illumos gate

I've tagged gwr as he knows the smb code very well and jbk as he helped me with a pam change before and also has worked on the ldap code recently.

• (very bad - current) ugly cron that does a switcheroo (depends on having userPassword unhashed in ldap)
• (bad) relax pam_smb_passwd restrictions -> use smb code for updating smbpasswd, proper locking, ... but still not really great. But something I can do)
• (good) have smb code optionally talk to ldap and use a unhashed userPassword (way outside of my skill set, requires no schema extensions)
• (best) have smb code optionally talk to ldap and use a new attribute that stores nthash or lmhash in ldap (way outside of my skill set, require schema extension... which brings fun things like getting an OID space, creating a new objectClass and attributes...)

The last option would probably also allow for storing things like a SID in ldap, which would be nice to have idmap and other bits the same over multiple hosts.

#!/opt/local/bin/python3

import os
import sys
import ldap3
import hashlib
import binascii
import argparse
from getpass import getpass
from pwd import getpwnam
from grp import getgrnam

SMBPASSWD_PATH="/var/smb/smbpasswd" 
SMBPASSWD_MODE=0o400
SMBPASSWD_UID="root" 
SMBPASSWD_GID="sys" 

def nthash(password, illumos=False):
    nthash = binascii.hexlify(
        hashlib.new(
            'md4',
            password.encode('utf-16le')
        ).digest()
    ).upper().decode('utf-8')

    if illumos:
        nthash_bs = "" 
        for step in range(0, len(nthash), 2):
            nthash_bs += nthash[step:(step+2)][::-1]
        return nthash_bs

    return nthash

if __name__ == "__main__":
    ## parse arguments
    parser = argparse.ArgumentParser()
    parser.add_argument("-D", help="bind DN", metavar="binddn",
        dest="binddn", required=True, type=str)
    parser.add_argument("-H", help="LDAP Uniform Resource Identifier", metavar="URI",
        dest="uri", required=True, type=str)
    parser.add_argument("-b", help="base dn for search", metavar="basedn",
        dest="basedn", required=True, type=str)
    parser.add_argument("-w", help="bind password", metavar="passwd",
        dest="password", type=str)
    parser.add_argument("-W", help="prompt for bind password",
        dest="prompt_password", action="store_true")
    args = parser.parse_args()

    if args.prompt_password:
        args.password = getpass("Enter LDAP Password: ")

    if not args.password:
        print(
            "Please specify password using -w or use -W to prompt for password.",
            file=sys.stderr,
        )
        sys.exit(1)

    ## sync ldap to smbpasswd
    ldapsrv = ldap3.Server(args.uri)
    with ldap3.Connection(ldapsrv, auto_bind=False,  user=args.binddn, password=args.password) as conn:
        conn.start_tls()
        conn.bind()
        conn.search(
            search_base=args.basedn,
            search_scope=ldap3.SUBTREE,
            search_filter="(objectClass=posixAccount)",
            attributes=['uid', 'uidNumber', 'userPassword'],
        )

        fd_path = "{}.ldap".format(SMBPASSWD_PATH)
        with open(fd_path, "w") as fd:
            os.chmod(fd_path, SMBPASSWD_MODE)
            os.chown(fd_path,
                getpwnam(SMBPASSWD_UID).pw_uid,
                getgrnam(SMBPASSWD_GID).gr_gid)
            for account in conn.entries:
                print("{user}:{uid}:{lmhash}:{nthash}".format(
                    user=account.uid.value,
                    uid=account.uidNumber.value,
                    lmhash="",
                    nthash=nthash(account.userPassword.value.decode('utf-8'), True),
                ), file=fd)
        if os.path.exists(fd_path):
            os.replace(fd_path, SMBPASSWD_PATH)

Rewrite of the ugly shell script in python, at least it is readable now.