]> andersk Git - openssh.git/blame - auth-pam.c
- (tim) [configure.ac] updwtmpx() on OpenServer seems to add duplicate entry.
[openssh.git] / auth-pam.c
CommitLineData
05114c74 1/*-
2 * Copyright (c) 2002 Networks Associates Technology, Inc.
3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project by ThinkSec AS and
6 * NAI Labs, the Security Research Division of Network Associates, Inc.
7 * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
8 * DARPA CHATS research program.
09564242 9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
09564242 18 *
05114c74 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
a5c9cd31 30 */
93c5ef94 31/*
32 * Copyright (c) 2003,2004 Damien Miller <djm@mindrot.org>
33 * Copyright (c) 2003,2004 Darren Tucker <dtucker@zip.com.au>
34 *
35 * Permission to use, copy, modify, and distribute this software for any
36 * purpose with or without fee is hereby granted, provided that the above
37 * copyright notice and this permission notice appear in all copies.
38 *
39 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
40 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
41 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
42 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
43 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
44 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
45 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
46 */
a5c9cd31 47
5ff453c0 48/* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
a5c9cd31 49#include "includes.h"
5ff453c0 50RCSID("$Id$");
a5c9cd31 51
52#ifdef USE_PAM
2511d104 53#if defined(HAVE_SECURITY_PAM_APPL_H)
05114c74 54#include <security/pam_appl.h>
2511d104 55#elif defined (HAVE_PAM_PAM_APPL_H)
56#include <pam/pam_appl.h>
57#endif
05114c74 58
fde58bd4 59#include "auth.h"
5c377b3b 60#include "auth-pam.h"
05114c74 61#include "buffer.h"
62#include "bufaux.h"
42f11eb2 63#include "canohost.h"
05114c74 64#include "log.h"
65#include "monitor_wrap.h"
66#include "msg.h"
67#include "packet.h"
0f3ee929 68#include "misc.h"
05114c74 69#include "servconf.h"
70#include "ssh2.h"
71#include "xmalloc.h"
5b9e2464 72#include "auth-options.h"
a5c9cd31 73
7fceb20d 74extern ServerOptions options;
3eaf3960 75extern Buffer loginmsg;
b3ef7fb7 76extern int compat20;
1e08e787 77extern u_int utmp_len;
7fceb20d 78
05114c74 79#ifdef USE_POSIX_THREADS
80#include <pthread.h>
81/*
aff51935 82 * Avoid namespace clash when *not* using pthreads for systems *with*
83 * pthreads, which unconditionally define pthread_t via sys/types.h
05114c74 84 * (e.g. Linux)
85 */
aff51935 86typedef pthread_t sp_pthread_t;
05114c74 87#else
e47e681f 88typedef pid_t sp_pthread_t;
89#endif
90
91struct pam_ctxt {
92 sp_pthread_t pam_thread;
93 int pam_psock;
94 int pam_csock;
95 int pam_done;
96};
97
98static void sshpam_free_ctx(void *);
99static struct pam_ctxt *cleanup_ctxt;
100
101#ifndef USE_POSIX_THREADS
05114c74 102/*
103 * Simulate threads with processes.
104 */
a5c9cd31 105
100e6910 106static int sshpam_thread_status = -1;
107static mysig_t sshpam_oldsig;
108
109static void
110sshpam_sigchld_handler(int sig)
111{
8a956cda 112 signal(SIGCHLD, SIG_DFL);
28b49ff8 113 if (cleanup_ctxt == NULL)
114 return; /* handler called after PAM cleanup, shouldn't happen */
8a956cda 115 if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG)
930d0441 116 <= 0) {
8a956cda 117 /* PAM thread has not exitted, privsep slave must have */
118 kill(cleanup_ctxt->pam_thread, SIGTERM);
119 if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0)
930d0441 120 <= 0)
8a956cda 121 return; /* could not wait */
122 }
100e6910 123 if (WIFSIGNALED(sshpam_thread_status) &&
124 WTERMSIG(sshpam_thread_status) == SIGTERM)
125 return; /* terminated by pthread_cancel */
126 if (!WIFEXITED(sshpam_thread_status))
127 fatal("PAM: authentication thread exited unexpectedly");
128 if (WEXITSTATUS(sshpam_thread_status) != 0)
129 fatal("PAM: authentication thread exited uncleanly");
130}
131
05114c74 132static void
133pthread_exit(void *value __unused)
134{
135 _exit(0);
136}
5daf7064 137
05114c74 138static int
139pthread_create(sp_pthread_t *thread, const void *attr __unused,
140 void *(*thread_start)(void *), void *arg)
141{
142 pid_t pid;
143
355fbf31 144 sshpam_thread_status = -1;
05114c74 145 switch ((pid = fork())) {
146 case -1:
147 error("fork(): %s", strerror(errno));
148 return (-1);
149 case 0:
150 thread_start(arg);
151 _exit(1);
152 default:
153 *thread = pid;
100e6910 154 sshpam_oldsig = signal(SIGCHLD, sshpam_sigchld_handler);
05114c74 155 return (0);
156 }
157}
a5c9cd31 158
05114c74 159static int
160pthread_cancel(sp_pthread_t thread)
8c9fe09e 161{
28b49ff8 162 signal(SIGCHLD, sshpam_oldsig);
05114c74 163 return (kill(thread, SIGTERM));
8c9fe09e 164}
165
05114c74 166static int
167pthread_join(sp_pthread_t thread, void **value __unused)
8c9fe09e 168{
05114c74 169 int status;
170
100e6910 171 if (sshpam_thread_status != -1)
172 return (sshpam_thread_status);
173 signal(SIGCHLD, sshpam_oldsig);
05114c74 174 waitpid(thread, &status, 0);
175 return (status);
8c9fe09e 176}
05114c74 177#endif
178
179
0a23d79f 180static pam_handle_t *sshpam_handle = NULL;
181static int sshpam_err = 0;
182static int sshpam_authenticated = 0;
0a23d79f 183static int sshpam_session_open = 0;
184static int sshpam_cred_established = 0;
b3ef7fb7 185static int sshpam_account_status = -1;
2212fc98 186static char **sshpam_env = NULL;
d948154a 187static Authctxt *sshpam_authctxt = NULL;
5de92f17 188static const char *sshpam_password = NULL;
05114c74 189
2212fc98 190/* Some PAM implementations don't implement this */
191#ifndef HAVE_PAM_GETENVLIST
192static char **
193pam_getenvlist(pam_handle_t *pamh)
194{
195 /*
aff51935 196 * XXX - If necessary, we can still support envrionment passing
2212fc98 197 * for platforms without pam_getenvlist by searching for known
198 * env vars (e.g. KRB5CCNAME) from the PAM environment.
199 */
200 return NULL;
201}
202#endif
203
b3ef7fb7 204void
c10bb2ce 205sshpam_password_change_required(int reqd)
b3ef7fb7 206{
90f3c272 207 debug3("%s %d", __func__, reqd);
d948154a 208 if (sshpam_authctxt == NULL)
529d73ab 209 fatal("%s: PAM authctxt not initialized", __func__);
d948154a 210 sshpam_authctxt->force_pwchange = reqd;
b3ef7fb7 211 if (reqd) {
212 no_port_forwarding_flag |= 2;
213 no_agent_forwarding_flag |= 2;
214 no_x11_forwarding_flag |= 2;
215 } else {
216 no_port_forwarding_flag &= ~2;
217 no_agent_forwarding_flag &= ~2;
218 no_x11_forwarding_flag &= ~2;
b3ef7fb7 219 }
220}
dd1fb864 221
2212fc98 222/* Import regular and PAM environment from subprocess */
223static void
224import_environments(Buffer *b)
225{
226 char *env;
227 u_int i, num_env;
228 int err;
229
90f3c272 230 debug3("PAM: %s entering", __func__);
231
a1e0095d 232#ifndef USE_POSIX_THREADS
b3ef7fb7 233 /* Import variables set by do_pam_account */
234 sshpam_account_status = buffer_get_int(b);
c10bb2ce 235 sshpam_password_change_required(buffer_get_int(b));
b3ef7fb7 236
2212fc98 237 /* Import environment from subprocess */
238 num_env = buffer_get_int(b);
239 sshpam_env = xmalloc((num_env + 1) * sizeof(*sshpam_env));
240 debug3("PAM: num env strings %d", num_env);
241 for(i = 0; i < num_env; i++)
242 sshpam_env[i] = buffer_get_string(b, NULL);
243
244 sshpam_env[num_env] = NULL;
245
246 /* Import PAM environment from subprocess */
247 num_env = buffer_get_int(b);
248 debug("PAM: num PAM env strings %d", num_env);
249 for(i = 0; i < num_env; i++) {
250 env = buffer_get_string(b, NULL);
251
f79a6165 252#ifdef HAVE_PAM_PUTENV
2212fc98 253 /* Errors are not fatal here */
254 if ((err = pam_putenv(sshpam_handle, env)) != PAM_SUCCESS) {
255 error("PAM: pam_putenv: %s",
256 pam_strerror(sshpam_handle, sshpam_err));
257 }
f79a6165 258#endif
2212fc98 259 }
a1e0095d 260#endif
2212fc98 261}
262
ad55cd03 263/*
05114c74 264 * Conversation function for authentication thread.
ad55cd03 265 */
05114c74 266static int
0943f13c 267sshpam_thread_conv(int n, struct pam_message **msg,
5b9e2464 268 struct pam_response **resp, void *data)
a5c9cd31 269{
05114c74 270 Buffer buffer;
271 struct pam_ctxt *ctxt;
0a23d79f 272 struct pam_response *reply;
05114c74 273 int i;
274
60922169 275 debug3("PAM: %s entering, %d messages", __func__, n);
0a23d79f 276 *resp = NULL;
277
d506e25f 278 if (data == NULL) {
279 error("PAM: conversation function passed a null context");
280 return (PAM_CONV_ERR);
281 }
05114c74 282 ctxt = data;
283 if (n <= 0 || n > PAM_MAX_NUM_MSG)
284 return (PAM_CONV_ERR);
0a23d79f 285
286 if ((reply = malloc(n * sizeof(*reply))) == NULL)
287 return (PAM_CONV_ERR);
288 memset(reply, 0, n * sizeof(*reply));
289
05114c74 290 buffer_init(&buffer);
291 for (i = 0; i < n; ++i) {
05114c74 292 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
293 case PAM_PROMPT_ECHO_OFF:
aff51935 294 buffer_put_cstring(&buffer,
0a23d79f 295 PAM_MSG_MEMBER(msg, i, msg));
aff51935 296 if (ssh_msg_send(ctxt->pam_csock,
7b2a0de3 297 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
298 goto fail;
aff51935 299 if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
7b2a0de3 300 goto fail;
05114c74 301 if (buffer_get_char(&buffer) != PAM_AUTHTOK)
302 goto fail;
0a23d79f 303 reply[i].resp = buffer_get_string(&buffer, NULL);
05114c74 304 break;
305 case PAM_PROMPT_ECHO_ON:
aff51935 306 buffer_put_cstring(&buffer,
0a23d79f 307 PAM_MSG_MEMBER(msg, i, msg));
aff51935 308 if (ssh_msg_send(ctxt->pam_csock,
7b2a0de3 309 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
310 goto fail;
311 if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
312 goto fail;
05114c74 313 if (buffer_get_char(&buffer) != PAM_AUTHTOK)
314 goto fail;
0a23d79f 315 reply[i].resp = buffer_get_string(&buffer, NULL);
05114c74 316 break;
317 case PAM_ERROR_MSG:
aff51935 318 buffer_put_cstring(&buffer,
0a23d79f 319 PAM_MSG_MEMBER(msg, i, msg));
aff51935 320 if (ssh_msg_send(ctxt->pam_csock,
7b2a0de3 321 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
322 goto fail;
05114c74 323 break;
324 case PAM_TEXT_INFO:
aff51935 325 buffer_put_cstring(&buffer,
0a23d79f 326 PAM_MSG_MEMBER(msg, i, msg));
aff51935 327 if (ssh_msg_send(ctxt->pam_csock,
7b2a0de3 328 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
329 goto fail;
05114c74 330 break;
331 default:
332 goto fail;
a5c9cd31 333 }
05114c74 334 buffer_clear(&buffer);
a5c9cd31 335 }
05114c74 336 buffer_free(&buffer);
0a23d79f 337 *resp = reply;
05114c74 338 return (PAM_SUCCESS);
0a23d79f 339
05114c74 340 fail:
0a23d79f 341 for(i = 0; i < n; i++) {
342 if (reply[i].resp != NULL)
343 xfree(reply[i].resp);
344 }
345 xfree(reply);
05114c74 346 buffer_free(&buffer);
347 return (PAM_CONV_ERR);
348}
a5c9cd31 349
05114c74 350/*
351 * Authentication thread.
352 */
353static void *
354sshpam_thread(void *ctxtp)
355{
356 struct pam_ctxt *ctxt = ctxtp;
357 Buffer buffer;
c53917a9 358 struct pam_conv sshpam_conv;
e4472e7e 359 int flags = (options.permit_empty_passwd == 0 ?
360 PAM_DISALLOW_NULL_AUTHTOK : 0);
05114c74 361#ifndef USE_POSIX_THREADS
2212fc98 362 extern char **environ;
363 char **env_from_pam;
364 u_int i;
05114c74 365 const char *pam_user;
366
0943f13c 367 pam_get_item(sshpam_handle, PAM_USER, (void **)&pam_user);
05114c74 368 setproctitle("%s [pam]", pam_user);
2212fc98 369 environ[0] = NULL;
05114c74 370#endif
a5c9cd31 371
c53917a9 372 sshpam_conv.conv = sshpam_thread_conv;
373 sshpam_conv.appdata_ptr = ctxt;
374
d948154a 375 if (sshpam_authctxt == NULL)
529d73ab 376 fatal("%s: PAM authctxt not initialized", __func__);
377
05114c74 378 buffer_init(&buffer);
379 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
380 (const void *)&sshpam_conv);
381 if (sshpam_err != PAM_SUCCESS)
382 goto auth_fail;
e4472e7e 383 sshpam_err = pam_authenticate(sshpam_handle, flags);
05114c74 384 if (sshpam_err != PAM_SUCCESS)
385 goto auth_fail;
b3ef7fb7 386
2935db92 387 if (compat20) {
b3ef7fb7 388 if (!do_pam_account())
389 goto auth_fail;
d948154a 390 if (sshpam_authctxt->force_pwchange) {
b3ef7fb7 391 sshpam_err = pam_chauthtok(sshpam_handle,
392 PAM_CHANGE_EXPIRED_AUTHTOK);
393 if (sshpam_err != PAM_SUCCESS)
394 goto auth_fail;
c10bb2ce 395 sshpam_password_change_required(0);
b3ef7fb7 396 }
2935db92 397 }
b3ef7fb7 398
05114c74 399 buffer_put_cstring(&buffer, "OK");
2212fc98 400
401#ifndef USE_POSIX_THREADS
b3ef7fb7 402 /* Export variables set by do_pam_account */
403 buffer_put_int(&buffer, sshpam_account_status);
d948154a 404 buffer_put_int(&buffer, sshpam_authctxt->force_pwchange);
b3ef7fb7 405
2212fc98 406 /* Export any environment strings set in child */
407 for(i = 0; environ[i] != NULL; i++)
408 ; /* Count */
409 buffer_put_int(&buffer, i);
410 for(i = 0; environ[i] != NULL; i++)
411 buffer_put_cstring(&buffer, environ[i]);
412
413 /* Export any environment strings set by PAM in child */
414 env_from_pam = pam_getenvlist(sshpam_handle);
415 for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
416 ; /* Count */
417 buffer_put_int(&buffer, i);
418 for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
419 buffer_put_cstring(&buffer, env_from_pam[i]);
420#endif /* USE_POSIX_THREADS */
421
7b2a0de3 422 /* XXX - can't do much about an error here */
05114c74 423 ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
424 buffer_free(&buffer);
425 pthread_exit(NULL);
426
427 auth_fail:
428 buffer_put_cstring(&buffer,
429 pam_strerror(sshpam_handle, sshpam_err));
7b2a0de3 430 /* XXX - can't do much about an error here */
05114c74 431 ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
432 buffer_free(&buffer);
433 pthread_exit(NULL);
b6453d99 434
05114c74 435 return (NULL); /* Avoid warning for non-pthread case */
a5c9cd31 436}
437
c6630044 438void
439sshpam_thread_cleanup(void)
a5c9cd31 440{
c6630044 441 struct pam_ctxt *ctxt = cleanup_ctxt;
442
90f3c272 443 debug3("PAM: %s entering", __func__);
c6630044 444 if (ctxt != NULL && ctxt->pam_thread != 0) {
445 pthread_cancel(ctxt->pam_thread);
446 pthread_join(ctxt->pam_thread, NULL);
447 close(ctxt->pam_psock);
448 close(ctxt->pam_csock);
449 memset(ctxt, 0, sizeof(*ctxt));
450 cleanup_ctxt = NULL;
451 }
05114c74 452}
a5c9cd31 453
05114c74 454static int
0943f13c 455sshpam_null_conv(int n, struct pam_message **msg,
5b9e2464 456 struct pam_response **resp, void *data)
05114c74 457{
60922169 458 debug3("PAM: %s entering, %d messages", __func__, n);
05114c74 459 return (PAM_CONV_ERR);
460}
a5c9cd31 461
05114c74 462static struct pam_conv null_conv = { sshpam_null_conv, NULL };
463
c6630044 464void
465sshpam_cleanup(void)
05114c74 466{
05114c74 467 debug("PAM: cleanup");
0a23d79f 468 if (sshpam_handle == NULL)
469 return;
05114c74 470 pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
471 if (sshpam_cred_established) {
472 pam_setcred(sshpam_handle, PAM_DELETE_CRED);
473 sshpam_cred_established = 0;
474 }
475 if (sshpam_session_open) {
476 pam_close_session(sshpam_handle, PAM_SILENT);
477 sshpam_session_open = 0;
a5c9cd31 478 }
dd1fb864 479 sshpam_authenticated = 0;
05114c74 480 pam_end(sshpam_handle, sshpam_err);
481 sshpam_handle = NULL;
a5c9cd31 482}
483
05114c74 484static int
529d73ab 485sshpam_init(Authctxt *authctxt)
a5c9cd31 486{
74678fb9 487 extern char *__progname;
529d73ab 488 const char *pam_rhost, *pam_user, *user = authctxt->user;
05114c74 489
490 if (sshpam_handle != NULL) {
491 /* We already have a PAM context; check if the user matches */
492 sshpam_err = pam_get_item(sshpam_handle,
0943f13c 493 PAM_USER, (void **)&pam_user);
05114c74 494 if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0)
495 return (0);
05114c74 496 pam_end(sshpam_handle, sshpam_err);
497 sshpam_handle = NULL;
498 }
499 debug("PAM: initializing for \"%s\"", user);
01224183 500 sshpam_err =
501 pam_start(SSHD_PAM_SERVICE, user, &null_conv, &sshpam_handle);
d948154a 502 sshpam_authctxt = authctxt;
529d73ab 503
5ff453c0 504 if (sshpam_err != PAM_SUCCESS) {
505 pam_end(sshpam_handle, sshpam_err);
506 sshpam_handle = NULL;
05114c74 507 return (-1);
5ff453c0 508 }
c5a7d788 509 pam_rhost = get_remote_name_or_ip(utmp_len, options.use_dns);
05d62329 510 debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
05114c74 511 sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
5ff453c0 512 if (sshpam_err != PAM_SUCCESS) {
5b9e2464 513 pam_end(sshpam_handle, sshpam_err);
5ff453c0 514 sshpam_handle = NULL;
515 return (-1);
516 }
517#ifdef PAM_TTY_KLUDGE
aff51935 518 /*
519 * Some silly PAM modules (e.g. pam_time) require a TTY to operate.
520 * sshd doesn't set the tty until too late in the auth process and
5ff453c0 521 * may not even set one (for tty-less connections)
aff51935 522 */
5ff453c0 523 debug("PAM: setting PAM_TTY to \"ssh\"");
524 sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, "ssh");
05114c74 525 if (sshpam_err != PAM_SUCCESS) {
526 pam_end(sshpam_handle, sshpam_err);
527 sshpam_handle = NULL;
528 return (-1);
a5c9cd31 529 }
5ff453c0 530#endif
05114c74 531 return (0);
a5c9cd31 532}
533
05114c74 534static void *
535sshpam_init_ctx(Authctxt *authctxt)
a5c9cd31 536{
05114c74 537 struct pam_ctxt *ctxt;
538 int socks[2];
2b87da3b 539
90f3c272 540 debug3("PAM: %s entering", __func__);
7fceb20d 541 /* Refuse to start if we don't have PAM enabled */
542 if (!options.use_pam)
543 return NULL;
544
05114c74 545 /* Initialize PAM */
529d73ab 546 if (sshpam_init(authctxt) == -1) {
05114c74 547 error("PAM: initialization failed");
548 return (NULL);
549 }
5c377b3b 550
05114c74 551 ctxt = xmalloc(sizeof *ctxt);
c6630044 552 memset(ctxt, 0, sizeof(*ctxt));
05114c74 553
554 /* Start the authentication thread */
555 if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
556 error("PAM: failed create sockets: %s", strerror(errno));
557 xfree(ctxt);
558 return (NULL);
559 }
560 ctxt->pam_psock = socks[0];
561 ctxt->pam_csock = socks[1];
562 if (pthread_create(&ctxt->pam_thread, NULL, sshpam_thread, ctxt) == -1) {
563 error("PAM: failed to start authentication thread: %s",
564 strerror(errno));
565 close(socks[0]);
566 close(socks[1]);
567 xfree(ctxt);
568 return (NULL);
a5c9cd31 569 }
c6630044 570 cleanup_ctxt = ctxt;
05114c74 571 return (ctxt);
572}
a5c9cd31 573
05114c74 574static int
575sshpam_query(void *ctx, char **name, char **info,
576 u_int *num, char ***prompts, u_int **echo_on)
577{
578 Buffer buffer;
579 struct pam_ctxt *ctxt = ctx;
580 size_t plen;
581 u_char type;
582 char *msg;
cbdeccf3 583 size_t len;
05114c74 584
90f3c272 585 debug3("PAM: %s entering", __func__);
05114c74 586 buffer_init(&buffer);
587 *name = xstrdup("");
588 *info = xstrdup("");
589 *prompts = xmalloc(sizeof(char *));
590 **prompts = NULL;
591 plen = 0;
592 *echo_on = xmalloc(sizeof(u_int));
593 while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) {
594 type = buffer_get_char(&buffer);
595 msg = buffer_get_string(&buffer, NULL);
596 switch (type) {
597 case PAM_PROMPT_ECHO_ON:
598 case PAM_PROMPT_ECHO_OFF:
599 *num = 1;
cbdeccf3 600 len = plen + strlen(msg) + 1;
601 **prompts = xrealloc(**prompts, len);
602 plen += snprintf(**prompts + plen, len, "%s", msg);
05114c74 603 **echo_on = (type == PAM_PROMPT_ECHO_ON);
604 xfree(msg);
605 return (0);
606 case PAM_ERROR_MSG:
607 case PAM_TEXT_INFO:
608 /* accumulate messages */
4f1b45b4 609 len = plen + strlen(msg) + 2;
cbdeccf3 610 **prompts = xrealloc(**prompts, len);
4f1b45b4 611 plen += snprintf(**prompts + plen, len, "%s\n", msg);
05114c74 612 xfree(msg);
5daf7064 613 break;
05114c74 614 case PAM_SUCCESS:
615 case PAM_AUTH_ERR:
616 if (**prompts != NULL) {
617 /* drain any accumulated messages */
3eaf3960 618 debug("PAM: %s", **prompts);
619 buffer_append(&loginmsg, **prompts,
620 strlen(**prompts));
05114c74 621 xfree(**prompts);
622 **prompts = NULL;
623 }
624 if (type == PAM_SUCCESS) {
2212fc98 625 import_environments(&buffer);
05114c74 626 *num = 0;
627 **echo_on = 0;
628 ctxt->pam_done = 1;
629 xfree(msg);
630 return (0);
631 }
1e08e787 632 error("PAM: %s for %s%.100s from %.100s", msg,
633 sshpam_authctxt->valid ? "" : "illegal user ",
634 sshpam_authctxt->user,
635 get_remote_name_or_ip(utmp_len, options.use_dns));
e250770b 636 /* FALLTHROUGH */
5daf7064 637 default:
05114c74 638 *num = 0;
639 **echo_on = 0;
640 xfree(msg);
641 ctxt->pam_done = -1;
642 return (-1);
643 }
a5c9cd31 644 }
05114c74 645 return (-1);
a5c9cd31 646}
647
05114c74 648/* XXX - see also comment in auth-chall.c:verify_response */
649static int
650sshpam_respond(void *ctx, u_int num, char **resp)
a5c9cd31 651{
05114c74 652 Buffer buffer;
653 struct pam_ctxt *ctxt = ctx;
654
90f3c272 655 debug2("PAM: %s entering, %d responses", __func__, num);
05114c74 656 switch (ctxt->pam_done) {
657 case 1:
658 sshpam_authenticated = 1;
659 return (0);
660 case 0:
661 break;
662 default:
663 return (-1);
a5c9cd31 664 }
05114c74 665 if (num != 1) {
666 error("PAM: expected one response, got %u", num);
667 return (-1);
668 }
669 buffer_init(&buffer);
670 buffer_put_cstring(&buffer, *resp);
7b2a0de3 671 if (ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer) == -1) {
672 buffer_free(&buffer);
673 return (-1);
674 }
05114c74 675 buffer_free(&buffer);
676 return (1);
a5c9cd31 677}
678
05114c74 679static void
680sshpam_free_ctx(void *ctxtp)
a5c9cd31 681{
05114c74 682 struct pam_ctxt *ctxt = ctxtp;
39ce53de 683
90f3c272 684 debug3("PAM: %s entering", __func__);
c6630044 685 sshpam_thread_cleanup();
05114c74 686 xfree(ctxt);
687 /*
688 * We don't call sshpam_cleanup() here because we may need the PAM
689 * handle at a later stage, e.g. when setting up a session. It's
690 * still on the cleanup list, so pam_end() *will* be called before
691 * the server process terminates.
692 */
ad55cd03 693}
694
05114c74 695KbdintDevice sshpam_device = {
696 "pam",
697 sshpam_init_ctx,
698 sshpam_query,
699 sshpam_respond,
700 sshpam_free_ctx
701};
702
703KbdintDevice mm_sshpam_device = {
704 "pam",
705 mm_sshpam_init_ctx,
706 mm_sshpam_query,
707 mm_sshpam_respond,
708 mm_sshpam_free_ctx
709};
2919e060 710
2b87da3b 711/*
05114c74 712 * This replaces auth-pam.c
ad55cd03 713 */
05114c74 714void
529d73ab 715start_pam(Authctxt *authctxt)
ad55cd03 716{
817e6d38 717 if (!options.use_pam)
718 fatal("PAM: initialisation requested when UsePAM=no");
719
529d73ab 720 if (sshpam_init(authctxt) == -1)
05114c74 721 fatal("PAM: initialisation failed");
a5c9cd31 722}
723
05114c74 724void
725finish_pam(void)
a5c9cd31 726{
c6630044 727 sshpam_cleanup();
a5c9cd31 728}
729
5b9e2464 730u_int
731do_pam_account(void)
a5c9cd31 732{
b3ef7fb7 733 if (sshpam_account_status != -1)
734 return (sshpam_account_status);
735
5b9e2464 736 sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
90f3c272 737 debug3("PAM: %s pam_acct_mgmt = %d", __func__, sshpam_err);
b3ef7fb7 738
739 if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
740 sshpam_account_status = 0;
741 return (sshpam_account_status);
5b9e2464 742 }
743
b3ef7fb7 744 if (sshpam_err == PAM_NEW_AUTHTOK_REQD)
c10bb2ce 745 sshpam_password_change_required(1);
b3ef7fb7 746
747 sshpam_account_status = 1;
748 return (sshpam_account_status);
05114c74 749}
46c76c63 750
49e82bb9 751void
752do_pam_set_tty(const char *tty)
753{
26b3608b 754 if (tty != NULL) {
755 debug("PAM: setting PAM_TTY to \"%s\"", tty);
756 sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, tty);
757 if (sshpam_err != PAM_SUCCESS)
758 fatal("PAM: failed to set PAM_TTY: %s",
759 pam_strerror(sshpam_handle, sshpam_err));
760 }
05114c74 761}
cbd7492e 762
05114c74 763void
764do_pam_setcred(int init)
765{
766 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
767 (const void *)&null_conv);
768 if (sshpam_err != PAM_SUCCESS)
769 fatal("PAM: failed to set PAM_CONV: %s",
770 pam_strerror(sshpam_handle, sshpam_err));
771 if (init) {
772 debug("PAM: establishing credentials");
773 sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED);
774 } else {
775 debug("PAM: reinitializing credentials");
776 sshpam_err = pam_setcred(sshpam_handle, PAM_REINITIALIZE_CRED);
777 }
778 if (sshpam_err == PAM_SUCCESS) {
779 sshpam_cred_established = 1;
780 return;
781 }
782 if (sshpam_authenticated)
783 fatal("PAM: pam_setcred(): %s",
784 pam_strerror(sshpam_handle, sshpam_err));
785 else
786 debug("PAM: pam_setcred(): %s",
787 pam_strerror(sshpam_handle, sshpam_err));
a5c9cd31 788}
789
05114c74 790static int
0943f13c 791sshpam_tty_conv(int n, struct pam_message **msg,
5b9e2464 792 struct pam_response **resp, void *data)
ee48c949 793{
05114c74 794 char input[PAM_MAX_MSG_SIZE];
0a23d79f 795 struct pam_response *reply;
ee48c949 796 int i;
797
60922169 798 debug3("PAM: %s called with %d messages", __func__, n);
799
0a23d79f 800 *resp = NULL;
801
3eaf3960 802 if (n <= 0 || n > PAM_MAX_NUM_MSG || !isatty(STDIN_FILENO))
05114c74 803 return (PAM_CONV_ERR);
0a23d79f 804
805 if ((reply = malloc(n * sizeof(*reply))) == NULL)
806 return (PAM_CONV_ERR);
807 memset(reply, 0, n * sizeof(*reply));
808
05114c74 809 for (i = 0; i < n; ++i) {
810 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
811 case PAM_PROMPT_ECHO_OFF:
0a23d79f 812 reply[i].resp =
aff51935 813 read_passphrase(PAM_MSG_MEMBER(msg, i, msg),
05114c74 814 RP_ALLOW_STDIN);
0a23d79f 815 reply[i].resp_retcode = PAM_SUCCESS;
05114c74 816 break;
817 case PAM_PROMPT_ECHO_ON:
74117b26 818 fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
05114c74 819 fgets(input, sizeof input, stdin);
8936b151 820 if ((reply[i].resp = strdup(input)) == NULL)
821 goto fail;
0a23d79f 822 reply[i].resp_retcode = PAM_SUCCESS;
05114c74 823 break;
824 case PAM_ERROR_MSG:
825 case PAM_TEXT_INFO:
74117b26 826 fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
0a23d79f 827 reply[i].resp_retcode = PAM_SUCCESS;
05114c74 828 break;
829 default:
830 goto fail;
831 }
ee48c949 832 }
0a23d79f 833 *resp = reply;
05114c74 834 return (PAM_SUCCESS);
0a23d79f 835
05114c74 836 fail:
0a23d79f 837 for(i = 0; i < n; i++) {
838 if (reply[i].resp != NULL)
839 xfree(reply[i].resp);
840 }
841 xfree(reply);
05114c74 842 return (PAM_CONV_ERR);
ee48c949 843}
844
8600a4ab 845static struct pam_conv tty_conv = { sshpam_tty_conv, NULL };
3eaf3960 846
05114c74 847/*
848 * XXX this should be done in the authentication phase, but ssh1 doesn't
849 * support that
850 */
851void
852do_pam_chauthtok(void)
a5c9cd31 853{
05114c74 854 if (use_privsep)
5b9e2464 855 fatal("Password expired (unable to change with privsep)");
05114c74 856 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
3eaf3960 857 (const void *)&tty_conv);
05114c74 858 if (sshpam_err != PAM_SUCCESS)
859 fatal("PAM: failed to set PAM_CONV: %s",
860 pam_strerror(sshpam_handle, sshpam_err));
861 debug("PAM: changing password");
862 sshpam_err = pam_chauthtok(sshpam_handle, PAM_CHANGE_EXPIRED_AUTHTOK);
863 if (sshpam_err != PAM_SUCCESS)
864 fatal("PAM: pam_chauthtok(): %s",
865 pam_strerror(sshpam_handle, sshpam_err));
5daf7064 866}
867
ef687c66 868static int
0943f13c 869sshpam_store_conv(int n, struct pam_message **msg,
ef687c66 870 struct pam_response **resp, void *data)
871{
872 struct pam_response *reply;
873 int i;
874 size_t len;
875
876 debug3("PAM: %s called with %d messages", __func__, n);
877 *resp = NULL;
878
879 if (n <= 0 || n > PAM_MAX_NUM_MSG)
880 return (PAM_CONV_ERR);
881
882 if ((reply = malloc(n * sizeof(*reply))) == NULL)
883 return (PAM_CONV_ERR);
884 memset(reply, 0, n * sizeof(*reply));
885
886 for (i = 0; i < n; ++i) {
887 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
888 case PAM_ERROR_MSG:
889 case PAM_TEXT_INFO:
890 len = strlen(PAM_MSG_MEMBER(msg, i, msg));
891 buffer_append(&loginmsg, PAM_MSG_MEMBER(msg, i, msg), len);
892 buffer_append(&loginmsg, "\n", 1 );
893 reply[i].resp_retcode = PAM_SUCCESS;
894 break;
895 default:
896 goto fail;
897 }
898 }
899 *resp = reply;
900 return (PAM_SUCCESS);
901
902 fail:
903 for(i = 0; i < n; i++) {
904 if (reply[i].resp != NULL)
905 xfree(reply[i].resp);
906 }
907 xfree(reply);
908 return (PAM_CONV_ERR);
909}
910
8600a4ab 911static struct pam_conv store_conv = { sshpam_store_conv, NULL };
ef687c66 912
3eaf3960 913void
914do_pam_session(void)
915{
dd1fb864 916 debug3("PAM: opening session");
aff51935 917 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
ef687c66 918 (const void *)&store_conv);
3eaf3960 919 if (sshpam_err != PAM_SUCCESS)
920 fatal("PAM: failed to set PAM_CONV: %s",
921 pam_strerror(sshpam_handle, sshpam_err));
922 sshpam_err = pam_open_session(sshpam_handle, 0);
923 if (sshpam_err != PAM_SUCCESS)
924 fatal("PAM: pam_open_session(): %s",
925 pam_strerror(sshpam_handle, sshpam_err));
926 sshpam_session_open = 1;
927}
928
aff51935 929/*
749560dd 930 * Set a PAM environment string. We need to do this so that the session
931 * modules can handle things like Kerberos/GSI credentials that appear
932 * during the ssh authentication process.
933 */
749560dd 934int
aff51935 935do_pam_putenv(char *name, char *value)
749560dd 936{
749560dd 937 int ret = 1;
b6453d99 938#ifdef HAVE_PAM_PUTENV
263c65df 939 char *compound;
940 size_t len;
941
942 len = strlen(name) + strlen(value) + 2;
943 compound = xmalloc(len);
944
945 snprintf(compound, len, "%s=%s", name, value);
946 ret = pam_putenv(sshpam_handle, compound);
947 xfree(compound);
749560dd 948#endif
263c65df 949
749560dd 950 return (ret);
951}
952
2212fc98 953char **
954fetch_pam_child_environment(void)
955{
956 return sshpam_env;
957}
958
05114c74 959char **
960fetch_pam_environment(void)
961{
05114c74 962 return (pam_getenvlist(sshpam_handle));
05114c74 963}
5c377b3b 964
05114c74 965void
966free_pam_environment(char **env)
967{
968 char **envp;
5daf7064 969
0eb6370a 970 if (env == NULL)
971 return;
972
05114c74 973 for (envp = env; *envp; envp++)
974 xfree(*envp);
975 xfree(env);
a5c9cd31 976}
977
5de92f17 978/*
979 * "Blind" conversation function for password authentication. Assumes that
980 * echo-off prompts are for the password and stores messages for later
981 * display.
982 */
983static int
0943f13c 984sshpam_passwd_conv(int n, struct pam_message **msg,
5de92f17 985 struct pam_response **resp, void *data)
986{
987 struct pam_response *reply;
988 int i;
989 size_t len;
990
991 debug3("PAM: %s called with %d messages", __func__, n);
992
993 *resp = NULL;
994
995 if (n <= 0 || n > PAM_MAX_NUM_MSG)
996 return (PAM_CONV_ERR);
997
998 if ((reply = malloc(n * sizeof(*reply))) == NULL)
999 return (PAM_CONV_ERR);
1000 memset(reply, 0, n * sizeof(*reply));
1001
1002 for (i = 0; i < n; ++i) {
1003 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
1004 case PAM_PROMPT_ECHO_OFF:
1005 if (sshpam_password == NULL)
1006 goto fail;
8936b151 1007 if ((reply[i].resp = strdup(sshpam_password)) == NULL)
1008 goto fail;
5de92f17 1009 reply[i].resp_retcode = PAM_SUCCESS;
1010 break;
1011 case PAM_ERROR_MSG:
1012 case PAM_TEXT_INFO:
1013 len = strlen(PAM_MSG_MEMBER(msg, i, msg));
1014 if (len > 0) {
1015 buffer_append(&loginmsg,
1016 PAM_MSG_MEMBER(msg, i, msg), len);
1017 buffer_append(&loginmsg, "\n", 1);
1018 }
8936b151 1019 if ((reply[i].resp = strdup("")) == NULL)
1020 goto fail;
5de92f17 1021 reply[i].resp_retcode = PAM_SUCCESS;
1022 break;
1023 default:
1024 goto fail;
1025 }
1026 }
1027 *resp = reply;
1028 return (PAM_SUCCESS);
1029
1030 fail:
1031 for(i = 0; i < n; i++) {
1032 if (reply[i].resp != NULL)
1033 xfree(reply[i].resp);
1034 }
1035 xfree(reply);
1036 return (PAM_CONV_ERR);
1037}
1038
1039static struct pam_conv passwd_conv = { sshpam_passwd_conv, NULL };
1040
1041/*
1042 * Attempt password authentication via PAM
1043 */
1044int
1045sshpam_auth_passwd(Authctxt *authctxt, const char *password)
1046{
1047 int flags = (options.permit_empty_passwd == 0 ?
1048 PAM_DISALLOW_NULL_AUTHTOK : 0);
0e716148 1049 static char badpw[] = "\b\n\r\177INCORRECT";
5de92f17 1050
1051 if (!options.use_pam || sshpam_handle == NULL)
1052 fatal("PAM: %s called when PAM disabled or failed to "
1053 "initialise.", __func__);
1054
1055 sshpam_password = password;
1056 sshpam_authctxt = authctxt;
1057
0e716148 1058 /*
1059 * If the user logging in is invalid, or is root but is not permitted
1060 * by PermitRootLogin, use an invalid password to prevent leaking
1061 * information via timing (eg if the PAM config has a delay on fail).
1062 */
1063 if (!authctxt->valid || (authctxt->pw->pw_uid == 0 &&
1064 options.permit_root_login != PERMIT_YES))
1065 sshpam_password = badpw;
1066
5de92f17 1067 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
1068 (const void *)&passwd_conv);
1069 if (sshpam_err != PAM_SUCCESS)
1070 fatal("PAM: %s: failed to set PAM_CONV: %s", __func__,
1071 pam_strerror(sshpam_handle, sshpam_err));
1072
1073 sshpam_err = pam_authenticate(sshpam_handle, flags);
1074 sshpam_password = NULL;
1075 if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
1076 debug("PAM: password authentication accepted for %.100s",
1077 authctxt->user);
1078 return 1;
1079 } else {
1080 debug("PAM: password authentication failed for %.100s: %s",
1081 authctxt->valid ? authctxt->user : "an illegal user",
1082 pam_strerror(sshpam_handle, sshpam_err));
1083 return 0;
1084 }
1085}
a5c9cd31 1086#endif /* USE_PAM */
This page took 0.347591 seconds and 5 git commands to generate.