2 * Unix SMB/CIFS implementation.
3 * Routines to operate on various trust relationships
4 * Copyright (C) Andrew Bartlett 2001
5 * Copyright (C) Rafal Szczesniak 2003
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 #include "../libcli/auth/libcli_auth.h"
23 #include "rpc_client/cli_netlogon.h"
24 #include "rpc_client/cli_pipe.h"
25 #include "../librpc/gen_ndr/ndr_netlogon.h"
28 #include "libsmb/libsmb.h"
30 /*********************************************************
31 Change the domain password on the PDC.
32 Do most of the legwork ourselfs. Caller must have
33 already setup the connection to the NETLOGON pipe
34 **********************************************************/
36 NTSTATUS trust_pw_find_change_and_store_it(struct rpc_pipe_client *cli,
40 unsigned char old_trust_passwd_hash[16];
41 unsigned char new_trust_passwd_hash[16];
42 enum netr_SchannelType sec_channel_type = SEC_CHAN_NULL;
43 const char *account_name;
44 char *new_trust_passwd;
47 if (!get_trust_pw_hash(domain, old_trust_passwd_hash, &account_name,
49 DEBUG(0, ("could not fetch domain secrets for domain %s!\n", domain));
50 return NT_STATUS_UNSUCCESSFUL;
53 switch (sec_channel_type) {
58 return NT_STATUS_NOT_SUPPORTED;
61 /* Create a random machine account password */
62 new_trust_passwd = generate_random_password(mem_ctx,
63 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
64 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
65 if (new_trust_passwd == NULL) {
66 DEBUG(0, ("generate_random_password failed\n"));
67 return NT_STATUS_NO_MEMORY;
70 E_md4hash(new_trust_passwd, new_trust_passwd_hash);
72 nt_status = rpccli_netlogon_set_trust_password(cli, mem_ctx,
74 old_trust_passwd_hash,
76 new_trust_passwd_hash,
79 if (NT_STATUS_IS_OK(nt_status)) {
80 DEBUG(3,("%s : trust_pw_change_and_store_it: Changed password.\n",
81 current_timestring(talloc_tos(), False)));
83 * Return the result of trying to write the new password
84 * back into the trust account file.
87 switch (sec_channel_type) {
90 if (!secrets_store_machine_password(new_trust_passwd, domain, sec_channel_type)) {
91 nt_status = NT_STATUS_UNSUCCESSFUL;
95 case SEC_CHAN_DOMAIN: {
98 time_t pass_last_set_time;
100 /* we need to get the sid first for the
101 * pdb_set_trusteddom_pw call */
103 if (!pdb_get_trusteddom_pw(domain, &pwd, &sid, &pass_last_set_time)) {
104 nt_status = NT_STATUS_TRUSTED_RELATIONSHIP_FAILURE;
106 if (!pdb_set_trusteddom_pw(domain, new_trust_passwd, &sid)) {
107 nt_status = NT_STATUS_INTERNAL_DB_CORRUPTION;