init.c revision 120945
155682Smarkm/* 2120945Snectar * Copyright (c) 1997-2002 Kungliga Tekniska H�gskolan 355682Smarkm * (Royal Institute of Technology, Stockholm, Sweden). 455682Smarkm * All rights reserved. 555682Smarkm * 655682Smarkm * Redistribution and use in source and binary forms, with or without 755682Smarkm * modification, are permitted provided that the following conditions 855682Smarkm * are met: 955682Smarkm * 1055682Smarkm * 1. Redistributions of source code must retain the above copyright 1155682Smarkm * notice, this list of conditions and the following disclaimer. 1255682Smarkm * 1355682Smarkm * 2. Redistributions in binary form must reproduce the above copyright 1455682Smarkm * notice, this list of conditions and the following disclaimer in the 1555682Smarkm * documentation and/or other materials provided with the distribution. 1655682Smarkm * 1755682Smarkm * 3. Neither the name of the Institute nor the names of its contributors 1855682Smarkm * may be used to endorse or promote products derived from this software 1955682Smarkm * without specific prior written permission. 2055682Smarkm * 2155682Smarkm * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 2255682Smarkm * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2355682Smarkm * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2455682Smarkm * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 2555682Smarkm * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2655682Smarkm * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2755682Smarkm * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2855682Smarkm * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2955682Smarkm * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 3055682Smarkm * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3155682Smarkm * SUCH DAMAGE. 3255682Smarkm */ 3355682Smarkm 3455682Smarkm#include "kadmin_locl.h" 3555682Smarkm#include <kadm5/private.h> 3655682Smarkm 37120945SnectarRCSID("$Id: init.c,v 1.29 2002/12/03 14:08:17 joda Exp $"); 3855682Smarkm 3955682Smarkmstatic kadm5_ret_t 4055682Smarkmcreate_random_entry(krb5_principal princ, 4155682Smarkm unsigned max_life, 4255682Smarkm unsigned max_rlife, 4355682Smarkm u_int32_t attributes) 4455682Smarkm{ 4555682Smarkm kadm5_principal_ent_rec ent; 4655682Smarkm kadm5_ret_t ret; 4755682Smarkm int mask = 0; 4855682Smarkm krb5_keyblock *keys; 4955682Smarkm int n_keys, i; 5055682Smarkm 5155682Smarkm memset(&ent, 0, sizeof(ent)); 5255682Smarkm ent.principal = princ; 5355682Smarkm mask |= KADM5_PRINCIPAL; 5455682Smarkm if (max_life) { 5555682Smarkm ent.max_life = max_life; 5655682Smarkm mask |= KADM5_MAX_LIFE; 5755682Smarkm } 5855682Smarkm if (max_rlife) { 5955682Smarkm ent.max_renewable_life = max_rlife; 6055682Smarkm mask |= KADM5_MAX_RLIFE; 6155682Smarkm } 6255682Smarkm ent.attributes |= attributes | KRB5_KDB_DISALLOW_ALL_TIX; 6355682Smarkm mask |= KADM5_ATTRIBUTES; 6455682Smarkm 6555682Smarkm ret = kadm5_create_principal(kadm_handle, &ent, mask, "hemlig"); 6655682Smarkm if(ret) 6755682Smarkm return ret; 6855682Smarkm ret = kadm5_randkey_principal(kadm_handle, princ, &keys, &n_keys); 6955682Smarkm if(ret) 7055682Smarkm return ret; 7155682Smarkm for(i = 0; i < n_keys; i++) 7255682Smarkm krb5_free_keyblock_contents(context, &keys[i]); 7355682Smarkm free(keys); 7455682Smarkm ret = kadm5_get_principal(kadm_handle, princ, &ent, 7555682Smarkm KADM5_PRINCIPAL | KADM5_ATTRIBUTES); 7655682Smarkm if(ret) 7755682Smarkm return ret; 7855682Smarkm ent.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX); 7955682Smarkm ent.kvno = 1; 8055682Smarkm ret = kadm5_modify_principal(kadm_handle, &ent, 8155682Smarkm KADM5_ATTRIBUTES|KADM5_KVNO); 8255682Smarkm kadm5_free_principal_ent (kadm_handle, &ent); 8355682Smarkm if(ret) 8455682Smarkm return ret; 8555682Smarkm return 0; 8655682Smarkm} 8755682Smarkm 8855682Smarkmstatic struct getargs args[] = { 8955682Smarkm { "realm-max-ticket-life", 0, arg_string, NULL, 9055682Smarkm "realm max ticket lifetime" }, 9155682Smarkm { "realm-max-renewable-life", 0, arg_string, NULL, 9255682Smarkm "realm max renewable lifetime" }, 93120945Snectar { "help", 'h', arg_flag, NULL }, 9455682Smarkm}; 9555682Smarkm 9655682Smarkmstatic int num_args = sizeof(args) / sizeof(args[0]); 9755682Smarkm 9855682Smarkmstatic void 9955682Smarkmusage(void) 10055682Smarkm{ 10172445Sassar arg_printusage (args, num_args, "init", "realm..."); 10255682Smarkm} 10355682Smarkm 10455682Smarkmint 10555682Smarkminit(int argc, char **argv) 10655682Smarkm{ 10755682Smarkm kadm5_ret_t ret; 10855682Smarkm int i; 10955682Smarkm char *realm_max_life = NULL; 11055682Smarkm char *realm_max_rlife = NULL; 111120945Snectar int help_flag = 0; 11255682Smarkm HDB *db; 11355682Smarkm int optind = 0; 11455682Smarkm krb5_deltat max_life, max_rlife; 11555682Smarkm 11655682Smarkm args[0].value = &realm_max_life; 11755682Smarkm args[1].value = &realm_max_rlife; 118120945Snectar args[2].value = &help_flag; 11955682Smarkm 120120945Snectar if(getarg(args, num_args, argc, argv, &optind) || help_flag) { 12155682Smarkm usage(); 12255682Smarkm return 0; 12355682Smarkm } 12455682Smarkm 12572445Sassar if(argc - optind < 1) { 12672445Sassar usage(); 12772445Sassar return 0; 12872445Sassar } 12972445Sassar 13055682Smarkm if (realm_max_life) { 13155682Smarkm if (str2deltat (realm_max_life, &max_life) != 0) { 13255682Smarkm krb5_warnx (context, "unable to parse `%s'", realm_max_life); 13355682Smarkm return 0; 13455682Smarkm } 13555682Smarkm } 13655682Smarkm if (realm_max_rlife) { 13755682Smarkm if (str2deltat (realm_max_rlife, &max_rlife) != 0) { 13855682Smarkm krb5_warnx (context, "unable to parse `%s'", realm_max_rlife); 13955682Smarkm return 0; 14055682Smarkm } 14155682Smarkm } 14255682Smarkm 14355682Smarkm db = _kadm5_s_get_db(kadm_handle); 14455682Smarkm 14555682Smarkm ret = db->open(context, db, O_RDWR | O_CREAT, 0600); 14655682Smarkm if(ret){ 14755682Smarkm krb5_warn(context, ret, "hdb_open"); 14855682Smarkm return 0; 14955682Smarkm } 15055682Smarkm db->close(context, db); 15155682Smarkm for(i = optind; i < argc; i++){ 15255682Smarkm krb5_principal princ; 15355682Smarkm const char *realm = argv[i]; 15455682Smarkm 15555682Smarkm /* Create `krbtgt/REALM' */ 156120945Snectar ret = krb5_make_principal(context, &princ, realm, 157120945Snectar KRB5_TGS_NAME, realm, NULL); 158120945Snectar if(ret) 159120945Snectar return 0; 16055682Smarkm if (realm_max_life == NULL) { 16155682Smarkm max_life = 0; 162120945Snectar if(edit_deltat ("Realm max ticket life", &max_life, NULL, 0)) { 163120945Snectar krb5_free_principal(context, princ); 164120945Snectar return 0; 165120945Snectar } 16655682Smarkm } 16755682Smarkm if (realm_max_rlife == NULL) { 16855682Smarkm max_rlife = 0; 169120945Snectar if(edit_deltat("Realm max renewable ticket life", &max_rlife, 170120945Snectar NULL, 0)) { 171120945Snectar krb5_free_principal(context, princ); 172120945Snectar return 0; 173120945Snectar } 17455682Smarkm } 17555682Smarkm create_random_entry(princ, max_life, max_rlife, 0); 17655682Smarkm krb5_free_principal(context, princ); 17755682Smarkm 17855682Smarkm /* Create `kadmin/changepw' */ 17955682Smarkm krb5_make_principal(context, &princ, realm, 18055682Smarkm "kadmin", "changepw", NULL); 18155682Smarkm create_random_entry(princ, 5*60, 5*60, 18255682Smarkm KRB5_KDB_DISALLOW_TGT_BASED| 18355682Smarkm KRB5_KDB_PWCHANGE_SERVICE| 18455682Smarkm KRB5_KDB_DISALLOW_POSTDATED| 18555682Smarkm KRB5_KDB_DISALLOW_FORWARDABLE| 18655682Smarkm KRB5_KDB_DISALLOW_RENEWABLE| 18755682Smarkm KRB5_KDB_DISALLOW_PROXIABLE| 18855682Smarkm KRB5_KDB_REQUIRES_PRE_AUTH); 18955682Smarkm krb5_free_principal(context, princ); 19055682Smarkm 19155682Smarkm /* Create `kadmin/admin' */ 19255682Smarkm krb5_make_principal(context, &princ, realm, 19355682Smarkm "kadmin", "admin", NULL); 19455682Smarkm create_random_entry(princ, 60*60, 60*60, KRB5_KDB_REQUIRES_PRE_AUTH); 19555682Smarkm krb5_free_principal(context, princ); 19655682Smarkm 19755682Smarkm /* Create `changepw/kerberos' (for v4 compat) */ 19855682Smarkm krb5_make_principal(context, &princ, realm, 19955682Smarkm "changepw", "kerberos", NULL); 20072445Sassar create_random_entry(princ, 60*60, 60*60, 20172445Sassar KRB5_KDB_DISALLOW_TGT_BASED| 20272445Sassar KRB5_KDB_PWCHANGE_SERVICE); 20372445Sassar 20455682Smarkm krb5_free_principal(context, princ); 20555682Smarkm 20672445Sassar /* Create `kadmin/hprop' for database propagation */ 20772445Sassar krb5_make_principal(context, &princ, realm, 20872445Sassar "kadmin", "hprop", NULL); 20972445Sassar create_random_entry(princ, 60*60, 60*60, 21072445Sassar KRB5_KDB_REQUIRES_PRE_AUTH| 21172445Sassar KRB5_KDB_DISALLOW_TGT_BASED); 21272445Sassar krb5_free_principal(context, princ); 21372445Sassar 21455682Smarkm /* Create `default' */ 21555682Smarkm { 21655682Smarkm kadm5_principal_ent_rec ent; 21755682Smarkm int mask = 0; 21855682Smarkm 21955682Smarkm memset (&ent, 0, sizeof(ent)); 22055682Smarkm mask |= KADM5_PRINCIPAL; 22155682Smarkm krb5_make_principal(context, &ent.principal, realm, 22255682Smarkm "default", NULL); 22355682Smarkm mask |= KADM5_MAX_LIFE; 22455682Smarkm ent.max_life = 24 * 60 * 60; 22555682Smarkm mask |= KADM5_MAX_RLIFE; 22655682Smarkm ent.max_renewable_life = 7 * ent.max_life; 22755682Smarkm ent.attributes = KRB5_KDB_DISALLOW_ALL_TIX; 22855682Smarkm mask |= KADM5_ATTRIBUTES; 22955682Smarkm 23055682Smarkm ret = kadm5_create_principal(kadm_handle, &ent, mask, ""); 23155682Smarkm if (ret) 23255682Smarkm krb5_err (context, 1, ret, "kadm5_create_principal"); 23355682Smarkm 23455682Smarkm krb5_free_principal(context, ent.principal); 23555682Smarkm } 23655682Smarkm } 23755682Smarkm return 0; 23855682Smarkm} 239