1 /* $NetBSD: check.c,v 1.1.1.2 2014/04/24 12:45:27 pettai Exp $ */
4 * Copyright (c) 2005 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the Institute nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 * Check database for strange configurations on default principals
40 #include "kadmin_locl.h"
41 #include "kadmin-commands.h"
44 get_check_entry(const char *name
, kadm5_principal_ent_rec
*ent
)
47 krb5_principal principal
;
49 ret
= krb5_parse_name(context
, name
, &principal
);
51 krb5_warn(context
, ret
, "krb5_unparse_name: %s", name
);
55 memset(ent
, 0, sizeof(*ent
));
56 ret
= kadm5_get_principal(kadm_handle
, principal
, ent
, 0);
57 krb5_free_principal(context
, principal
);
66 do_check_entry(krb5_principal principal
, void *data
)
69 kadm5_principal_ent_rec princ
;
73 ret
= krb5_unparse_name(context
, principal
, &name
);
77 memset (&princ
, 0, sizeof(princ
));
78 ret
= kadm5_get_principal(kadm_handle
, principal
, &princ
,
79 KADM5_PRINCIPAL
| KADM5_KEY_DATA
);
81 krb5_warn(context
, ret
, "Failed to get principal: %s", name
);
86 for (i
= 0; i
< princ
.n_key_data
; i
++) {
88 ret
= krb5_enctype_keysize(context
,
89 princ
.key_data
[i
].key_data_type
[0],
91 if (ret
== 0 && keysize
!= (size_t)princ
.key_data
[i
].key_data_length
[0]) {
93 "Principal %s enctype %d, wrong length: %lu\n",
94 name
, princ
.key_data
[i
].key_data_type
[0],
95 (unsigned long)princ
.key_data
[i
].key_data_length
);
100 kadm5_free_principal_ent(kadm_handle
, &princ
);
106 check(void *opt
, int argc
, char **argv
)
108 kadm5_principal_ent_rec ent
;
110 char *realm
= NULL
, *p
, *p2
;
114 ret
= krb5_get_default_realm(context
, &realm
);
116 krb5_warn(context
, ret
, "krb5_get_default_realm");
120 realm
= strdup(argv
[0]);
122 krb5_warnx(context
, "malloc");
128 * Check krbtgt/REALM@REALM
130 * For now, just check existance
133 if (asprintf(&p
, "%s/%s@%s", KRB5_TGS_NAME
, realm
, realm
) == -1) {
134 krb5_warn(context
, errno
, "asprintf");
138 ret
= get_check_entry(p
, &ent
);
140 printf("%s doesn't exist, are you sure %s is a realm in your database",
147 kadm5_free_principal_ent(kadm_handle
, &ent
);
150 * Check kadmin/admin@REALM
153 if (asprintf(&p
, "kadmin/admin@%s", realm
) == -1) {
154 krb5_warn(context
, errno
, "asprintf");
158 ret
= get_check_entry(p
, &ent
);
160 printf("%s doesn't exist, "
161 "there is no way to do remote administration", p
);
167 kadm5_free_principal_ent(kadm_handle
, &ent
);
170 * Check kadmin/changepw@REALM
173 if (asprintf(&p
, "kadmin/changepw@%s", realm
) == -1) {
174 krb5_warn(context
, errno
, "asprintf");
178 ret
= get_check_entry(p
, &ent
);
180 printf("%s doesn't exist, "
181 "there is no way to do change password", p
);
187 kadm5_free_principal_ent(kadm_handle
, &ent
);
190 * Check for duplicate afs keys
195 krb5_warn(context
, errno
, "malloc");
200 if (asprintf(&p
, "afs/%s@%s", p2
, realm
) == -1) {
201 krb5_warn(context
, errno
, "asprintf");
207 ret
= get_check_entry(p
, &ent
);
210 kadm5_free_principal_ent(kadm_handle
, &ent
);
215 if (asprintf(&p
, "afs@%s", realm
) == -1) {
216 krb5_warn(context
, errno
, "asprintf");
220 ret
= get_check_entry(p
, &ent
);
223 kadm5_free_principal_ent(kadm_handle
, &ent
);
225 krb5_warnx(context
, "afs@REALM and afs/cellname@REALM both exists");
230 foreach_principal("*", do_check_entry
, "check", NULL
);