-/* $OpenBSD: gss-serv-krb5.c,v 1.1 2003/08/22 10:56:09 markus Exp $ */
+/* $OpenBSD: gss-serv-krb5.c,v 1.3 2004/07/21 10:36:23 djm Exp $ */
/*
* Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
extern ServerOptions options;
#ifdef HEIMDAL
-#include <krb5.h>
+# include <krb5.h>
#else
-#include <gssapi_krb5.h>
+# ifdef HAVE_GSSAPI_KRB5
+# include <gssapi_krb5.h>
+# elif HAVE_GSSAPI_GSSAPI_KRB5
+# include <gssapi/gssapi_krb5.h>
+# endif
#endif
static krb5_context krb_context = NULL;
+static int ssh_gssapi_krb5_init();
+static int ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name);
+static int ssh_gssapi_krb5_localname(ssh_gssapi_client *client, char **user);
+static void ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client);
+
+ssh_gssapi_mech gssapi_kerberos_mech = {
+ "toWM5Slw5Ew8Mqkay+al2g==",
+ "Kerberos",
+ {9, "\x2A\x86\x48\x86\xF7\x12\x01\x02\x02"},
+ NULL,
+ &ssh_gssapi_krb5_userok,
+ &ssh_gssapi_krb5_localname,
+ &ssh_gssapi_krb5_storecreds
+};
/* Initialise the krb5 library, for the stuff that GSSAPI won't do */
-static int
-ssh_gssapi_krb5_init()
+static int
+ssh_gssapi_krb5_init(void)
{
krb5_error_code problem;
logit("Cannot initialize krb5 context");
return 0;
}
+#ifdef KRB5_INIT_ETS
krb5_init_ets(krb_context);
+#endif
return 1;
}
krb5_principal princ;
OM_uint32 maj_status, min_status;
gss_cred_id_t krb5_cred_handle;
-
+ int len;
if (client->creds == NULL) {
debug("No credentials stored");
{
int tmpfd;
char ccname[40];
-
- snprintf(ccname, sizeof(ccname),
+ mode_t old_umask;
+
+ snprintf(ccname, sizeof(ccname),
"FILE:/tmp/krb5cc_%d_XXXXXX", geteuid());
-
- if ((tmpfd = mkstemp(ccname + strlen("FILE:"))) == -1) {
+
+ old_umask = umask(0177);
+ tmpfd = mkstemp(ccname + strlen("FILE:"));
+ umask(old_umask);
+ if (tmpfd == -1) {
logit("mkstemp(): %.100s", strerror(errno));
problem = errno;
return;
}
#endif /* #ifdef HEIMDAL */
- if ((problem = krb5_parse_name(krb_context,
+ if ((problem = krb5_parse_name(krb_context,
client->exportedname.value, &princ))) {
logit("krb5_parse_name(): %.100s",
krb5_get_err_text(krb_context, problem));
client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));
client->store.envvar = "KRB5CCNAME";
- client->store.envval = xstrdup(client->store.filename);
+ len = strlen(client->store.filename) + 6;
+ client->store.envval = xmalloc(len);
+ snprintf(client->store.envval, len, "FILE:%s", client->store.filename);
#ifdef USE_PAM
if (options.use_pam)
- do_pam_putenv(client->store.envvar,client->store.envval);
+ do_pam_putenv(client->store.envvar, client->store.envval);
#endif
krb5_cc_close(krb_context, ccache);
return;
}
-ssh_gssapi_mech gssapi_kerberos_mech = {
- "toWM5Slw5Ew8Mqkay+al2g==",
- "Kerberos",
- {9, "\x2A\x86\x48\x86\xF7\x12\x01\x02\x02"},
- NULL,
- &ssh_gssapi_krb5_userok,
- &ssh_gssapi_krb5_localname,
- &ssh_gssapi_krb5_storecreds
-};
-
-ssh_gssapi_mech gssapi_kerberos_mech_old = {
- "Se3H81ismmOC3OE+FwYCiQ==",
- "Kerberos",
- {9, "\x2A\x86\x48\x86\xF7\x12\x01\x02\x02"},
- &ssh_gssapi_krb5_init,
- &ssh_gssapi_krb5_userok,
- &ssh_gssapi_krb5_localname,
- &ssh_gssapi_krb5_storecreds
-};
-
#endif /* KRB5 */
#endif /* GSSAPI */