]>
Commit | Line | Data |
---|---|---|
0ba40daa | 1 | /* |
34a88012 | 2 | * |
3 | * Copyright (c) 2001 Gert Doering. All rights reserved. | |
4 | * | |
0ba40daa | 5 | * Redistribution and use in source and binary forms, with or without |
6 | * modification, are permitted provided that the following conditions | |
7 | * are met: | |
8 | * 1. Redistributions of source code must retain the above copyright | |
9 | * notice, this list of conditions and the following disclaimer. | |
10 | * 2. Redistributions in binary form must reproduce the above copyright | |
11 | * notice, this list of conditions and the following disclaimer in the | |
12 | * documentation and/or other materials provided with the distribution. | |
13 | * | |
14 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | |
15 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | |
16 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | |
17 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | |
18 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | |
19 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | |
20 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | |
21 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
22 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | |
23 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
24 | * | |
25 | */ | |
90e70cfc | 26 | #include "includes.h" |
262b1744 | 27 | #include "auth.h" |
73d9dad3 | 28 | #include "ssh.h" |
29 | #include "log.h" | |
30 | #include "servconf.h" | |
805dcf3a | 31 | #include "canohost.h" |
32 | #include "xmalloc.h" | |
f0b467ef | 33 | #include "buffer.h" |
90e70cfc | 34 | |
35 | #ifdef _AIX | |
36 | ||
37 | #include <uinfo.h> | |
2aa3a16c | 38 | #include "port-aix.h" |
90e70cfc | 39 | |
73d9dad3 | 40 | extern ServerOptions options; |
f0b467ef | 41 | extern Buffer loginmsg; |
73d9dad3 | 42 | |
d852ad8b | 43 | # ifdef HAVE_SETAUTHDB |
44 | static char old_registry[REGISTRY_SIZE] = ""; | |
45 | # endif | |
46 | ||
90e70cfc | 47 | /* |
0ba40daa | 48 | * AIX has a "usrinfo" area where logname and other stuff is stored - |
49 | * a few applications actually use this and die if it's not set | |
50 | * | |
51 | * NOTE: TTY= should be set, but since no one uses it and it's hard to | |
52 | * acquire due to privsep code. We will just drop support. | |
90e70cfc | 53 | */ |
54 | void | |
0ba40daa | 55 | aix_usrinfo(struct passwd *pw) |
90e70cfc | 56 | { |
90e70cfc | 57 | u_int i; |
9901cb37 | 58 | size_t len; |
0ba40daa | 59 | char *cp; |
90e70cfc | 60 | |
9901cb37 | 61 | len = sizeof("LOGNAME= NAME= ") + (2 * strlen(pw->pw_name)); |
62 | cp = xmalloc(len); | |
63 | ||
1e72a7e3 | 64 | i = snprintf(cp, len, "LOGNAME=%s%cNAME=%s%c", pw->pw_name, '\0', |
65 | pw->pw_name, '\0'); | |
90e70cfc | 66 | if (usrinfo(SETUINFO, cp, i) == -1) |
67 | fatal("Couldn't set usrinfo: %s", strerror(errno)); | |
68 | debug3("AIX/UsrInfo: set len %d", i); | |
9901cb37 | 69 | |
90e70cfc | 70 | xfree(cp); |
71 | } | |
72 | ||
f0b467ef | 73 | # ifdef WITH_AIXAUTHENTICATE |
bc7dfc06 | 74 | /* |
75 | * Remove embedded newlines in string (if any). | |
76 | * Used before logging messages returned by AIX authentication functions | |
77 | * so the message is logged on one line. | |
78 | */ | |
79 | void | |
80 | aix_remove_embedded_newlines(char *p) | |
81 | { | |
82 | if (p == NULL) | |
83 | return; | |
84 | ||
85 | for (; *p; p++) { | |
86 | if (*p == '\n') | |
87 | *p = ' '; | |
88 | } | |
89 | /* Remove trailing whitespace */ | |
90 | if (*--p == ' ') | |
91 | *p = '\0'; | |
92 | } | |
f0b467ef | 93 | |
94 | /* | |
95 | * Do authentication via AIX's authenticate routine. We loop until the | |
96 | * reenter parameter is 0, but normally authenticate is called only once. | |
97 | * | |
98 | * Note: this function returns 1 on success, whereas AIX's authenticate() | |
99 | * returns 0. | |
100 | */ | |
101 | int | |
cadfc759 | 102 | sys_auth_passwd(Authctxt *ctxt, const char *password) |
f0b467ef | 103 | { |
cadfc759 | 104 | char *authmsg = NULL, *host, *msg, *name = ctxt->pw->pw_name; |
105 | int authsuccess = 0, expired, reenter, result; | |
f0b467ef | 106 | |
107 | do { | |
108 | result = authenticate((char *)name, (char *)password, &reenter, | |
109 | &authmsg); | |
110 | aix_remove_embedded_newlines(authmsg); | |
111 | debug3("AIX/authenticate result %d, msg %.100s", result, | |
112 | authmsg); | |
113 | } while (reenter); | |
114 | ||
115 | if (result == 0) { | |
116 | authsuccess = 1; | |
117 | ||
cadfc759 | 118 | host = (char *)get_canonical_hostname(options.use_dns); |
119 | ||
120 | /* | |
121 | * Record successful login. We don't have a pty yet, so just | |
122 | * label the line as "ssh" | |
123 | */ | |
f0b467ef | 124 | aix_setauthdb(name); |
125 | if (loginsuccess((char *)name, (char *)host, "ssh", &msg) == 0) { | |
126 | if (msg != NULL) { | |
127 | debug("%s: msg %s", __func__, msg); | |
128 | buffer_append(&loginmsg, msg, strlen(msg)); | |
129 | xfree(msg); | |
130 | } | |
131 | } | |
cadfc759 | 132 | |
133 | /* | |
134 | * Check if the user's password is expired. | |
135 | */ | |
136 | expired = passwdexpired(name, &msg); | |
137 | if (msg && *msg) { | |
138 | buffer_append(&loginmsg, msg, strlen(msg)); | |
139 | aix_remove_embedded_newlines(msg); | |
140 | } | |
141 | debug3("AIX/passwdexpired returned %d msg %.100s", expired, msg); | |
142 | ||
143 | switch (expired) { | |
144 | case 0: /* password not expired */ | |
145 | break; | |
146 | case 1: /* expired, password change required */ | |
147 | ctxt->force_pwchange = 1; | |
148 | disable_forwarding(); | |
149 | break; | |
150 | default: /* user can't change(2) or other error (-1) */ | |
151 | logit("Password can't be changed for user %s: %.100s", | |
152 | name, msg); | |
153 | if (msg) | |
154 | xfree(msg); | |
155 | authsuccess = 0; | |
156 | } | |
157 | ||
d852ad8b | 158 | aix_restoreauthdb(); |
f0b467ef | 159 | } |
160 | ||
161 | if (authmsg != NULL) | |
162 | xfree(authmsg); | |
163 | ||
164 | return authsuccess; | |
165 | } | |
bc7dfc06 | 166 | |
f0b467ef | 167 | # ifdef CUSTOM_FAILED_LOGIN |
73d9dad3 | 168 | /* |
169 | * record_failed_login: generic "login failed" interface function | |
170 | */ | |
171 | void | |
172 | record_failed_login(const char *user, const char *ttyname) | |
173 | { | |
f0b467ef | 174 | char *hostname = (char *)get_canonical_hostname(options.use_dns); |
9901cb37 | 175 | |
2aa3a16c | 176 | if (geteuid() != 0) |
177 | return; | |
178 | ||
179 | aix_setauthdb(user); | |
f0b467ef | 180 | # ifdef AIX_LOGINFAILED_4ARG |
f58c0e01 | 181 | loginfailed((char *)user, hostname, (char *)ttyname, AUDIT_FAIL_AUTH); |
f0b467ef | 182 | # else |
e351e493 | 183 | loginfailed((char *)user, hostname, (char *)ttyname); |
f0b467ef | 184 | # endif |
d852ad8b | 185 | aix_restoreauthdb(); |
73d9dad3 | 186 | } |
f0b467ef | 187 | # endif /* CUSTOM_FAILED_LOGIN */ |
2aa3a16c | 188 | |
189 | /* | |
190 | * If we have setauthdb, retrieve the password registry for the user's | |
d852ad8b | 191 | * account then feed it to setauthdb. This will mean that subsequent AIX auth |
192 | * functions will only use the specified loadable module. If we don't have | |
193 | * setauthdb this is a no-op. | |
2aa3a16c | 194 | */ |
195 | void | |
196 | aix_setauthdb(const char *user) | |
197 | { | |
198 | # ifdef HAVE_SETAUTHDB | |
d852ad8b | 199 | char *registry; |
2aa3a16c | 200 | |
201 | if (setuserdb(S_READ) == -1) { | |
202 | debug3("%s: Could not open userdb to read", __func__); | |
203 | return; | |
204 | } | |
205 | ||
206 | if (getuserattr((char *)user, S_REGISTRY, ®istry, SEC_CHAR) == 0) { | |
d852ad8b | 207 | if (setauthdb(registry, old_registry) == 0) |
208 | debug3("AIX/setauthdb set registry '%s'", registry); | |
2aa3a16c | 209 | else |
d852ad8b | 210 | debug3("AIX/setauthdb set registry '%s' failed: %s", |
211 | registry, strerror(errno)); | |
2aa3a16c | 212 | } else |
213 | debug3("%s: Could not read S_REGISTRY for user: %s", __func__, | |
214 | strerror(errno)); | |
215 | enduserdb(); | |
f0b467ef | 216 | # endif /* HAVE_SETAUTHDB */ |
2aa3a16c | 217 | } |
90e70cfc | 218 | |
d852ad8b | 219 | /* |
220 | * Restore the user's registry settings from old_registry. | |
221 | * Note that if the first aix_setauthdb fails, setauthdb("") is still safe | |
222 | * (it restores the system default behaviour). If we don't have setauthdb, | |
223 | * this is a no-op. | |
224 | */ | |
225 | void | |
226 | aix_restoreauthdb(void) | |
227 | { | |
228 | # ifdef HAVE_SETAUTHDB | |
229 | if (setauthdb(old_registry, NULL) == 0) | |
230 | debug3("%s: restoring old registry '%s'", __func__, | |
231 | old_registry); | |
232 | else | |
233 | debug3("%s: failed to restore old registry %s", __func__, | |
234 | old_registry); | |
235 | # endif /* HAVE_SETAUTHDB */ | |
236 | } | |
237 | ||
f0b467ef | 238 | # endif /* WITH_AIXAUTHENTICATE */ |
239 | ||
240 | #endif /* _AIX */ |