]>
Commit | Line | Data |
---|---|---|
0ba40daa | 1 | /* |
34a88012 | 2 | * |
3 | * Copyright (c) 2001 Gert Doering. All rights reserved. | |
4 | * | |
0ba40daa | 5 | * Redistribution and use in source and binary forms, with or without |
6 | * modification, are permitted provided that the following conditions | |
7 | * are met: | |
8 | * 1. Redistributions of source code must retain the above copyright | |
9 | * notice, this list of conditions and the following disclaimer. | |
10 | * 2. Redistributions in binary form must reproduce the above copyright | |
11 | * notice, this list of conditions and the following disclaimer in the | |
12 | * documentation and/or other materials provided with the distribution. | |
13 | * | |
14 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | |
15 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | |
16 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | |
17 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | |
18 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | |
19 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | |
20 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | |
21 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
22 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | |
23 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
24 | * | |
25 | */ | |
90e70cfc | 26 | #include "includes.h" |
262b1744 | 27 | #include "auth.h" |
73d9dad3 | 28 | #include "ssh.h" |
29 | #include "log.h" | |
30 | #include "servconf.h" | |
805dcf3a | 31 | #include "canohost.h" |
32 | #include "xmalloc.h" | |
f0b467ef | 33 | #include "buffer.h" |
90e70cfc | 34 | |
35 | #ifdef _AIX | |
36 | ||
37 | #include <uinfo.h> | |
2aa3a16c | 38 | #include "port-aix.h" |
90e70cfc | 39 | |
73d9dad3 | 40 | extern ServerOptions options; |
f0b467ef | 41 | extern Buffer loginmsg; |
73d9dad3 | 42 | |
d852ad8b | 43 | # ifdef HAVE_SETAUTHDB |
44 | static char old_registry[REGISTRY_SIZE] = ""; | |
45 | # endif | |
46 | ||
90e70cfc | 47 | /* |
0ba40daa | 48 | * AIX has a "usrinfo" area where logname and other stuff is stored - |
49 | * a few applications actually use this and die if it's not set | |
50 | * | |
51 | * NOTE: TTY= should be set, but since no one uses it and it's hard to | |
52 | * acquire due to privsep code. We will just drop support. | |
90e70cfc | 53 | */ |
54 | void | |
0ba40daa | 55 | aix_usrinfo(struct passwd *pw) |
90e70cfc | 56 | { |
90e70cfc | 57 | u_int i; |
9901cb37 | 58 | size_t len; |
0ba40daa | 59 | char *cp; |
90e70cfc | 60 | |
9901cb37 | 61 | len = sizeof("LOGNAME= NAME= ") + (2 * strlen(pw->pw_name)); |
62 | cp = xmalloc(len); | |
63 | ||
1e72a7e3 | 64 | i = snprintf(cp, len, "LOGNAME=%s%cNAME=%s%c", pw->pw_name, '\0', |
65 | pw->pw_name, '\0'); | |
90e70cfc | 66 | if (usrinfo(SETUINFO, cp, i) == -1) |
67 | fatal("Couldn't set usrinfo: %s", strerror(errno)); | |
68 | debug3("AIX/UsrInfo: set len %d", i); | |
9901cb37 | 69 | |
90e70cfc | 70 | xfree(cp); |
71 | } | |
72 | ||
f0b467ef | 73 | # ifdef WITH_AIXAUTHENTICATE |
bc7dfc06 | 74 | /* |
75 | * Remove embedded newlines in string (if any). | |
76 | * Used before logging messages returned by AIX authentication functions | |
77 | * so the message is logged on one line. | |
78 | */ | |
79 | void | |
80 | aix_remove_embedded_newlines(char *p) | |
81 | { | |
82 | if (p == NULL) | |
83 | return; | |
84 | ||
85 | for (; *p; p++) { | |
86 | if (*p == '\n') | |
87 | *p = ' '; | |
88 | } | |
89 | /* Remove trailing whitespace */ | |
90 | if (*--p == ' ') | |
91 | *p = '\0'; | |
92 | } | |
f0b467ef | 93 | |
94 | /* | |
95 | * Do authentication via AIX's authenticate routine. We loop until the | |
96 | * reenter parameter is 0, but normally authenticate is called only once. | |
97 | * | |
98 | * Note: this function returns 1 on success, whereas AIX's authenticate() | |
99 | * returns 0. | |
100 | */ | |
101 | int | |
cadfc759 | 102 | sys_auth_passwd(Authctxt *ctxt, const char *password) |
f0b467ef | 103 | { |
cadfc759 | 104 | char *authmsg = NULL, *host, *msg, *name = ctxt->pw->pw_name; |
105 | int authsuccess = 0, expired, reenter, result; | |
f0b467ef | 106 | |
107 | do { | |
108 | result = authenticate((char *)name, (char *)password, &reenter, | |
109 | &authmsg); | |
110 | aix_remove_embedded_newlines(authmsg); | |
111 | debug3("AIX/authenticate result %d, msg %.100s", result, | |
112 | authmsg); | |
113 | } while (reenter); | |
114 | ||
115 | if (result == 0) { | |
116 | authsuccess = 1; | |
117 | ||
cadfc759 | 118 | host = (char *)get_canonical_hostname(options.use_dns); |
119 | ||
120 | /* | |
121 | * Record successful login. We don't have a pty yet, so just | |
122 | * label the line as "ssh" | |
123 | */ | |
f0b467ef | 124 | aix_setauthdb(name); |
125 | if (loginsuccess((char *)name, (char *)host, "ssh", &msg) == 0) { | |
126 | if (msg != NULL) { | |
127 | debug("%s: msg %s", __func__, msg); | |
128 | buffer_append(&loginmsg, msg, strlen(msg)); | |
129 | xfree(msg); | |
130 | } | |
131 | } | |
cadfc759 | 132 | |
133 | /* | |
134 | * Check if the user's password is expired. | |
135 | */ | |
6d05637a | 136 | expired = passwdexpired(name, &msg); |
137 | if (msg && *msg) { | |
138 | buffer_append(&loginmsg, msg, strlen(msg)); | |
139 | aix_remove_embedded_newlines(msg); | |
140 | } | |
141 | debug3("AIX/passwdexpired returned %d msg %.100s", expired, msg); | |
cadfc759 | 142 | |
143 | switch (expired) { | |
144 | case 0: /* password not expired */ | |
145 | break; | |
146 | case 1: /* expired, password change required */ | |
147 | ctxt->force_pwchange = 1; | |
148 | disable_forwarding(); | |
149 | break; | |
150 | default: /* user can't change(2) or other error (-1) */ | |
151 | logit("Password can't be changed for user %s: %.100s", | |
152 | name, msg); | |
153 | if (msg) | |
154 | xfree(msg); | |
155 | authsuccess = 0; | |
156 | } | |
157 | ||
d852ad8b | 158 | aix_restoreauthdb(); |
f0b467ef | 159 | } |
160 | ||
161 | if (authmsg != NULL) | |
162 | xfree(authmsg); | |
163 | ||
164 | return authsuccess; | |
165 | } | |
bc5c2025 | 166 | |
167 | /* | |
168 | * Check if specified account is permitted to log in. | |
169 | * Returns 1 if login is allowed, 0 if not allowed. | |
170 | */ | |
171 | int | |
172 | sys_auth_allowed_user(struct passwd *pw) | |
173 | { | |
174 | char *msg = NULL; | |
175 | int result, permitted = 0; | |
176 | struct stat st; | |
177 | ||
178 | /* | |
179 | * Don't perform checks for root account (PermitRootLogin controls | |
180 | * logins via * ssh) or if running as non-root user (since | |
181 | * loginrestrictions will always fail due to insufficient privilege). | |
182 | */ | |
183 | if (pw->pw_uid == 0 || geteuid() != 0) { | |
184 | debug3("%s: not checking"); | |
185 | return 1; | |
186 | } | |
187 | ||
188 | result = loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &msg); | |
189 | if (result == 0) | |
190 | permitted = 1; | |
191 | /* | |
192 | * If restricted because /etc/nologin exists, the login will be denied | |
193 | * in session.c after the nologin message is sent, so allow for now | |
194 | * and do not append the returned message. | |
195 | */ | |
196 | if (result == -1 && errno == EPERM && stat(_PATH_NOLOGIN, &st) == 0) | |
197 | permitted = 1; | |
198 | else if (msg != NULL) | |
199 | buffer_append(&loginmsg, msg, strlen(msg)); | |
200 | if (msg == NULL) | |
201 | msg = xstrdup("(none)"); | |
202 | aix_remove_embedded_newlines(msg); | |
203 | debug3("AIX/loginrestrictions returned %d msg %.100s", result, msg); | |
204 | ||
205 | if (!permitted) | |
206 | logit("Login restricted for %s: %.100s", pw->pw_name, msg); | |
207 | xfree(msg); | |
208 | return permitted; | |
209 | } | |
210 | ||
f0b467ef | 211 | # ifdef CUSTOM_FAILED_LOGIN |
73d9dad3 | 212 | /* |
213 | * record_failed_login: generic "login failed" interface function | |
214 | */ | |
215 | void | |
216 | record_failed_login(const char *user, const char *ttyname) | |
217 | { | |
f0b467ef | 218 | char *hostname = (char *)get_canonical_hostname(options.use_dns); |
9901cb37 | 219 | |
2aa3a16c | 220 | if (geteuid() != 0) |
221 | return; | |
222 | ||
223 | aix_setauthdb(user); | |
f0b467ef | 224 | # ifdef AIX_LOGINFAILED_4ARG |
f58c0e01 | 225 | loginfailed((char *)user, hostname, (char *)ttyname, AUDIT_FAIL_AUTH); |
f0b467ef | 226 | # else |
e351e493 | 227 | loginfailed((char *)user, hostname, (char *)ttyname); |
f0b467ef | 228 | # endif |
d852ad8b | 229 | aix_restoreauthdb(); |
73d9dad3 | 230 | } |
f0b467ef | 231 | # endif /* CUSTOM_FAILED_LOGIN */ |
2aa3a16c | 232 | |
233 | /* | |
234 | * If we have setauthdb, retrieve the password registry for the user's | |
d852ad8b | 235 | * account then feed it to setauthdb. This will mean that subsequent AIX auth |
236 | * functions will only use the specified loadable module. If we don't have | |
237 | * setauthdb this is a no-op. | |
2aa3a16c | 238 | */ |
239 | void | |
240 | aix_setauthdb(const char *user) | |
241 | { | |
242 | # ifdef HAVE_SETAUTHDB | |
d852ad8b | 243 | char *registry; |
2aa3a16c | 244 | |
245 | if (setuserdb(S_READ) == -1) { | |
246 | debug3("%s: Could not open userdb to read", __func__); | |
247 | return; | |
248 | } | |
249 | ||
250 | if (getuserattr((char *)user, S_REGISTRY, ®istry, SEC_CHAR) == 0) { | |
d852ad8b | 251 | if (setauthdb(registry, old_registry) == 0) |
252 | debug3("AIX/setauthdb set registry '%s'", registry); | |
2aa3a16c | 253 | else |
d852ad8b | 254 | debug3("AIX/setauthdb set registry '%s' failed: %s", |
255 | registry, strerror(errno)); | |
2aa3a16c | 256 | } else |
257 | debug3("%s: Could not read S_REGISTRY for user: %s", __func__, | |
258 | strerror(errno)); | |
259 | enduserdb(); | |
f0b467ef | 260 | # endif /* HAVE_SETAUTHDB */ |
2aa3a16c | 261 | } |
90e70cfc | 262 | |
d852ad8b | 263 | /* |
264 | * Restore the user's registry settings from old_registry. | |
265 | * Note that if the first aix_setauthdb fails, setauthdb("") is still safe | |
266 | * (it restores the system default behaviour). If we don't have setauthdb, | |
267 | * this is a no-op. | |
268 | */ | |
269 | void | |
270 | aix_restoreauthdb(void) | |
271 | { | |
272 | # ifdef HAVE_SETAUTHDB | |
273 | if (setauthdb(old_registry, NULL) == 0) | |
274 | debug3("%s: restoring old registry '%s'", __func__, | |
275 | old_registry); | |
276 | else | |
277 | debug3("%s: failed to restore old registry %s", __func__, | |
278 | old_registry); | |
279 | # endif /* HAVE_SETAUTHDB */ | |
280 | } | |
281 | ||
f0b467ef | 282 | # endif /* WITH_AIXAUTHENTICATE */ |
283 | ||
284 | #endif /* _AIX */ |