]> andersk Git - gssapi-openssh.git/blame - openssh/ssh-add.c
Import of OpenSSH 3.7p1
[gssapi-openssh.git] / openssh / ssh-add.c
CommitLineData
3c0ef626 1/*
2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
5 * Adds an identity to the authentication server, or removes an identity.
6 *
7 * As far as I am concerned, the code I have written for this software
8 * can be used freely for any purpose. Any derived versions of this
9 * software must be clearly marked as such, and if the derived work is
10 * incompatible with the protocol description in the RFC file, it must be
11 * called by a name other than "ssh" or "Secure Shell".
12 *
13 * SSH2 implementation,
14 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
15 *
16 * Redistribution and use in source and binary forms, with or without
17 * modification, are permitted provided that the following conditions
18 * are met:
19 * 1. Redistributions of source code must retain the above copyright
20 * notice, this list of conditions and the following disclaimer.
21 * 2. Redistributions in binary form must reproduce the above copyright
22 * notice, this list of conditions and the following disclaimer in the
23 * documentation and/or other materials provided with the distribution.
24 *
25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
30 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
31 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
32 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35 */
36
37#include "includes.h"
0fff78ff 38RCSID("$OpenBSD: ssh-add.c,v 1.68 2003/06/16 10:22:45 markus Exp $");
3c0ef626 39
40#include <openssl/evp.h>
41
42#include "ssh.h"
43#include "rsa.h"
44#include "log.h"
45#include "xmalloc.h"
46#include "key.h"
47#include "authfd.h"
48#include "authfile.h"
49#include "pathnames.h"
50#include "readpass.h"
f5799ae1 51#include "misc.h"
3c0ef626 52
53#ifdef HAVE___PROGNAME
54extern char *__progname;
55#else
56char *__progname;
57#endif
58
59/* argv0 */
60extern char *__progname;
61
e9a17296 62/* Default files to add */
63static char *default_files[] = {
64 _PATH_SSH_CLIENT_ID_RSA,
65 _PATH_SSH_CLIENT_ID_DSA,
700318f3 66 _PATH_SSH_CLIENT_IDENTITY,
e9a17296 67 NULL
68};
69
f5799ae1 70/* Default lifetime (0 == forever) */
71static int lifetime = 0;
e9a17296 72
6a9b3198 73/* User has to confirm key use */
74static int confirm = 0;
75
3c0ef626 76/* we keep a cache of one passphrases */
77static char *pass = NULL;
78static void
79clear_pass(void)
80{
81 if (pass) {
82 memset(pass, 0, strlen(pass));
83 xfree(pass);
84 pass = NULL;
85 }
86}
87
88static int
89delete_file(AuthenticationConnection *ac, const char *filename)
90{
91 Key *public;
92 char *comment = NULL;
93 int ret = -1;
94
95 public = key_load_public(filename, &comment);
96 if (public == NULL) {
97 printf("Bad key file %s\n", filename);
98 return -1;
99 }
100 if (ssh_remove_identity(ac, public)) {
101 fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
102 ret = 0;
103 } else
104 fprintf(stderr, "Could not remove identity: %s\n", filename);
105
106 key_free(public);
107 xfree(comment);
e9a17296 108
3c0ef626 109 return ret;
110}
111
112/* Send a request to remove all identities. */
113static int
114delete_all(AuthenticationConnection *ac)
115{
116 int ret = -1;
117
118 if (ssh_remove_all_identities(ac, 1))
119 ret = 0;
120 /* ignore error-code for ssh2 */
121 ssh_remove_all_identities(ac, 2);
122
123 if (ret == 0)
124 fprintf(stderr, "All identities removed.\n");
125 else
126 fprintf(stderr, "Failed to remove all identities.\n");
127
128 return ret;
129}
130
131static int
132add_file(AuthenticationConnection *ac, const char *filename)
133{
134 struct stat st;
135 Key *private;
136 char *comment = NULL;
137 char msg[1024];
138 int ret = -1;
139
140 if (stat(filename, &st) < 0) {
141 perror(filename);
142 return -1;
143 }
144 /* At first, try empty passphrase */
145 private = key_load_private(filename, "", &comment);
146 if (comment == NULL)
147 comment = xstrdup(filename);
148 /* try last */
149 if (private == NULL && pass != NULL)
150 private = key_load_private(filename, pass, NULL);
151 if (private == NULL) {
152 /* clear passphrase since it did not work */
153 clear_pass();
154 snprintf(msg, sizeof msg, "Enter passphrase for %.200s: ",
155 comment);
156 for (;;) {
157 pass = read_passphrase(msg, RP_ALLOW_STDIN);
158 if (strcmp(pass, "") == 0) {
159 clear_pass();
160 xfree(comment);
161 return -1;
162 }
163 private = key_load_private(filename, pass, &comment);
164 if (private != NULL)
165 break;
166 clear_pass();
0fff78ff 167 snprintf(msg, sizeof msg,
168 "Bad passphrase, try again for %.200s: ", comment);
3c0ef626 169 }
170 }
f5799ae1 171
6a9b3198 172 if (ssh_add_identity_constrained(ac, private, comment, lifetime,
173 confirm)) {
3c0ef626 174 fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
175 ret = 0;
f5799ae1 176 if (lifetime != 0)
6a9b3198 177 fprintf(stderr,
f5799ae1 178 "Lifetime set to %d seconds\n", lifetime);
6a9b3198 179 if (confirm != 0)
180 fprintf(stderr,
181 "The user has to confirm each use of the key\n");
f5799ae1 182 } else if (ssh_add_identity(ac, private, comment)) {
183 fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
184 ret = 0;
185 } else {
3c0ef626 186 fprintf(stderr, "Could not add identity: %s\n", filename);
f5799ae1 187 }
3c0ef626 188
189 xfree(comment);
190 key_free(private);
e9a17296 191
3c0ef626 192 return ret;
193}
194
195static int
196update_card(AuthenticationConnection *ac, int add, const char *id)
197{
700318f3 198 char *pin;
6a9b3198 199 int ret = -1;
700318f3 200
201 pin = read_passphrase("Enter passphrase for smartcard: ", RP_ALLOW_STDIN);
202 if (pin == NULL)
203 return -1;
204
0fff78ff 205 if (ssh_update_card(ac, add, id, pin, lifetime, confirm)) {
3c0ef626 206 fprintf(stderr, "Card %s: %s\n",
e9a17296 207 add ? "added" : "removed", id);
6a9b3198 208 ret = 0;
3c0ef626 209 } else {
210 fprintf(stderr, "Could not %s card: %s\n",
e9a17296 211 add ? "add" : "remove", id);
6a9b3198 212 ret = -1;
3c0ef626 213 }
6a9b3198 214 xfree(pin);
215 return ret;
3c0ef626 216}
217
e9a17296 218static int
3c0ef626 219list_identities(AuthenticationConnection *ac, int do_fp)
220{
221 Key *key;
222 char *comment, *fp;
223 int had_identities = 0;
224 int version;
225
226 for (version = 1; version <= 2; version++) {
227 for (key = ssh_get_first_identity(ac, &comment, version);
e9a17296 228 key != NULL;
229 key = ssh_get_next_identity(ac, &comment, version)) {
3c0ef626 230 had_identities = 1;
231 if (do_fp) {
232 fp = key_fingerprint(key, SSH_FP_MD5,
233 SSH_FP_HEX);
234 printf("%d %s %s (%s)\n",
235 key_size(key), fp, comment, key_type(key));
236 xfree(fp);
237 } else {
238 if (!key_write(key, stdout))
239 fprintf(stderr, "key_write failed");
240 fprintf(stdout, " %s\n", comment);
241 }
242 key_free(key);
243 xfree(comment);
244 }
245 }
e9a17296 246 if (!had_identities) {
3c0ef626 247 printf("The agent has no identities.\n");
e9a17296 248 return -1;
249 }
250 return 0;
251}
252
f5799ae1 253static int
254lock_agent(AuthenticationConnection *ac, int lock)
255{
256 char prompt[100], *p1, *p2;
257 int passok = 1, ret = -1;
258
259 strlcpy(prompt, "Enter lock password: ", sizeof(prompt));
260 p1 = read_passphrase(prompt, RP_ALLOW_STDIN);
261 if (lock) {
262 strlcpy(prompt, "Again: ", sizeof prompt);
263 p2 = read_passphrase(prompt, RP_ALLOW_STDIN);
264 if (strcmp(p1, p2) != 0) {
265 fprintf(stderr, "Passwords do not match.\n");
266 passok = 0;
267 }
268 memset(p2, 0, strlen(p2));
269 xfree(p2);
270 }
271 if (passok && ssh_lock_agent(ac, lock, p1)) {
272 fprintf(stderr, "Agent %slocked.\n", lock ? "" : "un");
273 ret = 0;
274 } else
275 fprintf(stderr, "Failed to %slock agent.\n", lock ? "" : "un");
276 memset(p1, 0, strlen(p1));
277 xfree(p1);
41b2f314 278 return (ret);
f5799ae1 279}
280
e9a17296 281static int
282do_file(AuthenticationConnection *ac, int deleting, char *file)
283{
284 if (deleting) {
285 if (delete_file(ac, file) == -1)
286 return -1;
287 } else {
288 if (add_file(ac, file) == -1)
289 return -1;
290 }
291 return 0;
3c0ef626 292}
293
294static void
295usage(void)
296{
297 fprintf(stderr, "Usage: %s [options]\n", __progname);
298 fprintf(stderr, "Options:\n");
299 fprintf(stderr, " -l List fingerprints of all identities.\n");
300 fprintf(stderr, " -L List public key parameters of all identities.\n");
301 fprintf(stderr, " -d Delete identity.\n");
302 fprintf(stderr, " -D Delete all identities.\n");
f5799ae1 303 fprintf(stderr, " -x Lock agent.\n");
41b2f314 304 fprintf(stderr, " -X Unlock agent.\n");
f5799ae1 305 fprintf(stderr, " -t life Set lifetime (in seconds) when adding identities.\n");
6a9b3198 306 fprintf(stderr, " -c Require confirmation to sign using identities\n");
3c0ef626 307#ifdef SMARTCARD
308 fprintf(stderr, " -s reader Add key in smartcard reader.\n");
309 fprintf(stderr, " -e reader Remove key in smartcard reader.\n");
310#endif
311}
312
313int
314main(int argc, char **argv)
315{
316 extern char *optarg;
317 extern int optind;
318 AuthenticationConnection *ac = NULL;
3c0ef626 319 char *sc_reader_id = NULL;
320 int i, ch, deleting = 0, ret = 0;
321
0fff78ff 322 __progname = ssh_get_progname(argv[0]);
3c0ef626 323 init_rng();
324 seed_rng();
325
326 SSLeay_add_all_algorithms();
327
328 /* At first, get a connection to the authentication agent. */
329 ac = ssh_get_authentication_connection();
330 if (ac == NULL) {
331 fprintf(stderr, "Could not open a connection to your authentication agent.\n");
e9a17296 332 exit(2);
3c0ef626 333 }
6a9b3198 334 while ((ch = getopt(argc, argv, "lLcdDxXe:s:t:")) != -1) {
3c0ef626 335 switch (ch) {
336 case 'l':
337 case 'L':
e9a17296 338 if (list_identities(ac, ch == 'l' ? 1 : 0) == -1)
339 ret = 1;
3c0ef626 340 goto done;
341 break;
f5799ae1 342 case 'x':
343 case 'X':
344 if (lock_agent(ac, ch == 'x' ? 1 : 0) == -1)
345 ret = 1;
346 goto done;
347 break;
6a9b3198 348 case 'c':
349 confirm = 1;
350 break;
3c0ef626 351 case 'd':
352 deleting = 1;
353 break;
354 case 'D':
355 if (delete_all(ac) == -1)
356 ret = 1;
357 goto done;
358 break;
359 case 's':
360 sc_reader_id = optarg;
361 break;
362 case 'e':
e9a17296 363 deleting = 1;
3c0ef626 364 sc_reader_id = optarg;
365 break;
f5799ae1 366 case 't':
367 if ((lifetime = convtime(optarg)) == -1) {
368 fprintf(stderr, "Invalid lifetime\n");
369 ret = 1;
370 goto done;
371 }
372 break;
3c0ef626 373 default:
374 usage();
375 ret = 1;
376 goto done;
377 }
378 }
379 argc -= optind;
380 argv += optind;
381 if (sc_reader_id != NULL) {
382 if (update_card(ac, !deleting, sc_reader_id) == -1)
383 ret = 1;
384 goto done;
385 }
386 if (argc == 0) {
e9a17296 387 char buf[MAXPATHLEN];
388 struct passwd *pw;
700318f3 389 struct stat st;
390 int count = 0;
e9a17296 391
392 if ((pw = getpwuid(getuid())) == NULL) {
3c0ef626 393 fprintf(stderr, "No user found with uid %u\n",
394 (u_int)getuid());
395 ret = 1;
396 goto done;
397 }
e9a17296 398
399 for(i = 0; default_files[i]; i++) {
700318f3 400 snprintf(buf, sizeof(buf), "%s/%s", pw->pw_dir,
e9a17296 401 default_files[i]);
700318f3 402 if (stat(buf, &st) < 0)
403 continue;
e9a17296 404 if (do_file(ac, deleting, buf) == -1)
3c0ef626 405 ret = 1;
700318f3 406 else
407 count++;
3c0ef626 408 }
700318f3 409 if (count == 0)
410 ret = 1;
3c0ef626 411 } else {
e9a17296 412 for(i = 0; i < argc; i++) {
413 if (do_file(ac, deleting, argv[i]) == -1)
414 ret = 1;
3c0ef626 415 }
416 }
417 clear_pass();
418
419done:
420 ssh_close_authentication_connection(ac);
421 return ret;
422}
This page took 0.121427 seconds and 5 git commands to generate.