[PATCH] Remove broken api_SetUserPassword() ?
abartlet at samba.org
Mon May 14 17:03:12 MDT 2012
On Mon, 2012-05-14 at 22:12 +0200, Volker Lendecke wrote:
> On Mon, May 14, 2012 at 09:52:27PM +0200, Volker Lendecke wrote:
> > Hi!
> > Attached find a patch for what I find to be a very likely
> > cut&paste error.
> > Does anybody know if we have a test for this case? To me it
> > seems it's a bit unlikely we actually have to use
> > strlen(pass1) and strlen(pass2) in this code piece. The
> > code to me seems to indicate we got raw hashes, which might
> > contain 0-bytes.
> > Volker
Volker, first very well spotted for noticing this.
Not only is this code untested, a code inspection shows it is
inoperative (our SAMR server will not accept a password change without
the NT hash as verification for that call), and in the plaintext case is
simply wrong (the passwords are not encrypted correctly for
I propose this patch instead (remove the lot) for discussion. This
isn't even the RAP password change used by smbpasswd as a fallback
(SamOEMChangePassword), this is an even older one. This version doesn't
give us the new plaintext or NT password, unless the whole lot was sent
plaintext over the wire (and then the current implementation looses the
All that said, in the commit a17203ba (reimplementing this against SAMR)
GD removed the comment which said:
- * Attempt to verify the old password against smbpasswd entries
- * Win98 clients send old and new password in plaintext for this call.
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 8617 bytes
Desc: not available
More information about the samba-technical