summaryrefslogtreecommitdiff
path: root/source4/kdc/hdb-samba4.c
Commit message (Collapse)AuthorAgeFilesLines
* s4:kdc: make sure reset_bad_password_netlogon() stops subreq before returnStefan Metzmacher2022-11-241-2/+13
| | | | | | | | | | | We pass the stack variable 'req' to dcerpc_winbind_SendToSam_r_send(), so we need to make sure the runtime of the subreq in not longer than the stack variable. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15253 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2021-20251: s4:auth: fix use after free in ↵Stefan Metzmacher2022-11-241-1/+1
| | | | | | | | | | | | | | | | authsam_logon_success_accounting() This fixes a use after free problem introduced by commit 7b8e32efc336fb728e0c7e3dd6fbe2ed54122124, which has msg = current; which means the lifetime of the 'msg' memory is no longer in the scope of th caller. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15253 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2021-20251 s4:kdc: Check badPwdCount update return statusJoseph Sutton2022-09-121-2/+7
| | | | | | | | | | | | If the account has been locked out in the meantime (indicated by NT_STATUS_ACCOUNT_LOCKED_OUT), we should return the appropriate error code. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2021-20251 s4:kdc: Check return status of authsam_logon_success_accounting()Joseph Sutton2022-09-121-4/+11
| | | | | | | | | | | | | | | | If we find that the user has been locked out sometime during the request (due to a race), we will now return an error code. Note that we cannot avoid the MIT KDC aspect of the issue by checking the return status of mit_samba_zero_bad_password_count(), because kdb_vftabl::audit_as_req() returning void means we cannot pass on the result. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* CVE-2021-20251 s4:kdc: Move logon success accounting code into existing branchJoseph Sutton2022-09-121-20/+13
| | | | | | | | | | This simplifies the code for the following commit. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Set Kerberos debug class for all KDC filesAndreas Schneider2022-09-121-0/+3
| | | | | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Sep 12 03:27:55 UTC 2022 on sn-devel-184
* CVE-2022-32744 s4:kdc: Modify HDB plugin to only look up kpasswd principalJoseph Sutton2022-07-271-0/+66
| | | | | | | | | | | | | This plugin is now only used by the kpasswd service. Thus, ensuring we only look up the kadmin/changepw principal means we can't be fooled into accepting tickets for other service principals. We make sure not to specify a specific kvno, to ensure that we do not accept RODC-issued tickets. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:kdc: Pass supported enctypes to samba_kdc_set_fixed_keys()Andrew Bartlett2022-03-241-1/+1
| | | | | | | Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
* s4:kdc: avoid using sdb_entry_ex in hdb_samba4_{first,next}key()Stefan Metzmacher2022-03-241-8/+8
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: avoid using sdb_entry_ex in hdb_samba4_fetch_kvno()Stefan Metzmacher2022-03-241-4/+4
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: samba_kdc_{first,next}key() only need sdb_entryStefan Metzmacher2022-03-241-2/+2
| | | | | | | sdb_entry_ex will be removed shortly. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: samba_kdc_fetch() only needs sdb_entryStefan Metzmacher2022-03-241-1/+1
| | | | | | | sdb_entry_ex will be removed shortly. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: use sdb_entry_to_hdb_entry() directlyStefan Metzmacher2022-03-241-5/+5
| | | | | | | We should avoid sdb_entry_ex, as it will be removed soon. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: hdb_samba4_fetch_fast_cookie() don't need sdb_entry_exStefan Metzmacher2022-03-241-8/+6
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: only pass sdb_keys to samba_kdc_set_fixed_keys()Stefan Metzmacher2022-03-241-2/+2
| | | | | | | This prepares the removal of sdb_entry_ex. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: let samba_kdc_entry take references to sdb_entry and kdc_entryStefan Metzmacher2022-03-241-4/+7
| | | | | | | kdc_entry can be hdb_entry or krb5_db_entry. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Add KDC support for Protected Users groupJoseph Sutton2022-03-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Accounts in the Protected Users group acting as clients lack support for the RC4 encryption type. TGTs issued to such accounts have a lifetime restricted to four hours, and are unable to be proxied or forwarded. To determine at lookup time whether a client account is a member of Protected Users, we now also create an auth_user_info_dc structure when creating the database entry for an AS-REQ, rather than only when creating a PAC for a TGT, or when recreating the PAC from an RODC-issued TGT. This means that the user's groups are now expanded even for AS-REQs that result in an error (such as a PREAUTH_REQUIRED error), but this is required to be able to correctly determine the account's available encryption types, which are needed soon after fetching the user account. Currently, the TGT lifetime may exceed four hours (for Heimdal specifically). This may happen if PKINIT is used, and either the pkinit_max_life_from_cert_extension option is TRUE and pkinit_max_life_bound is greater than four hours, or pkinit_max_life_from_cert is greater than four hours. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:kdc: tunnel the check_client_access status to hdb_samba4_audit()Stefan Metzmacher2022-03-171-0/+4
| | | | | | | | | | | | Otherwise useful information gets lost while converting from NTSTATUS to krb5_error and back to NTSTATUS again. E.g. NT_STATUS_ACCOUNT_DISABLED would be audited as NT_STATUS_ACCOUNT_LOCKED_OUT. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15015 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-kdc: Handle previously unhandled auth event typesJoseph Sutton2022-03-171-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cases to handle KDC_AUTH_EVENT_VALIDATED_LONG_TERM_KEY and KDC_AUTH_EVENT_PREAUTH_SUCCEEDED were removed in: commit 791be84c3eecb95e03611458e2305bae272ba267 Author: Stefan Metzmacher <metze@samba.org> Date: Wed Mar 2 10:10:08 2022 +1300 s4:kdc: hdb_samba4_audit() is only called once per request Normally these auth event types are overwritten with the KDC_AUTH_EVENT_CLIENT_AUTHORIZED event type, but if a client passes the pre-authentication check, and happens to fail the client access check (e.g. because the account is disabled), we get error messages of the form: hdb_samba4_audit: Unhandled hdb_auth_status=9 => INTERNAL_ERROR To avoid such errors, use the error code provided in the request structure to obtain a relevant status code in cases not handled explicitly. For unexpected values we return KRB5KRB_ERR_GENERIC in order to hopefully prevent success. And within make test we panic in order let a ci run fail. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15015 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-kdc: Fix memory leak in FAST cookie handlingAndrew Bartlett2022-03-111-0/+1
| | | | | | | | | | | The call to sdb_free_entry() was forgotten. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15000 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Fri Mar 11 11:05:55 UTC 2022 on sn-devel-184
* s4:kdc: don't set mapped_state in auth_usersupplied_info for audit loggingStefan Metzmacher2022-03-101-1/+0
| | | | | | | | | | mapped_state is completely irrelevant for audit logging and will also be removed in the next commits. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: redirect pre-authentication failures to an RWDCStefan Metzmacher2022-03-061-70/+23
| | | | | | | | | | | | The most important case is that we still have a previous password cached at the RODC and the inbound replication hasn't wiped the cache yet and we also haven't triggered a new replication yet. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14865 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: hdb_samba4_audit() is only called once per requestStefan Metzmacher2022-03-011-11/+15
| | | | | | | | | | | | | | So we need to restructure the logic a bit. NOTE: This commit finally works again! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Joseph Sutton <jsutton@samba.org> Autobuild-Date(master): Tue Mar 1 23:28:22 UTC 2022 on sn-devel-184
* s4-kdc: Adapt to move from HDB auditing to KDC auditing constantsAndrew Bartlett2022-03-011-16/+17
| | | | | | | | | | | | | | | | | | | | This is to adapt to: commit 6530021f09a5cab631be19a1b5898a0ba6b32f16 Author: Luke Howard <lukeh@padl.com> Date: Thu Jan 13 14:37:29 2022 +1100 kdc: move auth event definitions into KDC header Move KDC auth event macro definitions out of hdb.h and into a new KDC header, kdc-audit.h. NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* s4:kdc: Adapt to hdb_entry_ex removalJoseph Sutton2022-03-011-16/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rather than having a 'free_entry' member that can be called to free an hdb_entry, we now implement the free function in HDB. We perform the free only if the context pointer is non-NULL. We also remove the ZERO_STRUCTP() in sdb_entry_to_hdb_entry(), as the context pointer is now part of the 'hdb_entry' structure itself, and this would undesirably zero it out. This is an adaptation to Heimdal commits: commit c5551775e204d00c7ee8055ab6ddbba7e0590584 Author: Luke Howard <lukeh@padl.com> Date: Fri Jan 7 12:15:55 2022 +1100 hdb: decorate HDB_entry with context member Decorate HDB_entry with context and move free_entry callback into HDB structure itself. Requires updating hdb_free_entry() signature to include HDB parameter. A follow-up commit will consolidate hdb_entry_ex (which has a single hdb_entry member) into hdb_entry. commit 0e8c4ccc6ee0123ea39e53e8917fc3f6bb74e8c8 Author: Luke Howard <lukeh@padl.com> Date: Fri Jan 7 12:54:40 2022 +1100 hdb: eliminate hdb_entry_ex Remove hdb_entry_ex and revert to the original design of hdb_entry (except with an additional context member in hdb_entry which is managed by the free_entry method in HDB). NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Adapt to removal of auth audit event typesJoseph Sutton2022-03-011-43/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is an adaptation to Heimdal: commit 06f8985c55fcd23e3efe0017ed2480c5b3c4524f Author: Luke Howard <lukeh@padl.com> Date: Wed Jan 5 09:42:03 2022 +1100 hdb: consolidate preauth audit event types Instead of having distinct preauth success/failure events for different mechanisms, have a single event; the mechanism can be disambiguated by querying the HDB_REQUEST_KV_PA_NAME key. Note: there is still an explicit event for long-term key-based success/failure in order to help the backend implement lockout. Audit failure (HDB_AUTH_EVENT_PREAUTH_FAILED) in the main preauth loop, rather than in each mechanism. Success is still audited in the mechanism to allow client pre-authentication success to be noted even if something subsequent (e.g. encoding a reply, memory allocation) fails. The generic catch-all for success remains. NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Add 'not authorised' auth eventsJoseph Sutton2022-03-011-0/+2
| | | | | | | | | | | | | | | | | | | | This is an adaptation to Heimdal: commit d683780b1d728bf8c5b794a1f66842e5a25bd360 Author: Luke Howard <lukeh@padl.com> Date: Sat Jan 1 23:44:05 2022 +1100 kdc: separate PKINIT/GSS authorization failure Create a new audit event for PKINIT/GSS authorization (impersonation) failure NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Adapt to removal of auth event detailsJoseph Sutton2022-03-011-4/+38
| | | | | | | | | | | | | | | | | | | | | | | This is an adaptation to Heimdal: commit e15e711b13e2fb33f4480a054cba60b6c4c0183b Author: Luke Howard <lukeh@padl.com> Date: Sat Jan 1 18:05:51 2022 +1100 kdc: remove auth_event_details audit key The auth event details audit key (formerly, parameter to auth_status) contained, variously, an encryption type name; a PKINIT client certificate name; or, a GSS initiator name. Audit these instead using individual keys that reflect the values' contents. NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Refactor HDB APIJoseph Sutton2022-03-011-35/+59
| | | | | | | | | | | | | | | | | | | | | | | | | This is an adaptation to Heimdal: commit b1dcc1a47485165ada778ef3c3463cfc0779d183 Author: Luke Howard <lukeh@padl.com> Date: Fri Dec 31 17:24:58 2021 +1100 kdc: refactor Samba-specific auditing API in terms of existing API Make Samba-specific HDB auth status API a wrapper on the existing auditing API, with a view towards unifying the two APIs in a future commit. The term "auth status" is replaced with "auth event", and the HDB auth_status method is replaced with a more general purpose audit method which has access to the entire request structure. NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14995 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:kdc: Translate HDB flags to SDB flagsAndreas Schneider2022-01-281-1/+5
| | | | | | | | | | | | | | | | | | | | | We used to have a 1 to 1 mapping, but now we have a conflict with these: #define SDB_F_FORCE_CANON 16384 #define HDB_F_PRECHECK 16384 We currently don't really care about HDB_F_PRECHECK, so we can just filter it out. In the long run we may change the SDB flags space to uint64... BUG: https://bugzilla.samba.org/show_bug.cgi?id=14960 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Fri Jan 28 13:33:22 UTC 2022 on sn-devel-184
* s4:kdc: Remove trailing spaces in hdb-samba4.cAndreas Schneider2022-01-281-3/+3
| | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=14960 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:kdc/hdb: Store and retrieve a FX-COOKIE valueAndrew Bartlett2022-01-191-1/+128
| | | | | | | | | | | Note Windows uses the string "MICROSOFT" as cookie, so it's wrong to have a per DC cookie, but we need to adjust the Heimdal logic to support that. NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:kdc: Update to match updated Heimdal's new HDB versionAndrew Bartlett2022-01-191-23/+63
| | | | | | | | | | | Including updates to hook into the improved hdb_auth_status by Stefan Metzmacher <metze@samba.org> from his Heimdal upgrade branch. NOTE: THIS COMMIT WON'T COMPILE/WORK ON ITS OWN! Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* hdb: Initialise HDB structureJoseph Sutton2021-12-091-1/+1
| | | | | | | | | | | | Additional fields may be added to this structure without us explicitly initialising them. This could cause Heimdal to crash upon reading garbage data, so we should zero-initialise the structure. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Dec 9 02:47:27 UTC 2021 on sn-devel-184
* CVE-2020-25719 kdc: Avoid races and multiple DB lookups in s4u2self checkAndrew Bartlett2021-11-091-31/+12
| | | | | | | | | | | | | | | | | | | Looking up the DB twice is subject to a race and is a poor use of resources, so instead just pass in the record we already got when trying to confirm that the server in S4U2Self is the same as the requesting client. The client record has already been bound to the the original client by the SID check in the PAC. Likewise by looking up server only once we ensure that the keys looked up originally are in the record we confirm the SID for here. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14686 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
* auth auth_log: csbuild unused parm unix_usernameGary Lockyer2019-06-131-2/+1
| | | | | | | | | | | | | | | | | | Fixes csbuild errors Error: COMPILER_WARNING: auth/auth_log.c: scope_hint: In function ‘log_authentication_event_json’ auth/auth_log.c:146:14: warning: unused parameter ‘unix_username’ [-Wunused-parameter] Error: COMPILER_WARNING: auth/auth_log.c: scope_hint: In function ‘log_authentication_event_human_readable’ auth/auth_log.c:586:14: warning: unused parameter ‘unix_username’ [-Wunused-parameter] Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
* kdc hdb: Generate and pass logon IDGary Lockyer2019-02-201-2/+4
| | | | | | | Generate and pass the logon_id in SamLogon calls Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* librpc idl: netlogon netr_identity_info logon_id to 64 bitGary Lockyer2019-02-201-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fold the two 32 bit values logon_id_high and logon_id_low into a single 64 bit logon_id in netr_identity_info. This will be used to tie together winbind and SamLogon requests in audit logging. Summary of the of the Query and Response from Microsoft on it's usage. [REG:119013019612095] [MS-NRPC]: NETLOGON_LOGON_IDENTITY_INFO: Does the Reserved field have LogonId meaning? Questions: In NetrLogonSamLogonEx does the Reserved field (of NETLOGON_LOGON_IDENTITY_INFO) have LogonId meaning? What is a valid LogonID, and does have any audit usage? Samba is sending a constant "deadbeef" in hex and would like to understand any usage of this field. Response: The NRPC spec is accurate in defining the field as Reserved, and without protocol significance. In the header file in our source code, it is defined as LogonId and commented as such, but it’s effectively not used. This is probably why the API structure has that field name. It may have been intended as such but it’s not used. Samba will send a random value in this field. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth: For NTLM and KDC authentication, log the authentication durationAndrew Bartlett2018-06-251-0/+3
| | | | | | | | | | | | | | This is not a general purpose profiling solution, but these JSON logs are already being generated and stored, so this is worth adding. Some administrators are very keen to know how long authentication takes, particularly due to long replication transactions in other processes. This complements a similar patch set to log the transaction duration. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
* Fix spelling s/fowarding/forwarding/Mathieu Parent2018-05-121-1/+1
| | | | | | Signed-off-by: Mathieu Parent <math.parent@gmail.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
* s4:kdc: only map SDB_ERR_NOT_FOUND_HERE to HDB_ERR_NOT_FOUND_HEREStefan Metzmacher2017-12-061-6/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | HDB_ERR_NOT_FOUND_HERE indicated a very specific error on an RODC. We should not map any error to HDB_ERR_NOT_FOUND_HERE, we should just pass errors along unmapped. Otherwise we'll hit the logic bug in: if (ret == KDC_PROXY_REQUEST) { uint16_t port; if (!sock->kdc_socket->kdc->am_rodc) { DEBUG(0,("kdc_udp_call_loop: proxying requested when not RODC")); talloc_free(call); goto done; } And just don't send an error message to the client. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13132 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Dec 6 23:16:54 CET 2017 on sn-devel-144
* netlogon: Implement SendToSam along with its winbind forwardingGarming Sam2017-05-301-1/+29
| | | | | | | | | | | This allows you to forward bad password count resets to 0. Currently, there is a missing access check for the RODC to ensure it only applies to cached users (msDS-Allowed-Password-Replication-Group). (further patches still need to address forcing a RWDC contact) Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* kdc: Send bad password via NETLOGON in RODCGarming Sam2017-05-301-7/+72
| | | | | | | | | | This means that a RWDC will be collecting the badPwdCount to ensure domain wide lockout. TODO The parameters should be better constructed. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* heimdal: Pass extra information to hdb_auth_status() to log success and failuresAndrew Bartlett2017-03-291-4/+120
| | | | | | | | | | We now pass on the original client name and the client address to allow consistent audit logging in Samba across multiple protocols. We use config->db[0] to find the first database to record incorrect users. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* auth: keep track of lastLogon and lastLogonTimestampDouglas Bagnall2015-12-151-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | lastLogon is supposed to be updated for every interactive or kerberos login, and (according to testing against Windows2012r2) when the bad password count is non-zero but the lockout time is zero. It is not replicated. lastLogonTimestamp is updated if the old value is more than 14 - random.choice([0, 1, 2, 3, 4, 5]) days old, and it is replicated. The 14 in this calculation is the default, stored as "msDS-LogonTimeSyncInterval", which we offer no interface for changing. The authsam_zero_bad_pwd_count() function is a convenient place to update these values, as it is called upon a successful logon however that logon is performed. That makes the function's name inaccurate, so we rename it authsam_logon_success_accounting(). It also needs to be told whet5her the login is interactive. The password_lockout tests are extended to test lastLogon and lasLogonTimestamp. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Ralph Boehme <slow@samba.org>
* hdb-samba: Translate SDB errors to HDB errorsAndreas Schneider2015-08-051-26/+97
| | | | | Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-kdc: Use sdb in db-glue and hdb-samba4Günther Deschner2015-07-301-3/+46
| | | | | | | | | | | | Guenther Pair-Programmed-With: Andreas Schneider <asn@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Thu Jul 30 13:29:27 CEST 2015 on sn-devel-104
* s4-kdc/db_glue: pass down only a samba_kdc_entry to samba_kdc_check_s4u2proxy().Günther Deschner2015-03-271-1/+4
| | | | | | | Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4-kdc/db_glue: pass down only a samba_kdc_entry to ↵Günther Deschner2015-03-271-1/+4
| | | | | | | | | samba_kdc_check_pkinit_ms_upn_match(). Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4-kdc/db_glue: pass down only a samba_kdc_entry to samba_kdc_check_s4u2self().Günther Deschner2015-03-271-2/+5
| | | | | | | Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
View Lorry Controller Status