Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 : SMB client password change routine
4 : Copyright (C) Andrew Tridgell 1994-1998
5 :
6 : This program is free software; you can redistribute it and/or modify
7 : it under the terms of the GNU General Public License as published by
8 : the Free Software Foundation; either version 3 of the License, or
9 : (at your option) any later version.
10 :
11 : This program is distributed in the hope that it will be useful,
12 : but WITHOUT ANY WARRANTY; without even the implied warranty of
13 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 : GNU General Public License for more details.
15 :
16 : You should have received a copy of the GNU General Public License
17 : along with this program. If not, see <http://www.gnu.org/licenses/>.
18 : */
19 :
20 : #include "includes.h"
21 : #include "../librpc/gen_ndr/ndr_samr.h"
22 : #include "rpc_client/cli_pipe.h"
23 : #include "rpc_client/cli_samr.h"
24 : #include "libsmb/libsmb.h"
25 : #include "libsmb/clirap.h"
26 : #include "libsmb/nmblib.h"
27 : #include "../libcli/smb/smbXcli_base.h"
28 :
29 : /*************************************************************
30 : Change a password on a remote machine using IPC calls.
31 : *************************************************************/
32 :
33 6 : NTSTATUS remote_password_change(const char *remote_machine,
34 : const char *domain, const char *user_name,
35 : const char *old_passwd, const char *new_passwd,
36 : char **err_str)
37 : {
38 6 : struct cli_state *cli = NULL;
39 6 : struct cli_credentials *creds = NULL;
40 6 : struct rpc_pipe_client *pipe_hnd = NULL;
41 : NTSTATUS status;
42 : NTSTATUS result;
43 6 : bool pass_must_change = False;
44 :
45 6 : *err_str = NULL;
46 :
47 6 : result = cli_connect_nb(talloc_tos(),
48 : remote_machine,
49 : NULL,
50 : 0,
51 : 0x20,
52 : NULL,
53 : SMB_SIGNING_IPC_DEFAULT,
54 : 0,
55 : &cli);
56 6 : if (!NT_STATUS_IS_OK(result)) {
57 0 : if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) {
58 0 : if (asprintf(err_str, "Unable to connect to SMB server on "
59 : "machine %s. NetBIOS support disabled\n",
60 : remote_machine) == -1) {
61 0 : *err_str = NULL;
62 : }
63 : } else {
64 0 : if (asprintf(err_str, "Unable to connect to SMB server on "
65 : "machine %s. Error was : %s.\n",
66 : remote_machine, nt_errstr(result))==-1) {
67 0 : *err_str = NULL;
68 : }
69 : }
70 0 : return result;
71 : }
72 :
73 6 : creds = cli_session_creds_init(cli,
74 : user_name,
75 : domain,
76 : NULL, /* realm */
77 : old_passwd,
78 : false, /* use_kerberos */
79 : false, /* fallback_after_kerberos */
80 : false, /* use_ccache */
81 : false); /* password_is_nt_hash */
82 6 : SMB_ASSERT(creds != NULL);
83 :
84 6 : result = smbXcli_negprot(cli->conn,
85 6 : cli->timeout,
86 6 : lp_client_ipc_min_protocol(),
87 6 : lp_client_ipc_max_protocol(),
88 : NULL,
89 : NULL,
90 : NULL);
91 :
92 6 : if (!NT_STATUS_IS_OK(result)) {
93 0 : if (asprintf(err_str, "machine %s rejected the negotiate "
94 : "protocol. Error was : %s.\n",
95 : remote_machine, nt_errstr(result)) == -1) {
96 0 : *err_str = NULL;
97 : }
98 0 : cli_shutdown(cli);
99 0 : return result;
100 : }
101 :
102 : /* Given things like SMB signing, restrict anonymous and the like,
103 : try an authenticated connection first */
104 6 : result = cli_session_setup_creds(cli, creds);
105 :
106 6 : if (!NT_STATUS_IS_OK(result)) {
107 :
108 : /* Password must change or Password expired are the only valid
109 : * error conditions here from where we can proceed, the rest like
110 : * account locked out or logon failure will lead to errors later
111 : * anyway */
112 :
113 0 : if (!NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) &&
114 0 : !NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED)) {
115 0 : if (asprintf(err_str, "Could not connect to machine %s: "
116 : "%s\n", remote_machine, nt_errstr(result)) == -1) {
117 0 : *err_str = NULL;
118 : }
119 0 : cli_shutdown(cli);
120 0 : return result;
121 : }
122 :
123 0 : pass_must_change = True;
124 :
125 : /*
126 : * We should connect as the anonymous user here, in case
127 : * the server has "must change password" checked...
128 : * Thanks to <Nicholas.S.Jenkins@cdc.com> for this fix.
129 : */
130 :
131 0 : result = cli_session_setup_anon(cli);
132 :
133 0 : if (!NT_STATUS_IS_OK(result)) {
134 0 : if (asprintf(err_str, "machine %s rejected the session "
135 : "setup. Error was : %s.\n",
136 : remote_machine, nt_errstr(result)) == -1) {
137 0 : *err_str = NULL;
138 : }
139 0 : cli_shutdown(cli);
140 0 : return result;
141 : }
142 : }
143 :
144 6 : result = cli_tree_connect(cli, "IPC$", "IPC", NULL);
145 6 : if (!NT_STATUS_IS_OK(result)) {
146 0 : if (asprintf(err_str, "machine %s rejected the tconX on the "
147 : "IPC$ share. Error was : %s.\n",
148 : remote_machine, nt_errstr(result))) {
149 0 : *err_str = NULL;
150 : }
151 0 : cli_shutdown(cli);
152 0 : return result;
153 : }
154 :
155 : /* Try not to give the password away too easily */
156 :
157 6 : if (!pass_must_change) {
158 : const struct sockaddr_storage *remote_sockaddr =
159 6 : smbXcli_conn_remote_sockaddr(cli->conn);
160 :
161 6 : result = cli_rpc_pipe_open_with_creds(cli,
162 : &ndr_table_samr,
163 : NCACN_NP,
164 : DCERPC_AUTH_TYPE_NTLMSSP,
165 : DCERPC_AUTH_LEVEL_PRIVACY,
166 : remote_machine,
167 : remote_sockaddr,
168 : creds,
169 : &pipe_hnd);
170 : } else {
171 : /*
172 : * If the user password must be changed the ntlmssp bind will
173 : * fail the same way as the session setup above did. The
174 : * difference is that with a pipe bind we don't get a good
175 : * error message, the result will be that the rpc call below
176 : * will just fail. So we do it anonymously, there's no other
177 : * way.
178 : */
179 0 : result = cli_rpc_pipe_open_noauth(
180 : cli, &ndr_table_samr, &pipe_hnd);
181 : }
182 :
183 6 : if (!NT_STATUS_IS_OK(result)) {
184 0 : if (lp_client_lanman_auth()) {
185 : /* Use the old RAP method. */
186 0 : if (!cli_oem_change_password(cli, user_name, new_passwd, old_passwd)) {
187 0 : result = cli_nt_error(cli);
188 0 : if (asprintf(err_str, "machine %s rejected the "
189 : "password change: Error was : %s.\n",
190 : remote_machine, nt_errstr(result)) == -1) {
191 0 : *err_str = NULL;
192 : }
193 0 : cli_shutdown(cli);
194 0 : return result;
195 : }
196 : } else {
197 0 : if (asprintf(err_str, "SAMR connection to machine %s "
198 : "failed. Error was %s, but LANMAN password "
199 : "changes are disabled\n",
200 : remote_machine, nt_errstr(result)) == -1) {
201 0 : *err_str = NULL;
202 : }
203 0 : cli_shutdown(cli);
204 0 : return result;
205 : }
206 : }
207 :
208 6 : status = dcerpc_samr_chgpasswd_user4(pipe_hnd->binding_handle,
209 : talloc_tos(),
210 6 : pipe_hnd->srv_name_slash,
211 : user_name,
212 : old_passwd,
213 : new_passwd,
214 : &result);
215 6 : if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
216 : /* All good, password successfully changed. */
217 6 : cli_shutdown(cli);
218 6 : return NT_STATUS_OK;
219 : }
220 0 : if (!NT_STATUS_IS_OK(status)) {
221 0 : if (NT_STATUS_EQUAL(status,
222 0 : NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
223 0 : NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) ||
224 0 : NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
225 : /* DO NOT FALLBACK TO RC4 */
226 0 : if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED) {
227 0 : cli_shutdown(cli);
228 0 : return NT_STATUS_STRONG_CRYPTO_NOT_SUPPORTED;
229 : }
230 : }
231 : } else {
232 0 : if (!NT_STATUS_IS_OK(result)) {
233 0 : int rc = asprintf(
234 : err_str,
235 : "machine %s rejected to change the password"
236 : "with error: %s",
237 : remote_machine,
238 : get_friendly_nt_error_msg(result));
239 0 : if (rc <= 0) {
240 0 : *err_str = NULL;
241 : }
242 0 : cli_shutdown(cli);
243 0 : return result;
244 : }
245 : }
246 :
247 0 : result = rpccli_samr_chgpasswd_user2(pipe_hnd, talloc_tos(),
248 : user_name, new_passwd, old_passwd);
249 0 : if (NT_STATUS_IS_OK(result)) {
250 : /* Great - it all worked! */
251 0 : cli_shutdown(cli);
252 0 : return NT_STATUS_OK;
253 :
254 0 : } else if (!(NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)
255 0 : || NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL))) {
256 : /* it failed, but for reasons such as wrong password, too short etc ... */
257 :
258 0 : if (asprintf(err_str, "machine %s rejected the password change: "
259 : "Error was : %s.\n",
260 : remote_machine, get_friendly_nt_error_msg(result)) == -1) {
261 0 : *err_str = NULL;
262 : }
263 0 : cli_shutdown(cli);
264 0 : return result;
265 : }
266 :
267 : /* OK, that failed, so try again... */
268 0 : TALLOC_FREE(pipe_hnd);
269 :
270 : /* Try anonymous NTLMSSP... */
271 0 : result = NT_STATUS_UNSUCCESSFUL;
272 :
273 : /* OK, this is ugly, but... try an anonymous pipe. */
274 0 : result = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
275 : &pipe_hnd);
276 :
277 0 : if ( NT_STATUS_IS_OK(result) &&
278 0 : (NT_STATUS_IS_OK(result = rpccli_samr_chgpasswd_user2(
279 : pipe_hnd, talloc_tos(), user_name,
280 : new_passwd, old_passwd)))) {
281 : /* Great - it all worked! */
282 0 : cli_shutdown(cli);
283 0 : return NT_STATUS_OK;
284 : } else {
285 0 : if (!(NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)
286 0 : || NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL))) {
287 : /* it failed, but again it was due to things like new password too short */
288 :
289 0 : if (asprintf(err_str, "machine %s rejected the "
290 : "(anonymous) password change: Error was : "
291 : "%s.\n", remote_machine,
292 : get_friendly_nt_error_msg(result)) == -1) {
293 0 : *err_str = NULL;
294 : }
295 0 : cli_shutdown(cli);
296 0 : return result;
297 : }
298 :
299 : /* We have failed to change the user's password, and we think the server
300 : just might not support SAMR password changes, so fall back */
301 :
302 0 : if (lp_client_lanman_auth()) {
303 : /* Use the old RAP method. */
304 0 : if (cli_oem_change_password(cli, user_name, new_passwd, old_passwd)) {
305 : /* SAMR failed, but the old LanMan protocol worked! */
306 :
307 0 : cli_shutdown(cli);
308 0 : return NT_STATUS_OK;
309 : }
310 :
311 0 : result = cli_nt_error(cli);
312 0 : if (asprintf(err_str, "machine %s rejected the password "
313 : "change: Error was : %s.\n",
314 : remote_machine, nt_errstr(result)) == -1) {
315 0 : *err_str = NULL;
316 : }
317 0 : cli_shutdown(cli);
318 0 : return result;
319 : } else {
320 0 : if (asprintf(err_str, "SAMR connection to machine %s "
321 : "failed. Error was %s, but LANMAN password "
322 : "changes are disabled\n",
323 : remote_machine, nt_errstr(result)) == -1) {
324 0 : *err_str = NULL;
325 : }
326 0 : cli_shutdown(cli);
327 0 : return NT_STATUS_UNSUCCESSFUL;
328 : }
329 : }
330 : }
|
