From 794e48ae111ebb81ed2595bf8701827669af2141 Mon Sep 17 00:00:00 2001 From: Herwin Weststrate Date: Wed, 9 Dec 2015 18:47:47 +0100 Subject: [PATCH] Added MSV1_0_ALLOW_MSVCHAPV2 flag to ntlm_auth An implementation of https://lists.samba.org/archive/samba/2012-March/166497.html (which has been discussed in 2012, but was never implemented). It has been tested on a Debian Jessie system with this patch added to the Debian package (which is currently 4.1.17). Even though this is Samba 4, the ntlm_auth installed is the one from Samba 3 (yes, it surprised me too). The backend was a machine with Windows 2012R2. It was first tested with the local security policy 'Network Security: LAN Manager authentication level' setting changed to 'Send NTLMv2 Response Only' (allow ntlm v1). This way we are able to authenticate with and without the MSV1_0_ALLOW_MSVCHAPV2 flag (as expected). After the basic step has been verified, the local security policy 'Network Security: LAN Manager authentication level' setting was changed to 'Send NTLMv2 Response Only. Refuse LM & NTLM' (only allow ntlm v2). The behaviour now changed according to the MSV1_0_ALLOW_MSVCHAPV2 flag (again: as expected). $ ntlm_auth --request-nt-key --username=XXXXXXXXXXXXX --challenge=XXXXXXXXXXXXXXXXX --nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --domain= Logon failure (0xc000006d) $ ntlm_auth --request-nt-key --username=XXXXXXXXXXXXX --challenge=XXXXXXXXXXXXXXXXX --nt-response=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --domain= --allow-mschapv2 NT_KEY: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX The changes in `wbclient.h` are intended for programs that use libwinbind directly instead of authenticating via `ntlm_auth`. I intend to use that within FreeRADIUS (see https://bugzilla.samba.org/show_bug.cgi?id=11149). --- docs-xml/manpages/ntlm_auth.1.xml | 5 +++++ nsswitch/libwbclient/wbclient.h | 1 + source3/utils/ntlm_auth.c | 6 ++++++ source4/utils/ntlm_auth.c | 7 +++++++ 4 files changed, 19 insertions(+) diff --git a/docs-xml/manpages/ntlm_auth.1.xml b/docs-xml/manpages/ntlm_auth.1.xml index 3dfcc03..e5dad8e 100644 --- a/docs-xml/manpages/ntlm_auth.1.xml +++ b/docs-xml/manpages/ntlm_auth.1.xml @@ -381,6 +381,11 @@ + --allow-mschapv2 + Explicitly allow MSCHAPv2. + + + --offline-logon Allow offline logons for plain text auth. diff --git a/nsswitch/libwbclient/wbclient.h b/nsswitch/libwbclient/wbclient.h index adf8fe3..97be81f 100644 --- a/nsswitch/libwbclient/wbclient.h +++ b/nsswitch/libwbclient/wbclient.h @@ -315,6 +315,7 @@ struct wbcChangePasswordParams { #define WBC_MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT 0x00000020 #define WBC_MSV1_0_RETURN_PROFILE_PATH 0x00000200 #define WBC_MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT 0x00000800 +#define WBC_MSV1_0_ALLOW_MSVCHAPV2 0x00010000 /* wbcAuthUserParams->flags */ diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c index 4878aa1..863c37b 100644 --- a/source3/utils/ntlm_auth.c +++ b/source3/utils/ntlm_auth.c @@ -167,6 +167,7 @@ static int request_lm_key; static int request_user_session_key; static int use_cached_creds; static int offline_logon; +static int opt_allow_mschapv2; static const char *require_membership_of; static const char *require_membership_of_sid; @@ -527,6 +528,9 @@ NTSTATUS contact_winbind_auth_crap(const char *username, request.data.auth_crap.logon_parameters = extra_logon_parameters | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT | MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT; + if (opt_allow_mschapv2) + request.data.auth_crap.logon_parameters |= MSV1_0_ALLOW_MSVCHAPV2; + if (require_membership_of_sid) fstrcpy(request.data.auth_crap.require_membership_of_sid, require_membership_of_sid); @@ -2716,6 +2720,7 @@ enum { OPT_DIAGNOSTICS, OPT_REQUIRE_MEMBERSHIP, OPT_USE_CACHED_CREDS, + OPT_ALLOW_MSCHAPV2, OPT_PAM_WINBIND_CONF, OPT_TARGET_SERVICE, OPT_TARGET_HOSTNAME, @@ -2756,6 +2761,7 @@ enum { { "request-lm-key", 0, POPT_ARG_NONE, &request_lm_key, OPT_LM_KEY, "Retrieve LM session key"}, { "request-nt-key", 0, POPT_ARG_NONE, &request_user_session_key, OPT_USER_SESSION_KEY, "Retrieve User (NT) session key"}, { "use-cached-creds", 0, POPT_ARG_NONE, &use_cached_creds, OPT_USE_CACHED_CREDS, "Use cached credentials if no password is given"}, + { "allow-mschapv2", 0, POPT_ARG_NONE, &opt_allow_mschapv2, OPT_ALLOW_MSCHAPV2, "Explicitly allow MSCHAPv2" }, { "offline-logon", 0, POPT_ARG_NONE, &offline_logon, OPT_OFFLINE_LOGON, "Use cached passwords when DC is offline"}, diff --git a/source4/utils/ntlm_auth.c b/source4/utils/ntlm_auth.c index f7c95eb..7f7a0e7 100644 --- a/source4/utils/ntlm_auth.c +++ b/source4/utils/ntlm_auth.c @@ -104,6 +104,7 @@ static const char *opt_workstation; static const char *opt_password; static int opt_multiplex; static int use_cached_creds; +static int opt_allow_mschapv2; static void mux_printf(unsigned int mux_id, const char *format, ...) PRINTF_ATTRIBUTE(2, 3); @@ -174,6 +175,7 @@ static NTSTATUS local_pw_check_specified(struct loadparm_context *lp_ctx, if (!mem_ctx) { nt_status = NT_STATUS_NO_MEMORY; } else { + uint32_t logon_parameters = 0; E_md4hash(opt_password, nt_pw.hash); if (E_deshash(opt_password, lm_pw.hash)) { @@ -183,10 +185,13 @@ static NTSTATUS local_pw_check_specified(struct loadparm_context *lp_ctx, } nt_pwd = &nt_pw; + if (opt_allow_mschapv2) + logon_parameters |= MSV1_0_ALLOW_MSVCHAPV2; nt_status = ntlm_password_check(mem_ctx, lpcfg_lanman_auth(lp_ctx), lpcfg_ntlm_auth(lp_ctx), + logon_parameters | MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT | MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT, challenge, @@ -1043,6 +1048,7 @@ enum { OPT_REQUIRE_MEMBERSHIP, OPT_MULTIPLEX, OPT_USE_CACHED_CREDS, + OPT_ALLOW_MSCHAPV2, }; int main(int argc, const char **argv) @@ -1069,6 +1075,7 @@ int main(int argc, const char **argv) { "password", 0, POPT_ARG_STRING, &opt_password, OPT_PASSWORD, "User's plaintext password"}, { "multiplex", 0, POPT_ARG_NONE, &opt_multiplex, OPT_MULTIPLEX, "Multiplex Mode"}, { "use-cached-creds", 0, POPT_ARG_NONE, &use_cached_creds, OPT_USE_CACHED_CREDS, "silently ignored for compatibility reasons"}, + { "allow-mschapv2", 0, POPT_ARG_NONE, &opt_allow_mschapv2, OPT_ALLOW_MSCHAPV2, "Explicitly allow MSCHAPv2" }, POPT_COMMON_SAMBA POPT_COMMON_VERSION { NULL }