[openssh.git] / auth-passwd.c

/*

auth-passwd.c

Author: Tatu Ylonen <ylo@cs.hut.fi>

Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
                   All rights reserved

Created: Sat Mar 18 05:11:38 1995 ylo

Password authentication.  This file contains the functions to check whether
the password is valid for the user.

*/

#include "includes.h"

#ifndef HAVE_PAM

RCSID("$Id$");

#include "packet.h"
#include "ssh.h"
#include "servconf.h"
#include "xmalloc.h"
#include "config.h"

#ifdef HAVE_SHADOW_H
#include <shadow.h>
#endif

#ifdef HAVE_MD5_PASSWORDS
#include "md5crypt.h"
#endif

/* Don't need anything from here if we are using PAM */

/* Tries to authenticate the user using password.  Returns true if
   authentication succeeds. */

int auth_password(struct passwd *pw, const char *password)
{
  extern ServerOptions options;
  char *encrypted_password;
#ifdef HAVE_SHADOW_H
  struct spwd *spw;
#endif

  if (pw->pw_uid == 0 && options.permit_root_login == 2)
  {
      /*packet_send_debug("Server does not permit root login with password.");*/
      return 0;
  }

  if (*password == '\0' && options.permit_empty_passwd == 0)
  {
      /*packet_send_debug("Server does not permit empty password login.");*/
      return 0;
  }

  /* deny if no user. */
  if (pw == NULL)
    return 0;

#ifdef SKEY
  if (options.skey_authentication == 1) {
    if (strncasecmp(password, "s/key", 5) == 0) {
      char *skeyinfo = skey_keyinfo(pw->pw_name);
      if(skeyinfo == NULL){
	debug("generating fake skeyinfo for %.100s.", pw->pw_name);
        skeyinfo = skey_fake_keyinfo(pw->pw_name);
      }
      if(skeyinfo != NULL)
        packet_send_debug(skeyinfo);
      /* Try again. */
      return 0;
    }
    else if (skey_haskey(pw->pw_name) == 0 && 
	     skey_passcheck(pw->pw_name, (char *)password) != -1) {
      /* Authentication succeeded. */
      return 1;
    }
    /* Fall back to ordinary passwd authentication. */
  }
#endif

#if defined(KRB4)
  /* Support for Kerberos v4 authentication - Dug Song <dugsong@UMICH.EDU> */
  if (options.kerberos_authentication)
    {
      AUTH_DAT adata;
      KTEXT_ST tkt;
      struct hostent *hp;
      unsigned long faddr;
      char localhost[MAXHOSTNAMELEN];
      char phost[INST_SZ];
      char realm[REALM_SZ];
      int r;
      
      /* Try Kerberos password authentication only for non-root
	 users and only if Kerberos is installed. */
      if (pw->pw_uid != 0 && krb_get_lrealm(realm, 1) == KSUCCESS) {

	/* Set up our ticket file. */
	if (!krb4_init(pw->pw_uid)) {
	  log("Couldn't initialize Kerberos ticket file for %s!", pw->pw_name);
	  goto kerberos_auth_failure;
	}
	/* Try to get TGT using our password. */
	r = krb_get_pw_in_tkt((char *)pw->pw_name, "", realm, "krbtgt", realm,
			      DEFAULT_TKT_LIFE, (char *)password);
	if (r != INTK_OK) {
	  packet_send_debug("Kerberos V4 password authentication for %s "
			    "failed: %s", pw->pw_name, krb_err_txt[r]);
	  goto kerberos_auth_failure;
	}
	/* Successful authentication. */
	chown(tkt_string(), pw->pw_uid, pw->pw_gid);
	
	/* Now that we have a TGT, try to get a local "rcmd" ticket to
	   ensure that we are not talking to a bogus Kerberos server. */
	(void) gethostname(localhost, sizeof(localhost));
	(void) strlcpy(phost, (char *)krb_get_phost(localhost), INST_SZ);
	r = krb_mk_req(&tkt, KRB4_SERVICE_NAME, phost, realm, 33);

	if (r == KSUCCESS) {
	  if (!(hp = gethostbyname(localhost))) {
	    log("Couldn't get local host address!");
	    goto kerberos_auth_failure;
	  }
	  memmove((void *)&faddr, (void *)hp->h_addr, sizeof(faddr));

	  /* Verify our "rcmd" ticket. */
	  r = krb_rd_req(&tkt, KRB4_SERVICE_NAME, phost, faddr, &adata, "");
	  if (r == RD_AP_UNDEC) {
	    /* Probably didn't have a srvtab on localhost. Allow login. */
	    log("Kerberos V4 TGT for %s unverifiable, no srvtab installed? "
		"krb_rd_req: %s", pw->pw_name, krb_err_txt[r]);
	  }
	  else if (r != KSUCCESS) {
	    log("Kerberos V4 %s ticket unverifiable: %s",
		KRB4_SERVICE_NAME, krb_err_txt[r]);
	    goto kerberos_auth_failure;
	  }
	}
	else if (r == KDC_PR_UNKNOWN) {
	  /* Allow login if no rcmd service exists, but log the error. */
	  log("Kerberos V4 TGT for %s unverifiable: %s; %s.%s "
	      "not registered, or srvtab is wrong?", pw->pw_name,
	      krb_err_txt[r], KRB4_SERVICE_NAME, phost);
	}
	else {
	  /* TGT is bad, forget it. Possibly spoofed! */
	  packet_send_debug("WARNING: Kerberos V4 TGT possibly spoofed for"
			    "%s: %s", pw->pw_name, krb_err_txt[r]);
	  goto kerberos_auth_failure;
	}
	
	/* Authentication succeeded. */
	return 1;
	
      kerberos_auth_failure:
	krb4_cleanup_proc(NULL);
	
	if (!options.kerberos_or_local_passwd)
	  return 0;
      }
      else {
	/* Logging in as root or no local Kerberos realm. */
	packet_send_debug("Unable to authenticate to Kerberos.");
      }
      /* Fall back to ordinary passwd authentication. */
    }
#endif /* KRB4 */
  
  /* Check for users with no password. */
  if (strcmp(password, "") == 0 && strcmp(pw->pw_passwd, "") == 0)
    {
      packet_send_debug("Login permitted without a password because the account has no password.");
      return 1; /* The user has no password and an empty password was tried. */
    }

#ifdef HAVE_SHADOW_H
  spw = getspnam(pw->pw_name);
  if (spw == NULL)
    return(0);

  if ((spw->sp_namp == NULL) || (strcmp(pw->pw_name, spw->sp_namp) != 0))
    fatal("Shadow lookup returned garbage.");

  if (strlen(spw->sp_pwdp) < 3)
    return(0);

  /* Encrypt the candidate password using the proper salt. */
#ifdef HAVE_MD5_PASSWORDS
  if (is_md5_salt(spw->sp_pwdp))
    encrypted_password = md5_crypt(password, spw->sp_pwdp);
  else
    encrypted_password = crypt(password, spw->sp_pwdp);
#else /* HAVE_MD5_PASSWORDS */    
  encrypted_password = crypt(password, spw->sp_pwdp);
#endif /* HAVE_MD5_PASSWORDS */    

  /* Authentication is accepted if the encrypted passwords are identical. */
  return (strcmp(encrypted_password, spw->sp_pwdp) == 0);
#else /* !HAVE_SHADOW_H */

  /* Encrypt the candidate password using the proper salt. */
  encrypted_password = crypt(password, 
			     (pw->pw_passwd[0] && pw->pw_passwd[1]) ?
			     pw->pw_passwd : "xx");
  /* Authentication is accepted if the encrypted passwords are identical. */
  return (strcmp(encrypted_password, pw->pw_passwd) == 0);
#endif /* !HAVE_SHADOW_H */
}

#endif /* !HAVE_PAM */
Commit	Line	Data
8efc0c15	1	/*
	2
	3	auth-passwd.c
	4
	5	Author: Tatu Ylonen <ylo@cs.hut.fi>
	6
	7	Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
	8	All rights reserved
	9
	10	Created: Sat Mar 18 05:11:38 1995 ylo
	11
	12	Password authentication. This file contains the functions to check whether
	13	the password is valid for the user.
	14
	15	*/
	16
	17	#include "includes.h"
caf3bc51	18
	19	#ifndef HAVE_PAM
	20
8efc0c15	21	RCSID("$Id$");
	22
	23	#include "packet.h"
	24	#include "ssh.h"
	25	#include "servconf.h"
	26	#include "xmalloc.h"
b2344d54	27	#include "config.h"
	28
	29	#ifdef HAVE_SHADOW_H
	30	#include <shadow.h>
	31	#endif
	32
caf3bc51	33	#ifdef HAVE_MD5_PASSWORDS
	34	#include "md5crypt.h"
	35	#endif
	36
b2344d54	37	/* Don't need anything from here if we are using PAM */
8efc0c15	38
8efc0c15	39	/* Tries to authenticate the user using password. Returns true if
	40	authentication succeeds. */
	41
	42	int auth_password(struct passwd pw, const char password)
	43	{
	44	extern ServerOptions options;
	45	char *encrypted_password;
b2344d54	46	#ifdef HAVE_SHADOW_H
	47	struct spwd *spw;
	48	#endif
8efc0c15	49
	50	if (pw->pw_uid == 0 && options.permit_root_login == 2)
	51	{
	52	/packet_send_debug("Server does not permit root login with password.");/
	53	return 0;
	54	}
	55
	56	if (*password == '\0' && options.permit_empty_passwd == 0)
	57	{
	58	/packet_send_debug("Server does not permit empty password login.");/
	59	return 0;
	60	}
	61
	62	/* deny if no user. */
	63	if (pw == NULL)
	64	return 0;
	65
8efc0c15	66	#ifdef SKEY
	67	if (options.skey_authentication == 1) {
	68	if (strncasecmp(password, "s/key", 5) == 0) {
	69	char *skeyinfo = skey_keyinfo(pw->pw_name);
	70	if(skeyinfo == NULL){
	71	debug("generating fake skeyinfo for %.100s.", pw->pw_name);
	72	skeyinfo = skey_fake_keyinfo(pw->pw_name);
	73	}
	74	if(skeyinfo != NULL)
	75	packet_send_debug(skeyinfo);
	76	/* Try again. */
	77	return 0;
	78	}
	79	else if (skey_haskey(pw->pw_name) == 0 &&
	80	skey_passcheck(pw->pw_name, (char *)password) != -1) {
	81	/* Authentication succeeded. */
	82	return 1;
	83	}
	84	/* Fall back to ordinary passwd authentication. */
	85	}
	86	#endif
	87
	88	#if defined(KRB4)
	89	/* Support for Kerberos v4 authentication - Dug Song <dugsong@UMICH.EDU> */
	90	if (options.kerberos_authentication)
	91	{
	92	AUTH_DAT adata;
	93	KTEXT_ST tkt;
	94	struct hostent *hp;
	95	unsigned long faddr;
6a17f9c2	96	char localhost[MAXHOSTNAMELEN];
	97	char phost[INST_SZ];
	98	char realm[REALM_SZ];
8efc0c15	99	int r;
	100
	101	/* Try Kerberos password authentication only for non-root
	102	users and only if Kerberos is installed. */
	103	if (pw->pw_uid != 0 && krb_get_lrealm(realm, 1) == KSUCCESS) {
	104
	105	/* Set up our ticket file. */
6a17f9c2	106	if (!krb4_init(pw->pw_uid)) {
6a17f9c2	107	log("Couldn't initialize Kerberos ticket file for %s!", pw->pw_name);
8efc0c15	108	goto kerberos_auth_failure;
	109	}
	110	/* Try to get TGT using our password. */
	111	r = krb_get_pw_in_tkt((char *)pw->pw_name, "", realm, "krbtgt", realm,
	112	DEFAULT_TKT_LIFE, (char *)password);
	113	if (r != INTK_OK) {
	114	packet_send_debug("Kerberos V4 password authentication for %s "
	115	"failed: %s", pw->pw_name, krb_err_txt[r]);
	116	goto kerberos_auth_failure;
	117	}
	118	/* Successful authentication. */
6a17f9c2	119	chown(tkt_string(), pw->pw_uid, pw->pw_gid);
8efc0c15	120
	121	/* Now that we have a TGT, try to get a local "rcmd" ticket to
	122	ensure that we are not talking to a bogus Kerberos server. */
6a17f9c2	123	(void) gethostname(localhost, sizeof(localhost));
6a17f9c2	124	(void) strlcpy(phost, (char *)krb_get_phost(localhost), INST_SZ);
8efc0c15	125	r = krb_mk_req(&tkt, KRB4_SERVICE_NAME, phost, realm, 33);
	126
	127	if (r == KSUCCESS) {
	128	if (!(hp = gethostbyname(localhost))) {
	129	log("Couldn't get local host address!");
	130	goto kerberos_auth_failure;
	131	}
	132	memmove((void )&faddr, (void )hp->h_addr, sizeof(faddr));
	133
	134	/* Verify our "rcmd" ticket. */
	135	r = krb_rd_req(&tkt, KRB4_SERVICE_NAME, phost, faddr, &adata, "");
	136	if (r == RD_AP_UNDEC) {
	137	/* Probably didn't have a srvtab on localhost. Allow login. */
	138	log("Kerberos V4 TGT for %s unverifiable, no srvtab installed? "
	139	"krb_rd_req: %s", pw->pw_name, krb_err_txt[r]);
	140	}
	141	else if (r != KSUCCESS) {
	142	log("Kerberos V4 %s ticket unverifiable: %s",
	143	KRB4_SERVICE_NAME, krb_err_txt[r]);
	144	goto kerberos_auth_failure;
	145	}
	146	}
	147	else if (r == KDC_PR_UNKNOWN) {
	148	/* Allow login if no rcmd service exists, but log the error. */
	149	log("Kerberos V4 TGT for %s unverifiable: %s; %s.%s "
	150	"not registered, or srvtab is wrong?", pw->pw_name,
	151	krb_err_txt[r], KRB4_SERVICE_NAME, phost);
	152	}
	153	else {
	154	/* TGT is bad, forget it. Possibly spoofed! */
	155	packet_send_debug("WARNING: Kerberos V4 TGT possibly spoofed for"
	156	"%s: %s", pw->pw_name, krb_err_txt[r]);
	157	goto kerberos_auth_failure;
	158	}
	159
	160	/* Authentication succeeded. */
	161	return 1;
	162
	163	kerberos_auth_failure:
6a17f9c2	164	krb4_cleanup_proc(NULL);
	165
	166	if (!options.kerberos_or_local_passwd)
	167	return 0;
8efc0c15	168	}
	169	else {
	170	/* Logging in as root or no local Kerberos realm. */
	171	packet_send_debug("Unable to authenticate to Kerberos.");
	172	}
	173	/* Fall back to ordinary passwd authentication. */
	174	}
	175	#endif /* KRB4 */
	176
	177	/* Check for users with no password. */
	178	if (strcmp(password, "") == 0 && strcmp(pw->pw_passwd, "") == 0)
	179	{
	180	packet_send_debug("Login permitted without a password because the account has no password.");
	181	return 1; /* The user has no password and an empty password was tried. */
	182	}
	183
b2344d54	184	#ifdef HAVE_SHADOW_H
	185	spw = getspnam(pw->pw_name);
	186	if (spw == NULL)
	187	return(0);
	188
	189	if ((spw->sp_namp == NULL) \|\| (strcmp(pw->pw_name, spw->sp_namp) != 0))
	190	fatal("Shadow lookup returned garbage.");
	191
	192	if (strlen(spw->sp_pwdp) < 3)
	193	return(0);
	194
	195	/* Encrypt the candidate password using the proper salt. */
caf3bc51	196	#ifdef HAVE_MD5_PASSWORDS
	197	if (is_md5_salt(spw->sp_pwdp))
	198	encrypted_password = md5_crypt(password, spw->sp_pwdp);
	199	else
	200	encrypted_password = crypt(password, spw->sp_pwdp);
	201	#else /* HAVE_MD5_PASSWORDS */
b2344d54	202	encrypted_password = crypt(password, spw->sp_pwdp);
caf3bc51	203	#endif /* HAVE_MD5_PASSWORDS */
b2344d54	204
	205	/* Authentication is accepted if the encrypted passwords are identical. */
	206	return (strcmp(encrypted_password, spw->sp_pwdp) == 0);
	207	#else /* !HAVE_SHADOW_H */
	208
8efc0c15	209	/* Encrypt the candidate password using the proper salt. */
	210	encrypted_password = crypt(password,
	211	(pw->pw_passwd[0] && pw->pw_passwd[1]) ?
	212	pw->pw_passwd : "xx");
8efc0c15	213	/* Authentication is accepted if the encrypted passwords are identical. */
8efc0c15	214	return (strcmp(encrypted_password, pw->pw_passwd) == 0);
b2344d54	215	#endif /* !HAVE_SHADOW_H */
8efc0c15	216	}
b2344d54	217
b2344d54	218	#endif /* !HAVE_PAM */