1 /* Unix NT password database implementation, version 0.6.
3 * This program is free software; you can redistribute it and/or modify it under
4 * the terms of the GNU General Public License as published by the Free
5 * Software Foundation; either version 3 of the License, or (at your option)
8 * This program is distributed in the hope that it will be useful, but WITHOUT
9 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
10 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
13 * You should have received a copy of the GNU General Public License along with
14 * this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "../libcli/auth/libcli_auth.h"
25 #if defined(HAVE_SECURITY_PAM_EXT_H)
26 #include <security/pam_ext.h>
27 #elif defined(HAVE_PAM_PAM_EXT_H)
28 #include <pam/pam_ext.h>
31 #if defined(HAVE_SECURITY__PAM_MACROS_H)
32 #include <security/_pam_macros.h>
33 #elif defined(HAVE_PAM__PAM_MACROS_H)
34 #include <pam/_pam_macros.h>
41 #define _pam_overwrite(x) \
43 register char *__xx__; \
50 * Don't just free it, forget it too.
53 #define _pam_drop(X) \
61 #define _pam_drop_reply(/* struct pam_response * */ reply, /* int */ replies) \
65 for (reply_i=0; reply_i<replies; ++reply_i) { \
66 if (reply[reply_i].resp) { \
67 _pam_overwrite(reply[reply_i].resp); \
68 free(reply[reply_i].resp); \
76 int converse(pam_handle_t *, int, int, struct pam_message **,
77 struct pam_response **);
78 int make_remark(pam_handle_t *, unsigned int, int, const char *);
79 void _cleanup(pam_handle_t *, void *, int);
80 char *_pam_delete(register char *);
82 /* syslogging function for errors and other information */
83 #ifdef HAVE_PAM_VSYSLOG
84 void _log_err( pam_handle_t *pamh, int err, const char *format, ... )
88 va_start(args, format);
89 pam_vsyslog(pamh, err, format, args);
93 void _log_err( pam_handle_t *pamh, int err, const char *format, ... )
98 if (asprintf(&mod_format, "(pam_smbpass) %s", format) == -1) {
100 * try really, really hard to log something, since
101 * this may have been a message about a malloc()
104 va_start(args, format);
105 vsyslog(err | LOG_AUTH, format, args);
110 va_start(args, format);
111 vsyslog(err | LOG_AUTH, mod_format, args);
118 /* this is a front-end for module-application conversations */
120 int converse( pam_handle_t * pamh, int ctrl, int nargs
121 , struct pam_message **message
122 , struct pam_response **response )
125 struct pam_conv *conv = NULL;
127 retval = _pam_get_item(pamh, PAM_CONV, &conv);
128 if (retval == PAM_SUCCESS) {
130 retval = conv->conv(nargs, (const struct pam_message **) message
131 ,response, conv->appdata_ptr);
133 if (retval != PAM_SUCCESS && on(SMB_DEBUG, ctrl)) {
134 _log_err(pamh, LOG_DEBUG, "conversation failure [%s]"
135 ,pam_strerror(pamh, retval));
138 _log_err(pamh, LOG_ERR, "couldn't obtain coversation function [%s]"
139 ,pam_strerror(pamh, retval));
142 return retval; /* propagate error status */
145 int make_remark( pam_handle_t * pamh, unsigned int ctrl
146 , int type, const char *text )
148 if (off(SMB__QUIET, ctrl)) {
149 struct pam_message *pmsg[1], msg[1];
150 struct pam_response *resp;
153 msg[0].msg = discard_const_p(char, text);
154 msg[0].msg_style = type;
157 return converse(pamh, ctrl, 1, pmsg, &resp);
163 /* set the control flags for the SMB module. */
165 unsigned int set_ctrl(pam_handle_t *pamh,
171 const char *service_file = NULL;
175 ctrl = SMB_DEFAULTS; /* the default selection of options */
177 /* set some flags manually */
179 /* A good, sane default (matches Samba's behavior). */
180 set( SMB__NONULL, ctrl );
182 /* initialize service file location */
183 service_file=get_dyn_CONFIGFILE();
185 if (flags & PAM_SILENT) {
186 set( SMB__QUIET, ctrl );
189 /* Run through the arguments once, looking for an alternate smb config
194 for (j = 0; j < SMB_CTRLS_; ++j) {
195 if (smb_args[j].token
196 && !strncmp(argv[i], smb_args[j].token, strlen(smb_args[j].token)))
202 if (j == SMB_CONF_FILE) {
203 service_file = argv[i] + 8;
208 /* Read some options from the Samba config. Can be overridden by
210 if(lp_load_client(service_file) == false) {
211 _log_err(pamh, LOG_ERR, "Error loading service file %s", service_file);
216 _log_err(pamh, LOG_ERR, "Error loading secrets database");
219 if (lp_null_passwords()) {
220 set( SMB__NULLOK, ctrl );
223 /* now parse the rest of the arguments to this module */
228 for (j = 0; j < SMB_CTRLS_; ++j) {
229 if (smb_args[j].token
230 && !strncmp(*argv, smb_args[j].token, strlen(smb_args[j].token)))
236 if (j >= SMB_CTRLS_) {
237 _log_err(pamh, LOG_ERR, "unrecognized option [%s]", *argv);
239 ctrl &= smb_args[j].mask; /* for turning things off */
240 ctrl |= smb_args[j].flag; /* for turning things on */
243 ++argv; /* step to next argument */
246 /* auditing is a more sensitive version of debug */
248 if (on( SMB_AUDIT, ctrl )) {
249 set( SMB_DEBUG, ctrl );
251 /* return the set of flags */
256 /* use this to free strings. ESPECIALLY password strings */
258 char * _pam_delete( register char *xx )
260 _pam_overwrite( xx );
265 void _cleanup( pam_handle_t * pamh, void *x, int error_status )
267 x = _pam_delete( (char *) x );
272 * Safe duplication of character strings. "Paranoid"; don't leave
273 * evidence of old token around for later stack analysis.
276 char * smbpXstrDup( pam_handle_t *pamh, const char *x )
278 register char *newstr = NULL;
283 for (i = 0; x[i]; ++i); /* length of string */
284 if ((newstr = SMB_MALLOC_ARRAY(char, ++i)) == NULL) {
286 _log_err(pamh, LOG_CRIT, "out of memory in smbpXstrDup");
294 return newstr; /* return the duplicate or NULL on error */
297 /* ************************************************************** *
298 * Useful non-trivial functions *
299 * ************************************************************** */
301 void _cleanup_failures( pam_handle_t * pamh, void *fl, int err )
304 const char *service = NULL;
305 struct _pam_failed_auth *failure;
307 #ifdef PAM_DATA_SILENT
308 quiet = err & PAM_DATA_SILENT; /* should we log something? */
312 #ifdef PAM_DATA_REPLACE
313 err &= PAM_DATA_REPLACE; /* are we just replacing data? */
315 failure = (struct _pam_failed_auth *) fl;
317 if (failure != NULL) {
319 #ifdef PAM_DATA_SILENT
320 if (!quiet && !err) { /* under advisement from Sun,may go away */
322 if (!quiet) { /* under advisement from Sun,may go away */
325 /* log the number of authentication failures */
326 if (failure->count != 0) {
327 _pam_get_item( pamh, PAM_SERVICE, &service );
328 _log_err(pamh, LOG_NOTICE
329 , "%d authentication %s "
330 "from %s for service %s as %s(%d)"
332 , failure->count == 1 ? "failure" : "failures"
334 , service == NULL ? "**unknown**" : service
335 , failure->user, failure->id );
336 if (failure->count > SMB_MAX_RETRIES) {
337 _log_err(pamh, LOG_ALERT
338 , "service(%s) ignoring max retries; %d > %d"
339 , service == NULL ? "**unknown**" : service
345 _pam_delete( failure->agent ); /* tidy up */
346 _pam_delete( failure->user ); /* tidy up */
347 SAFE_FREE( failure );
351 int _smb_verify_password( pam_handle_t * pamh, struct samu *sampass,
352 const char *p, unsigned int ctrl )
356 int retval = PAM_AUTH_ERR;
363 name = pdb_get_username(sampass);
365 #ifdef HAVE_PAM_FAIL_DELAY
366 if (off( SMB_NODELAY, ctrl )) {
367 (void) pam_fail_delay( pamh, 1000000 ); /* 1 sec delay for on failure */
371 if (!pdb_get_nt_passwd(sampass))
373 _log_err(pamh, LOG_DEBUG, "user %s has null SMB password", name);
375 if (off( SMB__NONULL, ctrl )
376 && (pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ))
377 { /* this means we've succeeded */
380 const char *service = NULL;
382 _pam_get_item( pamh, PAM_SERVICE, &service );
383 _log_err(pamh, LOG_NOTICE, "failed auth request by %s for service %s as %s",
384 uidtoname(getuid()), service ? service : "**unknown**", name);
389 if (asprintf(&data_name, "-SMB-FAIL- %s", name) == -1) {
390 _log_err(pamh, LOG_CRIT, "no memory for data-name" );
395 * The password we were given wasn't an encrypted password, or it
396 * didn't match the one we have. We encrypt the password now and try
400 nt_lm_owf_gen(p, nt_pw, lm_pw);
402 /* the moment of truth -- do we agree with the password? */
404 if (!memcmp( nt_pw, pdb_get_nt_passwd(sampass), 16 )) {
406 retval = PAM_SUCCESS;
407 if (data_name) { /* reset failures */
408 pam_set_data(pamh, data_name, NULL, _cleanup_failures);
412 const char *service = NULL;
414 retval = PAM_AUTH_ERR;
416 _pam_get_item( pamh, PAM_SERVICE, &service );
418 if (data_name != NULL) {
419 struct _pam_failed_auth *newauth = NULL;
420 const struct _pam_failed_auth *old = NULL;
422 /* get a failure recorder */
424 newauth = SMB_MALLOC_P( struct _pam_failed_auth );
426 if (newauth != NULL) {
428 /* any previous failures for this user ? */
429 _pam_get_data(pamh, data_name, &old);
432 newauth->count = old->count + 1;
433 if (newauth->count >= SMB_MAX_RETRIES) {
434 retval = PAM_MAXTRIES;
437 _log_err(pamh, LOG_NOTICE,
438 "failed auth request by %s for service %s as %s",
440 service ? service : "**unknown**", name);
443 if (!sid_to_uid(pdb_get_user_sid(sampass), &(newauth->id))) {
444 _log_err(pamh, LOG_NOTICE,
445 "failed auth request by %s for service %s as %s",
447 service ? service : "**unknown**", name);
449 newauth->user = smbpXstrDup( pamh, name );
450 newauth->agent = smbpXstrDup( pamh, uidtoname( getuid() ) );
451 pam_set_data( pamh, data_name, newauth, _cleanup_failures );
454 _log_err(pamh, LOG_CRIT, "no memory for failure recorder" );
455 _log_err(pamh, LOG_NOTICE,
456 "failed auth request by %s for service %s as %s(%d)",
458 service ? service : "**unknown**", name);
461 _log_err(pamh, LOG_NOTICE,
462 "failed auth request by %s for service %s as %s(%d)",
464 service ? service : "**unknown**", name);
467 _pam_delete( data_name );
474 * _smb_blankpasswd() is a quick check for a blank password
476 * returns TRUE if user does not have a password
477 * - to avoid prompting for one in such cases (CG)
480 int _smb_blankpasswd( unsigned int ctrl, struct samu *sampass )
485 * This function does not have to be too smart if something goes
486 * wrong, return FALSE and let this case to be treated somewhere
490 if (on( SMB__NONULL, ctrl ))
491 return 0; /* will fail but don't let on yet */
493 if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ))
496 if (pdb_get_nt_passwd(sampass) == NULL)
505 * obtain a password from the user
508 int _smb_read_password( pam_handle_t * pamh, unsigned int ctrl,
509 const char *comment, const char *prompt1,
510 const char *prompt2, const char *data_name, char **pass )
517 struct pam_message msg[3], *pmsg[3];
518 struct pam_response *resp;
522 /* make sure nothing inappropriate gets returned */
524 *pass = token = NULL;
526 /* which authentication token are we getting? */
528 authtok_flag = on(SMB__OLD_PASSWD, ctrl) ? PAM_OLDAUTHTOK : PAM_AUTHTOK;
530 /* should we obtain the password from a PAM item ? */
532 if (on(SMB_TRY_FIRST_PASS, ctrl) || on(SMB_USE_FIRST_PASS, ctrl)) {
533 retval = _pam_get_item( pamh, authtok_flag, &item );
534 if (retval != PAM_SUCCESS) {
536 _log_err(pamh, LOG_ALERT,
537 "pam_get_item returned error to smb_read_password");
539 } else if (item != NULL) { /* we have a password! */
543 } else if (on( SMB_USE_FIRST_PASS, ctrl )) {
544 return PAM_AUTHTOK_RECOVER_ERR; /* didn't work */
545 } else if (on( SMB_USE_AUTHTOK, ctrl )
546 && off( SMB__OLD_PASSWD, ctrl ))
548 return PAM_AUTHTOK_RECOVER_ERR;
553 * getting here implies we will have to get the password from the
557 /* prepare to converse */
558 if (comment != NULL && off(SMB__QUIET, ctrl)) {
560 msg[0].msg_style = PAM_TEXT_INFO;
561 msg[0].msg = discard_const_p(char, comment);
568 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
569 msg[i++].msg = discard_const_p(char, prompt1);
571 if (prompt2 != NULL) {
573 msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
574 msg[i++].msg = discard_const_p(char, prompt2);
581 retval = converse( pamh, ctrl, i, pmsg, &resp );
584 int j = comment ? 1 : 0;
585 /* interpret the response */
587 if (retval == PAM_SUCCESS) { /* a good conversation */
589 token = smbpXstrDup(pamh, resp[j++].resp);
592 /* verify that password entered correctly */
593 if (!resp[j].resp || strcmp( token, resp[j].resp )) {
594 _pam_delete( token );
595 retval = PAM_AUTHTOK_RECOVER_ERR;
596 make_remark( pamh, ctrl, PAM_ERROR_MSG
601 _log_err(pamh, LOG_NOTICE,
602 "could not recover authentication token");
607 _pam_drop_reply( resp, expect );
610 retval = (retval == PAM_SUCCESS) ? PAM_AUTHTOK_RECOVER_ERR : retval;
613 if (retval != PAM_SUCCESS) {
614 if (on( SMB_DEBUG, ctrl ))
615 _log_err(pamh, LOG_DEBUG, "unable to obtain a password");
618 /* 'token' is the entered password */
620 if (off( SMB_NOT_SET_PASS, ctrl )) {
622 /* we store this password as an item */
624 retval = pam_set_item( pamh, authtok_flag, (const void *)token );
625 _pam_delete( token ); /* clean it up */
626 if (retval != PAM_SUCCESS
627 || (retval = _pam_get_item( pamh, authtok_flag
628 ,&item )) != PAM_SUCCESS)
630 _log_err(pamh, LOG_CRIT, "error manipulating password");
635 * then store it as data specific to this module. pam_end()
636 * will arrange to clean it up.
639 retval = pam_set_data( pamh, data_name, (void *) token, _cleanup );
640 if (retval != PAM_SUCCESS
641 || (retval = _pam_get_data( pamh, data_name, &item ))
644 _log_err(pamh, LOG_CRIT, "error manipulating password data [%s]",
645 pam_strerror( pamh, retval ));
646 _pam_delete( token );
650 token = NULL; /* break link to password */
654 item = NULL; /* break link to password */
659 int _pam_smb_approve_pass(pam_handle_t * pamh,
661 const char *pass_old,
662 const char *pass_new )
665 /* Further checks should be handled through module stacking. -SRL */
666 if (pass_new == NULL || (pass_old && !strcmp( pass_old, pass_new )))
668 if (on(SMB_DEBUG, ctrl)) {
669 _log_err(pamh, LOG_DEBUG,
670 "passwd: bad authentication token (null or unchanged)");
672 make_remark( pamh, ctrl, PAM_ERROR_MSG, pass_new == NULL ?
673 "No password supplied" : "Password unchanged" );
674 return PAM_AUTHTOK_ERR;
681 * Work around the pam API that has functions with void ** as parameters
682 * These lead to strict aliasing warnings with gcc.
684 int _pam_get_item(const pam_handle_t *pamh,
688 const void **item = (const void **)_item;
689 return pam_get_item(pamh, item_type, item);
692 int _pam_get_data(const pam_handle_t *pamh,
693 const char *module_data_name,
696 const void **data = (const void **)_data;
697 return pam_get_data(pamh, module_data_name, data);