1/* 2 Unix SMB/CIFS implementation. 3 Password and authentication handling 4 Copyright (C) Jeremy Allison 1996-2002 5 Copyright (C) Andrew Tridgell 2002 6 Copyright (C) Gerald (Jerry) Carter 2000 7 Copyright (C) Stefan (metze) Metzmacher 2002 8 9 This program is free software; you can redistribute it and/or modify 10 it under the terms of the GNU General Public License as published by 11 the Free Software Foundation; either version 2 of the License, or 12 (at your option) any later version. 13 14 This program is distributed in the hope that it will be useful, 15 but WITHOUT ANY WARRANTY; without even the implied warranty of 16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 GNU General Public License for more details. 18 19 You should have received a copy of the GNU General Public License 20 along with this program; if not, write to the Free Software 21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 22*/ 23 24#include "includes.h" 25 26/* NOTE! the global_sam_sid is the SID of our local SAM. This is only 27 equal to the domain SID when we are a DC, otherwise its our 28 workstation SID */ 29static DOM_SID *global_sam_sid=NULL; 30 31#undef DBGC_CLASS 32#define DBGC_CLASS DBGC_PASSDB 33 34/**************************************************************************** 35 Read a SID from a file. This is for compatibility with the old MACHINE.SID 36 style of SID storage 37****************************************************************************/ 38static BOOL read_sid_from_file(const char *fname, DOM_SID *sid) 39{ 40 char **lines; 41 int numlines; 42 BOOL ret; 43 44 lines = file_lines_load(fname, &numlines); 45 46 if (!lines || numlines < 1) { 47 if (lines) file_lines_free(lines); 48 return False; 49 } 50 51 ret = string_to_sid(sid, lines[0]); 52 file_lines_free(lines); 53 return ret; 54} 55 56/* 57 generate a random sid - used to build our own sid if we don't have one 58*/ 59static void generate_random_sid(DOM_SID *sid) 60{ 61 int i; 62 uchar raw_sid_data[12]; 63 64 memset((char *)sid, '\0', sizeof(*sid)); 65 sid->sid_rev_num = 1; 66 sid->id_auth[5] = 5; 67 sid->num_auths = 0; 68 sid->sub_auths[sid->num_auths++] = 21; 69 70 generate_random_buffer(raw_sid_data, 12); 71 for (i = 0; i < 3; i++) 72 sid->sub_auths[sid->num_auths++] = IVAL(raw_sid_data, i*4); 73} 74 75/**************************************************************************** 76 Generate the global machine sid. 77****************************************************************************/ 78 79static DOM_SID *pdb_generate_sam_sid(void) 80{ 81 DOM_SID domain_sid; 82 char *fname = NULL; 83 BOOL is_dc = False; 84 DOM_SID *sam_sid; 85 86 if(!(sam_sid=SMB_MALLOC_P(DOM_SID))) 87 return NULL; 88 89 generate_wellknown_sids(); 90 91 switch (lp_server_role()) { 92 case ROLE_DOMAIN_PDC: 93 case ROLE_DOMAIN_BDC: 94 is_dc = True; 95 break; 96 default: 97 is_dc = False; 98 break; 99 } 100 101 if (is_dc) { 102 if (secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) { 103 sid_copy(sam_sid, &domain_sid); 104 return sam_sid; 105 } 106 } 107 108 if (secrets_fetch_domain_sid(global_myname(), sam_sid)) { 109 110 /* We got our sid. If not a pdc/bdc, we're done. */ 111 if (!is_dc) 112 return sam_sid; 113 114 if (!secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) { 115 116 /* No domain sid and we're a pdc/bdc. Store it */ 117 118 if (!secrets_store_domain_sid(lp_workgroup(), sam_sid)) { 119 DEBUG(0,("pdb_generate_sam_sid: Can't store domain SID as a pdc/bdc.\n")); 120 SAFE_FREE(sam_sid); 121 return NULL; 122 } 123 return sam_sid; 124 } 125 126 if (!sid_equal(&domain_sid, sam_sid)) { 127 128 /* Domain name sid doesn't match global sam sid. Re-store domain sid as 'local' sid. */ 129 130 DEBUG(0,("pdb_generate_sam_sid: Mismatched SIDs as a pdc/bdc.\n")); 131 if (!secrets_store_domain_sid(global_myname(), &domain_sid)) { 132 DEBUG(0,("pdb_generate_sam_sid: Can't re-store domain SID for local sid as PDC/BDC.\n")); 133 SAFE_FREE(sam_sid); 134 return NULL; 135 } 136 return sam_sid; 137 } 138 139 return sam_sid; 140 141 } 142 143 /* check for an old MACHINE.SID file for backwards compatibility */ 144 asprintf(&fname, "%s/MACHINE.SID", lp_private_dir()); 145 146 if (read_sid_from_file(fname, sam_sid)) { 147 /* remember it for future reference and unlink the old MACHINE.SID */ 148 if (!secrets_store_domain_sid(global_myname(), sam_sid)) { 149 DEBUG(0,("pdb_generate_sam_sid: Failed to store SID from file.\n")); 150 SAFE_FREE(fname); 151 SAFE_FREE(sam_sid); 152 return NULL; 153 } 154 unlink(fname); 155 if (is_dc) { 156 if (!secrets_store_domain_sid(lp_workgroup(), sam_sid)) { 157 DEBUG(0,("pdb_generate_sam_sid: Failed to store domain SID from file.\n")); 158 SAFE_FREE(fname); 159 SAFE_FREE(sam_sid); 160 return NULL; 161 } 162 } 163 164 /* Stored the old sid from MACHINE.SID successfully.*/ 165 SAFE_FREE(fname); 166 return sam_sid; 167 } 168 169 SAFE_FREE(fname); 170 171 /* we don't have the SID in secrets.tdb, we will need to 172 generate one and save it */ 173 generate_random_sid(sam_sid); 174 175 if (!secrets_store_domain_sid(global_myname(), sam_sid)) { 176 DEBUG(0,("pdb_generate_sam_sid: Failed to store generated machine SID.\n")); 177 SAFE_FREE(sam_sid); 178 return NULL; 179 } 180 if (is_dc) { 181 if (!secrets_store_domain_sid(lp_workgroup(), sam_sid)) { 182 DEBUG(0,("pdb_generate_sam_sid: Failed to store generated domain SID.\n")); 183 SAFE_FREE(sam_sid); 184 return NULL; 185 } 186 } 187 188 return sam_sid; 189} 190 191/* return our global_sam_sid */ 192DOM_SID *get_global_sam_sid(void) 193{ 194 if (global_sam_sid != NULL) 195 return global_sam_sid; 196 197 /* memory for global_sam_sid is allocated in 198 pdb_generate_sam_sid() as needed */ 199 200 if (!(global_sam_sid = pdb_generate_sam_sid())) { 201 smb_panic("Could not generate a machine SID\n"); 202 } 203 204 return global_sam_sid; 205} 206 207/** 208 * Force get_global_sam_sid to requery the backends 209 */ 210void reset_global_sam_sid(void) 211{ 212 SAFE_FREE(global_sam_sid); 213} 214