[openssh.git] / auth-krb5.c

/*
 *    Kerberos v5 authentication and ticket-passing routines.
 *
 * $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
 */
/*
 * Copyright (c) 2002 Daniel Kouril.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"
RCSID("$OpenBSD: auth-krb5.c,v 1.15 2003/11/21 11:57:02 djm Exp $");

#include "ssh.h"
#include "ssh1.h"
#include "packet.h"
#include "xmalloc.h"
#include "log.h"
#include "servconf.h"
#include "uidswap.h"
#include "auth.h"

#ifdef KRB5
#include <krb5.h>

extern ServerOptions	 options;

static int
krb5_init(void *context)
{
	Authctxt *authctxt = (Authctxt *)context;
	krb5_error_code problem;

	if (authctxt->krb5_ctx == NULL) {
		problem = krb5_init_context(&authctxt->krb5_ctx);
		if (problem)
			return (problem);
#ifdef KRB5_INIT_ETS
		krb5_init_ets(authctxt->krb5_ctx);
#endif
	}
	return (0);
}

int
auth_krb5_password(Authctxt *authctxt, const char *password)
{
#ifndef HEIMDAL
	krb5_creds creds;
	krb5_principal server;
#endif
	krb5_error_code problem;
	krb5_ccache ccache = NULL;
	int len;

	if (!authctxt->valid)
		return (0);

	temporarily_use_uid(authctxt->pw);

	problem = krb5_init(authctxt);
	if (problem)
		goto out;

	problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
		    &authctxt->krb5_user);
	if (problem)
		goto out;

#ifdef HEIMDAL
	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops, &ccache);
	if (problem)
		goto out;

	problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
		authctxt->krb5_user);
	if (problem)
		goto out;

	restore_uid();

	problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
	    ccache, password, 1, NULL);

	temporarily_use_uid(authctxt->pw);

	if (problem)
		goto out;

	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops,
	    &authctxt->krb5_fwd_ccache);
	if (problem)
		goto out;

	problem = krb5_cc_copy_cache(authctxt->krb5_ctx, ccache,
	    authctxt->krb5_fwd_ccache);
	krb5_cc_destroy(authctxt->krb5_ctx, ccache);
	ccache = NULL;
	if (problem)
		goto out;

#else
	problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
	    authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
	if (problem)
		goto out;

	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
	    KRB5_NT_SRV_HST, &server);
	if (problem)
		goto out;

	restore_uid();
	problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
	    NULL, NULL, NULL);
	krb5_free_principal(authctxt->krb5_ctx, server);
	temporarily_use_uid(authctxt->pw);
	if (problem)
		goto out;

	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
			  authctxt->pw->pw_name)) {
		problem = -1;
		goto out;
	}

	problem = ssh_krb5_cc_gen(authctxt->krb5_ctx, &authctxt->krb5_fwd_ccache);
	if (problem)
		goto out;

	problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
				     authctxt->krb5_user);
	if (problem)
		goto out;

	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
				 &creds);
	if (problem)
		goto out;
#endif

	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);

	len = strlen(authctxt->krb5_ticket_file) + 6;
	authctxt->krb5_ccname = xmalloc(len);
	snprintf(authctxt->krb5_ccname, len, "FILE:%s",
	    authctxt->krb5_ticket_file);

#ifdef USE_PAM
	if (options.use_pam)
		do_pam_putenv("KRB5CCNAME", authctxt->krb5_ccname);
#endif

 out:
	restore_uid();

	if (problem) {
		if (ccache)
			krb5_cc_destroy(authctxt->krb5_ctx, ccache);

		if (authctxt->krb5_ctx != NULL && problem!=-1)
			debug("Kerberos password authentication failed: %s",
			    krb5_get_err_text(authctxt->krb5_ctx, problem));
		else
			debug("Kerberos password authentication failed: %d",
			    problem);

		krb5_cleanup_proc(authctxt);

		if (options.kerberos_or_local_passwd)
			return (-1);
		else
			return (0);
	}
	return (1);
}

void
krb5_cleanup_proc(Authctxt *authctxt)
{
	debug("krb5_cleanup_proc called");
	if (authctxt->krb5_fwd_ccache) {
		krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
		authctxt->krb5_fwd_ccache = NULL;
	}
	if (authctxt->krb5_user) {
		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
		authctxt->krb5_user = NULL;
	}
	if (authctxt->krb5_ctx) {
		krb5_free_context(authctxt->krb5_ctx);
		authctxt->krb5_ctx = NULL;
	}
}

#ifndef HEIMDAL
krb5_error_code
ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
	int tmpfd, ret;
	char ccname[40];
	mode_t old_umask;

	ret = snprintf(ccname, sizeof(ccname),
	    "FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
	if (ret == -1 || ret >= sizeof(ccname))
		return errno;

	old_umask = umask(0177);
	tmpfd = mkstemp(ccname + strlen("FILE:"));
	umask(old_umask);
	if (tmpfd == -1) {
		logit("mkstemp(): %.100s", strerror(errno));
		return errno;
	}

	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
		logit("fchmod(): %.100s", strerror(errno));
		close(tmpfd);
		return errno;
	}
	close(tmpfd);

	return (krb5_cc_resolve(ctx, ccname, ccache));
}
#endif /* !HEIMDAL */
#endif /* KRB5 */
Commit	Line	Data
aa9f6a6e	1	/*
aa9f6a6e	2	* Kerberos v5 authentication and ticket-passing routines.
762715ce	3	*
aa9f6a6e	4	* $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
aa9f6a6e	5	*/
bb15f28b	6	/*
	7	* Copyright (c) 2002 Daniel Kouril. All rights reserved.
	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	* 2. Redistributions in binary form must reproduce the above copyright
	15	* notice, this list of conditions and the following disclaimer in the
	16	* documentation and/or other materials provided with the distribution.
	17	*
	18	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	19	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	20	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	21	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	22	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	23	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	24	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	25	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	26	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	27	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	28	*/
aa9f6a6e	29
aa9f6a6e	30	#include "includes.h"
aff51935	31	RCSID("$OpenBSD: auth-krb5.c,v 1.15 2003/11/21 11:57:02 djm Exp $");
93c3b6de	32
aa9f6a6e	33	#include "ssh.h"
	34	#include "ssh1.h"
	35	#include "packet.h"
	36	#include "xmalloc.h"
	37	#include "log.h"
	38	#include "servconf.h"
	39	#include "uidswap.h"
	40	#include "auth.h"
	41
	42	#ifdef KRB5
	43	#include <krb5.h>
	44
	45	extern ServerOptions options;
	46
	47	static int
	48	krb5_init(void *context)
	49	{
	50	Authctxt authctxt = (Authctxt )context;
	51	krb5_error_code problem;
a0105740	52
aa9f6a6e	53	if (authctxt->krb5_ctx == NULL) {
	54	problem = krb5_init_context(&authctxt->krb5_ctx);
	55	if (problem)
	56	return (problem);
79753592	57	#ifdef KRB5_INIT_ETS
aa9f6a6e	58	krb5_init_ets(authctxt->krb5_ctx);
79753592	59	#endif
aa9f6a6e	60	}
aa9f6a6e	61	return (0);
	62	}
	63
aa9f6a6e	64	int
	65	auth_krb5_password(Authctxt authctxt, const char password)
	66	{
12928e80	67	#ifndef HEIMDAL
	68	krb5_creds creds;
	69	krb5_principal server;
b6453d99	70	#endif
aa9f6a6e	71	krb5_error_code problem;
78e43412	72	krb5_ccache ccache = NULL;
6490a5d5	73	int len;
a0105740	74
fdaef11e	75	if (!authctxt->valid)
aa9f6a6e	76	return (0);
a0105740	77
aa9f6a6e	78	temporarily_use_uid(authctxt->pw);
a0105740	79
aa9f6a6e	80	problem = krb5_init(authctxt);
	81	if (problem)
	82	goto out;
a0105740	83
aa9f6a6e	84	problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
	85	&authctxt->krb5_user);
	86	if (problem)
	87	goto out;
a0105740	88
12928e80	89	#ifdef HEIMDAL
78e43412	90	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops, &ccache);
aa9f6a6e	91	if (problem)
aa9f6a6e	92	goto out;
a0105740	93
78e43412	94	problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
78e43412	95	authctxt->krb5_user);
aa9f6a6e	96	if (problem)
aa9f6a6e	97	goto out;
a0105740	98
a0105740	99	restore_uid();
b6453d99	100
aa9f6a6e	101	problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
78e43412	102	ccache, password, 1, NULL);
b6453d99	103
a0105740	104	temporarily_use_uid(authctxt->pw);
a0105740	105
aa9f6a6e	106	if (problem)
aa9f6a6e	107	goto out;
bd7af13d	108
78e43412	109	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops,
	110	&authctxt->krb5_fwd_ccache);
	111	if (problem)
	112	goto out;
	113
	114	problem = krb5_cc_copy_cache(authctxt->krb5_ctx, ccache,
	115	authctxt->krb5_fwd_ccache);
	116	krb5_cc_destroy(authctxt->krb5_ctx, ccache);
	117	ccache = NULL;
	118	if (problem)
	119	goto out;
a0105740	120
12928e80	121	#else
	122	problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
	123	authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
	124	if (problem)
	125	goto out;
	126
	127	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
	128	KRB5_NT_SRV_HST, &server);
	129	if (problem)
	130	goto out;
	131
	132	restore_uid();
	133	problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
	134	NULL, NULL, NULL);
	135	krb5_free_principal(authctxt->krb5_ctx, server);
	136	temporarily_use_uid(authctxt->pw);
	137	if (problem)
	138	goto out;
b6453d99	139
aff51935	140	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
12928e80	141	authctxt->pw->pw_name)) {
875ec275	142	problem = -1;
12928e80	143	goto out;
aff51935	144	}
12928e80	145
937eb918	146	problem = ssh_krb5_cc_gen(authctxt->krb5_ctx, &authctxt->krb5_fwd_ccache);
12928e80	147	if (problem)
	148	goto out;
	149
	150	problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
	151	authctxt->krb5_user);
	152	if (problem)
	153	goto out;
b6453d99	154
12928e80	155	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
	156	&creds);
	157	if (problem)
	158	goto out;
b6453d99	159	#endif
12928e80	160
aa9f6a6e	161	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
a0105740	162
6490a5d5	163	len = strlen(authctxt->krb5_ticket_file) + 6;
	164	authctxt->krb5_ccname = xmalloc(len);
	165	snprintf(authctxt->krb5_ccname, len, "FILE:%s",
	166	authctxt->krb5_ticket_file);
	167
ef084ee2	168	#ifdef USE_PAM
	169	if (options.use_pam)
	170	do_pam_putenv("KRB5CCNAME", authctxt->krb5_ccname);
	171	#endif
	172
aa9f6a6e	173	out:
aa9f6a6e	174	restore_uid();
a0105740	175
aa9f6a6e	176	if (problem) {
78e43412	177	if (ccache)
	178	krb5_cc_destroy(authctxt->krb5_ctx, ccache);
	179
12928e80	180	if (authctxt->krb5_ctx != NULL && problem!=-1)
c12337d9	181	debug("Kerberos password authentication failed: %s",
	182	krb5_get_err_text(authctxt->krb5_ctx, problem));
	183	else
	184	debug("Kerberos password authentication failed: %d",
	185	problem);
a0105740	186
aa9f6a6e	187	krb5_cleanup_proc(authctxt);
a0105740	188
aa9f6a6e	189	if (options.kerberos_or_local_passwd)
	190	return (-1);
	191	else
	192	return (0);
	193	}
	194	return (1);
	195	}
	196
	197	void
2362db19	198	krb5_cleanup_proc(Authctxt *authctxt)
aa9f6a6e	199	{
aa9f6a6e	200	debug("krb5_cleanup_proc called");
	201	if (authctxt->krb5_fwd_ccache) {
	202	krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
	203	authctxt->krb5_fwd_ccache = NULL;
	204	}
	205	if (authctxt->krb5_user) {
	206	krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
	207	authctxt->krb5_user = NULL;
	208	}
aa9f6a6e	209	if (authctxt->krb5_ctx) {
	210	krb5_free_context(authctxt->krb5_ctx);
	211	authctxt->krb5_ctx = NULL;
	212	}
	213	}
	214
937eb918	215	#ifndef HEIMDAL
	216	krb5_error_code
	217	ssh_krb5_cc_gen(krb5_context ctx, krb5_ccache *ccache) {
	218	int tmpfd, ret;
	219	char ccname[40];
	220	mode_t old_umask;
	221
	222	ret = snprintf(ccname, sizeof(ccname),
	223	"FILE:/tmp/krb5cc_%d_XXXXXXXXXX", geteuid());
	224	if (ret == -1 \|\| ret >= sizeof(ccname))
	225	return errno;
	226
	227	old_umask = umask(0177);
	228	tmpfd = mkstemp(ccname + strlen("FILE:"));
	229	umask(old_umask);
	230	if (tmpfd == -1) {
	231	logit("mkstemp(): %.100s", strerror(errno));
	232	return errno;
	233	}
	234
	235	if (fchmod(tmpfd,S_IRUSR \| S_IWUSR) == -1) {
	236	logit("fchmod(): %.100s", strerror(errno));
	237	close(tmpfd);
	238	return errno;
	239	}
	240	close(tmpfd);
	241
	242	return (krb5_cc_resolve(ctx, ccname, ccache));
	243	}
	244	#endif /* !HEIMDAL */
aa9f6a6e	245	#endif /* KRB5 */