source4/kdc/kpasswd-helper.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Samba kpasswd implementation
   5
   6    Copyright (c) 2005      Andrew Bartlett <abartlet@samba.org>
   7    Copyright (c) 2016      Andreas Schneider <asn@samba.org>
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "system/kerberos.h"
  25 #include "librpc/gen_ndr/samr.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "auth/auth.h"
  28 #include "kdc/kpasswd-helper.h"
  29
  30 bool kpasswd_make_error_reply(TALLOC_CTX *mem_ctx,
  31                               krb5_error_code error_code,
  32                               const char *error_string,
  33                               DATA_BLOB *error_data)
  34 {
  35         bool ok;
  36         char *s;
  37         size_t slen;
  38
  39         if (error_code == 0) {
  40                 DBG_DEBUG("kpasswd reply - %s\n", error_string);
  41         } else {
  42                 DBG_INFO("kpasswd reply - %s\n", error_string);
  43         }
  44
  45         ok = push_utf8_talloc(mem_ctx, &s, error_string, &slen);
  46         if (!ok) {
  47                 return false;
  48         }
  49
  50         /*
  51          * The string 's' has two terminating nul-bytes which are also
  52          * reflected by 'slen'. Normally Kerberos doesn't expect that strings
  53          * are nul-terminated, but Heimdal does!
  54          */
  55 #ifndef SAMBA4_USES_HEIMDAL
  56         if (slen < 2) {
  57                 return false;
  58         }
  59         slen -= 2;
  60 #endif
  61         if (2 + slen < slen) {
  62                 return false;
  63         }
  64         error_data->length = 2 + slen;
  65         error_data->data = talloc_size(mem_ctx, error_data->length);
  66         if (error_data->data == NULL) {
  67                 talloc_free(s);
  68                 return false;
  69         }
  70
  71         RSSVAL(error_data->data, 0, error_code);
  72         memcpy(error_data->data + 2, s, slen);
  73
  74         talloc_free(s);
  75
  76         return true;
  77 }
  78
  79 bool kpasswd_make_pwchange_reply(TALLOC_CTX *mem_ctx,
  80                                  NTSTATUS status,
  81                                  enum samPwdChangeReason reject_reason,
  82                                  struct samr_DomInfo1 *dominfo,
  83                                  DATA_BLOB *error_blob)
  84 {
  85         const char *reject_string = NULL;
  86
  87         if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
  88                 return kpasswd_make_error_reply(mem_ctx,
  89                                                 KRB5_KPASSWD_ACCESSDENIED,
  90                                                 "No such user when changing password",
  91                                                 error_blob);
  92         } else if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
  93                 return kpasswd_make_error_reply(mem_ctx,
  94                                                 KRB5_KPASSWD_ACCESSDENIED,
  95                                                 "Not permitted to change password",
  96                                                 error_blob);
  97         }
  98         if (dominfo != NULL &&
  99             NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION)) {
 100                 switch (reject_reason) {
 101                 case SAM_PWD_CHANGE_PASSWORD_TOO_SHORT:
 102                         reject_string =
 103                                 talloc_asprintf(mem_ctx,
 104                                                 "Password too short, password "
 105                                                 "must be at least %d characters "
 106                                                 "long.",
 107                                                 dominfo->min_password_length);
 108                         if (reject_string == NULL) {
 109                                 reject_string = "Password too short";
 110                         }
 111                         break;
 112                 case SAM_PWD_CHANGE_NOT_COMPLEX:
 113                         reject_string = "Password does not meet complexity "
 114                                         "requirements";
 115                         break;
 116                 case SAM_PWD_CHANGE_PWD_IN_HISTORY:
 117                         reject_string =
 118                                 talloc_asprintf(mem_ctx,
 119                                                 "Password is already in password "
 120                                                 "history. New password must not "
 121                                                 "match any of your %d previous "
 122                                                 "passwords.",
 123                                                 dominfo->password_history_length);
 124                         if (reject_string == NULL) {
 125                                 reject_string = "Password is already in password "
 126                                                 "history";
 127                         }
 128                         break;
 129                 default:
 130                         reject_string = "Password change rejected, password "
 131                                         "changes may not be permitted on this "
 132                                         "account, or the minimum password age "
 133                                         "may not have elapsed.";
 134                         break;
 135                 }
 136
 137                 return kpasswd_make_error_reply(mem_ctx,
 138                                                 KRB5_KPASSWD_SOFTERROR,
 139                                                 reject_string,
 140                                                 error_blob);
 141         }
 142
 143         if (!NT_STATUS_IS_OK(status)) {
 144                 reject_string = talloc_asprintf(mem_ctx,
 145                                                 "Failed to set password: %s",
 146                                                 nt_errstr(status));
 147                 if (reject_string == NULL) {
 148                         reject_string = "Failed to set password";
 149                 }
 150                 return kpasswd_make_error_reply(mem_ctx,
 151                                                 KRB5_KPASSWD_HARDERROR,
 152                                                 reject_string,
 153                                                 error_blob);
 154         }
 155
 156         return kpasswd_make_error_reply(mem_ctx,
 157                                         KRB5_KPASSWD_SUCCESS,
 158                                         "Password changed",
 159                                         error_blob);
 160 }
 161
 162 NTSTATUS kpasswd_samdb_set_password(TALLOC_CTX *mem_ctx,
 163                                     struct tevent_context *event_ctx,
 164                                     struct loadparm_context *lp_ctx,
 165                                     struct auth_session_info *session_info,
 166                                     bool is_service_principal,
 167                                     const char *target_principal_name,
 168                                     DATA_BLOB *password,
 169                                     enum samPwdChangeReason *reject_reason,
 170                                     struct samr_DomInfo1 **dominfo)
 171 {
 172         NTSTATUS status;
 173         struct ldb_context *samdb;
 174         struct ldb_dn *target_dn = NULL;
 175         int rc;
 176
 177         samdb = samdb_connect(mem_ctx,
 178                               event_ctx,
 179                               lp_ctx,
 180                               session_info,
 181                               0);
 182         if (samdb == NULL) {
 183                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 184         }
 185
 186         DBG_INFO("%s\\%s (%s) is changing password of %s\n",
 187                  session_info->info->domain_name,
 188                  session_info->info->account_name,
 189                  dom_sid_string(mem_ctx,
 190                                 &session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
 191                  target_principal_name);
 192
 193         rc = ldb_transaction_start(samdb);
 194         if (rc != LDB_SUCCESS) {
 195                 return NT_STATUS_TRANSACTION_ABORTED;
 196         }
 197
 198         if (is_service_principal) {
 199                 status = crack_service_principal_name(samdb,
 200                                                       mem_ctx,
 201                                                       target_principal_name,
 202                                                       &target_dn,
 203                                                       NULL);
 204         } else {
 205                 status = crack_user_principal_name(samdb,
 206                                                    mem_ctx,
 207                                                    target_principal_name,
 208                                                    &target_dn,
 209                                                    NULL);
 210         }
 211         if (!NT_STATUS_IS_OK(status)) {
 212                 ldb_transaction_cancel(samdb);
 213                 return status;
 214         }
 215
 216         status = samdb_set_password(samdb,
 217                                     mem_ctx,
 218                                     target_dn,
 219                                     NULL, /* domain_dn */
 220                                     password,
 221                                     NULL, /* lmNewHash */
 222                                     NULL, /* ntNewHash */
 223                                     NULL, /* lmOldHash */
 224                                     NULL, /* ntOldHash */
 225                                     reject_reason,
 226                                     dominfo);
 227         if (NT_STATUS_IS_OK(status)) {
 228                 rc = ldb_transaction_commit(samdb);
 229                 if (rc != LDB_SUCCESS) {
 230                         DBG_WARNING("Failed to commit transaction to "
 231                                     "set password on %s: %s\n",
 232                                     ldb_dn_get_linearized(target_dn),
 233                                     ldb_errstring(samdb));
 234                         return NT_STATUS_TRANSACTION_ABORTED;
 235                 }
 236         } else {
 237                 ldb_transaction_cancel(samdb);
 238         }
 239
 240         return status;
 241 }