mlsvc_util.c revision b819cea2f73f98c5662230cc9affc8cc84f77fcf
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2013 Nexenta Systems, Inc. All rights reserved.
*/
/*
* Utility functions to support the RPC interface library.
*/
#include <stdio.h>
#include <stdarg.h>
#include <strings.h>
#include <unistd.h>
#include <netdb.h>
#include <stdlib.h>
#include <note.h>
#include <syslog.h>
#include <smbsrv/libsmbns.h>
#include <smbsrv/libmlsvc.h>
#include <smbsrv/ntaccess.h>
#include <libsmbrdr.h>
#include <lsalib.h>
#include <samlib.h>
#include <smbsrv/netrauth.h>
extern int netr_open(char *, char *, mlsvc_handle_t *);
extern int netr_close(mlsvc_handle_t *);
static DWORD
char *admin_user, char *admin_pw,
char *machine_name, char *machine_pw);
static DWORD
char *machine_name, char *machine_pw);
{
"credential chain");
(void) netr_close(&netr_handle);
} else {
}
return (status);
}
/*
* Join the specified domain. The method varies depending on whether
* we're using "secure join" (using an administrative account to join)
* or "unsecure join" (using a pre-created machine account). In the
* latter case, the machine account is created "by hand" before this
* machine attempts to join, and we just change the password from the
* (weak) default password for a new machine account to a random one.
*
* Note that the caller has already done "DC discovery" and passes the
* domain info. in the first arg.
*
* Returns NT status codes.
*/
{
char machine_name[SMB_SAMACCT_MAXLEN];
unsigned char passwd_hash[SMBAUTH_HASH_SZ];
int rc;
/*
* Domain join support: AD (Kerberos+LDAP) or MS-RPC?
* Leave the AD code path disabled until it can be
* fixed up so that the SMB server is in complete
* control of which AD server we talk to. See:
* NX 12427 (Re-enable Kerberos+LDAP with...)
*/
return (NT_STATUS_INTERNAL_ERROR);
/*
* A non-null user means we do "secure join".
*/
/*
* Doing "secure join", so authenticate as the
* specified user (with admin. rights).
*/
/*
* If enabled, try to join using AD Services.
* The ADS code needs work. Not enabled yet.
*/
if (ads_enabled) {
if (err != SMB_ADJOIN_SUCCESS) {
} else {
}
}
/*
* If ADS was disabled or gave an error,
* fall-back and try to join using RPC.
*/
if (status != NT_STATUS_SUCCESS) {
}
} else {
/*
* Doing "Unsecure join" (pre-created account)
*/
}
if (status != NT_STATUS_SUCCESS)
goto out;
/*
* Make sure we can authenticate using the
* (new, or updated) machine account.
*/
if (rc != 0) {
goto out;
}
/*
* Store the new machine account password.
*/
if (rc != 0) {
"Failed to save machine account password");
goto out;
}
/*
* Update idmap config
*/
if (smb_config_refresh_idmap() != 0)
/*
* Note: The caller (smbd) saves the "secmode" and
* domain info (via smb_config_setdomaininfo) and
* and does smb_ipc_commit (or rollback).
*/
status = 0;
out:
/* Avoid leaving cleartext passwords around. */
return (status);
}
static DWORD
char *admin_user, char *admin_pw,
char *machine_name, char *machine_pw)
{
int rc;
/* Caller did smb_ipc_set() so we don't need the pw for now. */
if (rc != 0) {
return (RPC_NT_SERVER_UNAVAILABLE);
}
/* have samr_handle */
if (status != NT_STATUS_SUCCESS)
goto out_samr_handle;
/* have domain_handle */
if (status == NT_STATUS_USER_EXISTS) {
machine_name, &ainfo);
if (status != NT_STATUS_SUCCESS)
goto out_domain_handle;
}
if (status != NT_STATUS_SUCCESS) {
"Create or open machine account: %s",
goto out_domain_handle;
}
/*
* The account exists, and we have user_handle open
* on that account. Set the password and flags.
*/
if (status != NT_STATUS_SUCCESS) {
"Set machine account password: %s",
goto out_user_handle;
}
if (status != NT_STATUS_SUCCESS) {
"Set machine account control flags: %s",
goto out_user_handle;
}
(void) samr_close_handle(&user_handle);
(void) samr_close_handle(&domain_handle);
(void) samr_close_handle(&samr_handle);
return (status);
}
/*
* Doing "Unsecure join" (using a pre-created machine account).
* All we need to do is change the password from the default
* to a random string.
*
* Note: this is a work in progres. Nexenta issue 11960
* (allow joining an AD domain using a pre-created computer account)
* It turns out that to change the machine account password,
* we need to use a different RPC call, performed over the
* NetLogon secure channel. (See netr_server_password_set2)
*/
static DWORD
char *machine_name, char *machine_pw)
{
char old_pw[SMB_SAMACCT_MAXLEN];
/*
* Compose the current (default) password for the
* pre-created machine account, which is just the
* account name in lower case, truncated to 14
* characters.
*/
return (NT_STATUS_INTERNAL_ERROR);
old_pw, machine_pw);
if (status != NT_STATUS_SUCCESS) {
"Change machine account password: %s",
}
return (status);
}
void
mlsvc_disconnect(const char *server)
{
}