1 /* $NetBSD: init.c,v 1.1.1.1 2011/04/13 18:14:35 elric Exp $ */
4 * Copyright (c) 1997-2004 Kungliga Tekniska Högskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
21 * 3. Neither the name of the Institute nor the names of its contributors
22 * may be used to endorse or promote products derived from this software
23 * without specific prior written permission.
25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 #include "kadmin_locl.h"
39 #include "kadmin-commands.h"
40 #include <kadm5/private.h>
43 create_random_entry(krb5_principal princ
,
48 kadm5_principal_ent_rec ent
;
57 random_password(pwbuf
, sizeof(pwbuf
));
60 ret
= krb5_unparse_name(context
, princ
, &name
);
62 krb5_warn(context
, ret
, "failed to unparse principal name");
66 memset(&ent
, 0, sizeof(ent
));
67 ent
.principal
= princ
;
68 mask
|= KADM5_PRINCIPAL
;
70 ent
.max_life
= max_life
;
71 mask
|= KADM5_MAX_LIFE
;
74 ent
.max_renewable_life
= max_rlife
;
75 mask
|= KADM5_MAX_RLIFE
;
77 ent
.attributes
|= attributes
| KRB5_KDB_DISALLOW_ALL_TIX
;
78 mask
|= KADM5_ATTRIBUTES
;
80 /* Create the entry with a random password */
81 ret
= kadm5_create_principal(kadm_handle
, &ent
, mask
, password
);
83 krb5_warn(context
, ret
, "create_random_entry(%s): randkey failed",
88 /* Replace the string2key based keys with real random bytes */
89 ret
= kadm5_randkey_principal(kadm_handle
, princ
, &keys
, &n_keys
);
91 krb5_warn(context
, ret
, "create_random_entry(%s): randkey failed",
95 for(i
= 0; i
< n_keys
; i
++)
96 krb5_free_keyblock_contents(context
, &keys
[i
]);
98 ret
= kadm5_get_principal(kadm_handle
, princ
, &ent
,
99 KADM5_PRINCIPAL
| KADM5_ATTRIBUTES
);
101 krb5_warn(context
, ret
, "create_random_entry(%s): "
102 "unable to get principal", name
);
105 ent
.attributes
&= (~KRB5_KDB_DISALLOW_ALL_TIX
);
107 ret
= kadm5_modify_principal(kadm_handle
, &ent
,
108 KADM5_ATTRIBUTES
|KADM5_KVNO
);
109 kadm5_free_principal_ent (kadm_handle
, &ent
);
111 krb5_warn(context
, ret
, "create_random_entry(%s): "
112 "unable to modify principal", name
);
120 extern int local_flag
;
123 init(struct init_options
*opt
, int argc
, char **argv
)
128 krb5_deltat max_life
= 0, max_rlife
= 0;
131 krb5_warnx(context
, "init is only available in local (-l) mode");
135 if (opt
->realm_max_ticket_life_string
) {
136 if (str2deltat (opt
->realm_max_ticket_life_string
, &max_life
) != 0) {
137 krb5_warnx (context
, "unable to parse \"%s\"",
138 opt
->realm_max_ticket_life_string
);
142 if (opt
->realm_max_renewable_life_string
) {
143 if (str2deltat (opt
->realm_max_renewable_life_string
, &max_rlife
) != 0) {
144 krb5_warnx (context
, "unable to parse \"%s\"",
145 opt
->realm_max_renewable_life_string
);
150 db
= _kadm5_s_get_db(kadm_handle
);
152 ret
= db
->hdb_open(context
, db
, O_RDWR
| O_CREAT
, 0600);
154 krb5_warn(context
, ret
, "hdb_open");
157 db
->hdb_close(context
, db
);
158 for(i
= 0; i
< argc
; i
++){
159 krb5_principal princ
;
160 const char *realm
= argv
[i
];
162 if (opt
->realm_max_ticket_life_string
== NULL
) {
164 if(edit_deltat ("Realm max ticket life", &max_life
, NULL
, 0)) {
168 if (opt
->realm_max_renewable_life_string
== NULL
) {
170 if(edit_deltat("Realm max renewable ticket life", &max_rlife
,
176 /* Create `krbtgt/REALM' */
177 ret
= krb5_make_principal(context
, &princ
, realm
,
178 KRB5_TGS_NAME
, realm
, NULL
);
182 create_random_entry(princ
, max_life
, max_rlife
, 0);
183 krb5_free_principal(context
, princ
);
188 /* Create `kadmin/changepw' */
189 krb5_make_principal(context
, &princ
, realm
,
190 "kadmin", "changepw", NULL
);
192 * The Windows XP (at least) password changing protocol
193 * request the `kadmin/changepw' ticket with `renewable_ok,
194 * renewable, forwardable' and so fails if we disallow
197 create_random_entry(princ
, 5*60, 5*60,
198 KRB5_KDB_DISALLOW_TGT_BASED
|
199 KRB5_KDB_PWCHANGE_SERVICE
|
200 KRB5_KDB_DISALLOW_POSTDATED
|
201 KRB5_KDB_DISALLOW_RENEWABLE
|
202 KRB5_KDB_DISALLOW_PROXIABLE
|
203 KRB5_KDB_REQUIRES_PRE_AUTH
);
204 krb5_free_principal(context
, princ
);
206 /* Create `kadmin/admin' */
207 krb5_make_principal(context
, &princ
, realm
,
208 "kadmin", "admin", NULL
);
209 create_random_entry(princ
, 60*60, 60*60, KRB5_KDB_REQUIRES_PRE_AUTH
);
210 krb5_free_principal(context
, princ
);
212 /* Create `changepw/kerberos' (for v4 compat) */
213 krb5_make_principal(context
, &princ
, realm
,
214 "changepw", "kerberos", NULL
);
215 create_random_entry(princ
, 60*60, 60*60,
216 KRB5_KDB_DISALLOW_TGT_BASED
|
217 KRB5_KDB_PWCHANGE_SERVICE
);
219 krb5_free_principal(context
, princ
);
221 /* Create `kadmin/hprop' for database propagation */
222 krb5_make_principal(context
, &princ
, realm
,
223 "kadmin", "hprop", NULL
);
224 create_random_entry(princ
, 60*60, 60*60,
225 KRB5_KDB_REQUIRES_PRE_AUTH
|
226 KRB5_KDB_DISALLOW_TGT_BASED
);
227 krb5_free_principal(context
, princ
);
229 /* Create `WELLKNOWN/ANONYMOUS' for anonymous as-req */
230 krb5_make_principal(context
, &princ
, realm
,
231 KRB5_WELLKNOWN_NAME
, KRB5_ANON_NAME
, NULL
);
232 create_random_entry(princ
, 60*60, 60*60,
233 KRB5_KDB_REQUIRES_PRE_AUTH
);
234 krb5_free_principal(context
, princ
);
237 /* Create `default' */
239 kadm5_principal_ent_rec ent
;
242 memset (&ent
, 0, sizeof(ent
));
243 mask
|= KADM5_PRINCIPAL
;
244 krb5_make_principal(context
, &ent
.principal
, realm
,
246 mask
|= KADM5_MAX_LIFE
;
247 ent
.max_life
= 24 * 60 * 60;
248 mask
|= KADM5_MAX_RLIFE
;
249 ent
.max_renewable_life
= 7 * ent
.max_life
;
250 ent
.attributes
= KRB5_KDB_DISALLOW_ALL_TIX
;
251 mask
|= KADM5_ATTRIBUTES
;
253 ret
= kadm5_create_principal(kadm_handle
, &ent
, mask
, "");
255 krb5_err (context
, 1, ret
, "kadm5_create_principal");
257 krb5_free_principal(context
, ent
.principal
);