2 * Copyright (c) 2001,2002 Simon Wilkinson. All rights reserved.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37 #include <openssl/evp.h>
48 #include "monitor_wrap.h"
52 extern ServerOptions options;
53 extern u_char *session_id2;
54 extern int session_id2_len;
56 typedef struct ssh_gssapi_cred_cache {
61 } ssh_gssapi_cred_cache;
63 static struct ssh_gssapi_cred_cache gssapi_cred_store = {NULL,NULL,NULL};
66 * Environment variables pointing to delegated credentials
68 static char *delegation_env[] = {
69 "X509_USER_PROXY", /* GSSAPI/SSLeay */
70 "KRB5CCNAME", /* Krb5 and possibly SSLeay */
74 static void gssapi_unsetenv(const char *var);
81 #include <gssapi_krb5.h>
82 #define krb5_get_err_text(context,code) error_message(code)
85 static krb5_context krb_context = NULL;
87 /* Initialise the krb5 library, so we can use it for those bits that
90 int ssh_gssapi_krb5_init() {
91 krb5_error_code problem;
93 if (krb_context !=NULL)
96 problem = krb5_init_context(&krb_context);
98 log("Cannot initialize krb5 context");
101 krb5_init_ets(krb_context);
106 /* Check if this user is OK to login. This only works with krb5 - other
107 * GSSAPI mechanisms will need their own.
108 * Returns true if the user is OK to log in, otherwise returns 0
112 ssh_gssapi_krb5_userok(char *name) {
113 krb5_principal princ;
116 if (ssh_gssapi_krb5_init() == 0)
119 if ((retval=krb5_parse_name(krb_context, gssapi_client_name.value,
121 log("krb5_parse_name(): %.100s",
122 krb5_get_err_text(krb_context,retval));
125 if (krb5_kuserok(krb_context, princ, name)) {
127 log("Authorized to %s, krb5 principal %s (krb5_kuserok)",name,
128 (char *)gssapi_client_name.value);
133 krb5_free_principal(krb_context, princ);
138 ssh_gssapi_krb5_localname(char **user)
140 krb5_principal princ;
142 if (krb5_parse_name(krb_context, gssapi_client_name.value, &princ)) {
145 *user = (char *)xmalloc(256);
146 if (krb5_aname_to_localname(krb_context, princ, 256, *user)) {
154 /* Make sure that this is called _after_ we've setuid to the user */
156 /* This writes out any forwarded credentials. Its specific to the Kerberos
159 * We assume that our caller has made sure that the user has selected
160 * delegated credentials, and that the client_creds structure is correctly
165 ssh_gssapi_krb5_storecreds() {
167 krb5_error_code problem;
168 krb5_principal princ;
170 static char name[40];
172 OM_uint32 maj_status,min_status;
175 if (gssapi_client_creds==NULL) {
176 debug("No credentials stored");
180 if (ssh_gssapi_krb5_init() == 0)
183 if (options.gss_use_session_ccache) {
184 snprintf(ccname,sizeof(ccname),"/tmp/krb5cc_%d_XXXXXX",geteuid());
186 if ((tmpfd = mkstemp(ccname))==-1) {
187 log("mkstemp(): %.100s", strerror(errno));
190 if (fchmod(tmpfd, S_IRUSR | S_IWUSR) == -1) {
191 log("fchmod(): %.100s", strerror(errno));
196 snprintf(ccname,sizeof(ccname),"/tmp/krb5cc_%d",geteuid());
197 tmpfd = open(ccname, O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR);
199 log("open(): %.100s", strerror(errno));
205 snprintf(name, sizeof(name), "FILE:%s",ccname);
207 if ((problem = krb5_cc_resolve(krb_context, name, &ccache))) {
208 log("krb5_cc_default(): %.100s",
209 krb5_get_err_text(krb_context,problem));
213 if ((problem = krb5_parse_name(krb_context, gssapi_client_name.value,
215 log("krb5_parse_name(): %.100s",
216 krb5_get_err_text(krb_context,problem));
217 krb5_cc_destroy(krb_context,ccache);
221 if ((problem = krb5_cc_initialize(krb_context, ccache, princ))) {
222 log("krb5_cc_initialize(): %.100s",
223 krb5_get_err_text(krb_context,problem));
224 krb5_free_principal(krb_context,princ);
225 krb5_cc_destroy(krb_context,ccache);
229 krb5_free_principal(krb_context,princ);
231 if ((maj_status = gss_krb5_copy_ccache(&min_status,
234 log("gss_krb5_copy_ccache() failed");
235 ssh_gssapi_error(maj_status,min_status);
236 krb5_cc_destroy(krb_context,ccache);
240 krb5_cc_close(krb_context,ccache);
244 do_pam_putenv("KRB5CCNAME",name);
247 gssapi_cred_store.filename=strdup(ccname);
248 gssapi_cred_store.envvar="KRB5CCNAME";
249 gssapi_cred_store.envval=strdup(name);
257 #include <globus_gss_assist.h>
260 * Check if this user is OK to login under GSI. User has been authenticated
261 * as identity in global 'client_name.value' and is trying to log in as passed
262 * username in 'name'.
264 * Returns non-zero if user is authorized, 0 otherwise.
267 ssh_gssapi_gsi_userok(char *name)
271 /* This returns 0 on success */
272 authorized = (globus_gss_assist_userok(gssapi_client_name.value,
275 log("GSI user %s is%s authorized as target user %s",
276 (char *) gssapi_client_name.value, (authorized ? "" : " not"), name);
282 * Return the local username associated with the GSI credentials.
285 ssh_gssapi_gsi_localname(char **user)
287 return(globus_gss_assist_gridmap(gssapi_client_name.value, user) == 0);
291 * Handle setting up child environment for GSI.
293 * Make sure that this is called _after_ we've setuid to the user.
296 ssh_gssapi_gsi_storecreds()
298 OM_uint32 major_status;
299 OM_uint32 minor_status;
301 /* should use gss_export_cred() instead */
303 if (gssapi_client_creds != NULL)
305 char *creds_env = NULL;
308 * This is the current hack with the GSI gssapi library to
309 * export credentials to disk.
312 debug("Exporting delegated credentials");
314 minor_status = 0xdee0; /* Magic value */
316 gss_inquire_cred(&minor_status,
318 (gss_name_t *) &creds_env,
323 if ((major_status == GSS_S_COMPLETE) &&
324 (minor_status == 0xdee1) &&
330 * String is of the form:
331 * X509_USER_DELEG_PROXY=filename
332 * so we parse out the filename
333 * and then set X509_USER_PROXY
336 value = strchr(creds_env, '=');
343 do_pam_putenv("X509_USER_PROXY",value);
345 gssapi_cred_store.filename=strdup(value);
346 gssapi_cred_store.envvar="X509_USER_PROXY";
347 gssapi_cred_store.envval=strdup(value);
353 log("Failed to parse delegated credentials string '%s'",
359 log("Failed to export delegated credentials (error %ld)",
368 ssh_gssapi_cleanup_creds(void *ignored)
370 if (gssapi_cred_store.filename!=NULL) {
371 /* Unlink probably isn't sufficient */
372 debug("removing gssapi cred file\"%s\"",gssapi_cred_store.filename);
373 unlink(gssapi_cred_store.filename);
378 ssh_gssapi_storecreds()
380 switch (gssapi_client_type) {
383 ssh_gssapi_krb5_storecreds();
388 ssh_gssapi_gsi_storecreds();
392 /* GSSAPI not used in this authentication */
393 debug("No GSSAPI credentials stored");
396 log("ssh_gssapi_do_child: Unknown mechanism");
400 if (options.gss_cleanup_creds) {
401 fatal_add_cleanup(ssh_gssapi_cleanup_creds, NULL);
406 /* This allows GSSAPI methods to do things to the childs environment based
407 * on the passed authentication process and credentials.
409 * Question: If we didn't use userauth_external for some reason, should we
410 * still delegate credentials?
413 ssh_gssapi_do_child(char ***envp, u_int *envsizep)
416 if (gssapi_cred_store.envvar!=NULL &&
417 gssapi_cred_store.envval!=NULL) {
419 debug("Setting %s to %s", gssapi_cred_store.envvar,
420 gssapi_cred_store.envval);
421 child_set_env(envp, envsizep, gssapi_cred_store.envvar,
422 gssapi_cred_store.envval);
425 switch(gssapi_client_type) {
427 case GSS_KERBEROS: break;
433 debug("No GSSAPI credentials stored");
436 log("ssh_gssapi_do_child: Unknown mechanism");
441 ssh_gssapi_userok(char *user)
443 if (gssapi_client_name.length==0 ||
444 gssapi_client_name.value==NULL) {
445 debug("No suitable client data");
448 switch (gssapi_client_type) {
451 return(ssh_gssapi_krb5_userok(user));
452 break; /* Not reached */
456 return(ssh_gssapi_gsi_userok(user));
457 break; /* Not reached */
460 debug("Client not GSSAPI");
463 debug("Unknown client authentication type");
469 ssh_gssapi_localname(char **user)
472 if (gssapi_client_name.length==0 ||
473 gssapi_client_name.value==NULL) {
474 debug("No suitable client data");
477 switch (gssapi_client_type) {
480 return(ssh_gssapi_krb5_localname(user));
481 break; /* Not reached */
485 return(ssh_gssapi_gsi_localname(user));
486 break; /* Not reached */
489 debug("Client not GSSAPI");
492 debug("Unknown client authentication type");
498 * Clean our environment on startup. This means removing any environment
499 * strings that might inadvertantly been in root's environment and
500 * could cause serious security problems if we think we set them.
503 ssh_gssapi_clean_env(void)
509 for (envstr_index = 0;
510 (envstr = delegation_env[envstr_index]) != NULL;
513 if (getenv(envstr)) {
514 debug("Clearing environment variable %s", envstr);
515 gssapi_unsetenv(envstr);
521 * Wrapper around unsetenv.
524 gssapi_unsetenv(const char *var)
529 #else /* !HAVE_UNSETENV */
530 extern char **environ;
531 char **p1 = environ; /* New array list */
532 char **p2 = environ; /* Current array list */
533 int len = strlen(var);
536 * Walk through current environ array (p2) copying each pointer
537 * to new environ array (p1) unless the pointer is to the item
538 * we want to delete. Copy happens in place.
541 if ((strncmp(*p2, var, len) == 0) &&
542 ((*p2)[len] == '=')) {
544 * *p2 points at item to be deleted, just skip over it
549 * *p2 points at item we want to save, so copy it
557 /* And make sure new array is NULL terminated */
559 #endif /* HAVE_UNSETENV */