Added support for reporting usage metrics.

[gssapi-openssh.git] / openssh / auth.c

diff --git a/openssh/auth.c b/openssh/auth.c
index 68e350bc1c0d77321fdf61f26037f758c5d48207..19253fe52afe42a893e1bca3d4c429a47e40d0d4 100644 (file)
--- a/openssh/auth.c
+++ b/openssh/auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.75 2006/08/03 03:34:41 deraadt Exp $ */
+/* $OpenBSD: auth.c,v 1.80 2008/11/04 07:58:09 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -32,6 +32,7 @@
 #include <netinet/in.h>
 
 #include <errno.h>
+#include <fcntl.h>
 #ifdef HAVE_PATHS_H
 # include <paths.h>
 #endif
@@ -48,6 +49,7 @@
 #include <stdarg.h>
 #include <stdio.h>
 #include <string.h>
+#include <unistd.h>
 
 #include "xmalloc.h"
 #include "match.h"
@@ -69,6 +71,9 @@
 #endif
 #include "monitor_wrap.h"
 
+#include "version.h"
+#include "ssh-globus-usage.h"
+
 /* import */
 extern ServerOptions options;
 extern int use_privsep;
@@ -113,6 +118,7 @@ allowed_user(struct passwd * pw)
 #endif /* USE_SHADOW */
 
        /* grab passwd field for locked account check */
+       passwd = pw->pw_passwd;
 #ifdef USE_SHADOW
        if (spw != NULL)
 #ifdef USE_LIBIAF
@@ -120,8 +126,6 @@ allowed_user(struct passwd * pw)
 #else
                passwd = spw->sp_pwdp;
 #endif /* USE_LIBIAF */
-#else
-       passwd = pw->pw_passwd;
 #endif
 
        /* check for locked account */
@@ -291,6 +295,21 @@ auth_log(Authctxt *authctxt, int authenticated, char *method, char *info)
        if (authenticated == 0 && !authctxt->postponed)
                audit_event(audit_classify_auth(method));
 #endif
+       if (authenticated) {
+               char *userdn = NULL;
+               char *mech_name = NULL;
+               ssh_gssapi_get_client_info(&userdn, &mech_name);
+               debug("REPORTING (%s) (%s) (%s) (%s) (%s) (%s) (%s)",
+                        SSH_RELEASE, SSLeay_version(SSLEAY_VERSION),
+                        method, mech_name?mech_name:"NULL", get_remote_ipaddr(),
+                        (authctxt->user && authctxt->user[0])?
+                               authctxt->user : "unknown",
+                       userdn?userdn:"NULL");
+               ssh_globus_send_usage_metrics(SSH_RELEASE,
+                                       SSLeay_version(SSLEAY_VERSION),
+                                       method, mech_name, get_remote_ipaddr(),
+                                       authctxt->user, userdn);
+       }
 }
 
 /*
@@ -411,7 +430,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
  *
  * Returns 0 on success and -1 on failure
  */
-int
+static int
 secure_filename(FILE *f, const char *file, struct passwd *pw,
     char *err, size_t errlen)
 {
@@ -471,6 +490,46 @@ secure_filename(FILE *f, const char *file, struct passwd *pw,
        return 0;
 }
 
+FILE *
+auth_openkeyfile(const char *file, struct passwd *pw, int strict_modes)
+{
+       char line[1024];
+       struct stat st;
+       int fd;
+       FILE *f;
+
+       /*
+        * Open the file containing the authorized keys
+        * Fail quietly if file does not exist
+        */
+       if ((fd = open(file, O_RDONLY|O_NONBLOCK)) == -1)
+               return NULL;
+
+       if (fstat(fd, &st) < 0) {
+               close(fd);
+               return NULL;
+       }
+       if (!S_ISREG(st.st_mode)) {
+               logit("User %s authorized keys %s is not a regular file",
+                   pw->pw_name, file);
+               close(fd);
+               return NULL;
+       }
+       unset_nonblock(fd);
+       if ((f = fdopen(fd, "r")) == NULL) {
+               close(fd);
+               return NULL;
+       }
+       if (options.strict_modes &&
+           secure_filename(f, file, pw, line, sizeof(line)) != 0) {
+               fclose(f);
+               logit("Authentication refused: %s", line);
+               return NULL;
+       }
+
+       return f;
+}
+
 struct passwd *
 getpwnamallow(const char *user)
 {
@@ -486,6 +545,10 @@ getpwnamallow(const char *user)
            get_canonical_hostname(options.use_dns), get_remote_ipaddr());
 
        pw = getpwnam(user);
+#ifdef USE_PAM
+       if (options.use_pam && options.permit_pam_user_change && pw == NULL)
+               pw = sshpam_getpw(user);
+#endif
        if (pw == NULL) {
                logit("Invalid user %.100s from %.100s",
                      (user && user[0]) ? user : "unknown",