summaryrefslogtreecommitdiff
path: root/auth
Commit message (Collapse)AuthorAgeFilesLines
* krb5-samba: interdomain trust uses different salt principalAlexander Bokovoy2018-09-051-4/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Salt principal for the interdomain trust is krbtgt/DOMAIN@REALM where DOMAIN is the sAMAccountName without the dollar sign ($) The salt principal for the BLA$ user object was generated wrong. dn: CN=bla.base,CN=System,DC=w4edom-l4,DC=base securityIdentifier: S-1-5-21-4053568372-2049667917-3384589010 trustDirection: 3 trustPartner: bla.base trustPosixOffset: -2147483648 trustType: 2 trustAttributes: 8 flatName: BLA dn: CN=BLA$,CN=Users,DC=w4edom-l4,DC=base userAccountControl: 2080 primaryGroupID: 513 objectSid: S-1-5-21-278041429-3399921908-1452754838-1597 accountExpires: 9223372036854775807 sAMAccountName: BLA$ sAMAccountType: 805306370 pwdLastSet: 131485652467995000 The salt stored by Windows in the package_PrimaryKerberosBlob (within supplementalCredentials) seems to be 'W4EDOM-L4.BASEkrbtgtBLA' for the above trust and Samba stores 'W4EDOM-L4.BASEBLA$'. While the salt used when building the keys from trustAuthOutgoing/trustAuthIncoming is 'W4EDOM-L4.BASEkrbtgtBLA.BASE', which we handle correct. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13539 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Alexander Bokovoy <ab@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Sep 5 03:57:22 CEST 2018 on sn-devel-144 (cherry picked from commit f3e349bebc443133fdbe4e14b148ca8db8237060) Autobuild-User(v4-7-test): Stefan Metzmacher <metze@samba.org> Autobuild-Date(v4-7-test): Wed Sep 5 18:44:46 CEST 2018 on sn-devel-144
* lib: Fix array size in audit_loggingAndreas Schneider2018-06-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ../lib/audit_logging/audit_logging.c: In function ‘json_add_timestamp’: ../lib/audit_logging/audit_logging.c:603:12: error: ‘%s’ directive output may be truncated writing up to 9 bytes into a region of size between 0 and 43 [-Werror=format-truncation=] "%s.%06ld%s", ^~ ../lib/audit_logging/audit_logging.c:606:3: tz); ~~ ../lib/audit_logging/audit_logging.c:600:2: note: ‘snprintf’ output between 8 and 70 bytes into a destination of size 50 snprintf( ^~~~~~~~~ timestamp, ~~~~~~~~~~ sizeof(timestamp), ~~~~~~~~~~~~~~~~~~ "%s.%06ld%s", ~~~~~~~~~~~~~ buffer, ~~~~~~~ tv.tv_usec, ~~~~~~~~~~~ tz); ~~~ BUG: https://bugzilla.samba.org/show_bug.cgi?id=13437 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org> (cherry picked from commit 8b7c8eb3907e2123acee67949e88c26072afc81a)
* auth/ntlmssp: fix handling of GENSEC_FEATURE_LDAP_STYLE as a serverStefan Metzmacher2018-06-042-19/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes "NTLMSSP NTLM2 packet check failed due to invalid signature!" error messages, which were generated if the client only sends NTLMSSP_NEGOTIATE_SIGN without NTLMSSP_NEGOTIATE_SEAL on an LDAP connection. This fixes a regession in the combination of commits 77adac8c3cd2f7419894d18db735782c9646a202 and 3a0b835408a6efa339e8b34333906bfe3aacd6e3. We need to evaluate GENSEC_FEATURE_LDAP_STYLE at the end of the authentication (as a server, while we already do so at the beginning as a client). As a reminder I introduced GENSEC_FEATURE_LDAP_STYLE (as an internal flag) in order to let us work as a Windows using NTLMSSP for LDAP. Even if only signing is negotiated during the authentication the following PDUs will still be encrypted if NTLMSSP is used. This is exactly the same as if the client would have negotiated NTLMSSP_NEGOTIATE_SEAL. I guess it's a bug in Windows, but we have to reimplement that bug. Note this only applies to NTLMSSP and only to LDAP! Signing only works fine for LDAP with Kerberos or DCERPC and NTLMSSP. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13427 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed May 16 03:26:03 CEST 2018 on sn-devel-144 (cherry picked from commit c7a3ce95ac4ce837d8fde36578b3b1f56c3ac2fa)
* auth/ntlmssp: add ntlmssp_client:ldap_style_send_seal optionStefan Metzmacher2018-06-041-7/+17
| | | | | | | | | | | | | This will be used to similate a Windows client only using NTLMSSP_NEGOTIATE_SIGN without NTLMSSP_NEGOTIATE_SEAL on an LDAP connection, which is indicated internally by GENSEC_FEATURE_LDAP_STYLE. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13427 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 7f2bebf09cd8056b3f901dd9ff1fc9e9525f3e9d)
* tests/bind.py: Add a bind test with NTLMSSP with no domainGarming Sam2018-03-201-1/+25
| | | | | | | | | | | Confirmed to pass against Windows 2012 R2. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13206 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 2e49a97777ebf5bffbeadca03517b4a21bca24c0)
* auth: add auth_user_info_copy() functionStefan Metzmacher2018-03-202-0/+38
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13328 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> (cherry picked from commit 6ff891195855403bc485725aef8d43d4e3cabacb)
* CVE-2017-12150: auth/credentials: cli_credentials_authentication_requested() ↵Stefan Metzmacher2017-09-201-0/+16
| | | | | | | | should check for NTLM_CCACHE/SIGN/SEAL BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997 Signed-off-by: Stefan Metzmacher <metze@samba.org>
* source4 netlogon: Add authentication logging for ServerAuthenticate3Gary Lockyer2017-07-311-0/+12
| | | | | | | | | | | | Log NETLOGON authentication activity by instrumenting the netr_ServerAuthenticate3 processing. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12865 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> (cherry picked from commit efc335a03062740f51a6edd09d765a8b77e239c5)
* rpc: use symbolic constant to replace /root/ncalrpc_as_systemGary Lockyer2017-07-311-1/+1
| | | | | | | | | | | | Modified to use constant AS_SYSTEM_MAGIC_PATH_TOKEN instead of string literal "/root/ncalrpc_as_system" BUG: https://bugzilla.samba.org/show_bug.cgi?id=12865 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> (cherry picked from commit 1898096c7ecef4c323b14b7cf30db4283386f913)
* auth: Disable SChannel authentication if we are not a DCAndrew Bartlett2017-07-041-1/+16
| | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* auth/spnego: do basic state_position checking in gensec_spnego_update_in()Stefan Metzmacher2017-06-291-7/+19
| | | | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Jun 29 20:15:05 CEST 2017 on sn-devel-144
* auth/spnego: move gensec_spnego_update() into gensec_spnego_update_send()Stefan Metzmacher2017-06-291-37/+36
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: split out gensec_spnego_update_{client,server}() functionsStefan Metzmacher2017-06-291-200/+256
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: remove unused out_mem_ctx = spnego_state fallback in ↵Stefan Metzmacher2017-06-291-5/+0
| | | | | | | | | gensec_spnego_update() The only caller never passes NULL. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: add gensec_spnego_update_sub_abort() helper functionStefan Metzmacher2017-06-291-22/+31
| | | | | | | This helps to be consistent when destroying a unuseable sub context. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: remove useless spnego_state->sub_sec_ready checkStefan Metzmacher2017-06-291-3/+1
| | | | | | | | | The lines above make sure it's always true. Check with git show -U15 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: consitently set spnego_state->sub_sec_ready = true after ↵Stefan Metzmacher2017-06-291-10/+15
| | | | | | | gensec_update_ev() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: rename spnego_state->no_response_expected to ->sub_sec_readyStefan Metzmacher2017-06-291-10/+10
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: move gensec_spnego_update_out() behind gensec_spnego_update_in()Stefan Metzmacher2017-06-291-59/+62
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: move some more logic to gensec_spnego_update_in()Stefan Metzmacher2017-06-291-6/+10
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: move gensec_spnego_update_in() after gensec_spnego_update_send()Stefan Metzmacher2017-06-291-86/+89
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: set state_position = SPNEGO_DONE in gensec_spnego_update_cleanup()Stefan Metzmacher2017-06-291-4/+22
| | | | | | | | Every fatal error should mark the spnego_state to reject any further update() calls. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: move gensec_spnego_update_wrapper() into ↵Stefan Metzmacher2017-06-291-45/+53
| | | | | | | gensec_spnego_update_send() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/spnego: make use of data_blob_null instead of using data_blob(NULL, 0)Stefan Metzmacher2017-06-291-19/+15
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/credentials: remove unused smb_krb5_create_salt_principal()Stefan Metzmacher2017-06-271-79/+0
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/credentials: make use of smb_krb5_salt_principal() in ↵Stefan Metzmacher2017-06-271-12/+26
| | | | | | | cli_credentials_get_keytab() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth/ntlmssp: enforce NTLMSSP_NEGOTIATE_NTLM2 for the NTLMv2 client caseStefan Metzmacher2017-06-261-0/+21
| | | | | | | | | | | | | | Some servers may not announce the NTLMSSP_NEGOTIATE_NTLM2 (a.k.a. NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY) bit. But if we're acting as a client using NTLMv2 we need to enforce this flag, because it's not really a negotiationable in that case. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12862 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* auth/ntlmssp: make ntlmssp_server_check_password() shorterStefan Metzmacher2017-06-261-49/+53
| | | | | | | | | | We move as must as possible into ntlmssp_server_{pre,post}auth(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Mon Jun 26 13:07:30 CEST 2017 on sn-devel-144
* auth/ntlmssp: remove useless talloc_steal calls in ↵Stefan Metzmacher2017-06-261-2/+5
| | | | | | | | | | | | | ntlmssp_server_check_password() We only create a temporary auth_usersupplied_info structure and pass it down as const, lets keep the values on ntlmssp_state otherwise we may derefence stale pointers. We finally free the memory at the end of ntlmssp_server_postauth() now. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pycredentials: Add support for netr_crypt_passwordGary Lockyer2017-06-223-0/+77
| | | | | | | | | | Add code to encrypt a netr_CryptPassword structure with the current session key. This allows the making of Netr_ServerPasswordSet2 calls from python. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* pycredentials: add function to return the netr_AuthenticatorGary Lockyer2017-06-221-0/+40
| | | | | | | | | | | Add method new_client_authenticator that returns data to allow a netr_Authenticator to be constructed. Allows python to make netr_LogonSamLogonWithFlags, netr_LogonGetDomainInfo and similar calls Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: add GENSEC_UPDATE_IS_NTERROR() helper macroStefan Metzmacher2017-06-171-0/+6
| | | | | | | | | This allows us to write clearer code that checks for NT_STATUS_OK and NT_STATUS_MORE_PROCESSING_REQUIRED. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: clear the update_busy_ptr in gensec_subcontext_start()Stefan Metzmacher2017-06-171-0/+1
| | | | | | | | This is required to support async subcontexts. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth pycredentials: incorrect PyArg_ParseTupleAndKeywords callGary Lockyer2017-05-251-4/+7
| | | | | | | | | | | | | The challenge parameter was being treated as a string rather than as a data blob. This was causing intermittent seg faults. Removed the server_timestamp parameter as it's not currently used. Unable to produce a test case to reliably replicate the failure. However auth_log_samlogon does flap Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth pycredentials: correct docstring of get_ntlm_response methodGary Lockyer2017-05-251-2/+2
| | | | | | | | Fix copy paste error was incorrectly named "get_ntlm_username_domain" Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth_log: Add test that execises the SamLogon python bindingsGary Lockyer2017-05-251-0/+16
| | | | | | Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: make sure there's only one pending gensec_update_send() per contextStefan Metzmacher2017-05-212-1/+34
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: improve NT_STATUS_MORE_PROCESSING_REQUIRED logic in ↵Stefan Metzmacher2017-05-211-7/+11
| | | | | | | gensec_update_*() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: avoid using a state->subreq pointerStefan Metzmacher2017-05-211-12/+7
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: remove the sync update() hook from gensec_security_opsStefan Metzmacher2017-05-212-87/+0
| | | | | | | | | Some backends still do some nested event context magic, but that mapping between async and sync is done in these backends and not in the core gensec code anymore. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/spnego: add simple gensec_spnego_update_send/recv() wrapper functionsStefan Metzmacher2017-05-211-1/+63
| | | | | | | TODO: we still need to do the internals async. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: add implement gensec_ntlmssp_update_send/recv()Stefan Metzmacher2017-05-211-24/+57
| | | | | | | | Currently only backend functions are sync functions, but that needs to change in future. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: make gensec_ntlmssp_update() staticStefan Metzmacher2017-05-212-11/+4
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: rename 'input' to 'in' in gensec_ntlmssp_update()Stefan Metzmacher2017-05-211-3/+7
| | | | | | | This matches all other gensec modules. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: remove unused variable from gensec_ntlmssp_update()Stefan Metzmacher2017-05-211-1/+0
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: avoid using NT_STATUS_NOT_OK_RETURN() in gensec_ntlmssp_update()Stefan Metzmacher2017-05-211-2/+6
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/ntlmssp: remove mem_ctx=NULL handling from gensec_ntlmssp_update()Stefan Metzmacher2017-05-211-6/+0
| | | | | | | | The caller is expected always pass a valid context and this fallback was needed ages ago. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/spnego: make sure a fatal error or the final success make the state as ↵Stefan Metzmacher2017-05-211-0/+8
| | | | | | | | | | SPNEGO_DONE This means any further gensec_update() will fail with NT_STATUS_INVALID_PARAMETER. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/spnego: let spnego.c use the new gensec_child_* helper functionsStefan Metzmacher2017-05-211-268/+26
| | | | | | | | This means we no longer allow operations on a half finished authentication, it's activated by gensec_child_ready(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/gensec: add gensec_child_* helper functionsStefan Metzmacher2017-05-214-0/+300
| | | | | | | | They will be used to simplify the spnego backend and maybe of some use for a future negoex backend. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
View Lorry Controller Status