]>
Commit | Line | Data |
---|---|---|
7368a6c8 | 1 | /* |
2 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | |
3 | * All rights reserved | |
e78a59f5 | 4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
7368a6c8 | 5 | */ |
6 | ||
7 | #include "includes.h" | |
301e9b01 | 8 | RCSID("$OpenBSD: auth.c,v 1.7 2000/05/17 21:37:24 deraadt Exp $"); |
7368a6c8 | 9 | |
10 | #include "xmalloc.h" | |
11 | #include "rsa.h" | |
12 | #include "ssh.h" | |
13 | #include "pty.h" | |
14 | #include "packet.h" | |
15 | #include "buffer.h" | |
16 | #include "cipher.h" | |
17 | #include "mpaux.h" | |
18 | #include "servconf.h" | |
e78a59f5 | 19 | #include "compat.h" |
7368a6c8 | 20 | #include "channels.h" |
21 | #include "match.h" | |
c1ef8333 | 22 | #ifdef HAVE_LOGIN_H |
23 | #include <login.h> | |
24 | #endif | |
4cb5ffa0 | 25 | #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) |
26 | #include <shadow.h> | |
27 | #endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */ | |
7368a6c8 | 28 | |
e78a59f5 | 29 | #include "bufaux.h" |
30 | #include "ssh2.h" | |
31 | #include "auth.h" | |
7368a6c8 | 32 | #include "session.h" |
33 | #include "dispatch.h" | |
34 | ||
e78a59f5 | 35 | |
7368a6c8 | 36 | /* import */ |
37 | extern ServerOptions options; | |
38 | extern char *forced_command; | |
39 | ||
40 | /* | |
41 | * Check if the user is allowed to log in via ssh. If user is listed in | |
42 | * DenyUsers or user's primary group is listed in DenyGroups, false will | |
43 | * be returned. If AllowUsers isn't empty and user isn't listed there, or | |
44 | * if AllowGroups isn't empty and user isn't listed there, false will be | |
6ae2364d | 45 | * returned. |
7368a6c8 | 46 | * If the user's shell is not executable, false will be returned. |
6ae2364d | 47 | * Otherwise true is returned. |
7368a6c8 | 48 | */ |
a306f2dd | 49 | int |
7368a6c8 | 50 | allowed_user(struct passwd * pw) |
51 | { | |
52 | struct stat st; | |
53 | struct group *grp; | |
301e9b01 | 54 | char *shell; |
7368a6c8 | 55 | int i; |
56 | #ifdef WITH_AIXAUTHENTICATE | |
57 | char *loginmsg; | |
58 | #endif /* WITH_AIXAUTHENTICATE */ | |
4cb5ffa0 | 59 | #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) && \ |
60 | defined(HAS_SHADOW_EXPIRE) | |
61 | struct spwd *spw; | |
7368a6c8 | 62 | |
63 | /* Shouldn't be called if pw is NULL, but better safe than sorry... */ | |
64 | if (!pw) | |
65 | return 0; | |
66 | ||
4cb5ffa0 | 67 | spw = getspnam(pw->pw_name); |
68 | if (spw == NULL) | |
69 | return 0; | |
70 | ||
71 | /* Check account expiry */ | |
72 | if ((spw->sp_expire > 0) && ((time(NULL) / 86400) > spw->sp_expire)) | |
73 | return 0; | |
74 | ||
75 | /* Check password expiry */ | |
76 | if ((spw->sp_lstchg > 0) && (spw->sp_inact > 0) && | |
77 | ((time(NULL) / 86400) > (spw->sp_lstchg + spw->sp_inact))) | |
78 | return 0; | |
79 | #else | |
80 | /* Shouldn't be called if pw is NULL, but better safe than sorry... */ | |
81 | if (!pw) | |
82 | return 0; | |
83 | #endif | |
84 | ||
301e9b01 | 85 | /* |
86 | * Get the shell from the password data. An empty shell field is | |
87 | * legal, and means /bin/sh. | |
88 | */ | |
89 | shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell; | |
90 | ||
91 | /* deny if shell does not exists or is not executable */ | |
92 | if (stat(shell, &st) != 0) | |
7368a6c8 | 93 | return 0; |
94 | if (!((st.st_mode & S_IFREG) && (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)))) | |
95 | return 0; | |
96 | ||
97 | /* Return false if user is listed in DenyUsers */ | |
98 | if (options.num_deny_users > 0) { | |
99 | if (!pw->pw_name) | |
100 | return 0; | |
101 | for (i = 0; i < options.num_deny_users; i++) | |
102 | if (match_pattern(pw->pw_name, options.deny_users[i])) | |
103 | return 0; | |
104 | } | |
105 | /* Return false if AllowUsers isn't empty and user isn't listed there */ | |
106 | if (options.num_allow_users > 0) { | |
107 | if (!pw->pw_name) | |
108 | return 0; | |
109 | for (i = 0; i < options.num_allow_users; i++) | |
110 | if (match_pattern(pw->pw_name, options.allow_users[i])) | |
111 | break; | |
112 | /* i < options.num_allow_users iff we break for loop */ | |
113 | if (i >= options.num_allow_users) | |
114 | return 0; | |
115 | } | |
116 | /* Get the primary group name if we need it. Return false if it fails */ | |
117 | if (options.num_deny_groups > 0 || options.num_allow_groups > 0) { | |
118 | grp = getgrgid(pw->pw_gid); | |
119 | if (!grp) | |
120 | return 0; | |
121 | ||
122 | /* Return false if user's group is listed in DenyGroups */ | |
123 | if (options.num_deny_groups > 0) { | |
124 | if (!grp->gr_name) | |
125 | return 0; | |
126 | for (i = 0; i < options.num_deny_groups; i++) | |
127 | if (match_pattern(grp->gr_name, options.deny_groups[i])) | |
128 | return 0; | |
129 | } | |
130 | /* | |
131 | * Return false if AllowGroups isn't empty and user's group | |
132 | * isn't listed there | |
133 | */ | |
134 | if (options.num_allow_groups > 0) { | |
135 | if (!grp->gr_name) | |
136 | return 0; | |
137 | for (i = 0; i < options.num_allow_groups; i++) | |
138 | if (match_pattern(grp->gr_name, options.allow_groups[i])) | |
139 | break; | |
140 | /* i < options.num_allow_groups iff we break for | |
141 | loop */ | |
142 | if (i >= options.num_allow_groups) | |
143 | return 0; | |
144 | } | |
145 | } | |
146 | ||
147 | #ifdef WITH_AIXAUTHENTICATE | |
5daf7064 | 148 | if (loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) { |
c1ef8333 | 149 | if (loginmsg && *loginmsg) { |
150 | /* Remove embedded newlines (if any) */ | |
151 | char *p; | |
5daf7064 | 152 | for (p = loginmsg; *p; p++) { |
c1ef8333 | 153 | if (*p == '\n') |
154 | *p = ' '; | |
5daf7064 | 155 | } |
c1ef8333 | 156 | /* Remove trailing newline */ |
157 | *--p = '\0'; | |
5daf7064 | 158 | log("Login restricted for %s: %.100s", pw->pw_name, loginmsg); |
c1ef8333 | 159 | } |
7368a6c8 | 160 | return 0; |
c1ef8333 | 161 | } |
7368a6c8 | 162 | #endif /* WITH_AIXAUTHENTICATE */ |
163 | ||
164 | /* We found no reason not to let this user try to log on... */ | |
165 | return 1; | |
166 | } |