1 /* 2 * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "kadmin_locl.h" 35 #include <kadm5/private.h> 36 37 RCSID("$Id: init.c,v 1.23 1999/12/02 17:04:58 joda Exp $"); 38 39 static kadm5_ret_t 40 create_random_entry(krb5_principal princ, 41 unsigned max_life, 42 unsigned max_rlife, 43 u_int32_t attributes) 44 { 45 kadm5_principal_ent_rec ent; 46 kadm5_ret_t ret; 47 int mask = 0; 48 krb5_keyblock *keys; 49 int n_keys, i; 50 51 memset(&ent, 0, sizeof(ent)); 52 ent.principal = princ; 53 mask |= KADM5_PRINCIPAL; 54 if (max_life) { 55 ent.max_life = max_life; 56 mask |= KADM5_MAX_LIFE; 57 } 58 if (max_rlife) { 59 ent.max_renewable_life = max_rlife; 60 mask |= KADM5_MAX_RLIFE; 61 } 62 ent.attributes |= attributes | KRB5_KDB_DISALLOW_ALL_TIX; 63 mask |= KADM5_ATTRIBUTES; 64 65 ret = kadm5_create_principal(kadm_handle, &ent, mask, "hemlig"); 66 if(ret) 67 return ret; 68 ret = kadm5_randkey_principal(kadm_handle, princ, &keys, &n_keys); 69 if(ret) 70 return ret; 71 for(i = 0; i < n_keys; i++) 72 krb5_free_keyblock_contents(context, &keys[i]); 73 free(keys); 74 ret = kadm5_get_principal(kadm_handle, princ, &ent, 75 KADM5_PRINCIPAL | KADM5_ATTRIBUTES); 76 if(ret) 77 return ret; 78 ent.attributes &= (~KRB5_KDB_DISALLOW_ALL_TIX); 79 ent.kvno = 1; 80 ret = kadm5_modify_principal(kadm_handle, &ent, 81 KADM5_ATTRIBUTES|KADM5_KVNO); 82 kadm5_free_principal_ent (kadm_handle, &ent); 83 if(ret) 84 return ret; 85 return 0; 86 } 87 88 static struct getargs args[] = { 89 { "realm-max-ticket-life", 0, arg_string, NULL, 90 "realm max ticket lifetime" }, 91 { "realm-max-renewable-life", 0, arg_string, NULL, 92 "realm max renewable lifetime" }, 93 }; 94 95 static int num_args = sizeof(args) / sizeof(args[0]); 96 97 static void 98 usage(void) 99 { 100 arg_printusage (args, num_args, "ank", "principal"); 101 } 102 103 int 104 init(int argc, char **argv) 105 { 106 kadm5_ret_t ret; 107 int i; 108 char *realm_max_life = NULL; 109 char *realm_max_rlife = NULL; 110 HDB *db; 111 int optind = 0; 112 krb5_deltat max_life, max_rlife; 113 114 args[0].value = &realm_max_life; 115 args[1].value = &realm_max_rlife; 116 117 if(getarg(args, num_args, argc, argv, &optind)) { 118 usage(); 119 return 0; 120 } 121 122 if (realm_max_life) { 123 if (str2deltat (realm_max_life, &max_life) != 0) { 124 krb5_warnx (context, "unable to parse `%s'", realm_max_life); 125 return 0; 126 } 127 } 128 if (realm_max_rlife) { 129 if (str2deltat (realm_max_rlife, &max_rlife) != 0) { 130 krb5_warnx (context, "unable to parse `%s'", realm_max_rlife); 131 return 0; 132 } 133 } 134 135 db = _kadm5_s_get_db(kadm_handle); 136 137 ret = db->open(context, db, O_RDWR | O_CREAT, 0600); 138 if(ret){ 139 krb5_warn(context, ret, "hdb_open"); 140 return 0; 141 } 142 db->close(context, db); 143 for(i = optind; i < argc; i++){ 144 krb5_principal princ; 145 const char *realm = argv[i]; 146 147 /* Create `krbtgt/REALM' */ 148 krb5_make_principal(context, &princ, realm, "krbtgt", realm, NULL); 149 if (realm_max_life == NULL) { 150 max_life = 0; 151 edit_deltat ("Realm max ticket life", &max_life, NULL, 0); 152 } 153 if (realm_max_rlife == NULL) { 154 max_rlife = 0; 155 edit_deltat("Realm max renewable ticket life", &max_rlife, 156 NULL, 0); 157 } 158 create_random_entry(princ, max_life, max_rlife, 0); 159 krb5_free_principal(context, princ); 160 161 /* Create `kadmin/changepw' */ 162 krb5_make_principal(context, &princ, realm, 163 "kadmin", "changepw", NULL); 164 create_random_entry(princ, 5*60, 5*60, 165 KRB5_KDB_DISALLOW_TGT_BASED| 166 KRB5_KDB_PWCHANGE_SERVICE| 167 KRB5_KDB_DISALLOW_POSTDATED| 168 KRB5_KDB_DISALLOW_FORWARDABLE| 169 KRB5_KDB_DISALLOW_RENEWABLE| 170 KRB5_KDB_DISALLOW_PROXIABLE| 171 KRB5_KDB_REQUIRES_PRE_AUTH); 172 krb5_free_principal(context, princ); 173 174 /* Create `kadmin/admin' */ 175 krb5_make_principal(context, &princ, realm, 176 "kadmin", "admin", NULL); 177 create_random_entry(princ, 60*60, 60*60, KRB5_KDB_REQUIRES_PRE_AUTH); 178 krb5_free_principal(context, princ); 179 180 /* Create `changepw/kerberos' (for v4 compat) */ 181 krb5_make_principal(context, &princ, realm, 182 "changepw", "kerberos", NULL); 183 create_random_entry(princ, 60*60, 60*60, 0); 184 krb5_free_principal(context, princ); 185 186 /* Create `default' */ 187 { 188 kadm5_principal_ent_rec ent; 189 int mask = 0; 190 191 memset (&ent, 0, sizeof(ent)); 192 mask |= KADM5_PRINCIPAL; 193 krb5_make_principal(context, &ent.principal, realm, 194 "default", NULL); 195 mask |= KADM5_MAX_LIFE; 196 ent.max_life = 24 * 60 * 60; 197 mask |= KADM5_MAX_RLIFE; 198 ent.max_renewable_life = 7 * ent.max_life; 199 ent.attributes = KRB5_KDB_DISALLOW_ALL_TIX; 200 mask |= KADM5_ATTRIBUTES; 201 202 ret = kadm5_create_principal(kadm_handle, &ent, mask, ""); 203 if (ret) 204 krb5_err (context, 1, ret, "kadm5_create_principal"); 205 206 krb5_free_principal(context, ent.principal); 207 } 208 } 209 return 0; 210 } 211