Attachment 11790 Details for Bug 11694 – patch from github for master

[patch] patch from github for master

0001-Added-MSV1_0_ALLOW_MSVCHAPV2-flag-to-ntlm_auth.patch (text/plain), 6.68 KB, created by Andrew Bartlett on 2016-01-26 18:52:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Bartlett

Created: 2016-01-26 18:52:30 UTC

Size: 6.68 KB

patch

obsolete

>From 4cfda8f409580598885f814e36dfb2f74812ceec Mon Sep 17 00:00:00 2001
>From: Herwin Weststrate <herwin@quarantainenet.nl>
>Date: Wed, 9 Dec 2015 18:47:47 +0100
>Subject: [PATCH] Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth
>
>An implementation of https://lists.samba.org/archive/samba/2012-March/166497.html (which has been discussed in 2012, but was never implemented).
>
>It has been tested on a Debian Jessie system with this patch added to the Debian package (which is currently 4.1.17). Even though this is Samba 4, the ntlm_auth installed is the one from Samba 3 (yes, it surprised me too). The backend was a machine with Windows 2012R2.
>
>It was first tested with the local security policy 'Network Security: LAN Manager authentication level' setting changed to 'Send NTLMv2 Response Only' (allow ntlm v1). This way we are able to authenticate with and without the MSV1_0_ALLOW_MSVCHAPV2 flag (as expected).
>
>After the basic step has been verified, the local security policy 'Network Security: LAN Manager authentication level' setting was changed to 'Send NTLMv2 Response Only. Refuse LM & NTLM' (only allow ntlm v2). The behaviour now changed according to the MSV1_0_ALLOW_MSVCHAPV2 flag (again: as expected).
>
>  $ ntlm_auth --request-nt-key --username=XXXXXXXXXXXXX --challenge=XXXXXXXXXXXXXXXXX --nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --domain=
>  Logon failure (0xc000006d)
>  $ ntlm_auth --request-nt-key --username=XXXXXXXXXXXXX --challenge=XXXXXXXXXXXXXXXXX --nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --domain= --allow-mschapv2
>  NT_KEY: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>
>The changes in `wbclient.h` are intended for programs that use libwinbind directly instead of authenticating via `ntlm_auth`. I intend to use that within FreeRADIUS (see https://bugzilla.samba.org/show_bug.cgi?id=11149).
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=11694
>Signed-off-by: Herwin Weststrate <herwin@quarantainenet.nl>
>Reviewed-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Kai Blin <kai@samba.org>
>---
> docs-xml/manpages/ntlm_auth.1.xml | 5 +++++
> nsswitch/libwbclient/wbclient.h   | 1 +
> source3/utils/ntlm_auth.c         | 6 ++++++
> source4/utils/ntlm_auth.c         | 7 +++++++
> 4 files changed, 19 insertions(+)
>
>diff --git a/docs-xml/manpages/ntlm_auth.1.xml b/docs-xml/manpages/ntlm_auth.1.xml
>index 042893a..616d537 100644
>--- a/docs-xml/manpages/ntlm_auth.1.xml
>+++ b/docs-xml/manpages/ntlm_auth.1.xml
>@@ -381,6 +381,11 @@
> 	</varlistentry>
> 
> 	<varlistentry>
>+	<term>--allow-mschapv2</term>
>+	<listitem><para>Explicitly allow MSCHAPv2.</para></listitem>
>+	</varlistentry>
>+
>+	<varlistentry>
> 	<term>--offline-logon</term>
> 	<listitem><para>Allow offline logons for plain text auth.
> 	</para></listitem>
>diff --git a/nsswitch/libwbclient/wbclient.h b/nsswitch/libwbclient/wbclient.h
>index adf8fe3..97be81f 100644
>--- a/nsswitch/libwbclient/wbclient.h
>+++ b/nsswitch/libwbclient/wbclient.h
>@@ -315,6 +315,7 @@ struct wbcChangePasswordParams {
> #define WBC_MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT		0x00000020
> #define WBC_MSV1_0_RETURN_PROFILE_PATH			0x00000200
> #define WBC_MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT	0x00000800
>+#define WBC_MSV1_0_ALLOW_MSVCHAPV2			0x00010000
> 
> /* wbcAuthUserParams->flags */
> 
>diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c
>index b90f927..1556e48 100644
>--- a/source3/utils/ntlm_auth.c
>+++ b/source3/utils/ntlm_auth.c
>@@ -167,6 +167,7 @@ static int request_lm_key;
> static int request_user_session_key;
> static int use_cached_creds;
> static int offline_logon;
>+static int opt_allow_mschapv2;
> 
> static const char *require_membership_of;
> static const char *require_membership_of_sid;
>@@ -527,6 +528,9 @@ NTSTATUS contact_winbind_auth_crap(const char *username,
> 	request.data.auth_crap.logon_parameters = extra_logon_parameters
> 		| MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT | MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT;
> 
>+	if (opt_allow_mschapv2)
>+			request.data.auth_crap.logon_parameters |= MSV1_0_ALLOW_MSVCHAPV2;
>+
> 	if (require_membership_of_sid)
> 		fstrcpy(request.data.auth_crap.require_membership_of_sid, require_membership_of_sid);
> 
>@@ -2754,6 +2758,7 @@ enum {
> 	OPT_DIAGNOSTICS,
> 	OPT_REQUIRE_MEMBERSHIP,
> 	OPT_USE_CACHED_CREDS,
>+	OPT_ALLOW_MSCHAPV2,
> 	OPT_PAM_WINBIND_CONF,
> 	OPT_TARGET_SERVICE,
> 	OPT_TARGET_HOSTNAME,
>@@ -2794,6 +2799,7 @@ enum {
> 		{ "request-lm-key", 0, POPT_ARG_NONE, &request_lm_key, OPT_LM_KEY, "Retrieve LM session key"},
> 		{ "request-nt-key", 0, POPT_ARG_NONE, &request_user_session_key, OPT_USER_SESSION_KEY, "Retrieve User (NT) session key"},
> 		{ "use-cached-creds", 0, POPT_ARG_NONE, &use_cached_creds, OPT_USE_CACHED_CREDS, "Use cached credentials if no password is given"},
>+		{ "allow-mschapv2", 0, POPT_ARG_NONE, &opt_allow_mschapv2, OPT_ALLOW_MSCHAPV2, "Explicitly allow MSCHAPv2" },
> 		{ "offline-logon", 0, POPT_ARG_NONE, &offline_logon,
> 		  OPT_OFFLINE_LOGON,
> 		  "Use cached passwords when DC is offline"},
>diff --git a/source4/utils/ntlm_auth.c b/source4/utils/ntlm_auth.c
>index f7c95eb..7f7a0e7 100644
>--- a/source4/utils/ntlm_auth.c
>+++ b/source4/utils/ntlm_auth.c
>@@ -104,6 +104,7 @@ static const char *opt_workstation;
> static const char *opt_password;
> static int opt_multiplex;
> static int use_cached_creds;
>+static int opt_allow_mschapv2;
> 
> 
> static void mux_printf(unsigned int mux_id, const char *format, ...) PRINTF_ATTRIBUTE(2, 3);
>@@ -174,6 +175,7 @@ static NTSTATUS local_pw_check_specified(struct loadparm_context *lp_ctx,
> 	if (!mem_ctx) {
> 		nt_status = NT_STATUS_NO_MEMORY;
> 	} else {
>+		uint32_t logon_parameters = 0;
> 		
> 		E_md4hash(opt_password, nt_pw.hash);
> 		if (E_deshash(opt_password, lm_pw.hash)) {
>@@ -183,10 +185,13 @@ static NTSTATUS local_pw_check_specified(struct loadparm_context *lp_ctx,
> 		}
> 		nt_pwd = &nt_pw;
> 		
>+		if (opt_allow_mschapv2)
>+			logon_parameters |= MSV1_0_ALLOW_MSVCHAPV2;
> 		
> 		nt_status = ntlm_password_check(mem_ctx, 
> 						lpcfg_lanman_auth(lp_ctx),
> 						lpcfg_ntlm_auth(lp_ctx),
>+						logon_parameters |
> 						MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
> 						MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
> 						challenge,
>@@ -1043,6 +1048,7 @@ enum {
> 	OPT_REQUIRE_MEMBERSHIP,
> 	OPT_MULTIPLEX,
> 	OPT_USE_CACHED_CREDS,
>+	OPT_ALLOW_MSCHAPV2,
> };
> 
> int main(int argc, const char **argv)
>@@ -1069,6 +1075,7 @@ int main(int argc, const char **argv)
> 		{ "password", 0, POPT_ARG_STRING, &opt_password, OPT_PASSWORD, "User's plaintext password"},		
> 		{ "multiplex", 0, POPT_ARG_NONE, &opt_multiplex, OPT_MULTIPLEX, "Multiplex Mode"},
> 		{ "use-cached-creds", 0, POPT_ARG_NONE, &use_cached_creds, OPT_USE_CACHED_CREDS, "silently ignored for compatibility reasons"},
>+		{ "allow-mschapv2", 0, POPT_ARG_NONE, &opt_allow_mschapv2, OPT_ALLOW_MSCHAPV2, "Explicitly allow MSCHAPv2" },
> 		POPT_COMMON_SAMBA
> 		POPT_COMMON_VERSION
> 		{ NULL }
>-- 
>2.4.3
>

Actions: View

Attachments on bug 11694: 11790