]>
Commit | Line | Data |
---|---|---|
7368a6c8 | 1 | /* |
2 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | |
3 | * All rights reserved | |
e78a59f5 | 4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
7368a6c8 | 5 | */ |
6 | ||
7 | #include "includes.h" | |
c345cf9d | 8 | RCSID("$OpenBSD: auth.c,v 1.8 2000/08/04 20:30:07 markus Exp $"); |
7368a6c8 | 9 | |
10 | #include "xmalloc.h" | |
11 | #include "rsa.h" | |
12 | #include "ssh.h" | |
13 | #include "pty.h" | |
14 | #include "packet.h" | |
15 | #include "buffer.h" | |
16 | #include "cipher.h" | |
17 | #include "mpaux.h" | |
18 | #include "servconf.h" | |
e78a59f5 | 19 | #include "compat.h" |
7368a6c8 | 20 | #include "channels.h" |
21 | #include "match.h" | |
c1ef8333 | 22 | #ifdef HAVE_LOGIN_H |
23 | #include <login.h> | |
24 | #endif | |
4cb5ffa0 | 25 | #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) |
26 | #include <shadow.h> | |
27 | #endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */ | |
7368a6c8 | 28 | |
e78a59f5 | 29 | #include "bufaux.h" |
30 | #include "ssh2.h" | |
31 | #include "auth.h" | |
7368a6c8 | 32 | #include "session.h" |
e78a59f5 | 33 | |
7368a6c8 | 34 | /* import */ |
35 | extern ServerOptions options; | |
36 | extern char *forced_command; | |
37 | ||
38 | /* | |
39 | * Check if the user is allowed to log in via ssh. If user is listed in | |
40 | * DenyUsers or user's primary group is listed in DenyGroups, false will | |
41 | * be returned. If AllowUsers isn't empty and user isn't listed there, or | |
42 | * if AllowGroups isn't empty and user isn't listed there, false will be | |
6ae2364d | 43 | * returned. |
7368a6c8 | 44 | * If the user's shell is not executable, false will be returned. |
6ae2364d | 45 | * Otherwise true is returned. |
7368a6c8 | 46 | */ |
a306f2dd | 47 | int |
7368a6c8 | 48 | allowed_user(struct passwd * pw) |
49 | { | |
50 | struct stat st; | |
51 | struct group *grp; | |
301e9b01 | 52 | char *shell; |
7368a6c8 | 53 | int i; |
54 | #ifdef WITH_AIXAUTHENTICATE | |
55 | char *loginmsg; | |
56 | #endif /* WITH_AIXAUTHENTICATE */ | |
4cb5ffa0 | 57 | #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) && \ |
58 | defined(HAS_SHADOW_EXPIRE) | |
59 | struct spwd *spw; | |
7368a6c8 | 60 | |
61 | /* Shouldn't be called if pw is NULL, but better safe than sorry... */ | |
62 | if (!pw) | |
63 | return 0; | |
64 | ||
4cb5ffa0 | 65 | spw = getspnam(pw->pw_name); |
27494968 | 66 | if (spw != NULL) { |
67 | int days = time(NULL) / 86400; | |
4cb5ffa0 | 68 | |
27494968 | 69 | /* Check account expiry */ |
70 | if ((spw->sp_expire > 0) && (days > spw->sp_expire)) | |
71 | return 0; | |
72 | ||
73 | /* Check password expiry */ | |
74 | if ((spw->sp_lstchg > 0) && (spw->sp_inact > 0) && | |
75 | (days > (spw->sp_lstchg + spw->sp_inact))) | |
76 | return 0; | |
77 | } | |
4cb5ffa0 | 78 | #else |
79 | /* Shouldn't be called if pw is NULL, but better safe than sorry... */ | |
80 | if (!pw) | |
81 | return 0; | |
82 | #endif | |
83 | ||
301e9b01 | 84 | /* |
85 | * Get the shell from the password data. An empty shell field is | |
86 | * legal, and means /bin/sh. | |
87 | */ | |
88 | shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell; | |
89 | ||
90 | /* deny if shell does not exists or is not executable */ | |
91 | if (stat(shell, &st) != 0) | |
7368a6c8 | 92 | return 0; |
93 | if (!((st.st_mode & S_IFREG) && (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)))) | |
94 | return 0; | |
95 | ||
96 | /* Return false if user is listed in DenyUsers */ | |
97 | if (options.num_deny_users > 0) { | |
98 | if (!pw->pw_name) | |
99 | return 0; | |
100 | for (i = 0; i < options.num_deny_users; i++) | |
101 | if (match_pattern(pw->pw_name, options.deny_users[i])) | |
102 | return 0; | |
103 | } | |
104 | /* Return false if AllowUsers isn't empty and user isn't listed there */ | |
105 | if (options.num_allow_users > 0) { | |
106 | if (!pw->pw_name) | |
107 | return 0; | |
108 | for (i = 0; i < options.num_allow_users; i++) | |
109 | if (match_pattern(pw->pw_name, options.allow_users[i])) | |
110 | break; | |
111 | /* i < options.num_allow_users iff we break for loop */ | |
112 | if (i >= options.num_allow_users) | |
113 | return 0; | |
114 | } | |
115 | /* Get the primary group name if we need it. Return false if it fails */ | |
116 | if (options.num_deny_groups > 0 || options.num_allow_groups > 0) { | |
117 | grp = getgrgid(pw->pw_gid); | |
118 | if (!grp) | |
119 | return 0; | |
120 | ||
121 | /* Return false if user's group is listed in DenyGroups */ | |
122 | if (options.num_deny_groups > 0) { | |
123 | if (!grp->gr_name) | |
124 | return 0; | |
125 | for (i = 0; i < options.num_deny_groups; i++) | |
126 | if (match_pattern(grp->gr_name, options.deny_groups[i])) | |
127 | return 0; | |
128 | } | |
129 | /* | |
130 | * Return false if AllowGroups isn't empty and user's group | |
131 | * isn't listed there | |
132 | */ | |
133 | if (options.num_allow_groups > 0) { | |
134 | if (!grp->gr_name) | |
135 | return 0; | |
136 | for (i = 0; i < options.num_allow_groups; i++) | |
137 | if (match_pattern(grp->gr_name, options.allow_groups[i])) | |
138 | break; | |
139 | /* i < options.num_allow_groups iff we break for | |
140 | loop */ | |
141 | if (i >= options.num_allow_groups) | |
142 | return 0; | |
143 | } | |
144 | } | |
145 | ||
146 | #ifdef WITH_AIXAUTHENTICATE | |
5daf7064 | 147 | if (loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) { |
c1ef8333 | 148 | if (loginmsg && *loginmsg) { |
149 | /* Remove embedded newlines (if any) */ | |
150 | char *p; | |
5daf7064 | 151 | for (p = loginmsg; *p; p++) { |
c1ef8333 | 152 | if (*p == '\n') |
153 | *p = ' '; | |
5daf7064 | 154 | } |
c1ef8333 | 155 | /* Remove trailing newline */ |
156 | *--p = '\0'; | |
5daf7064 | 157 | log("Login restricted for %s: %.100s", pw->pw_name, loginmsg); |
c1ef8333 | 158 | } |
7368a6c8 | 159 | return 0; |
c1ef8333 | 160 | } |
7368a6c8 | 161 | #endif /* WITH_AIXAUTHENTICATE */ |
162 | ||
163 | /* We found no reason not to let this user try to log on... */ | |
164 | return 1; | |
165 | } |