_SALTING_PRINCIPAL, lp_realm());
 296
 297         return key;
 298 }
 299
 300 /************************************************************************
 301 ************************************************************************/
 302
 303 BOOL kerberos_secrets_store_des_salt( const char* salt )
 304 {
 305         char* key;
 306         BOOL ret;
 307
 308         if ( (key = des_salt_key()) == NULL ) {
 309                 DEBUG(0,("kerberos_secrets_store_des_salt: failed to generate key!\n"));
 310                 return False;
 311         }
 312
 313         if ( !salt ) {
 314                 DEBUG(8,("kerberos_secrets_store_des_salt: deleting salt\n"));
 315                 secrets_delete( key );
 316                 return True;
 317         }
 318
 319         DEBUG(3,("kerberos_secrets_store_des_salt: Storing salt \"%s\"\n", salt));
 320
 321         ret = secrets_store( key, salt, strlen(salt)+1 );
 322
 323         SAFE_FREE( key );
 324
 325         return ret;
 326 }
 327
 328 /************************************************************************
 329 ************************************************************************/
 330
 331 char* kerberos_secrets_fetch_des_salt( void )
 332 {
 333         char *salt, *key;
 334
 335         if ( (key = des_salt_key()) == NULL ) {
 336                 DEBUG(0,("kerberos_secrets_fetch_des_salt: failed to generate key!\n"));
 337                 return False;
 338         }
 339
 340         salt = (char*)secrets_fetch( key, NULL );
 341
 342         SAFE_FREE( key );
 343
 344         return salt;
 345 }
 346
 347
 348 /************************************************************************
 349  Routine to get the salting principal for this service.  This is
 350  maintained for backwards compatibilty with releases prior to 3.0.24.
 351  Since we store the salting principal string only at join, we may have
 352  to look for the older tdb keys.  Caller must free if return is not null.
 353  ************************************************************************/
 354
 355 krb5_principal kerberos_fetch_salt_princ_for_host_princ(krb5_context context,
 356                                                         krb5_principal host_princ,
 357                                                         int enctype)
 358 {
 359         char *unparsed_name = NULL, *salt_princ_s = NULL;
 360         krb5_principal ret_princ = NULL;
 361
 362         /* lookup new key first */
 363
 364         if ( (salt_princ_s = kerberos_secrets_fetch_des_salt()) == NULL ) {
 365
 366                 /* look under the old key.  If this fails, just use the standard key */
 367
 368                 if (smb_krb5_unparse_name(context, host_princ, &unparsed_name) != 0) {
 369                         return (krb5_principal)NULL;
 370                 }
 371                 if ((salt_princ_s = kerberos_secrets_fetch_salting_principal(unparsed_name, enctype)) == NULL) {
 372                         /* fall back to host/machine.realm@REALM */
 373                         salt_princ_s = kerberos_standard_des_salt();
 374                 }
 375         }
 376
 377         if (smb_krb5_parse_name(context, salt_princ_s, &ret_princ) != 0) {
 378                 ret_princ = NULL;
 379         }
 380
 381         SAFE_FREE(unparsed_name);
 382         SAFE_FREE(salt_princ_s);
 383
 384         return ret_princ;
 385 }
 386
 387 /************************************************************************
 388  Routine to set the salting principal for this service.  Active
 389  Directory may use a non-obvious principal name to generate the salt
 390  when it determines the key to use for encrypting tickets for a service,
 391  and hopefully we detected that when we joined the domain.
 392  Setting principal to NULL deletes this entry.
 393  ************************************************************************/
 394
 395 BOOL kerberos_secrets_store_salting_principal(const char *service,
 396                                               int enctype,
 397                                               const char *principal)
 398 {
 399         char *key = NULL;
 400         BOOL ret = False;
 401         krb5_context context = NULL;
 402         krb5_principal princ = NULL;
 403         char *princ_s = NULL;
 404         char *unparsed_name = NULL;
 405
 406         krb5_init_context(&context);
 407         if (!context) {
 408                 return False;
 409         }
 410         if (strchr_m(service, '@')) {
 411                 asprintf(&princ_s, "%s", service);
 412         } else {
 413                 asprintf(&princ_s, "%s@%s", service, lp_realm());
 414         }
 415
 416         if (smb_krb5_parse_name(context, princ_s, &princ) != 0) {
 417                 goto out;
 418
 419         }
 420         if (smb_krb5_unparse_name(context, princ, &unparsed_name) != 0) {
 421                 goto out;
 422         }
 423
 424         asprintf(&key, "%s/%s/enctype=%d", SECRETS_SALTING_PRINCIPAL, unparsed_name, enctype);
 425         if (!key)  {
 426                 goto out;
 427         }
 428
 429         if ((principal != NULL) && (strlen(principal) > 0)) {
 430                 ret = secrets_store(key, principal, strlen(principal) + 1);
 431         } else {
 432                 ret = secrets_delete(key);
 433         }
 434
 435  out:
 436
 437         SAFE_FREE(key);
 438         SAFE_FREE(princ_s);
 439         SAFE_FREE(unparsed_name);
 440
 441         if (context) {
 442                 krb5_free_context(context);
 443         }
 444
 445         return ret;
 446 }
 447
 448
 449 /************************************************************************
 450 ************************************************************************/
 451
 452 int kerberos_kinit_password(const char *principal,
 453                             const char *password,
 454                             int time_offset,
 455                             const char *cache_name)
 456 {
 457         return kerberos_kinit_password_ext(principal,
 458                                            password,
 459                                            time_offset,
 460                                            0,
 461                                            0,
 462                                            cache_name,
 463                                            False,
 464                                            False,
 465                                            0);
 466 }
 467
 468 /************************************************************************
 469  Create a string list of available kdc's, possibly searching by sitename.
 470  Does DNS queries.
 471 ************************************************************************/
 472
 473 static char *get_kdc_ip_string(char *mem_ctx, const char *realm, const char *sitename, struct in_addr primary_ip)
 474 {
 475         struct ip_service *ip_srv_site;
 476         struct ip_service *ip_srv_nonsite;
 477         int count_site, count_nonsite, i;
 478         char *kdc_str = talloc_asprintf(mem_ctx, "\tkdc = %s\n",
 479                                         inet_ntoa(primary_ip));
 480
 481         if (kdc_str == NULL) {
 482                 return NULL;
 483         }
 484
 485         /* Get the KDC's only in this site. */
 486
 487         get_kdc_list(realm, sitename, &ip_srv_site, &count_site);
 488
 489         for (i = 0; i < count_site; i++) {
 490                 if (ip_equal(ip_srv_site[i].ip, primary_ip)) {
 491                         continue;
 492                 }
 493                 /* Append to the string - inefficient but not done often. */
 494                 kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 495                         kdc_str, inet_ntoa(ip_srv_site[i].ip));
 496                 if (!kdc_str) {
 497                         SAFE_FREE(ip_srv_site);
 498                         return NULL;
 499                 }
 500         }
 501
 502         /* Get all KDC's. */
 503
 504         get_kdc_list(realm, NULL, &ip_srv_nonsite, &count_nonsite);
 505
 506         for (i = 0; i < count_nonsite; i++) {
 507                 int j;
 508
 509                 if (ip_equal(ip_srv_nonsite[i].ip, primary_ip)) {
 510                         continue;
 511                 }
 512
 513                 /* Ensure this isn't an IP already seen (YUK! this is n*n....) */
 514                 for (j = 0; j < count_site; j++) {
 515                         if (ip_equal(ip_srv_nonsite[i].ip, ip_srv_site[j].ip)) {
 516                                 break;
 517                         }
 518                         /* As the lists are sorted we can break early if nonsite > site. */
 519                         if (ip_service_compare(&ip_srv_nonsite[i], &ip_srv_site[j]) > 0) {
 520                                 break;
 521                         }
 522                 }
 523                 if (j != i) {
 524                         continue;
 525                 }
 526
 527                 /* Append to the string - inefficient but not done often. */
 528                 kdc_str = talloc_asprintf(mem_ctx, "%s\tkdc = %s\n",
 529                         kdc_str, inet_ntoa(ip_srv_nonsite[i].ip));
 530                 if (!kdc_str) {
 531                         SAFE_FREE(ip_srv_site);
 532                         SAFE_FREE(ip_srv_nonsite);
 533                         return NULL;
 534                 }
 535         }
 536
 537
 538         SAFE_FREE(ip_srv_site);
 539         SAFE_FREE(ip_srv_nonsite);
 540
 541         DEBUG(10,("get_kdc_ip_string: Returning %s\n",
 542                 kdc_str ));
 543
 544         return kdc_str;
 545 }
 546
 547 /************************************************************************
 548  Create  a specific krb5.conf file in the private directory pointing
 549  at a specific kdc for a realm. Keyed off domain name. Sets
 550  KRB5_CONFIG environment variable to point to this file. Must be
 551  run as root or will fail (which is a good thing :-).
 552 ************************************************************************/
 553
 554 BOOL create_local_private_krb5_conf_for_domain(const char *realm, const char *domain,
 555                                         const char *sitename, struct in_addr ip)
 556 {
 557         char *dname = talloc_asprintf(NULL, "%s/smb_krb5", lp_lockdir());
 558         char *tmpname = NULL;
 559         char *fname = NULL;
 560         char *file_contents = NULL;
 561         char *kdc_ip_string = NULL;
 562         size_t flen = 0;
 563         ssize_t ret;
 564         int fd;
 565         char *realm_upper = NULL;
 566
 567         if (!dname) {
 568                 return False;
 569         }
 570         if ((mkdir(dname, 0755)==-1) && (errno != EEXIST)) {
 571                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 572                         "failed to create directory %s. Error was %s\n",
 573                         dname, strerror(errno) ));
 574                 TALLOC_FREE(dname);
 575                 return False;
 576         }
 577
 578         tmpname = talloc_asprintf(dname, "%s/smb_tmp_krb5.XXXXXX", lp_lockdir());
 579         if (!tmpname) {
 580                 TALLOC_FREE(dname);
 581                 return False;
 582         }
 583
 584         fname = talloc_asprintf(dname, "%s/krb5.conf.%s", dname, domain);
 585         if (!fname) {
 586                 TALLOC_FREE(dname);
 587                 return False;
 588         }
 589
 590         DEBUG(10,("create_local_private_krb5_conf_for_domain: fname = %s, realm = %s, domain = %s\n",
 591                 fname, realm, domain ));
 592
 593         realm_upper = talloc_strdup(fname, realm);
 594         strupper_m(realm_upper);
 595
 596         kdc_ip_string = get_kdc_ip_string(dname, realm, sitename, ip);
 597         if (!kdc_ip_string) {
 598                 TALLOC_FREE(dname);
 599                 return False;
 600         }
 601
 602         file_contents = talloc_asprintf(fname, "[libdefaults]\n\tdefault_realm = %s\n\n"
 603                                 "[realms]\n\t%s = {\n"
 604                                 "\t\t%s\t}\n",
 605                                 realm_upper, realm_upper, kdc_ip_string);
 606
 607         if (!file_contents) {
 608                 TALLOC_FREE(dname);
 609                 return False;
 610         }
 611
 612         flen = strlen(file_contents);
 613
 614         fd = smb_mkstemp(tmpname);
 615         if (fd == -1) {
 616                 DEBUG(0,("create_local_private_krb5_conf_for_domain: smb_mkstemp failed,"
 617                         " for file %s. Errno %s\n",
 618                         tmpname, strerror(errno) ));
 619         }
 620
 621         if (fchmod(fd, 0644)==-1) {
 622                 DEBUG(0,("create_local_private_krb5_conf_for_domain: fchmod failed for %s."
 623                         " Errno %s\n",
 624                         tmpname, strerror(errno) ));
 625                 unlink(tmpname);
 626                 close(fd);
 627                 TALLOC_FREE(dname);
 628                 return False;
 629         }
 630
 631         ret = write(fd, file_contents, flen);
 632         if (flen != ret) {
 633                 DEBUG(0,("create_local_private_krb5_conf_for_domain: write failed,"
 634                         " returned %d (should be %u). Errno %s\n",
 635                         (int)ret, (unsigned int)flen, strerror(errno) ));
 636                 unlink(tmpname);
 637                 close(fd);
 638                 TALLOC_FREE(dname);
 639                 return False;
 640         }
 641         if (close(fd)==-1) {
 642                 DEBUG(0,("create_local_private_krb5_conf_for_domain: close failed."
 643                         " Errno %s\n", strerror(errno) ));
 644                 unlink(tmpname);
 645                 TALLOC_FREE(dname);
 646                 return False;
 647         }
 648
 649         if (rename(tmpname, fname) == -1) {
 650                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 651                         "of %s to %s failed. Errno %s\n",
 652                         tmpname, fname, strerror(errno) ));
 653                 unlink(tmpname);
 654                 TALLOC_FREE(dname);
 655                 return False;
 656         }
 657
 658         DEBUG(5,("create_local_private_krb5_conf_for_domain: wrote "
 659                 "file %s with realm %s KDC = %s\n",
 660                 fname, realm_upper, inet_ntoa(ip) ));
 661
 662         /* Set the environment variable to this file. */
 663         setenv("KRB5_CONFIG", fname, 1);
 664
 665 #if defined(OVERWRITE_SYSTEM_KRB5_CONF)
 666
 667 #define SYSTEM_KRB5_CONF_PATH "/etc/krb5.conf"
 668         /* Insanity, sheer insanity..... */
 669
 670         if (strequal(realm, lp_realm())) {
 671                 pstring linkpath;
 672                 int lret;
 673
 674                 lret = readlink(SYSTEM_KRB5_CONF_PATH, linkpath, sizeof(linkpath)-1);
 675                 linkpath[sizeof(pstring)-1] = '\0';
 676
 677                 if (lret == 0 || strcmp(linkpath, fname) == 0) {
 678                         /* Symlink already exists. */
 679                         TALLOC_FREE(dname);
 680                         return True;
 681                 }
 682
 683                 /* Try and replace with a symlink. */
 684                 if (symlink(fname, SYSTEM_KRB5_CONF_PATH) == -1) {
 685                         if (errno != EEXIST) {
 686                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: symlink "
 687                                         "of %s to %s failed. Errno %s\n",
 688                                         fname, SYSTEM_KRB5_CONF_PATH, strerror(errno) ));
 689                                 TALLOC_FREE(dname);
 690                                 return True; /* Not a fatal error. */
 691                         }
 692
 693                         pstrcpy(linkpath, SYSTEM_KRB5_CONF_PATH);
 694                         pstrcat(linkpath, ".saved");
 695
 696                         /* Yes, this is a race conditon... too bad. */
 697                         if (rename(SYSTEM_KRB5_CONF_PATH, linkpath) == -1) {
 698                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: rename "
 699                                         "of %s to %s failed. Errno %s\n",
 700                                         SYSTEM_KRB5_CONF_PATH, linkpath,
 701                                         strerror(errno) ));
 702                                 TALLOC_FREE(dname);
 703                                 return True; /* Not a fatal error. */
 704                         }
 705
 706                         if (symlink(fname, "/etc/krb5.conf") == -1) {
 707                                 DEBUG(0,("create_local_private_krb5_conf_for_domain: "
 708                                         "forced symlink of %s to /etc/krb5.conf failed. Errno %s\n",
 709                                         fname, strerror(errno) ));
 710                                 TALLOC_FREE(dname);
 711                                 return True; /* Not a fatal error. */
 712                         }
 713                 }
 714         }
 715 #endif
 716
 717         TALLOC_FREE(dname);
 718
 719         return True;
 720 }
 721 #endif