Attachment 120462 Details for Bug 93282 – Check host password lifetime - v2

[patch] Check host password lifetime - v2

0001-Check-host-password-lifetime.patch (text/plain), 10.85 KB, created by Sumit Bose on 2015-12-11 10:15:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sumit Bose

Created: 2015-12-11 10:15:20 UTC

Size: 10.85 KB

patch

obsolete

>From 525fc60716f9b44db50ec043b18e0131a78dac00 Mon Sep 17 00:00:00 2001
>From: Sumit Bose <sbose@redhat.com>
>Date: Fri, 4 Dec 2015 11:17:32 +0100
>Subject: [PATCH] Check host password lifetime
>
>---
> doc/adcli.xml       |  7 ++++++
> library/adenroll.c  | 63 +++++++++++++++++++++++++++++++++++++++++++++++------
> library/adenroll.h  |  5 +++++
> library/adprivate.h |  2 ++
> library/adutil.c    | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++
> library/adutil.h    |  1 +
> tools/computer.c    | 18 +++++++++++++++
> 7 files changed, 149 insertions(+), 7 deletions(-)
>
>diff --git a/doc/adcli.xml b/doc/adcli.xml
>index 7b6bc2d..5a27455 100644
>--- a/doc/adcli.xml
>+++ b/doc/adcli.xml
>@@ -364,6 +364,13 @@ $ adcli update --login-ccache=/tmp/krbcc_123
> 			computer account to this Kerberos principal.</para></listitem>
> 		</varlistentry>
> 		<varlistentry>
>+			<term><option>-computer-password-lifetime=<parameter>lifetime</parameter></option></term>
>+			<listitem><para>Only update the password of the
>+			computer account if it is older than the lifetime given
>+			in days. By default the password is updated if it is
>+			older than 30 days.</para></listitem>
>+		</varlistentry>
>+		<varlistentry>
> 			<term><option>--show-details</option></term>
> 			<listitem><para>After a successful join print out information
> 			about join operation. This is output in a format that should
>diff --git a/library/adenroll.c b/library/adenroll.c
>index 6e2c49d..b0c29ce 100644
>--- a/library/adenroll.c
>+++ b/library/adenroll.c
>@@ -98,6 +98,8 @@ struct _adcli_enroll {
> 	krb5_principal *keytab_principals;
> 	krb5_enctype *keytab_enctypes;
> 	int keytab_enctypes_explicit;
>+	unsigned int computer_password_lifetime;
>+	int computer_password_lifetime_explicit;
> };
> 
> static adcli_result
>@@ -963,6 +965,7 @@ retrieve_computer_account (adcli_enroll *enroll)
> 		"operatingSystem",
> 		"operatingSystemVersion",
> 		"operatingSystemServicePack",
>+		"pwdLastSet",
> 		NULL,
> 	};
> 
>@@ -1631,18 +1634,22 @@ enroll_join_or_update_tasks (adcli_enroll *enroll,
> {
> 	adcli_result res;
> 
>-	res = set_computer_password (enroll);
>-	if (res != ADCLI_SUCCESS)
>-		return res;
>+	if (!(flags & ADCLI_ENROLL_PASSWORD_VALID)) {
>+		res = set_computer_password (enroll);
>+		if (res != ADCLI_SUCCESS)
>+			return res;
>+	}
> 
> 	/* kvno is not needed if no keytab */
> 	if (flags & ADCLI_ENROLL_NO_KEYTAB)
> 		enroll->kvno = -1;
> 
>-	/* Get information about the computer account */
>-	res = retrieve_computer_account (enroll);
>-	if (res != ADCLI_SUCCESS)
>-		return res;
>+	/* Get information about the computer account if needed */
>+	if (enroll->computer_attributes == NULL) {
>+		res = retrieve_computer_account (enroll);
>+		if (res != ADCLI_SUCCESS)
>+			return res;
>+	}
> 
> 	/* We ignore failures of setting these fields */
> 	update_and_calculate_enctypes (enroll);
>@@ -1719,6 +1726,7 @@ adcli_enroll_update (adcli_enroll *enroll,
> {
> 	adcli_result res = ADCLI_SUCCESS;
> 	LDAP *ldap;
>+	char *value;
> 
> 	return_unexpected_if_fail (enroll != NULL);
> 
>@@ -1751,6 +1759,25 @@ adcli_enroll_update (adcli_enroll *enroll,
> 		}
> 	}
> 
>+	/* Get information about the computer account */
>+	res = retrieve_computer_account (enroll);
>+	if (res != ADCLI_SUCCESS)
>+		return res;
>+
>+	ldap = adcli_conn_get_ldap_connection (enroll->conn);
>+	assert (ldap != NULL);
>+
>+	value = _adcli_ldap_parse_value (ldap,
>+	                                 enroll->computer_attributes,
>+	                                 "pwdLastSet");
>+
>+	if (_adcli_check_nt_time_string_lifetime (value,
>+	                adcli_enroll_get_computer_password_lifetime (enroll))) {
>+		flags |= ADCLI_ENROLL_NO_KEYTAB;
>+		flags |= ADCLI_ENROLL_PASSWORD_VALID;
>+	}
>+	free (value);
>+
> 	return enroll_join_or_update_tasks (enroll, flags);
> }
> 
>@@ -2232,3 +2259,25 @@ adcli_enroll_auto_user_principal (adcli_enroll *enroll)
> 	_adcli_str_set (&enroll->user_principal, NULL);
> 	enroll->user_princpal_generate = 1;
> }
>+
>+#define DEFAULT_HOST_PW_LIFETIME 30
>+
>+unsigned int
>+adcli_enroll_get_computer_password_lifetime (adcli_enroll *enroll)
>+{
>+	return_val_if_fail (enroll != NULL, DEFAULT_HOST_PW_LIFETIME);
>+	if (enroll->computer_password_lifetime_explicit) {
>+		return enroll->computer_password_lifetime;
>+	}
>+	return DEFAULT_HOST_PW_LIFETIME;
>+}
>+
>+void
>+adcli_enroll_set_computer_password_lifetime (adcli_enroll *enroll,
>+                                   unsigned int lifetime)
>+{
>+	return_if_fail (enroll != NULL);
>+	enroll->computer_password_lifetime = lifetime;
>+
>+	enroll->computer_password_lifetime_explicit = 1;
>+}
>diff --git a/library/adenroll.h b/library/adenroll.h
>index c139981..9a107ab 100644
>--- a/library/adenroll.h
>+++ b/library/adenroll.h
>@@ -29,6 +29,7 @@
> typedef enum {
> 	ADCLI_ENROLL_NO_KEYTAB = 1 << 1,
> 	ADCLI_ENROLL_ALLOW_OVERWRITE = 1 << 2,
>+	ADCLI_ENROLL_PASSWORD_VALID = 1 << 3,
> } adcli_enroll_flags;
> 
> typedef struct _adcli_enroll adcli_enroll;
>@@ -103,6 +104,10 @@ void               adcli_enroll_set_user_principal      (adcli_enroll *enroll,
> 
> void               adcli_enroll_auto_user_principal     (adcli_enroll *enroll);
> 
>+unsigned int       adcli_enroll_get_computer_password_lifetime (adcli_enroll *enroll);
>+void               adcli_enroll_set_computer_password_lifetime (adcli_enroll *enroll,
>+                                                         unsigned int lifetime);
>+
> krb5_kvno          adcli_enroll_get_kvno                (adcli_enroll *enroll);
> 
> void               adcli_enroll_set_kvno                (adcli_enroll *enroll,
>diff --git a/library/adprivate.h b/library/adprivate.h
>index 2fc07a7..fc146af 100644
>--- a/library/adprivate.h
>+++ b/library/adprivate.h
>@@ -279,4 +279,6 @@ struct _adcli_attrs {
> 	int len;
> };
> 
>+bool             _adcli_check_nt_time_string_lifetime (const char *nt_time_string, unsigned int lifetime);
>+
> #endif /* ADPRIVATE_H_ */
>diff --git a/library/adutil.c b/library/adutil.c
>index bdda50b..01ac09d 100644
>--- a/library/adutil.c
>+++ b/library/adutil.c
>@@ -34,6 +34,8 @@
> #include <stdlib.h>
> #include <string.h>
> #include <unistd.h>
>+#include <stdint.h>
>+#include <time.h>
> 
> static adcli_message_func message_func = NULL;
> static char last_error[2048] = { 0, };
>@@ -387,6 +389,40 @@ _adcli_write_all (int fd,
> 	return 0;
> }
> 
>+#define AD_TO_UNIX_TIME_CONST 11644473600LL
>+
>+bool
>+_adcli_check_nt_time_string_lifetime (const char *nt_time_string,
>+                                      unsigned int lifetime)
>+{
>+	uint64_t nt_now;
>+	unsigned long long int pwd_last_set;
>+	char *endptr;
>+	time_t now;
>+
>+	if (nt_time_string == NULL) {
>+		_adcli_err ("Missing NT time string, assuming it is expired");
>+		return false;
>+	}
>+	now = time (NULL);
>+	/* NT timestamps start at 1601-01-01 and use a 100ns base */
>+	nt_now = (now + AD_TO_UNIX_TIME_CONST) * 1000 * 1000 * 10;
>+	errno = 0;
>+	pwd_last_set = strtoull (nt_time_string, &endptr, 10);
>+	if (errno != 0 || *endptr != '\0' || endptr == nt_time_string) {
>+		_adcli_err ("Failed to convert NT time string, assuming it is expired");
>+		return false;
>+	}
>+
>+	if (pwd_last_set + (lifetime * 24ULL * 60 * 60 \
>+				* 1000 * 1000 * 10) > nt_now) {
>+		_adcli_info ("Password not too old, no change needed");
>+		return true;
>+	}
>+
>+	return false;
>+}
>+
> #ifdef UTIL_TESTS
> 
> #include "test.h"
>@@ -434,6 +470,29 @@ test_strv_count (void)
> 	assert_num_eq (len, 3);
> }
> 
>+static void
>+test_check_nt_time_string_lifetime (void)
>+{
>+	/* Missing or invalid value */
>+	assert (!_adcli_check_nt_time_string_lifetime (NULL, 0));
>+	assert (!_adcli_check_nt_time_string_lifetime ("", 0));
>+	assert (!_adcli_check_nt_time_string_lifetime ("a", 0));
>+	assert (!_adcli_check_nt_time_string_lifetime ("1a", 0));
>+
>+	/* Certainly expired*/
>+	assert (!_adcli_check_nt_time_string_lifetime ("0", 0));
>+
>+	/* 1969-01-01T00:00:00: 116129340000000000 */
>+	/* Calculated with PowerShell:
>+	 * (Get-Date -Date "1969-01-01T00:00:00").ToFileTime() */
>+
>+	assert (!_adcli_check_nt_time_string_lifetime ("130645404000000000", 1));
>+
>+	/* This test will fail some time after 2200AD as a reminder to reflect
>+	 * why adcli is still needed. */
>+	assert (_adcli_check_nt_time_string_lifetime ("130645404000000000", 100000));
>+}
>+
> int
> main (int argc,
>       char *argv[])
>@@ -441,6 +500,7 @@ main (int argc,
> 	test_func (test_strv_add_free, "/util/strv_add_free");
> 	test_func (test_strv_dup, "/util/strv_dup");
> 	test_func (test_strv_count, "/util/strv_count");
>+	test_func (test_check_nt_time_string_lifetime, "/util/check_nt_time_string_lifetime");
> 	return test_run (argc, argv);
> }
> 
>diff --git a/library/adutil.h b/library/adutil.h
>index 41fc691..a07c5da 100644
>--- a/library/adutil.h
>+++ b/library/adutil.h
>@@ -25,6 +25,7 @@
> #define ADUTIL_H_
> 
> #include <stdlib.h>
>+#include <stdbool.h>
> 
> typedef enum {
> 	/* Successful completion */
>diff --git a/tools/computer.c b/tools/computer.c
>index 88dac39..4ffeb32 100644
>--- a/tools/computer.c
>+++ b/tools/computer.c
>@@ -29,6 +29,7 @@
> #include <assert.h>
> #include <err.h>
> #include <stdio.h>
>+#include <errno.h>
> 
> static void
> dump_details (adcli_conn *conn,
>@@ -103,6 +104,7 @@ typedef enum {
> 	opt_os_version,
> 	opt_os_service_pack,
> 	opt_user_principal,
>+	opt_computer_password_lifetime,
> } Option;
> 
> static adcli_tool_desc common_usages[] = {
>@@ -128,6 +130,7 @@ static adcli_tool_desc common_usages[] = {
> 	{ opt_os_version, "the computer operating system version", },
> 	{ opt_os_service_pack, "the computer operating system service pack", },
> 	{ opt_user_principal, "add an authentication principal to the account", },
>+	{ opt_computer_password_lifetime, "lifetime of the host accounts password in days", },
> 	{ opt_no_password, "don't prompt for or read a password" },
> 	{ opt_prompt_password, "prompt for a password if necessary" },
> 	{ opt_stdin_password, "read a password from stdin (until EOF) if\n"
>@@ -151,6 +154,8 @@ parse_option (Option opt,
> 	static int no_password = 0;
> 	static int prompt_password = 0;
> 	static int stdin_password = 0;
>+	char *endptr;
>+	unsigned int lifetime;
> 
> 	switch (opt) {
> 	case opt_login_ccache:
>@@ -244,6 +249,18 @@ parse_option (Option opt,
> 		else
> 			adcli_enroll_auto_user_principal (enroll);
> 		return;
>+	case opt_computer_password_lifetime:
>+		errno = 0;
>+		lifetime = strtoul (optarg, &endptr, 10);
>+		if (errno != 0 || *endptr != '\0' || endptr == optarg) {
>+			errx (EUSAGE,
>+			      "failure to parse value '%s' of option 'computer-password-lifetime'; "
>+			      "expecting non-negative integer indicating the lifetime in days",
>+			      optarg);
>+		}
>+
>+		adcli_enroll_set_computer_password_lifetime (enroll, lifetime);
>+		return;
> 	case opt_verbose:
> 		return;
> 
>@@ -404,6 +421,7 @@ adcli_tool_computer_update (adcli_conn *conn,
> 		{ "os-version", required_argument, NULL, opt_os_version },
> 		{ "os-service-pack", optional_argument, NULL, opt_os_service_pack },
> 		{ "user-principal", optional_argument, NULL, opt_user_principal },
>+		{ "computer-password-lifetime", optional_argument, NULL, opt_computer_password_lifetime },
> 		{ "show-details", no_argument, NULL, opt_show_details },
> 		{ "show-password", no_argument, NULL, opt_show_password },
> 		{ "verbose", no_argument, NULL, opt_verbose },
>-- 
>2.5.0
>

Actions: View | Splinter Review

Attachments on bug 93282: 120420 | 120462

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.