illumos gate

I did some investigations of what might be required to implement this. Basically, one needs to add a new "DB" lookup type similar to the "shadow" lookup. Here are some notes:

Design notes for adding a "get NT passwd" (hash),
similar to getspnam(3C).  API: getnpnam etc.
(Subst. /sp/ntpw/ in: getspnam, getspnam_r,
 getspent_r, setspent, endspent,
 fgetspent, fgetspent_r)

New DB file: /etc/ntpasswd

At first upgrade with this code, create
/etc/ntpasswd from /var/smb/smbpasswd
with updates to the format.  Old (smbpasswd) format:
    <user-name>:<user-id>:<LM hash>:<NTLM hash>
    gwr:81550::0123456789ABCDEF0123456789ABCDEF
New (ntpasswd) format:
    <user-name>:<user-id>:<LM hash>:<NTLM hash>:
    gwr:81550:*NO*LM*HASH*:0123456789ABCDEF0123456789ABCDEF:
Both hashes, if present, are 32-byte hex strings.
Note that the "LM hash" is usually absent (because
accepting or storing the LM hash undesirable from a
security standpoint, and not used in modern systems).
Note ":" at the end, missing from smbpasswd.

There is code to parse the old smbpasswd format in:
  usr/src/lib/smbsrv/libsmb/common/smb_pwdutil.c

New header:
  usr/src/head/ntpasswd.h  (like shadow.h)
  struct ntpw;  /* like shadow.h:spwd */
  (See sample ntpasswd.h)

Modify: usr/src/head/nss_dbdefs.h adding
#define    NSS_DBNAM_NTPASSWD    "ntpasswd" 
(after NSS_DBNAM_SHADOW)
Add NTPASSWD defines like the SHADOW ones.

I _don't_ think we need a new NSS_DBOP_...
because shadow uses the DBOP for passwd.  See:
    #define    NSS_DBOP_SHADOW_BYNAME    (NSS_DBOP_PASSWD_BYNAME)
So just use NSS_DBOP_PASSWD_BYNAME with nss_search().

Add new libc files like getspent*.c etc.
The NSS DB lookup goes like this:

    void
    _nss_initf_ntpaswd(nss_db_params_t *p)
    {
        p->name    = NSS_DBNAM_NTPASSWD;
        /* Use config for "passwd" */
        p->config_name    = NSS_DBNAM_PASSWD;
        p->default_config = NSS_DEFCONF_PASSWD;
    }

Add an NSS_MK_GETXYDBOPB() line to
usr/src/lib/libc/port/gen/nss_dbdefs.c
for  "ntpasswd", again like the "shadow" one.
Careful with getXbyY_to_dbop[] - see the
comment above it about nss_dbop_search().

See "shadow" DB support in:
  usr/src/lib/nsswitch/files/common/
  usr/src/lib/nsswitch/ldap/common/
and add "ntpaswd" method constructors, etc.

I think we can simply not implement "ntpasswd" 
in the other back-ends, but have to check.
(Might need stubs, might not.)

The proposed new "ntpasswd.h" header file is attached.
It would go in usr/src/head/ntpasswd.h