drsuapi.idl: fix source_dsa spelling
[samba4-gss.git] / source3 / libsmb / passchange.c
blobc4a82bfcd238a89849b398564a548348bc87fe72
1 /*
2 Unix SMB/CIFS implementation.
3 SMB client password change routine
4 Copyright (C) Andrew Tridgell 1994-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 #include "includes.h"
21 #include "../librpc/gen_ndr/ndr_samr.h"
22 #include "rpc_client/cli_pipe.h"
23 #include "rpc_client/cli_samr.h"
24 #include "libsmb/libsmb.h"
25 #include "libsmb/clirap.h"
26 #include "libsmb/nmblib.h"
27 #include "../libcli/smb/smbXcli_base.h"
29 /*************************************************************
30 Change a password on a remote machine using IPC calls.
31 *************************************************************/
33 NTSTATUS remote_password_change(const char *remote_machine,
34 const char *domain, const char *user_name,
35 const char *old_passwd, const char *new_passwd,
36 char **err_str)
38 struct cli_state *cli = NULL;
39 struct cli_credentials *creds = NULL;
40 struct rpc_pipe_client *pipe_hnd = NULL;
41 NTSTATUS status;
42 NTSTATUS result;
43 bool pass_must_change = False;
45 *err_str = NULL;
47 result = cli_connect_nb(talloc_tos(),
48 remote_machine,
49 NULL,
51 0x20,
52 NULL,
53 SMB_SIGNING_IPC_DEFAULT,
55 &cli);
56 if (!NT_STATUS_IS_OK(result)) {
57 if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED)) {
58 if (asprintf(err_str, "Unable to connect to SMB server on "
59 "machine %s. NetBIOS support disabled\n",
60 remote_machine) == -1) {
61 *err_str = NULL;
63 } else {
64 if (asprintf(err_str, "Unable to connect to SMB server on "
65 "machine %s. Error was : %s.\n",
66 remote_machine, nt_errstr(result))==-1) {
67 *err_str = NULL;
70 return result;
73 creds = cli_session_creds_init(cli,
74 user_name,
75 domain,
76 NULL, /* realm */
77 old_passwd,
78 false, /* use_kerberos */
79 false, /* fallback_after_kerberos */
80 false, /* use_ccache */
81 false); /* password_is_nt_hash */
82 SMB_ASSERT(creds != NULL);
84 result = smbXcli_negprot(cli->conn,
85 cli->timeout,
86 lp_client_ipc_min_protocol(),
87 lp_client_ipc_max_protocol(),
88 NULL,
89 NULL,
90 NULL);
92 if (!NT_STATUS_IS_OK(result)) {
93 if (asprintf(err_str, "machine %s rejected the negotiate "
94 "protocol. Error was : %s.\n",
95 remote_machine, nt_errstr(result)) == -1) {
96 *err_str = NULL;
98 cli_shutdown(cli);
99 return result;
102 /* Given things like SMB signing, restrict anonymous and the like,
103 try an authenticated connection first */
104 result = cli_session_setup_creds(cli, creds);
106 if (!NT_STATUS_IS_OK(result)) {
108 /* Password must change or Password expired are the only valid
109 * error conditions here from where we can proceed, the rest like
110 * account locked out or logon failure will lead to errors later
111 * anyway */
113 if (!NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_MUST_CHANGE) &&
114 !NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_EXPIRED)) {
115 if (asprintf(err_str, "Could not connect to machine %s: "
116 "%s\n", remote_machine, nt_errstr(result)) == -1) {
117 *err_str = NULL;
119 cli_shutdown(cli);
120 return result;
123 pass_must_change = True;
126 * We should connect as the anonymous user here, in case
127 * the server has "must change password" checked...
128 * Thanks to <Nicholas.S.Jenkins@cdc.com> for this fix.
131 result = cli_session_setup_anon(cli);
133 if (!NT_STATUS_IS_OK(result)) {
134 if (asprintf(err_str, "machine %s rejected the session "
135 "setup. Error was : %s.\n",
136 remote_machine, nt_errstr(result)) == -1) {
137 *err_str = NULL;
139 cli_shutdown(cli);
140 return result;
144 result = cli_tree_connect(cli, "IPC$", "IPC", NULL);
145 if (!NT_STATUS_IS_OK(result)) {
146 if (asprintf(err_str, "machine %s rejected the tconX on the "
147 "IPC$ share. Error was : %s.\n",
148 remote_machine, nt_errstr(result))) {
149 *err_str = NULL;
151 cli_shutdown(cli);
152 return result;
155 /* Try not to give the password away too easily */
157 if (!pass_must_change) {
158 const struct sockaddr_storage *remote_sockaddr =
159 smbXcli_conn_remote_sockaddr(cli->conn);
161 result = cli_rpc_pipe_open_with_creds(cli,
162 &ndr_table_samr,
163 NCACN_NP,
164 DCERPC_AUTH_TYPE_NTLMSSP,
165 DCERPC_AUTH_LEVEL_PRIVACY,
166 NULL, /* target_service */
167 remote_machine,
168 remote_sockaddr,
169 creds,
170 &pipe_hnd);
171 } else {
173 * If the user password must be changed the ntlmssp bind will
174 * fail the same way as the session setup above did. The
175 * difference is that with a pipe bind we don't get a good
176 * error message, the result will be that the rpc call below
177 * will just fail. So we do it anonymously, there's no other
178 * way.
180 result = cli_rpc_pipe_open_noauth(
181 cli, &ndr_table_samr, &pipe_hnd);
184 if (!NT_STATUS_IS_OK(result)) {
185 if (lp_client_lanman_auth()) {
186 /* Use the old RAP method. */
187 result = cli_oem_change_password(cli,
188 user_name,
189 new_passwd,
190 old_passwd);
191 if (!NT_STATUS_IS_OK(result)) {
192 if (asprintf(err_str, "machine %s rejected the "
193 "password change: Error was : %s.\n",
194 remote_machine, nt_errstr(result)) == -1) {
195 *err_str = NULL;
197 cli_shutdown(cli);
198 return result;
200 } else {
201 if (asprintf(err_str, "SAMR connection to machine %s "
202 "failed. Error was %s, but LANMAN password "
203 "changes are disabled\n",
204 remote_machine, nt_errstr(result)) == -1) {
205 *err_str = NULL;
207 cli_shutdown(cli);
208 return result;
212 status = dcerpc_samr_chgpasswd_user4(pipe_hnd->binding_handle,
213 talloc_tos(),
214 pipe_hnd->srv_name_slash,
215 user_name,
216 old_passwd,
217 new_passwd,
218 &result);
219 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
220 /* All good, password successfully changed. */
221 cli_shutdown(cli);
222 return NT_STATUS_OK;
224 if (!NT_STATUS_IS_OK(status)) {
225 if (NT_STATUS_EQUAL(status,
226 NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
227 NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) ||
228 NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
229 /* DO NOT FALLBACK TO RC4 */
230 if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED) {
231 cli_shutdown(cli);
232 return NT_STATUS_STRONG_CRYPTO_NOT_SUPPORTED;
235 } else {
236 if (!NT_STATUS_IS_OK(result)) {
237 int rc = asprintf(
238 err_str,
239 "machine %s rejected to change the password "
240 "with error: %s\n",
241 remote_machine,
242 get_friendly_nt_error_msg(result));
243 if (rc <= 0) {
244 *err_str = NULL;
246 cli_shutdown(cli);
247 return result;
251 result = rpccli_samr_chgpasswd_user2(pipe_hnd, talloc_tos(),
252 user_name, new_passwd, old_passwd);
253 if (NT_STATUS_IS_OK(result)) {
254 /* Great - it all worked! */
255 cli_shutdown(cli);
256 return NT_STATUS_OK;
259 if (!(NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ||
260 NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)))
262 /* it failed, but for reasons such as wrong password, too short etc ... */
264 if (asprintf(err_str, "machine %s rejected the password change: "
265 "Error was : %s.\n",
266 remote_machine, get_friendly_nt_error_msg(result)) == -1) {
267 *err_str = NULL;
269 cli_shutdown(cli);
270 return result;
273 /* OK, that failed, so try again... */
274 TALLOC_FREE(pipe_hnd);
276 /* OK, this is ugly, but... try an anonymous pipe. */
277 result = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr,
278 &pipe_hnd);
280 if ( NT_STATUS_IS_OK(result) &&
281 (NT_STATUS_IS_OK(result = rpccli_samr_chgpasswd_user2(
282 pipe_hnd, talloc_tos(), user_name,
283 new_passwd, old_passwd)))) {
284 /* Great - it all worked! */
285 cli_shutdown(cli);
286 return NT_STATUS_OK;
287 } else {
288 if (!(NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)
289 || NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL))) {
290 /* it failed, but again it was due to things like new password too short */
292 if (asprintf(err_str, "machine %s rejected the "
293 "(anonymous) password change: Error was : "
294 "%s.\n", remote_machine,
295 get_friendly_nt_error_msg(result)) == -1) {
296 *err_str = NULL;
298 cli_shutdown(cli);
299 return result;
302 /* We have failed to change the user's password, and we think the server
303 just might not support SAMR password changes, so fall back */
305 if (!lp_client_lanman_auth()) {
306 if (asprintf(err_str, "SAMR connection to machine %s "
307 "failed. Error was %s, but LANMAN password "
308 "changes are disabled\n",
309 remote_machine, nt_errstr(result)) == -1) {
310 *err_str = NULL;
312 cli_shutdown(cli);
313 return NT_STATUS_UNSUCCESSFUL;
316 /* Use the old RAP method. */
317 result = cli_oem_change_password(cli,
318 user_name,
319 new_passwd,
320 old_passwd);
321 if (NT_STATUS_IS_OK(result)) {
322 /* SAMR failed, but the old LanMan protocol worked! */
324 cli_shutdown(cli);
325 return NT_STATUS_OK;
328 if (asprintf(err_str,
329 "machine %s rejected the password "
330 "change: Error was : %s.\n",
331 remote_machine,
332 nt_errstr(result)) == -1)
334 *err_str = NULL;
336 cli_shutdown(cli);
337 return result;