diff options
author | markm <markm@FreeBSD.org> | 1999-09-19 14:19:32 +0000 |
---|---|---|
committer | markm <markm@FreeBSD.org> | 1999-09-19 14:19:32 +0000 |
commit | fe83e8abf357ee11114856a5278bb38431a9517c (patch) | |
tree | 36ce70fe2e8419130e546c38a7790e8ab224a362 /crypto/kerberosIV/kadmin/kadmin.c | |
parent | a8a89cfaf983bc64f4b42f7c35209a5a36dd0fe8 (diff) | |
download | FreeBSD-src-fe83e8abf357ee11114856a5278bb38431a9517c.zip FreeBSD-src-fe83e8abf357ee11114856a5278bb38431a9517c.tar.gz |
Clean import of KTH krb4-0.10.1.
Diffstat (limited to 'crypto/kerberosIV/kadmin/kadmin.c')
-rw-r--r-- | crypto/kerberosIV/kadmin/kadmin.c | 918 |
1 files changed, 609 insertions, 309 deletions
diff --git a/crypto/kerberosIV/kadmin/kadmin.c b/crypto/kerberosIV/kadmin/kadmin.c index f117b6b..340a914 100644 --- a/crypto/kerberosIV/kadmin/kadmin.c +++ b/crypto/kerberosIV/kadmin/kadmin.c @@ -28,19 +28,24 @@ or implied warranty. */ #include "kadm_locl.h" +#include "getarg.h" +#include "parse_time.h" -RCSID("$Id: kadmin.c,v 1.48 1997/05/13 09:43:06 bg Exp $"); +RCSID("$Id: kadmin.c,v 1.59.2.1 1999/09/02 08:51:59 joda Exp $"); -static void change_password(int argc, char **argv); -static void change_key(int argc, char **argv); -static void change_admin_password(int argc, char **argv); -static void add_new_key(int argc, char **argv); -static void del_entry(int argc, char **argv); -static void get_entry(int argc, char **argv); -static void mod_entry(int argc, char **argv); -static void help(int argc, char **argv); -static void clean_up_cmd(int argc, char **argv); -static void quit_cmd(int argc, char **argv); +static int change_password(int argc, char **argv); +static int change_key(int argc, char **argv); +static int change_admin_password(int argc, char **argv); +static int add_new_key(int argc, char **argv); +static int del_entry(int argc, char **argv); +static int get_entry(int argc, char **argv); +static int mod_entry(int argc, char **argv); +static int help(int argc, char **argv); +static int clean_up_cmd(int argc, char **argv); +static int quit_cmd(int argc, char **argv); +static int set_timeout_cmd(int argc, char **argv); + +static int set_timeout(const char *); static SL_cmd cmds[] = { {"change_password", change_password, "Change a user's password"}, @@ -59,6 +64,8 @@ static SL_cmd cmds[] = { {"get_entry", get_entry, "Get entry from kerberos database"}, {"mod_entry", mod_entry, "Modify entry in kerberos database"}, {"destroy_tickets", clean_up_cmd, "Destroy admin tickets"}, + {"set_timeout", set_timeout_cmd, "Set ticket timeout"}, + {"timeout" }, {"exit", quit_cmd, "Exit program"}, {"quit"}, {"help", help, "Help"}, @@ -81,7 +88,6 @@ static SL_cmd cmds[] = { static krb_principal pr; static char default_realm[REALM_SZ]; /* default kerberos realm */ static char krbrlm[REALM_SZ]; /* current realm being administered */ -static int multiple = 0; /* Allow multiple requests per ticket */ #ifdef NOENCRYPTION #define read_long_pw_string placebo_read_pw_string @@ -139,31 +145,41 @@ get_attr(Kadm_vals *vals) SET_FIELD(KADM_ATTR,vals->fields); } +static time_t +parse_expdate(const char *str) +{ + struct tm edate; + + memset(&edate, 0, sizeof(edate)); + if (sscanf(str, "%d-%d-%d", + &edate.tm_year, &edate.tm_mon, &edate.tm_mday) == 3) { + edate.tm_mon--; /* January is 0, not 1 */ + edate.tm_hour = 23; /* nearly midnight at the end of the */ + edate.tm_min = 59; /* specified day */ + } + if(krb_check_tm (edate)) + return -1; + edate.tm_year -= 1900; + return tm2time (edate, 1); +} + static void get_expdate(Kadm_vals *vals) { char buff[BUFSIZ]; - struct tm edate; + time_t t; - memset(&edate, 0, sizeof(edate)); do { - printf("Expiration date (enter yyyy-mm-dd) ? [%.24s] ", - asctime(k_localtime(&vals->exp_date))); + strftime(buff, sizeof(buff), "%Y-%m-%d", k_localtime(&vals->exp_date)); + printf("Expiration date (enter yyyy-mm-dd) ? [%s] ", buff); fflush(stdout); if (fgets(buff, sizeof(buff), stdin) == NULL || *buff == '\n') { clearerr(stdin); return; } - if (sscanf(buff, "%d-%d-%d", - &edate.tm_year, &edate.tm_mon, &edate.tm_mday) == 3) { - edate.tm_mon--; /* January is 0, not 1 */ - edate.tm_hour = 23; /* nearly midnight at the end of the */ - edate.tm_min = 59; /* specified day */ - } - } while (krb_check_tm (edate)); - - edate.tm_year -= 1900; - vals->exp_date = tm2time (edate, 1); + t = parse_expdate(buff); + }while(t < 0); + vals->exp_date = t; SET_FIELD(KADM_EXPDATE,vals->fields); } @@ -172,9 +188,11 @@ princ_exists(char *name, char *instance, char *realm) { int status; + int old = krb_use_admin_server(1); status = krb_get_pw_in_tkt(name, instance, realm, KRB_TICKET_GRANTING_TICKET, realm, 1, ""); + krb_use_admin_server(old); if ((status == KSUCCESS) || (status == INTK_BADPW)) return(PE_YES); @@ -184,15 +202,12 @@ princ_exists(char *name, char *instance, char *realm) return(PE_UNSURE); } -static int -get_password(u_int32_t *low, u_int32_t *high, char *prompt, int byteswap) +static void +passwd_to_lowhigh(u_int32_t *low, u_int32_t *high, char *password, int byteswap) { - char new_passwd[MAX_KPW_LEN]; /* new password */ des_cblock newkey; - if (read_long_pw_string(new_passwd, sizeof(new_passwd)-1, prompt, 1)) - return(BAD_PW); - if (strlen(new_passwd) == 0) { + if (strlen(password) == 0) { printf("Using random password.\n"); #ifdef NOENCRYPTION memset(newkey, 0, sizeof(newkey)); @@ -203,9 +218,8 @@ get_password(u_int32_t *low, u_int32_t *high, char *prompt, int byteswap) #ifdef NOENCRYPTION memset(newkey, 0, sizeof(newkey)); #else - des_string_to_key(new_passwd, &newkey); + des_string_to_key(password, &newkey); #endif - memset(new_passwd, 0, sizeof(new_passwd)); } memcpy(low, newkey, 4); @@ -221,6 +235,17 @@ get_password(u_int32_t *low, u_int32_t *high, char *prompt, int byteswap) *low = htonl(*low); *high = htonl(*high); } +} + +static int +get_password(u_int32_t *low, u_int32_t *high, char *prompt, int byteswap) +{ + char new_passwd[MAX_KPW_LEN]; /* new password */ + + if (read_long_pw_string(new_passwd, sizeof(new_passwd)-1, prompt, 1)) + return(BAD_PW); + passwd_to_lowhigh (low, high, new_passwd, byteswap); + memset (new_passwd, 0, sizeof(new_passwd)); return(GOOD_PW); } @@ -232,23 +257,23 @@ get_admin_password(void) int ticket_life = 1; /* minimum ticket lifetime */ CREDENTIALS c; - if (multiple) { - /* If admin tickets exist and are valid, just exit. */ - memset(&c, 0, sizeof(c)); - if (krb_get_cred(PWSERV_NAME, KADM_SINST, krbrlm, &c) == KSUCCESS) - /* - * If time is less than lifetime - FUDGE_VALUE after issue date, - * tickets will probably last long enough for the next - * transaction. - */ - if (time(0) < (c.issue_date + (5 * 60 * c.lifetime) - FUDGE_VALUE)) - return(KADM_SUCCESS); - ticket_life = DEFAULT_TKT_LIFE; - } + alarm(0); + /* If admin tickets exist and are valid, just exit. */ + memset(&c, 0, sizeof(c)); + if (krb_get_cred(PWSERV_NAME, KADM_SINST, krbrlm, &c) == KSUCCESS) + /* + * If time is less than lifetime - FUDGE_VALUE after issue date, + * tickets will probably last long enough for the next + * transaction. + */ + if (time(0) < (c.issue_date + (5 * 60 * c.lifetime) - FUDGE_VALUE)) + return(KADM_SUCCESS); + ticket_life = DEFAULT_TKT_LIFE; if (princ_exists(pr.name, pr.instance, pr.realm) != PE_NO) { char prompt[256]; - snprintf(prompt, sizeof(prompt), "%s's Password: ", krb_unparse_name(&pr)); + snprintf(prompt, sizeof(prompt), "%s's Password: ", + krb_unparse_name(&pr)); if (read_long_pw_string(admin_passwd, sizeof(admin_passwd)-1, prompt, 0)) { @@ -259,7 +284,7 @@ get_admin_password(void) PWSERV_NAME, KADM_SINST, ticket_life, admin_passwd); memset(admin_passwd, 0, sizeof(admin_passwd)); - + /* Initialize non shared random sequence from session key. */ memset(&c, 0, sizeof(c)); krb_get_cred(PWSERV_NAME, KADM_SINST, krbrlm, &c); @@ -289,107 +314,144 @@ get_admin_password(void) return(BAD_PW); } -static void -usage(void) -{ - fprintf (stderr, "Usage: kadmin [[-u|-p] admin_name] [-r default_realm]" - " [-m]\n" - " -m allows multiple admin requests to be " - "serviced with one entry of admin\n" - " password.\n"); - exit (1); -} +static char *principal; +static char *username; +static char *realm; +static char *timeout; +static int tflag; /* use existing tickets */ +static int mflag; /* compatibility */ +static int version_flag; +static int help_flag; + +static time_t destroy_timeout = 5 * 60; + +struct getargs args[] = { + { NULL, 'p', arg_string, &principal, + "principal to authenticate as"}, + { NULL, 'u', arg_string, &username, + "username, other than default" }, + { NULL, 'r', arg_string, &realm, "local realm" }, + { NULL, 'm', arg_flag, &mflag, "disable ticket timeout" }, + { NULL, 'T', arg_string, &timeout, "default ticket timeout" }, + { NULL, 't', arg_flag, &tflag, "use existing tickets" }, + { "version",0, arg_flag, &version_flag }, + { "help", 'h', arg_flag, &help_flag }, +}; -/* GLOBAL */ -static void +static int num_args = sizeof(args) / sizeof(args[0]); + +static int clean_up() { - dest_tkt(); + if(!tflag) + return dest_tkt() == KSUCCESS; + return 0; } -static void +static int clean_up_cmd (int argc, char **argv) { clean_up(); + return 0; } -/* GLOBAL */ -static void -quit() +static int +quit_cmd (int argc, char **argv) { - printf("Cleaning up and exiting.\n"); - clean_up(); - exit(0); + return 1; } -static void -quit_cmd (int argc, char **argv) +static void +usage(int code) { - quit(); + arg_printusage(args, num_args, NULL, "[command]"); + exit(code); } -static void +static int do_init(int argc, char **argv) { - int c; - int tflag = 0; - char tktstring[MaxPathLen]; - int k_errno; - + int optind = 0; + int ret; + set_progname (argv[0]); + + if(getarg(args, num_args, argc, argv, &optind) < 0) + usage(1); + if(help_flag) + usage(0); + if(version_flag) { + print_version(NULL); + exit(0); + } memset(&pr, 0, sizeof(pr)); - if (krb_get_default_principal(pr.name, pr.instance, default_realm) < 0) - errx (1, "I could not even guess who you might be"); - while ((c = getopt(argc, argv, "p:u:r:mt")) != EOF) - switch (c) { - case 'p': - case 'u': - if((k_errno = krb_parse_name(optarg, &pr)) != KSUCCESS) - errx (1, "%s", krb_get_err_text(k_errno)); - break; - case 'r': - memset(default_realm, 0, sizeof(default_realm)); - strncpy(default_realm, optarg, sizeof(default_realm) - 1); - break; - case 'm': - multiple++; - break; - case 't': - tflag++; - break; - default: - usage(); - break; - } - if (optind < argc) - usage(); - strcpy(krbrlm, default_realm); + ret = krb_get_default_principal(pr.name, pr.instance, default_realm); + if(ret < 0) + errx(1, "Can't figure out default principal"); + if(pr.instance[0] == '\0') + strcpy_truncate(pr.instance, "admin", sizeof(pr.instance)); + if(principal) { + if(username) + warnx("Ignoring username when principal is given"); + ret = krb_parse_name(principal, &pr); + if(ret) + errx(1, "%s: %s", principal, krb_get_err_text(ret)); + if(pr.realm[0] != '\0') + strcpy_truncate(default_realm, pr.realm, sizeof(default_realm)); + } else if(username) { + strcpy_truncate(pr.name, username, sizeof(pr.name)); + strcpy_truncate(pr.instance, "admin", sizeof(pr.instance)); + } + + if(realm) + strcpy_truncate(default_realm, realm, sizeof(default_realm)); + + strcpy_truncate(krbrlm, default_realm, sizeof(krbrlm)); + + if(pr.realm[0] == '\0') + strcpy_truncate(pr.realm, krbrlm, sizeof(pr.realm)); if (kadm_init_link(PWSERV_NAME, KRB_MASTER, krbrlm) != KADM_SUCCESS) *krbrlm = '\0'; - if (pr.realm[0] == '\0') - strcpy (pr.realm, krbrlm); - if (pr.instance[0] == '\0') - strcpy(pr.instance, "admin"); - if (!tflag) { - snprintf(tktstring, sizeof(tktstring), TKT_ROOT "_adm_%d",(int)getpid()); + if(timeout) { + if(set_timeout(timeout) == -1) + warnx("bad timespecification `%s'", timeout); + } else if(mflag) + destroy_timeout = 0; + + if (tflag) + destroy_timeout = 0; /* disable timeout */ + else{ + char tktstring[128]; + snprintf(tktstring, sizeof(tktstring), + TKT_ROOT "_adm_%d",(int)getpid()); krb_set_tkt_string(tktstring); } - + return optind; +} + +static void +sigalrm(int sig) +{ + if(clean_up()) + printf("\nTickets destroyed.\n"); } int main(int argc, char **argv) { - do_init(argc, argv); - - printf("Welcome to the Kerberos Administration Program, version 2\n"); - printf("Type \"help\" if you need it.\n"); - sl_loop (cmds, "kadmin: "); - printf("\n"); - quit(); + int optind = do_init(argc, argv); + if(argc > optind) + sl_command(cmds, argc - optind, argv + optind); + else { + void *data = NULL; + signal(SIGALRM, sigalrm); + while(sl_command_loop(cmds, "kadmin: ", &data) == 0) + alarm(destroy_timeout); + } + clean_up(); exit(0); } @@ -409,9 +471,9 @@ setvals(Kadm_vals *vals, char *string) return status; } if (!realm[0]) - strcpy(realm, default_realm); + strcpy_truncate(realm, default_realm, sizeof(realm)); if (strcmp(realm, krbrlm)) { - strcpy(krbrlm, realm); + strcpy_truncate(krbrlm, realm, sizeof(krbrlm)); if ((status = kadm_init_link(PWSERV_NAME, KRB_MASTER, krbrlm)) != KADM_SUCCESS) printf("kadm error for realm %s: %s\n", @@ -423,20 +485,79 @@ setvals(Kadm_vals *vals, char *string) return KADM_SUCCESS; } -static void +static int +set_timeout(const char *timespec) +{ + int t = parse_time(timespec, "s"); + if(t == -1) + return -1; + destroy_timeout = t; + return 0; +} + +static int +set_timeout_cmd(int argc, char **argv) +{ + char ts[128]; + if (argc > 2) { + printf("Usage: set_timeout [timeout]\n"); + return 0; + } + if(argc == 2) { + if(set_timeout(argv[1]) == -1){ + printf("Bad time specification `%s'\n", argv[1]); + return 0; + } + } + if(destroy_timeout == 0) + printf("Timeout disabled.\n"); + else{ + unparse_time(destroy_timeout, ts, sizeof(ts)); + printf("Timeout after %s.\n", ts); + } + return 0; +} + +static int change_password(int argc, char **argv) { Kadm_vals old, new; int status; char pw_prompt[BUFSIZ]; - if (argc != 2) { - printf("Usage: change_password loginname\n"); - return; + char pw[32]; + int generate_password = 0; + int i; + int optind = 0; + char *user = NULL; + + struct getargs cpw_args[] = { + { "random", 'r', arg_flag, NULL, "generate random password" }, + }; + i = 0; + cpw_args[i++].value = &generate_password; + + if(getarg(cpw_args, sizeof(cpw_args) / sizeof(cpw_args[0]), + argc, argv, &optind)){ + arg_printusage(cpw_args, + sizeof(cpw_args) / sizeof(cpw_args[0]), + "cpw", + "principal"); + return 0; } - if (setvals(&old, argv[1]) != KADM_SUCCESS) - return; + argc -= optind; + argv += optind; + + if (argc != 1) { + printf("Usage: change_password [options] principal\n"); + return 0; + } + + user = argv[0]; + + if (setvals(&old, user) != KADM_SUCCESS) + return 0; new = old; @@ -445,30 +566,39 @@ change_password(int argc, char **argv) if (princ_exists(old.name, old.instance, krbrlm) != PE_NO) { /* get the admin's password */ if (get_admin_password() != GOOD_PW) - return; + return 0; - /* get the new password */ - snprintf(pw_prompt, sizeof(pw_prompt), "New password for %s:", argv[1]); + + if (generate_password) { + random_password(pw, sizeof(pw), &new.key_low, &new.key_high); + } else { + /* get the new password */ + snprintf(pw_prompt, sizeof(pw_prompt), + "New password for %s:", user); - if (get_password(&new.key_low, &new.key_high, - pw_prompt, SWAP) == GOOD_PW) { - status = kadm_mod(&old, &new); - if (status == KADM_SUCCESS) { - printf("Password changed for %s.\n", argv[1]); - } else { - printf("kadmin: %s\nwhile changing password for %s", - error_message(status), argv[1]); + if (get_password(&new.key_low, &new.key_high, + pw_prompt, SWAP) != GOOD_PW) { + printf("Error reading password; password unchanged\n"); + return 0; } - } else - printf("Error reading password; password unchanged\n"); + } + + status = kadm_mod(&old, &new); + if (status == KADM_SUCCESS) { + printf("Password changed for %s.\n", user); + if (generate_password) + printf("Password is: %s\n", pw); + } else { + printf("kadmin: %s\nwhile changing password for %s", + error_message(status), user); + } + + memset(pw, 0, sizeof(pw)); memset(&new, 0, sizeof(new)); - if (!multiple) - clean_up(); - } - else + } else printf("kadmin: Principal %s does not exist.\n", krb_unparse_name_long (old.name, old.instance, krbrlm)); - return; + return 0; } static int @@ -511,7 +641,7 @@ printkey(unsigned char *tkey) printf("\n"); } -static void +static int change_key(int argc, char **argv) { Kadm_vals old, new; @@ -520,11 +650,11 @@ change_key(int argc, char **argv) if (argc != 2) { printf("Usage: change_key principal-name\n"); - return; + return 0; } if (setvals(&old, argv[1]) != KADM_SUCCESS) - return; + return 0; new = old; @@ -533,7 +663,7 @@ change_key(int argc, char **argv) if (princ_exists(old.name, old.instance, krbrlm) != PE_NO) { /* get the admin's password */ if (get_admin_password() != GOOD_PW) - return; + return 0; /* get the new password */ printf("New DES key for %s: ", argv[1]); @@ -555,16 +685,14 @@ change_key(int argc, char **argv) } else printf("Error reading key; key unchanged\n"); memset(&new, 0, sizeof(new)); - if (!multiple) - clean_up(); } else printf("kadmin: Principal %s does not exist.\n", krb_unparse_name_long (old.name, old.instance, krbrlm)); - return; + return 0; } -static void +static int change_admin_password(int argc, char **argv) { des_cblock newkey; @@ -572,9 +700,10 @@ change_admin_password(int argc, char **argv) char pword[MAX_KPW_LEN]; char *pw_msg; + alarm(0); if (argc != 1) { printf("Usage: change_admin_password\n"); - return; + return 0; } if (get_pw_new_pwd(pword, sizeof(pword), &pr, 1) == 0) { des_string_to_key(pword, &newkey); @@ -588,140 +717,241 @@ change_admin_password(int argc, char **argv) memset(newkey, 0, sizeof(newkey)); memset(pword, 0, sizeof(pword)); } - if (!multiple) - clean_up(); - return; + return 0; } -static void +void random_password(char*, size_t, u_int32_t*, u_int32_t*); + +static int add_new_key(int argc, char **argv) { - Kadm_vals new; + int i; char pw_prompt[BUFSIZ]; int status; + int generate_password = 0; + char *password = NULL; + + char *expiration_string = NULL; + time_t default_expiration = 0; + int expiration_set = 0; + + char *life_string = NULL; + time_t default_life = 0; + int life_set = 0; + + int attributes = -1; + int default_attributes = 0; + int attributes_set = 0; + + int optind = 0; + + /* XXX remember to update value assignments below */ + struct getargs add_args[] = { + { "random", 'r', arg_flag, NULL, "generate random password" }, + { "password", 'p', arg_string, NULL }, + { "life", 'l', arg_string, NULL, "max ticket life" }, + { "expiration", 'e', arg_string, NULL, "principal expiration" }, + { "attributes", 'a', arg_integer, NULL } + }; + i = 0; + add_args[i++].value = &generate_password; + add_args[i++].value = &password; + add_args[i++].value = &life_string; + add_args[i++].value = &expiration_string; + add_args[i++].value = &attributes; + + + if(getarg(add_args, sizeof(add_args) / sizeof(add_args[0]), + argc, argv, &optind)){ + arg_printusage(add_args, + sizeof(add_args) / sizeof(add_args[0]), + "add", + "principal ..."); + return 0; + } - if (argc != 2) { - printf("Usage: add_new_key user_name.\n"); - return; + if(expiration_string) { + default_expiration = parse_expdate(expiration_string); + if(default_expiration < 0) + warnx("Unknown expiration date `%s'", expiration_string); + else + expiration_set = 1; + } + if(life_string) { + time_t t = parse_time(life_string, "hour"); + if(t == -1) + warnx("Unknown lifetime `%s'", life_string); + else { + default_life = krb_time_to_life(0, t); + life_set = 1; + } + } + if(attributes != -1) { + default_attributes = attributes; + attributes_set = 1; } - if (setvals(&new, argv[1]) != KADM_SUCCESS) - return; - SET_FIELD(KADM_EXPDATE,new.fields); - SET_FIELD(KADM_ATTR,new.fields); - SET_FIELD(KADM_MAXLIFE,new.fields); - SET_FIELD(KADM_DESKEY,new.fields); - if (princ_exists(new.name, new.instance, krbrlm) != PE_YES) { - Kadm_vals vals; + { + char default_name[ANAME_SZ + INST_SZ + 1]; + char old_default[INST_SZ + 1] = ""; + Kadm_vals new, default_vals; + char pw[32]; u_char fields[4]; - char n[ANAME_SZ + INST_SZ + 1]; - /* get the admin's password */ - if (get_admin_password() != GOOD_PW) - return; + for(i = optind; i < argc; i++) { + if (setvals(&new, argv[i]) != KADM_SUCCESS) + return 0; + SET_FIELD(KADM_EXPDATE, new.fields); + SET_FIELD(KADM_ATTR, new.fields); + SET_FIELD(KADM_MAXLIFE, new.fields); + SET_FIELD(KADM_DESKEY, new.fields); + + if (princ_exists(new.name, new.instance, krbrlm) == PE_YES) { + printf("kadmin: Principal %s already exists.\n", argv[i]); + continue; + } + /* get the admin's password */ + if (get_admin_password() != GOOD_PW) + return 0; - memset(fields, 0, sizeof(fields)); - SET_FIELD(KADM_NAME,fields); - SET_FIELD(KADM_INST,fields); - SET_FIELD(KADM_EXPDATE,fields); - SET_FIELD(KADM_ATTR,fields); - SET_FIELD(KADM_MAXLIFE,fields); - snprintf (n, sizeof(n), "default.%s", new.instance); - if (setvals(&vals, n) != KADM_SUCCESS) - return; + snprintf (default_name, sizeof(default_name), + "default.%s", new.instance); + if(strcmp(old_default, default_name) != 0) { + memset(fields, 0, sizeof(fields)); + SET_FIELD(KADM_NAME, fields); + SET_FIELD(KADM_INST, fields); + SET_FIELD(KADM_EXPDATE, fields); + SET_FIELD(KADM_ATTR, fields); + SET_FIELD(KADM_MAXLIFE, fields); + if (setvals(&default_vals, default_name) != KADM_SUCCESS) + return 0; + + if (kadm_get(&default_vals, fields) != KADM_SUCCESS) { + /* no such entry, try just `default' */ + if (setvals(&default_vals, "default") != KADM_SUCCESS) + continue; + if ((status = kadm_get(&default_vals, fields)) != KADM_SUCCESS) { + warnx ("kadm error: %s", error_message(status)); + break; /* no point in continuing */ + } + } - if (kadm_get(&vals, fields) != KADM_SUCCESS) { - if (setvals(&vals, "default") != KADM_SUCCESS) - return; - if ((status = kadm_get(&vals, fields)) != KADM_SUCCESS) { - printf ("kadm error: %s\n", error_message(status)); - return; + if (default_vals.max_life == 255) /* Defaults not set! */ { + /* This is the default maximum lifetime for new principals. */ + if (strcmp(new.instance, "admin") == 0) + default_vals.max_life = 1 + (CLOCK_SKEW/(5*60)); /* 5+5 minutes */ + else if (strcmp(new.instance, "root") == 0) + default_vals.max_life = 96; /* 8 hours */ + else if (krb_life_to_time(0, 162) >= 24*60*60) + default_vals.max_life = 162; /* ca 100 hours */ + else + default_vals.max_life = 255; /* ca 21 hours (maximum) */ + + /* Also fix expiration date. */ + { + time_t now; + struct tm tm; + + now = time(0); + tm = *gmtime(&now); + if (strcmp(new.name, "rcmd") == 0 || + strcmp(new.name, "ftp") == 0 || + strcmp(new.name, "pop") == 0) + tm.tm_year += 5; + else + tm.tm_year += 2; + default_vals.exp_date = mktime(&tm); + } + default_vals.attributes = default_vals.attributes; + } + if(!life_set) + default_life = default_vals.max_life; + if(!expiration_set) + default_expiration = default_vals.exp_date; + if(!attributes_set) + default_attributes = default_vals.attributes; } - } - if (vals.max_life == 255) /* Defaults not set! */ { - /* This is the default maximum lifetime for new principals. */ - if (strcmp(new.instance, "admin") == 0) - vals.max_life = 1 + (CLOCK_SKEW/(5*60)); /* 5+5 minutes */ - else if (strcmp(new.instance, "root") == 0) - vals.max_life = 96; /* 8 hours */ - else if (krb_life_to_time(0, 162) >= 24*60*60) - vals.max_life = 162; /* ca 100 hours */ - else - vals.max_life = 255; /* ca 21 hours (maximum) */ - - /* Also fix expiration date. */ - if (strcmp(new.name, "rcmd") == 0) - vals.exp_date = 1104814999; /* Tue Jan 4 06:03:19 2005 */ - else - vals.exp_date = time(0) + 2*(365*24*60*60); /* + ca 2 years */ - } - - new.max_life = vals.max_life; - new.exp_date = vals.exp_date; - new.attributes = vals.attributes; - get_maxlife(&new); - get_attr(&new); - get_expdate(&new); - - /* get the new password */ - snprintf(pw_prompt, sizeof(pw_prompt), "Password for %s:", argv[1]); + new.max_life = default_life; + new.exp_date = default_expiration; + new.attributes = default_attributes; + if(!life_set) + get_maxlife(&new); + if(!attributes_set) + get_attr(&new); + if(!expiration_set) + get_expdate(&new); + + if(generate_password) { + random_password(pw, sizeof(pw), &new.key_low, &new.key_high); + } else if (password == NULL) { + /* get the new password */ + snprintf(pw_prompt, sizeof(pw_prompt), "Password for %s:", + argv[i]); - if (get_password(&new.key_low, &new.key_high, - pw_prompt, SWAP) == GOOD_PW) { + if (get_password(&new.key_low, &new.key_high, + pw_prompt, SWAP) != GOOD_PW) { + printf("Error reading password: %s not added\n", argv[i]); + memset(&new, 0, sizeof(new)); + return 0; + } + } else { + passwd_to_lowhigh (&new.key_low, &new.key_high, password, SWAP); + memset (password, 0, strlen(password)); + } + status = kadm_add(&new); if (status == KADM_SUCCESS) { - printf("%s added to database.\n", argv[1]); - } else { + printf("%s added to database", argv[i]); + if (generate_password) + printf (" with password `%s'", pw); + printf (".\n"); + } else printf("kadm error: %s\n",error_message(status)); - } - } else - printf("Error reading password; %s not added\n",argv[1]); - memset(&new, 0, sizeof(new)); - if (!multiple) - clean_up(); + + memset(pw, 0, sizeof(pw)); + memset(&new, 0, sizeof(new)); + } } - else - printf("kadmin: Principal already exists.\n"); - return; + + return 0; } -static void +static int del_entry(int argc, char **argv) { int status; Kadm_vals vals; + int i; - if (argc != 2) { - printf("Usage: del_entry username\n"); - return; + if (argc < 2) { + printf("Usage: delete principal...\n"); + return 0; } - if (setvals(&vals, argv[1]) != KADM_SUCCESS) - return; - - if (princ_exists(vals.name, vals.instance, krbrlm) != PE_NO) { - /* get the admin's password */ - if (get_admin_password() != GOOD_PW) - return; + for(i = 1; i < argc; i++) { + if (setvals(&vals, argv[i]) != KADM_SUCCESS) + return 0; - if ((status = kadm_del(&vals)) == KADM_SUCCESS){ - printf("%s removed from database.\n", argv[1]); - } else { - printf("kadm error: %s\n",error_message(status)); + if (princ_exists(vals.name, vals.instance, krbrlm) != PE_NO) { + /* get the admin's password */ + if (get_admin_password() != GOOD_PW) + return 0; + + if ((status = kadm_del(&vals)) == KADM_SUCCESS) + printf("%s removed from database.\n", argv[i]); + else + printf("kadm error: %s\n",error_message(status)); } - - if (!multiple) - clean_up(); + else + printf("kadmin: Principal %s does not exist.\n", + krb_unparse_name_long (vals.name, vals.instance, krbrlm)); } - else - printf("kadmin: Principal %s does not exist.\n", - krb_unparse_name_long (vals.name, vals.instance, krbrlm)); - return; + return 0; } -static void +static int get_entry(int argc, char **argv) { int status; @@ -730,7 +960,7 @@ get_entry(int argc, char **argv) if (argc != 2) { printf("Usage: get_entry username\n"); - return; + return 0; } memset(fields, 0, sizeof(fields)); @@ -743,103 +973,173 @@ get_entry(int argc, char **argv) #if 0 SET_FIELD(KADM_DESKEY,fields); #endif +#ifdef EXTENDED_KADM + SET_FIELD(KADM_MODDATE, fields); + SET_FIELD(KADM_MODNAME, fields); + SET_FIELD(KADM_MODINST, fields); + SET_FIELD(KADM_KVNO, fields); +#endif if (setvals(&vals, argv[1]) != KADM_SUCCESS) - return; + return 0; if (princ_exists(vals.name, vals.instance, krbrlm) != PE_NO) { /* get the admin's password */ if (get_admin_password() != GOOD_PW) - return; + return 0; if ((status = kadm_get(&vals, fields)) == KADM_SUCCESS) prin_vals(&vals); else printf("kadm error: %s\n",error_message(status)); - - if (!multiple) - clean_up(); } else printf("kadmin: Principal %s does not exist.\n", krb_unparse_name_long (vals.name, vals.instance, krbrlm)); - return; + return 0; } -static void +static int mod_entry(int argc, char **argv) { int status; u_char fields[4]; Kadm_vals ovals, nvals; + int i; + + char *expiration_string = NULL; + time_t default_expiration = 0; + int expiration_set = 0; + + char *life_string = NULL; + time_t default_life = 0; + int life_set = 0; + + int attributes = -1; + int default_attributes = 0; + int attributes_set = 0; + + int optind = 0; + + /* XXX remember to update value assignments below */ + struct getargs mod_args[] = { + { "life", 'l', arg_string, NULL, "max ticket life" }, + { "expiration", 'e', arg_string, NULL, "principal expiration" }, + { "attributes", 'a', arg_integer, NULL } + }; + i = 0; + mod_args[i++].value = &life_string; + mod_args[i++].value = &expiration_string; + mod_args[i++].value = &attributes; + + + if(getarg(mod_args, sizeof(mod_args) / sizeof(mod_args[0]), + argc, argv, &optind)){ + arg_printusage(mod_args, + sizeof(mod_args) / sizeof(mod_args[0]), + "mod", + "principal ..."); + return 0; + } - if (argc != 2) { - printf("Usage: mod_entry username\n"); - return; + if(expiration_string) { + default_expiration = parse_expdate(expiration_string); + if(default_expiration < 0) + warnx("Unknown expiration date `%s'", expiration_string); + else + expiration_set = 1; + } + if(life_string) { + time_t t = parse_time(life_string, "hour"); + if(t == -1) + warnx("Unknown lifetime `%s'", life_string); + else { + default_life = krb_time_to_life(0, t); + life_set = 1; + } + } + if(attributes != -1) { + default_attributes = attributes; + attributes_set = 1; } - memset(fields, 0, sizeof(fields)); - SET_FIELD(KADM_NAME,fields); - SET_FIELD(KADM_INST,fields); - SET_FIELD(KADM_EXPDATE,fields); - SET_FIELD(KADM_ATTR,fields); - SET_FIELD(KADM_MAXLIFE,fields); + for(i = optind; i < argc; i++) { + + memset(fields, 0, sizeof(fields)); + + SET_FIELD(KADM_NAME,fields); + SET_FIELD(KADM_INST,fields); + SET_FIELD(KADM_EXPDATE,fields); + SET_FIELD(KADM_ATTR,fields); + SET_FIELD(KADM_MAXLIFE,fields); - if (setvals(&ovals, argv[1]) != KADM_SUCCESS) - return; + if (setvals(&ovals, argv[i]) != KADM_SUCCESS) + return 0; - nvals = ovals; + nvals = ovals; - if (princ_exists(ovals.name, ovals.instance, krbrlm) == PE_NO) { - printf("kadmin: Principal %s does not exist.\n", - krb_unparse_name_long (ovals.name, ovals.instance, krbrlm)); - return; - } + if (princ_exists(ovals.name, ovals.instance, krbrlm) == PE_NO) { + printf("kadmin: Principal %s does not exist.\n", + krb_unparse_name_long (ovals.name, ovals.instance, krbrlm)); + return 0; + } - /* get the admin's password */ - if (get_admin_password() != GOOD_PW) - return; + /* get the admin's password */ + if (get_admin_password() != GOOD_PW) + return 0; - if ((status = kadm_get(&ovals, fields)) != KADM_SUCCESS) { - printf("[ unable to retrieve current settings: %s ]\n", - error_message(status)); - nvals.max_life = DEFAULT_TKT_LIFE; - nvals.exp_date = 0; - nvals.attributes = 0; - } else { - nvals.max_life = ovals.max_life; - nvals.exp_date = ovals.exp_date; - nvals.attributes = ovals.attributes; + if ((status = kadm_get(&ovals, fields)) != KADM_SUCCESS) { + printf("[ unable to retrieve current settings: %s ]\n", + error_message(status)); + nvals.max_life = DEFAULT_TKT_LIFE; + nvals.exp_date = 0; + nvals.attributes = 0; + } else { + nvals.max_life = ovals.max_life; + nvals.exp_date = ovals.exp_date; + nvals.attributes = ovals.attributes; } - get_maxlife(&nvals); - get_attr(&nvals); - get_expdate(&nvals); + if(life_set) { + nvals.max_life = default_life; + SET_FIELD(KADM_MAXLIFE, nvals.fields); + } else + get_maxlife(&nvals); + if(attributes_set) { + nvals.attributes = default_attributes; + SET_FIELD(KADM_ATTR, nvals.fields); + } else + get_attr(&nvals); + if(expiration_set) { + nvals.exp_date = default_expiration; + SET_FIELD(KADM_EXPDATE, nvals.fields); + } else + get_expdate(&nvals); - if (IS_FIELD(KADM_MAXLIFE, nvals.fields) || - IS_FIELD(KADM_ATTR, nvals.fields) || - IS_FIELD(KADM_EXPDATE, nvals.fields)) { - if ((status = kadm_mod(&ovals, &nvals)) != KADM_SUCCESS) { - printf("kadm error: %s\n",error_message(status)); - goto out; - } - if ((status = kadm_get(&ovals, fields)) != KADM_SUCCESS) { - printf("kadm error: %s\n",error_message(status)); - goto out; + if (IS_FIELD(KADM_MAXLIFE, nvals.fields) || + IS_FIELD(KADM_ATTR, nvals.fields) || + IS_FIELD(KADM_EXPDATE, nvals.fields)) { + if ((status = kadm_mod(&ovals, &nvals)) != KADM_SUCCESS) { + printf("kadm error: %s\n",error_message(status)); + goto out; + } + if ((status = kadm_get(&ovals, fields)) != KADM_SUCCESS) { + printf("kadm error: %s\n",error_message(status)); + goto out; + } } + prin_vals(&ovals); } - prin_vals(&ovals); - + out: - if (!multiple) - clean_up(); - return; + return 0; } -static void +static int help(int argc, char **argv) { sl_help (cmds, argc, argv); + return 0; } |