1 /* 2 * Copyright (c) 1997 - 2001 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "kadmin_locl.h" 35 #include <sl.h> 36 37 RCSID("$Id: kadmin.c,v 1.42 2003/03/31 10:20:19 lha Exp $"); 38 39 static char *config_file; 40 static char *keyfile; 41 static int local_flag; 42 static int help_flag; 43 static int version_flag; 44 static char *realm; 45 static char *admin_server; 46 static int server_port = 0; 47 static char *client_name; 48 static char *keytab; 49 50 static struct getargs args[] = { 51 { "principal", 'p', arg_string, &client_name, 52 "principal to authenticate as" }, 53 { "keytab", 'K', arg_string, &keytab, 54 "keytab for authentication principal" }, 55 { 56 "config-file", 'c', arg_string, &config_file, 57 "location of config file", "file" 58 }, 59 { 60 "key-file", 'k', arg_string, &keyfile, 61 "location of master key file", "file" 62 }, 63 { 64 "realm", 'r', arg_string, &realm, 65 "realm to use", "realm" 66 }, 67 { 68 "admin-server", 'a', arg_string, &admin_server, 69 "server to contact", "host" 70 }, 71 { 72 "server-port", 's', arg_integer, &server_port, 73 "port to use", "port number" 74 }, 75 { "local", 'l', arg_flag, &local_flag, "local admin mode" }, 76 { "help", 'h', arg_flag, &help_flag }, 77 { "version", 'v', arg_flag, &version_flag } 78 }; 79 80 static int num_args = sizeof(args) / sizeof(args[0]); 81 82 static SL_cmd commands[] = { 83 /* commands that are only available with `-l' */ 84 { 85 "dump", dump, "dump [file]", 86 "Dumps the database in a human readable format to the\n" 87 "specified file, or the standard out." 88 }, 89 { 90 "load", load, "load file", 91 "Loads a previously dumped file." 92 }, 93 { 94 "merge", merge, "merge file" , 95 "Merges the contents of a dump file into the database." 96 }, 97 { 98 "init", init, "init realm...", 99 "Initializes the default principals for a realm.\n" 100 "Creates the database if necessary." 101 }, 102 /* common commands */ 103 { 104 "add", add_new_key, "add principal" , 105 "Adds a principal to the database." 106 }, 107 { "add_new_key"}, 108 { "ank"}, 109 { 110 "passwd", cpw_entry, "passwd expression..." , 111 "Changes the password of one or more principals\n" 112 "matching the expressions." 113 }, 114 { "change_password"}, 115 { "cpw"}, 116 { 117 "delete", del_entry, "delete expression...", 118 "Deletes all principals matching the expressions." 119 }, 120 { "del_entry" }, 121 { "del" }, 122 { 123 "del_enctype", del_enctype, "del_enctype principal enctype...", 124 "Delete all the mentioned enctypes for principal." 125 }, 126 { 127 "ext_keytab", ext_keytab, "ext_keytab expression...", 128 "Extracts the keys of all principals matching the expressions,\n" 129 "and stores them in a keytab." 130 }, 131 { 132 "get", get_entry, "get expression...", 133 "Shows information about principals matching the expressions." 134 }, 135 { "get_entry" }, 136 { 137 "rename", rename_entry, "rename source target", 138 "Renames `source' to `target'." 139 }, 140 { 141 "modify", mod_entry, "modify principal", 142 "Modifies some attributes of the specified principal." 143 }, 144 { 145 "privileges", get_privs, "privileges", 146 "Shows which kinds of operations you are allowed to perform." 147 }, 148 { "privs" }, 149 { 150 "list", list_princs, "list expression...", 151 "Lists principals in a terse format. The same as `get -t'." 152 }, 153 { "help", help, "help"}, 154 { "?"}, 155 { "exit", exit_kadmin, "exit"}, 156 { "quit" }, 157 { NULL} 158 }; 159 160 krb5_context context; 161 void *kadm_handle; 162 163 static SL_cmd *actual_cmds; 164 165 int 166 help(int argc, char **argv) 167 { 168 sl_help(actual_cmds, argc, argv); 169 return 0; 170 } 171 172 int 173 exit_kadmin (int argc, char **argv) 174 { 175 return 1; 176 } 177 178 static void 179 usage(int ret) 180 { 181 arg_printusage (args, num_args, NULL, "[command]"); 182 exit (ret); 183 } 184 185 int 186 get_privs(int argc, char **argv) 187 { 188 u_int32_t privs; 189 char str[128]; 190 kadm5_ret_t ret; 191 192 int help_flag = 0; 193 struct getargs args[] = { 194 { "help", 'h', arg_flag, NULL } 195 }; 196 int num_args = sizeof(args) / sizeof(args[0]); 197 int optind = 0; 198 199 args[0].value = &help_flag; 200 201 if(getarg(args, num_args, argc, argv, &optind)) { 202 arg_printusage (args, num_args, "privileges", NULL); 203 return 0; 204 } 205 if(help_flag) { 206 arg_printusage (args, num_args, "privileges", NULL); 207 return 0; 208 } 209 210 ret = kadm5_get_privs(kadm_handle, &privs); 211 if(ret) 212 krb5_warn(context, ret, "kadm5_get_privs"); 213 else{ 214 ret =_kadm5_privs_to_string(privs, str, sizeof(str)); 215 printf("%s\n", str); 216 } 217 return 0; 218 } 219 220 int 221 main(int argc, char **argv) 222 { 223 krb5_error_code ret; 224 krb5_config_section *cf = NULL; 225 kadm5_config_params conf; 226 int optind = 0; 227 228 setprogname(argv[0]); 229 230 ret = krb5_init_context(&context); 231 if (ret) 232 errx (1, "krb5_init_context failed: %d", ret); 233 234 if(getarg(args, num_args, argc, argv, &optind)) 235 usage(1); 236 237 if (help_flag) 238 usage (0); 239 240 if (version_flag) { 241 print_version(NULL); 242 exit(0); 243 } 244 245 argc -= optind; 246 argv += optind; 247 248 if (config_file == NULL) 249 config_file = HDB_DB_DIR "/kdc.conf"; 250 251 if(krb5_config_parse_file(context, config_file, &cf) == 0) { 252 const char *p = krb5_config_get_string (context, cf, 253 "kdc", "key-file", NULL); 254 if (p) 255 keyfile = strdup(p); 256 } 257 krb5_clear_error_string (context); 258 259 memset(&conf, 0, sizeof(conf)); 260 if(realm) { 261 krb5_set_default_realm(context, realm); /* XXX should be fixed 262 some other way */ 263 conf.realm = realm; 264 conf.mask |= KADM5_CONFIG_REALM; 265 } 266 267 if (admin_server) { 268 conf.admin_server = admin_server; 269 conf.mask |= KADM5_CONFIG_ADMIN_SERVER; 270 } 271 272 if (server_port) { 273 conf.kadmind_port = htons(server_port); 274 conf.mask |= KADM5_CONFIG_KADMIND_PORT; 275 } 276 277 if(local_flag){ 278 ret = kadm5_s_init_with_password_ctx(context, 279 KADM5_ADMIN_SERVICE, 280 NULL, 281 KADM5_ADMIN_SERVICE, 282 &conf, 0, 0, 283 &kadm_handle); 284 actual_cmds = commands; 285 } else if (keytab) { 286 ret = kadm5_c_init_with_skey_ctx(context, 287 client_name, 288 keytab, 289 KADM5_ADMIN_SERVICE, 290 &conf, 0, 0, 291 &kadm_handle); 292 actual_cmds = commands + 4; /* XXX */ 293 } else { 294 ret = kadm5_c_init_with_password_ctx(context, 295 client_name, 296 NULL, 297 KADM5_ADMIN_SERVICE, 298 &conf, 0, 0, 299 &kadm_handle); 300 actual_cmds = commands + 4; /* XXX */ 301 } 302 303 if(ret) 304 krb5_err(context, 1, ret, "kadm5_init_with_password"); 305 306 signal(SIGINT, SIG_IGN); /* ignore signals for now, the sl command 307 parser will handle SIGINT its own way; 308 we should really take care of this in 309 each function, f.i `get' might be 310 interruptable, but not `create' */ 311 if (argc != 0) { 312 ret = sl_command (actual_cmds, argc, argv); 313 if(ret == -1) 314 krb5_warnx (context, "unrecognized command: %s", argv[0]); 315 } else 316 ret = sl_loop (actual_cmds, "kadmin> ") != 0; 317 318 kadm5_destroy(kadm_handle); 319 krb5_config_file_free (context, cf); 320 krb5_free_context(context); 321 return ret; 322 } 323