]> andersk Git - openssh.git/blame - auth1.c
- markus@cvs.openbsd.org 2001/12/28 13:57:33
[openssh.git] / auth1.c
CommitLineData
a306f2dd 1/*
2 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
3 * All rights reserved
bcbf86ec 4 *
5 * As far as I am concerned, the code I have written for this software
6 * can be used freely for any purpose. Any derived versions of this
7 * software must be clearly marked as such, and if the derived work is
8 * incompatible with the protocol description in the RFC file, it must be
9 * called by a name other than "ssh" or "Secure Shell".
a306f2dd 10 */
11
12#include "includes.h"
20b279e6 13RCSID("$OpenBSD: auth1.c,v 1.33 2001/12/28 13:57:33 markus Exp $");
94ec8c6b 14
a306f2dd 15#include "xmalloc.h"
16#include "rsa.h"
42f11eb2 17#include "ssh1.h"
a306f2dd 18#include "packet.h"
19#include "buffer.h"
a306f2dd 20#include "mpaux.h"
42f11eb2 21#include "log.h"
a306f2dd 22#include "servconf.h"
23#include "compat.h"
24#include "auth.h"
25#include "session.h"
3b1a83df 26#include "misc.h"
ced49be2 27#include "uidswap.h"
a306f2dd 28
29/* import */
30extern ServerOptions options;
94ec8c6b 31
a306f2dd 32/*
33 * convert ssh auth msg type into description
34 */
396c147e 35static char *
a306f2dd 36get_authname(int type)
37{
38 static char buf[1024];
39 switch (type) {
40 case SSH_CMSG_AUTH_PASSWORD:
41 return "password";
42 case SSH_CMSG_AUTH_RSA:
43 return "rsa";
44 case SSH_CMSG_AUTH_RHOSTS_RSA:
45 return "rhosts-rsa";
46 case SSH_CMSG_AUTH_RHOSTS:
47 return "rhosts";
59c97189 48 case SSH_CMSG_AUTH_TIS:
49 case SSH_CMSG_AUTH_TIS_RESPONSE:
50 return "challenge-response";
ced49be2 51#if defined(KRB4) || defined(KRB5)
a306f2dd 52 case SSH_CMSG_AUTH_KERBEROS:
53 return "kerberos";
a306f2dd 54#endif
55 }
56 snprintf(buf, sizeof buf, "bad-auth-msg-%d", type);
57 return buf;
58}
59
60/*
59c97189 61 * read packets, try to authenticate the user and
62 * return only if authentication is successful
a306f2dd 63 */
396c147e 64static void
59c97189 65do_authloop(Authctxt *authctxt)
a306f2dd 66{
94ec8c6b 67 int authenticated = 0;
1e3b8b07 68 u_int bits;
b775c6f2 69 Key *client_host_key;
a306f2dd 70 BIGNUM *n;
94ec8c6b 71 char *client_user, *password;
59c97189 72 char info[1024];
1e3b8b07 73 u_int dlen;
20b279e6 74 int plen;
1e3b8b07 75 u_int ulen;
a306f2dd 76 int type = 0;
59c97189 77 struct passwd *pw = authctxt->pw;
78
79 debug("Attempting authentication for %s%.100s.",
184eed6a 80 authctxt->valid ? "" : "illegal user ", authctxt->user);
59c97189 81
82 /* If the user has no password, accept authentication immediately. */
83 if (options.password_authentication &&
ced49be2 84#if defined(KRB4) || defined(KRB5)
59c97189 85 (!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
86#endif
f4ebf0e8 87#ifdef USE_PAM
8d60e965 88 auth_pam_password(pw, "")) {
b7ccb051 89#elif defined(HAVE_OSF_SIA)
90 0) {
59c97189 91#else
af774732 92 auth_password(authctxt, "")) {
59c97189 93#endif
94 auth_log(authctxt, 1, "without authentication", "");
95 return;
96 }
a306f2dd 97
98 /* Indicate that authentication is needed. */
99 packet_start(SSH_SMSG_FAILURE);
100 packet_send();
101 packet_write_wait();
102
94ec8c6b 103 client_user = NULL;
104
59c97189 105 for (;;) {
94ec8c6b 106 /* default to fail */
107 authenticated = 0;
108
59c97189 109 info[0] = '\0';
a306f2dd 110
111 /* Get a packet from the client. */
112 type = packet_read(&plen);
113
114 /* Process the packet. */
115 switch (type) {
a306f2dd 116
ced49be2 117#if defined(KRB4) || defined(KRB5)
a306f2dd 118 case SSH_CMSG_AUTH_KERBEROS:
119 if (!options.kerberos_authentication) {
a306f2dd 120 verbose("Kerberos authentication disabled.");
a306f2dd 121 } else {
ced49be2 122 char *kdata = packet_get_string(&dlen);
95500969 123 packet_check_eom();
184eed6a 124
ced49be2 125 if (kdata[0] == 4) { /* KRB_PROT_VERSION */
126#ifdef KRB4
127 KTEXT_ST tkt;
184eed6a 128
ced49be2 129 tkt.length = dlen;
130 if (tkt.length < MAX_KTXT_LEN)
131 memcpy(tkt.dat, kdata, tkt.length);
184eed6a 132
ced49be2 133 if (auth_krb4(authctxt, &tkt, &client_user)) {
134 authenticated = 1;
135 snprintf(info, sizeof(info),
136 " tktuser %.100s",
137 client_user);
94ec8c6b 138 }
ced49be2 139#endif /* KRB4 */
140 } else {
141#ifdef KRB5
142 krb5_data tkt;
143 tkt.length = dlen;
144 tkt.data = kdata;
184eed6a 145
ced49be2 146 if (auth_krb5(authctxt, &tkt, &client_user)) {
147 authenticated = 1;
148 snprintf(info, sizeof(info),
149 " tktuser %.100s",
150 client_user);
ced49be2 151 }
152#endif /* KRB5 */
a306f2dd 153 }
59c97189 154 xfree(kdata);
a306f2dd 155 }
156 break;
ced49be2 157#endif /* KRB4 || KRB5 */
184eed6a 158
ced49be2 159#if defined(AFS) || defined(KRB5)
160 /* XXX - punt on backward compatibility here. */
161 case SSH_CMSG_HAVE_KERBEROS_TGT:
162 packet_send_debug("Kerberos TGT passing disabled before authentication.");
163 break;
164#ifdef AFS
165 case SSH_CMSG_HAVE_AFS_TOKEN:
166 packet_send_debug("AFS token passing disabled before authentication.");
167 break;
168#endif /* AFS */
169#endif /* AFS || KRB5 */
184eed6a 170
a306f2dd 171 case SSH_CMSG_AUTH_RHOSTS:
172 if (!options.rhosts_authentication) {
173 verbose("Rhosts authentication disabled.");
174 break;
175 }
176 /*
177 * Get client user name. Note that we just have to
178 * trust the client; this is one reason why rhosts
179 * authentication is insecure. (Another is
180 * IP-spoofing on a local network.)
181 */
182 client_user = packet_get_string(&ulen);
95500969 183 packet_check_eom();
a306f2dd 184
94ec8c6b 185 /* Try to authenticate using /etc/hosts.equiv and .rhosts. */
a306f2dd 186 authenticated = auth_rhosts(pw, client_user);
187
59c97189 188 snprintf(info, sizeof info, " ruser %.100s", client_user);
a306f2dd 189 break;
190
191 case SSH_CMSG_AUTH_RHOSTS_RSA:
192 if (!options.rhosts_rsa_authentication) {
193 verbose("Rhosts with RSA authentication disabled.");
194 break;
195 }
196 /*
197 * Get client user name. Note that we just have to
198 * trust the client; root on the client machine can
199 * claim to be any user.
200 */
201 client_user = packet_get_string(&ulen);
202
203 /* Get the client host key. */
b775c6f2 204 client_host_key = key_new(KEY_RSA1);
a306f2dd 205 bits = packet_get_int();
20b279e6 206 packet_get_bignum(client_host_key->rsa->e);
207 packet_get_bignum(client_host_key->rsa->n);
a306f2dd 208
b775c6f2 209 if (bits != BN_num_bits(client_host_key->rsa->n))
94ec8c6b 210 verbose("Warning: keysize mismatch for client_host_key: "
b775c6f2 211 "actual %d, announced %d",
212 BN_num_bits(client_host_key->rsa->n), bits);
95500969 213 packet_check_eom();
a306f2dd 214
b775c6f2 215 authenticated = auth_rhosts_rsa(pw, client_user,
dc421aa3 216 client_host_key);
b775c6f2 217 key_free(client_host_key);
a306f2dd 218
59c97189 219 snprintf(info, sizeof info, " ruser %.100s", client_user);
a306f2dd 220 break;
221
222 case SSH_CMSG_AUTH_RSA:
223 if (!options.rsa_authentication) {
224 verbose("RSA authentication disabled.");
225 break;
226 }
227 /* RSA authentication requested. */
b775c6f2 228 if ((n = BN_new()) == NULL)
229 fatal("do_authloop: BN_new failed");
20b279e6 230 packet_get_bignum(n);
95500969 231 packet_check_eom();
a306f2dd 232 authenticated = auth_rsa(pw, n);
233 BN_clear_free(n);
234 break;
235
236 case SSH_CMSG_AUTH_PASSWORD:
237 if (!options.password_authentication) {
238 verbose("Password authentication disabled.");
239 break;
240 }
241 /*
242 * Read user password. It is in plain text, but was
243 * transmitted over the encrypted channel so it is
244 * not visible to an outside observer.
245 */
246 password = packet_get_string(&dlen);
95500969 247 packet_check_eom();
a306f2dd 248
249#ifdef USE_PAM
250 /* Do PAM auth with password */
251 authenticated = auth_pam_password(pw, password);
4d33e531 252#elif defined(HAVE_OSF_SIA)
253 /* Do SIA auth with password */
b7ccb051 254 authenticated = auth_sia_password(authctxt->user,
255 password);
4d33e531 256#else /* !USE_PAM && !HAVE_OSF_SIA */
b4b5d644 257 /* Try authentication with the password. */
af774732 258 authenticated = auth_password(authctxt, password);
a306f2dd 259#endif /* USE_PAM */
260
261 memset(password, 0, strlen(password));
262 xfree(password);
263 break;
264
a306f2dd 265 case SSH_CMSG_AUTH_TIS:
266 debug("rcvd SSH_CMSG_AUTH_TIS");
5ba55ada 267 if (options.challenge_response_authentication == 1) {
268 char *challenge = get_challenge(authctxt);
59c97189 269 if (challenge != NULL) {
270 debug("sending challenge '%s'", challenge);
a306f2dd 271 packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE);
59c97189 272 packet_put_cstring(challenge);
5ba55ada 273 xfree(challenge);
a306f2dd 274 packet_send();
275 packet_write_wait();
276 continue;
277 }
278 }
279 break;
280 case SSH_CMSG_AUTH_TIS_RESPONSE:
281 debug("rcvd SSH_CMSG_AUTH_TIS_RESPONSE");
5ba55ada 282 if (options.challenge_response_authentication == 1) {
a306f2dd 283 char *response = packet_get_string(&dlen);
59c97189 284 debug("got response '%s'", response);
95500969 285 packet_check_eom();
59c97189 286 authenticated = verify_response(authctxt, response);
287 memset(response, 'r', dlen);
a306f2dd 288 xfree(response);
289 }
290 break;
a306f2dd 291
292 default:
293 /*
294 * Any unknown messages will be ignored (and failure
295 * returned) during authentication.
296 */
297 log("Unknown message during authentication: type %d", type);
298 break;
299 }
af774732 300#ifdef BSD_AUTH
301 if (authctxt->as) {
302 auth_close(authctxt->as);
303 authctxt->as = NULL;
304 }
305#endif
59c97189 306 if (!authctxt->valid && authenticated)
307 fatal("INTERNAL ERROR: authenticated invalid user %s",
308 authctxt->user);
a306f2dd 309
2b87da3b 310#ifdef HAVE_CYGWIN
311 if (authenticated &&
e9571a2c 312 !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, pw)) {
3c62e7eb 313 packet_disconnect("Authentication rejected for uid %d.",
e9571a2c 314 pw == NULL ? -1 : pw->pw_uid);
3c62e7eb 315 authenticated = 0;
316 }
3c418020 317#else
59c97189 318 /* Special handling for root */
15853e93 319 if (authenticated && authctxt->pw->pw_uid == 0 &&
320 !auth_root_allowed(get_authname(type)))
59c97189 321 authenticated = 0;
3c418020 322#endif
2b87da3b 323#ifdef USE_PAM
94ec8c6b 324 if (authenticated && !do_pam_account(pw->pw_name, client_user))
325 authenticated = 0;
326#endif
a306f2dd 327
59c97189 328 /* Log before sending the reply */
329 auth_log(authctxt, authenticated, get_authname(type), info);
330
a306f2dd 331 if (client_user != NULL) {
332 xfree(client_user);
333 client_user = NULL;
334 }
335
94ec8c6b 336 if (authenticated)
337 return;
338
b4b5d644 339 if (authctxt->failures++ > AUTH_FAIL_MAX) {
2b87da3b 340#ifdef WITH_AIXAUTHENTICATE
341 loginfailed(authctxt->user,
342 get_canonical_hostname(options.reverse_mapping_check),
61e96248 343 "ssh");
c1ef8333 344#endif /* WITH_AIXAUTHENTICATE */
59c97189 345 packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
c1ef8333 346 }
a306f2dd 347
a306f2dd 348 packet_start(SSH_SMSG_FAILURE);
349 packet_send();
350 packet_write_wait();
351 }
352}
353
354/*
355 * Performs authentication of an incoming connection. Session key has already
356 * been exchanged and encryption is enabled.
357 */
358void
d5bb9418 359do_authentication(void)
a306f2dd 360{
59c97189 361 Authctxt *authctxt;
362 struct passwd *pw;
a306f2dd 363 int plen;
1e3b8b07 364 u_int ulen;
ced49be2 365 char *p, *user, *style = NULL;
a306f2dd 366
367 /* Get the name of the user that we wish to log in as. */
368 packet_read_expect(&plen, SSH_CMSG_USER);
369
370 /* Get the user name. */
371 user = packet_get_string(&ulen);
95500969 372 packet_check_eom();
a306f2dd 373
59c97189 374 if ((style = strchr(user, ':')) != NULL)
ced49be2 375 *style++ = '\0';
59c97189 376
ced49be2 377 /* XXX - SSH.com Kerberos v5 braindeath. */
378 if ((p = strchr(user, '@')) != NULL)
379 *p = '\0';
184eed6a 380
59c97189 381 authctxt = authctxt_new();
382 authctxt->user = user;
383 authctxt->style = style;
384
a306f2dd 385 /* Verify that the user is a valid user. */
386 pw = getpwnam(user);
94ec8c6b 387 if (pw && allowed_user(pw)) {
59c97189 388 authctxt->valid = 1;
389 pw = pwcopy(pw);
94ec8c6b 390 } else {
59c97189 391 debug("do_authentication: illegal user %s", user);
94ec8c6b 392 pw = NULL;
393 }
59c97189 394 authctxt->pw = pw;
a306f2dd 395
6172e290 396 setproctitle("%s", pw ? user : "unknown");
397
a306f2dd 398#ifdef USE_PAM
94ec8c6b 399 if (pw)
04fc7a67 400 start_pam(user);
a306f2dd 401#endif
402
403 /*
404 * If we are not running as root, the user must have the same uid as
94ec8c6b 405 * the server. (Unless you are running Windows)
a306f2dd 406 */
94ec8c6b 407#ifndef HAVE_CYGWIN
408 if (getuid() != 0 && pw && pw->pw_uid != getuid())
a306f2dd 409 packet_disconnect("Cannot change user when server not running as root.");
3c62e7eb 410#endif
a306f2dd 411
59c97189 412 /*
b4b5d644 413 * Loop until the user has been authenticated or the connection is
414 * closed, do_authloop() returns only if authentication is successful
415 */
59c97189 416 do_authloop(authctxt);
a306f2dd 417
418 /* The user has been authenticated and accepted. */
94ec8c6b 419 packet_start(SSH_SMSG_SUCCESS);
420 packet_send();
421 packet_write_wait();
59c97189 422
a306f2dd 423 /* Perform session preparation. */
bb5639fe 424 do_authenticated(authctxt);
a306f2dd 425}
This page took 0.168618 seconds and 5 git commands to generate.