source4/kdc/kpasswd-helper.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Samba kpasswd implementation
   5
   6    Copyright (c) 2005      Andrew Bartlett <abartlet@samba.org>
   7    Copyright (c) 2016      Andreas Schneider <asn@samba.org>
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/kerberos.h"
  25 #include "librpc/gen_ndr/samr.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "auth/auth.h"
  28 #include "kdc/kpasswd-helper.h"
  29
  30 bool kpasswd_make_error_reply(TALLOC_CTX *mem_ctx,
  31                               krb5_error_code error_code,
  32                               const char *error_string,
  33                               DATA_BLOB *error_data)
  34 {
  35         bool ok;
  36         char *s;
  37         size_t slen;
  38
  39         if (error_code == 0) {
  40                 DBG_DEBUG("kpasswd reply - %s\n", error_string);
  41         } else {
  42                 DBG_INFO("kpasswd reply - %s\n", error_string);
  43         }
  44
  45         ok = push_utf8_talloc(mem_ctx, &s, error_string, &slen);
  46         if (!ok) {
  47                 return false;
  48         }
  49
  50         /*
  51          * The string 's' has one terminating nul-byte which is also
  52          * reflected by 'slen'. We subtract it from the length.
  53          */
  54         if (slen < 1) {
  55                 talloc_free(s);
  56                 return false;
  57         }
  58         slen--;
  59
  60         /* Two bytes are added to the length to account for the error code. */
  61         if (2 + slen < slen) {
  62                 talloc_free(s);
  63                 return false;
  64         }
  65         error_data->length = 2 + slen;
  66         error_data->data = talloc_size(mem_ctx, error_data->length);
  67         if (error_data->data == NULL) {
  68                 talloc_free(s);
  69                 return false;
  70         }
  71
  72         RSSVAL(error_data->data, 0, error_code);
  73         memcpy(error_data->data + 2, s, slen);
  74
  75         talloc_free(s);
  76
  77         return true;
  78 }
  79
  80 bool kpasswd_make_pwchange_reply(TALLOC_CTX *mem_ctx,
  81                                  NTSTATUS status,
  82                                  enum samPwdChangeReason reject_reason,
  83                                  struct samr_DomInfo1 *dominfo,
  84                                  DATA_BLOB *error_blob)
  85 {
  86         const char *reject_string = NULL;
  87
  88         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
  89                 return kpasswd_make_error_reply(mem_ctx,
  90                                                 KRB5_KPASSWD_ACCESSDENIED,
  91                                                 "No such user when changing password",
  92                                                 error_blob);
  93         } else if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
  94                 return kpasswd_make_error_reply(mem_ctx,
  95                                                 KRB5_KPASSWD_ACCESSDENIED,
  96                                                 "Not permitted to change password",
  97                                                 error_blob);
  98         }
  99         if (dominfo != NULL &&
 100             NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
 101                 switch (reject_reason) {
 102                 case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT:
 103                         reject_string =
 104                                 talloc_asprintf(mem_ctx,
 105                                                 "Password too short, password "
 106                                                 "must be at least %d characters "
 107                                                 "long.",
 108                                                 dominfo->min_password_length);
 109                         if (reject_string == NULL) {
 110                                 reject_string = "Password too short";
 111                         }
 112                         break;
 113                 case SAM_PWD_CHANGE_NOT_COMPLEX:
 114                         reject_string = "Password does not meet complexity "
 115                                         "requirements";
 116                         break;
 117                 case SAM_PWD_CHANGE_PWD_IN_HISTORY:
 118                         reject_string =
 119                                 talloc_asprintf(mem_ctx,
 120                                                 "Password is already in password "
 121                                                 "history. New password must not "
 122                                                 "match any of your %d previous "
 123                                                 "passwords.",
 124                                                 dominfo->password_history_length);
 125                         if (reject_string == NULL) {
 126                                 reject_string = "Password is already in password "
 127                                                 "history";
 128                         }
 129                         break;
 130                 default:
 131                         reject_string = "Password change rejected, password "
 132                                         "changes may not be permitted on this "
 133                                         "account, or the minimum password age "
 134                                         "may not have elapsed.";
 135                         break;
 136                 }
 137
 138                 return kpasswd_make_error_reply(mem_ctx,
 139                                                 KRB5_KPASSWD_SOFTERROR,
 140                                                 reject_string,
 141                                                 error_blob);
 142         }
 143
 144         if (!NT_STATUS_IS_OK(status)) {
 145                 reject_string = talloc_asprintf(mem_ctx,
 146                                                 "Failed to set password: %s",
 147                                                 nt_errstr(status));
 148                 if (reject_string == NULL) {
 149                         reject_string = "Failed to set password";
 150                 }
 151                 return kpasswd_make_error_reply(mem_ctx,
 152                                                 KRB5_KPASSWD_HARDERROR,
 153                                                 reject_string,
 154                                                 error_blob);
 155         }
 156
 157         return kpasswd_make_error_reply(mem_ctx,
 158                                         KRB5_KPASSWD_SUCCESS,
 159                                         "Password changed",
 160                                         error_blob);
 161 }
 162
 163 NTSTATUS kpasswd_samdb_set_password(TALLOC_CTX *mem_ctx,
 164                                     struct tevent_context *event_ctx,
 165                                     struct loadparm_context *lp_ctx,
 166                                     struct auth_session_info *session_info,
 167                                     bool is_service_principal,
 168                                     const char *target_principal_name,
 169                                     DATA_BLOB *password,
 170                                     enum samPwdChangeReason *reject_reason,
 171                                     struct samr_DomInfo1 **dominfo)
 172 {
 173         NTSTATUS status;
 174         struct ldb_context *samdb;
 175         struct ldb_dn *target_dn = NULL;
 176         int rc;
 177
 178         samdb = samdb_connect(mem_ctx,
 179                               event_ctx,
 180                               lp_ctx,
 181                               session_info,
 182                               NULL,
 183                               0);
 184         if (samdb == NULL) {
 185                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 186         }
 187
 188         DBG_INFO("%s\\%s (%s) is changing password of %s\n",
 189                  session_info->info->domain_name,
 190                  session_info->info->account_name,
 191                  dom_sid_string(mem_ctx,
 192                                 &session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
 193                  target_principal_name);
 194
 195         rc = ldb_transaction_start(samdb);
 196         if (rc != LDB_SUCCESS) {
 197                 return NT_STATUS_TRANSACTION_ABORTED;
 198         }
 199
 200         if (is_service_principal) {
 201                 status = crack_service_principal_name(samdb,
 202                                                       mem_ctx,
 203                                                       target_principal_name,
 204                                                       &target_dn,
 205                                                       NULL);
 206         } else {
 207                 status = crack_user_principal_name(samdb,
 208                                                    mem_ctx,
 209                                                    target_principal_name,
 210                                                    &target_dn,
 211                                                    NULL);
 212         }
 213         if (!NT_STATUS_IS_OK(status)) {
 214                 ldb_transaction_cancel(samdb);
 215                 return status;
 216         }
 217
 218         status = samdb_set_password(samdb,
 219                                     mem_ctx,
 220                                     target_dn,
 221                                     NULL, /* domain_dn */
 222                                     password,
 223                                     NULL, /* lmNewHash */
 224                                     NULL, /* ntNewHash */
 225                                     NULL, /* lmOldHash */
 226                                     NULL, /* ntOldHash */
 227                                     reject_reason,
 228                                     dominfo);
 229         if (NT_STATUS_IS_OK(status)) {
 230                 rc = ldb_transaction_commit(samdb);
 231                 if (rc != LDB_SUCCESS) {
 232                         DBG_WARNING("Failed to commit transaction to "
 233                                     "set password on %s: %s\n",
 234                                     ldb_dn_get_linearized(target_dn),
 235                                     ldb_errstring(samdb));
 236                         return NT_STATUS_TRANSACTION_ABORTED;
 237                 }
 238         } else {
 239                 ldb_transaction_cancel(samdb);
 240         }
 241
 242         return status;
 243 }