Attachment 120420 Details for Bug 93282 – Check host password lifetime

[patch] Check host password lifetime

0001-Check-host-password-lifetime.patch (text/plain), 9.11 KB, created by Sumit Bose on 2015-12-08 21:13:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sumit Bose

Created: 2015-12-08 21:13:59 UTC

Size: 9.11 KB

patch

obsolete

>From 1d481764a2a0cf174d449c1be991dc9d5638e8a5 Mon Sep 17 00:00:00 2001
>From: Sumit Bose <sbose@redhat.com>
>Date: Fri, 4 Dec 2015 11:17:32 +0100
>Subject: [PATCH] Check host password lifetime
>
>---
> doc/adcli.xml      |  7 +++++++
> library/adenroll.c | 55 +++++++++++++++++++++++++++++++++++++++++++++------
> library/adenroll.h |  4 ++++
> library/adutil.c   | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
> library/adutil.h   |  3 +++
> tools/computer.c   |  6 ++++++
> 6 files changed, 127 insertions(+), 6 deletions(-)
>
>diff --git a/doc/adcli.xml b/doc/adcli.xml
>index 7b6bc2d..55a5486 100644
>--- a/doc/adcli.xml
>+++ b/doc/adcli.xml
>@@ -364,6 +364,13 @@ $ adcli update --login-ccache=/tmp/krbcc_123
> 			computer account to this Kerberos principal.</para></listitem>
> 		</varlistentry>
> 		<varlistentry>
>+			<term><option>-host-pw-lifetime=<parameter>lifetime</parameter></option></term>
>+			<listitem><para>Only update the password of the
>+			computer account if it is older than the lifetime given
>+			in days. By default the password is updated if it is
>+			older than 30 days.</para></listitem>
>+		</varlistentry>
>+		<varlistentry>
> 			<term><option>--show-details</option></term>
> 			<listitem><para>After a successful join print out information
> 			about join operation. This is output in a format that should
>diff --git a/library/adenroll.c b/library/adenroll.c
>index 6e2c49d..60b1d63 100644
>--- a/library/adenroll.c
>+++ b/library/adenroll.c
>@@ -98,6 +98,8 @@ struct _adcli_enroll {
> 	krb5_principal *keytab_principals;
> 	krb5_enctype *keytab_enctypes;
> 	int keytab_enctypes_explicit;
>+	unsigned int host_pw_lifetime;
>+	int host_pw_lifetime_explicit;
> };
> 
> static adcli_result
>@@ -963,6 +965,7 @@ retrieve_computer_account (adcli_enroll *enroll)
> 		"operatingSystem",
> 		"operatingSystemVersion",
> 		"operatingSystemServicePack",
>+		"pwdLastSet",
> 		NULL,
> 	};
> 
>@@ -1630,20 +1633,34 @@ enroll_join_or_update_tasks (adcli_enroll *enroll,
> 		             adcli_enroll_flags flags)
> {
> 	adcli_result res;
>+	LDAP *ldap;
>+	char *value;
> 
>-	res = set_computer_password (enroll);
>+	/* Get information about the computer account */
>+	res = retrieve_computer_account (enroll);
> 	if (res != ADCLI_SUCCESS)
> 		return res;
> 
>+	ldap = adcli_conn_get_ldap_connection (enroll->conn);
>+	assert (ldap != NULL);
>+
>+	value = _adcli_ldap_parse_value (ldap,
>+	                                 enroll->computer_attributes,
>+	                                 "pwdLastSet");
>+
>+	if (check_nt_time_string_lifetime(value,
>+	                                  adcli_enroll_get_host_pw_lifetime(enroll))) {
>+		flags |= ADCLI_ENROLL_NO_KEYTAB;
>+	} else {
>+		res = set_computer_password (enroll);
>+		if (res != ADCLI_SUCCESS)
>+			return res;
>+	}
>+
> 	/* kvno is not needed if no keytab */
> 	if (flags & ADCLI_ENROLL_NO_KEYTAB)
> 		enroll->kvno = -1;
> 
>-	/* Get information about the computer account */
>-	res = retrieve_computer_account (enroll);
>-	if (res != ADCLI_SUCCESS)
>-		return res;
>-
> 	/* We ignore failures of setting these fields */
> 	update_and_calculate_enctypes (enroll);
> 	update_computer_account (enroll);
>@@ -2232,3 +2249,29 @@ adcli_enroll_auto_user_principal (adcli_enroll *enroll)
> 	_adcli_str_set (&enroll->user_principal, NULL);
> 	enroll->user_princpal_generate = 1;
> }
>+
>+#define DEFAULT_HOST_PW_LIFETIME 30
>+
>+unsigned int
>+adcli_enroll_get_host_pw_lifetime (adcli_enroll *enroll)
>+{
>+	return_val_if_fail (enroll != NULL, NULL);
>+	if (enroll->host_pw_lifetime_explicit) {
>+		return enroll->host_pw_lifetime;
>+	}
>+	return DEFAULT_HOST_PW_LIFETIME;
>+}
>+
>+void
>+adcli_enroll_set_host_pw_lifetime (adcli_enroll *enroll,
>+                                   const char *value)
>+{
>+	char *endptr;
>+
>+	return_if_fail (enroll != NULL);
>+	errno = 0;
>+	enroll->host_pw_lifetime = strtoul(value, &endptr, 10);
>+	return_if_fail(errno == 0 && *endptr == '\0' && endptr != value);
>+
>+	enroll->host_pw_lifetime_explicit = 1;
>+}
>diff --git a/library/adenroll.h b/library/adenroll.h
>index c139981..0ae3b25 100644
>--- a/library/adenroll.h
>+++ b/library/adenroll.h
>@@ -103,6 +103,10 @@ void               adcli_enroll_set_user_principal      (adcli_enroll *enroll,
> 
> void               adcli_enroll_auto_user_principal     (adcli_enroll *enroll);
> 
>+unsigned int       adcli_enroll_get_host_pw_lifetime    (adcli_enroll *enroll);
>+void               adcli_enroll_set_host_pw_lifetime    (adcli_enroll *enroll,
>+                                                         const char *value);
>+
> krb5_kvno          adcli_enroll_get_kvno                (adcli_enroll *enroll);
> 
> void               adcli_enroll_set_kvno                (adcli_enroll *enroll,
>diff --git a/library/adutil.c b/library/adutil.c
>index bdda50b..ceefc53 100644
>--- a/library/adutil.c
>+++ b/library/adutil.c
>@@ -34,6 +34,7 @@
> #include <stdlib.h>
> #include <string.h>
> #include <unistd.h>
>+#include <time.h>
> 
> static adcli_message_func message_func = NULL;
> static char last_error[2048] = { 0, };
>@@ -387,6 +388,39 @@ _adcli_write_all (int fd,
> 	return 0;
> }
> 
>+#define AD_TO_UNIX_TIME_CONST 11644473600LL
>+
>+bool
>+check_nt_time_string_lifetime (const char *nt_time_string, unsigned int lifetime)
>+{
>+	uint64_t nt_now;
>+	unsigned long long int pwd_last_set;
>+	char *endptr;
>+	time_t now;
>+
>+	if (nt_time_string == NULL) {
>+		_adcli_err("Missing NT time string, assuming it is expired");
>+		return false;
>+	}
>+	now = time(NULL);
>+	/* NT timestamps start at 1601-01-01 and use a 100ns base */
>+	nt_now = (now + AD_TO_UNIX_TIME_CONST) * 1000 * 1000 * 10;
>+	errno = 0;
>+	pwd_last_set = strtoull (nt_time_string, &endptr, 10);
>+	if (errno != 0 || *endptr != '\0' || endptr == nt_time_string) {
>+		_adcli_err("Failed to convert NT time string, assuming it is expired");
>+		return false;
>+	}
>+
>+	if (pwd_last_set + (lifetime * 24ULL * 60 * 60 \
>+				* 1000 * 1000 * 10) > nt_now) {
>+		_adcli_info ("Password not too old, no change needed");
>+		return true;
>+	}
>+
>+	return false;
>+}
>+
> #ifdef UTIL_TESTS
> 
> #include "test.h"
>@@ -434,6 +468,29 @@ test_strv_count (void)
> 	assert_num_eq (len, 3);
> }
> 
>+static void
>+test_check_nt_time_string_lifetime(void)
>+{
>+	/* Missing or invalid value */
>+	assert(!check_nt_time_string_lifetime (NULL, 0));
>+	assert(!check_nt_time_string_lifetime ("", 0));
>+	assert(!check_nt_time_string_lifetime ("a", 0));
>+	assert(!check_nt_time_string_lifetime ("1a", 0));
>+
>+	/* Certainly expired*/
>+	assert(!check_nt_time_string_lifetime("0", 0));
>+
>+	/* 1969-01-01T00:00:00: 116129340000000000 */
>+	/* Calculated with PowerShell:
>+	 * (Get-Date -Date "1969-01-01T00:00:00").ToFileTime() */
>+
>+	assert(!check_nt_time_string_lifetime("130645404000000000", 1));
>+
>+	/* This test will fail some time after 2200AD as a reminder to reflect
>+	 * why adcli is still needed. */
>+	assert(check_nt_time_string_lifetime("130645404000000000", 100000));
>+}
>+
> int
> main (int argc,
>       char *argv[])
>@@ -441,6 +498,7 @@ main (int argc,
> 	test_func (test_strv_add_free, "/util/strv_add_free");
> 	test_func (test_strv_dup, "/util/strv_dup");
> 	test_func (test_strv_count, "/util/strv_count");
>+	test_func (test_check_nt_time_string_lifetime, "/util/check_nt_time_string_lifetime");
> 	return test_run (argc, argv);
> }
> 
>diff --git a/library/adutil.h b/library/adutil.h
>index 41fc691..e4ca0de 100644
>--- a/library/adutil.h
>+++ b/library/adutil.h
>@@ -25,6 +25,7 @@
> #define ADUTIL_H_
> 
> #include <stdlib.h>
>+#include <stdbool.h>
> 
> typedef enum {
> 	/* Successful completion */
>@@ -90,4 +91,6 @@ void              adcli_clear_last_error        (void);
> 
> const char *      adcli_get_last_error          (void);
> 
>+bool              check_nt_time_string_lifetime (const char *nt_time_string, unsigned int lifetime);
>+
> #endif /* ADUTIL_H_ */
>diff --git a/tools/computer.c b/tools/computer.c
>index 88dac39..09a3d51 100644
>--- a/tools/computer.c
>+++ b/tools/computer.c
>@@ -103,6 +103,7 @@ typedef enum {
> 	opt_os_version,
> 	opt_os_service_pack,
> 	opt_user_principal,
>+	opt_host_pw_lifetime,
> } Option;
> 
> static adcli_tool_desc common_usages[] = {
>@@ -128,6 +129,7 @@ static adcli_tool_desc common_usages[] = {
> 	{ opt_os_version, "the computer operating system version", },
> 	{ opt_os_service_pack, "the computer operating system service pack", },
> 	{ opt_user_principal, "add an authentication principal to the account", },
>+	{ opt_host_pw_lifetime, "lifetime of the host accounts password in days", },
> 	{ opt_no_password, "don't prompt for or read a password" },
> 	{ opt_prompt_password, "prompt for a password if necessary" },
> 	{ opt_stdin_password, "read a password from stdin (until EOF) if\n"
>@@ -244,6 +246,9 @@ parse_option (Option opt,
> 		else
> 			adcli_enroll_auto_user_principal (enroll);
> 		return;
>+	case opt_host_pw_lifetime:
>+		adcli_enroll_set_host_pw_lifetime (enroll, optarg);
>+		return;
> 	case opt_verbose:
> 		return;
> 
>@@ -404,6 +409,7 @@ adcli_tool_computer_update (adcli_conn *conn,
> 		{ "os-version", required_argument, NULL, opt_os_version },
> 		{ "os-service-pack", optional_argument, NULL, opt_os_service_pack },
> 		{ "user-principal", optional_argument, NULL, opt_user_principal },
>+		{ "host-pw-lifetime", optional_argument, NULL, opt_host_pw_lifetime },
> 		{ "show-details", no_argument, NULL, opt_show_details },
> 		{ "show-password", no_argument, NULL, opt_show_password },
> 		{ "verbose", no_argument, NULL, opt_verbose },
>-- 
>2.5.0
>

Actions: View | Splinter Review

Attachments on bug 93282: 120420 | 120462

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.