]>
Commit | Line | Data |
---|---|---|
7368a6c8 | 1 | /* |
2 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | |
3 | * All rights reserved | |
e78a59f5 | 4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
7368a6c8 | 5 | */ |
6 | ||
7 | #include "includes.h" | |
301e9b01 | 8 | RCSID("$OpenBSD: auth.c,v 1.7 2000/05/17 21:37:24 deraadt Exp $"); |
7368a6c8 | 9 | |
10 | #include "xmalloc.h" | |
11 | #include "rsa.h" | |
12 | #include "ssh.h" | |
13 | #include "pty.h" | |
14 | #include "packet.h" | |
15 | #include "buffer.h" | |
16 | #include "cipher.h" | |
17 | #include "mpaux.h" | |
18 | #include "servconf.h" | |
e78a59f5 | 19 | #include "compat.h" |
7368a6c8 | 20 | #include "channels.h" |
21 | #include "match.h" | |
c1ef8333 | 22 | #ifdef HAVE_LOGIN_H |
23 | #include <login.h> | |
24 | #endif | |
7368a6c8 | 25 | |
e78a59f5 | 26 | #include "bufaux.h" |
27 | #include "ssh2.h" | |
28 | #include "auth.h" | |
7368a6c8 | 29 | #include "session.h" |
30 | #include "dispatch.h" | |
31 | ||
e78a59f5 | 32 | |
7368a6c8 | 33 | /* import */ |
34 | extern ServerOptions options; | |
35 | extern char *forced_command; | |
36 | ||
37 | /* | |
38 | * Check if the user is allowed to log in via ssh. If user is listed in | |
39 | * DenyUsers or user's primary group is listed in DenyGroups, false will | |
40 | * be returned. If AllowUsers isn't empty and user isn't listed there, or | |
41 | * if AllowGroups isn't empty and user isn't listed there, false will be | |
6ae2364d | 42 | * returned. |
7368a6c8 | 43 | * If the user's shell is not executable, false will be returned. |
6ae2364d | 44 | * Otherwise true is returned. |
7368a6c8 | 45 | */ |
a306f2dd | 46 | int |
7368a6c8 | 47 | allowed_user(struct passwd * pw) |
48 | { | |
49 | struct stat st; | |
50 | struct group *grp; | |
301e9b01 | 51 | char *shell; |
7368a6c8 | 52 | int i; |
53 | #ifdef WITH_AIXAUTHENTICATE | |
54 | char *loginmsg; | |
55 | #endif /* WITH_AIXAUTHENTICATE */ | |
56 | ||
57 | /* Shouldn't be called if pw is NULL, but better safe than sorry... */ | |
58 | if (!pw) | |
59 | return 0; | |
60 | ||
301e9b01 | 61 | /* |
62 | * Get the shell from the password data. An empty shell field is | |
63 | * legal, and means /bin/sh. | |
64 | */ | |
65 | shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell; | |
66 | ||
67 | /* deny if shell does not exists or is not executable */ | |
68 | if (stat(shell, &st) != 0) | |
7368a6c8 | 69 | return 0; |
70 | if (!((st.st_mode & S_IFREG) && (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)))) | |
71 | return 0; | |
72 | ||
73 | /* Return false if user is listed in DenyUsers */ | |
74 | if (options.num_deny_users > 0) { | |
75 | if (!pw->pw_name) | |
76 | return 0; | |
77 | for (i = 0; i < options.num_deny_users; i++) | |
78 | if (match_pattern(pw->pw_name, options.deny_users[i])) | |
79 | return 0; | |
80 | } | |
81 | /* Return false if AllowUsers isn't empty and user isn't listed there */ | |
82 | if (options.num_allow_users > 0) { | |
83 | if (!pw->pw_name) | |
84 | return 0; | |
85 | for (i = 0; i < options.num_allow_users; i++) | |
86 | if (match_pattern(pw->pw_name, options.allow_users[i])) | |
87 | break; | |
88 | /* i < options.num_allow_users iff we break for loop */ | |
89 | if (i >= options.num_allow_users) | |
90 | return 0; | |
91 | } | |
92 | /* Get the primary group name if we need it. Return false if it fails */ | |
93 | if (options.num_deny_groups > 0 || options.num_allow_groups > 0) { | |
94 | grp = getgrgid(pw->pw_gid); | |
95 | if (!grp) | |
96 | return 0; | |
97 | ||
98 | /* Return false if user's group is listed in DenyGroups */ | |
99 | if (options.num_deny_groups > 0) { | |
100 | if (!grp->gr_name) | |
101 | return 0; | |
102 | for (i = 0; i < options.num_deny_groups; i++) | |
103 | if (match_pattern(grp->gr_name, options.deny_groups[i])) | |
104 | return 0; | |
105 | } | |
106 | /* | |
107 | * Return false if AllowGroups isn't empty and user's group | |
108 | * isn't listed there | |
109 | */ | |
110 | if (options.num_allow_groups > 0) { | |
111 | if (!grp->gr_name) | |
112 | return 0; | |
113 | for (i = 0; i < options.num_allow_groups; i++) | |
114 | if (match_pattern(grp->gr_name, options.allow_groups[i])) | |
115 | break; | |
116 | /* i < options.num_allow_groups iff we break for | |
117 | loop */ | |
118 | if (i >= options.num_allow_groups) | |
119 | return 0; | |
120 | } | |
121 | } | |
122 | ||
123 | #ifdef WITH_AIXAUTHENTICATE | |
c1ef8333 | 124 | if (loginrestrictions(pw->pw_name,S_RLOGIN,NULL,&loginmsg) != 0) { |
125 | if (loginmsg && *loginmsg) { | |
126 | /* Remove embedded newlines (if any) */ | |
127 | char *p; | |
128 | for (p = loginmsg; *p; p++) | |
129 | if (*p == '\n') | |
130 | *p = ' '; | |
131 | /* Remove trailing newline */ | |
132 | *--p = '\0'; | |
133 | log("Login restricted for %s: %.100s", | |
134 | pw->pw_name, loginmsg); | |
135 | } | |
7368a6c8 | 136 | return 0; |
c1ef8333 | 137 | } |
7368a6c8 | 138 | #endif /* WITH_AIXAUTHENTICATE */ |
139 | ||
140 | /* We found no reason not to let this user try to log on... */ | |
141 | return 1; | |
142 | } |