auth-pam.c

   1 /*-
   2  * Copyright (c) 2002 Networks Associates Technology, Inc.
   3  * All rights reserved.
   4  *
   5  * This software was developed for the FreeBSD Project by ThinkSec AS and
   6  * NAI Labs, the Security Research Division of Network Associates, Inc.
   7  * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
   8  * DARPA CHATS research program.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 /* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
  33 #include "includes.h"
  34 RCSID("$Id$");
  35
  36 #ifdef USE_PAM
  37 #if defined(HAVE_SECURITY_PAM_APPL_H)
  38 #include <security/pam_appl.h>
  39 #elif defined (HAVE_PAM_PAM_APPL_H)
  40 #include <pam/pam_appl.h>
  41 #endif
  42
  43 #include "auth.h"
  44 #include "auth-pam.h"
  45 #include "buffer.h"
  46 #include "bufaux.h"
  47 #include "canohost.h"
  48 #include "log.h"
  49 #include "monitor_wrap.h"
  50 #include "msg.h"
  51 #include "packet.h"
  52 #include "readpass.h"
  53 #include "servconf.h"
  54 #include "ssh2.h"
  55 #include "xmalloc.h"
  56 #include "auth-options.h"
  57
  58 extern ServerOptions options;
  59 extern Buffer loginmsg;
  60 extern int compat20;
  61
  62 #ifdef USE_POSIX_THREADS
  63 #include <pthread.h>
  64 /*
  65  * Avoid namespace clash when *not* using pthreads for systems *with*
  66  * pthreads, which unconditionally define pthread_t via sys/types.h
  67  * (e.g. Linux)
  68  */
  69 typedef pthread_t sp_pthread_t;
  70 #else
  71 /*
  72  * Simulate threads with processes.
  73  */
  74 typedef pid_t sp_pthread_t;
  75
  76 static void
  77 pthread_exit(void *value __unused)
  78 {
  79         _exit(0);
  80 }
  81
  82 static int
  83 pthread_create(sp_pthread_t *thread, const void *attr __unused,
  84     void *(*thread_start)(void *), void *arg)
  85 {
  86         pid_t pid;
  87
  88         switch ((pid = fork())) {
  89         case -1:
  90                 error("fork(): %s", strerror(errno));
  91                 return (-1);
  92         case 0:
  93                 thread_start(arg);
  94                 _exit(1);
  95         default:
  96                 *thread = pid;
  97                 return (0);
  98         }
  99 }
 100
 101 static int
 102 pthread_cancel(sp_pthread_t thread)
 103 {
 104         return (kill(thread, SIGTERM));
 105 }
 106
 107 static int
 108 pthread_join(sp_pthread_t thread, void **value __unused)
 109 {
 110         int status;
 111
 112         waitpid(thread, &status, 0);
 113         return (status);
 114 }
 115 #endif
 116
 117
 118 static pam_handle_t *sshpam_handle = NULL;
 119 static int sshpam_err = 0;
 120 static int sshpam_authenticated = 0;
 121 static int sshpam_new_authtok_reqd = 0;
 122 static int sshpam_session_open = 0;
 123 static int sshpam_cred_established = 0;
 124 static int sshpam_account_status = -1;
 125 static char **sshpam_env = NULL;
 126
 127 struct pam_ctxt {
 128         sp_pthread_t     pam_thread;
 129         int              pam_psock;
 130         int              pam_csock;
 131         int              pam_done;
 132 };
 133
 134 static void sshpam_free_ctx(void *);
 135 static struct pam_ctxt *cleanup_ctxt;
 136
 137 /* Some PAM implementations don't implement this */
 138 #ifndef HAVE_PAM_GETENVLIST
 139 static char **
 140 pam_getenvlist(pam_handle_t *pamh)
 141 {
 142         /*
 143          * XXX - If necessary, we can still support envrionment passing
 144          * for platforms without pam_getenvlist by searching for known
 145          * env vars (e.g. KRB5CCNAME) from the PAM environment.
 146          */
 147          return NULL;
 148 }
 149 #endif
 150
 151 void
 152 pam_password_change_required(int reqd)
 153 {
 154         sshpam_new_authtok_reqd = reqd;
 155         if (reqd) {
 156                 no_port_forwarding_flag |= 2;
 157                 no_agent_forwarding_flag |= 2;
 158                 no_x11_forwarding_flag |= 2;
 159         } else {
 160                 no_port_forwarding_flag &= ~2;
 161                 no_agent_forwarding_flag &= ~2;
 162                 no_x11_forwarding_flag &= ~2;
 163
 164         }
 165 }
 166 /* Import regular and PAM environment from subprocess */
 167 static void
 168 import_environments(Buffer *b)
 169 {
 170         char *env;
 171         u_int i, num_env;
 172         int err;
 173
 174         /* Import variables set by do_pam_account */
 175         sshpam_account_status = buffer_get_int(b);
 176         pam_password_change_required(buffer_get_int(b));
 177
 178         /* Import environment from subprocess */
 179         num_env = buffer_get_int(b);
 180         sshpam_env = xmalloc((num_env + 1) * sizeof(*sshpam_env));
 181         debug3("PAM: num env strings %d", num_env);
 182         for(i = 0; i < num_env; i++)
 183                 sshpam_env[i] = buffer_get_string(b, NULL);
 184
 185         sshpam_env[num_env] = NULL;
 186
 187         /* Import PAM environment from subprocess */
 188         num_env = buffer_get_int(b);
 189         debug("PAM: num PAM env strings %d", num_env);
 190         for(i = 0; i < num_env; i++) {
 191                 env = buffer_get_string(b, NULL);
 192
 193 #ifdef HAVE_PAM_PUTENV
 194                 /* Errors are not fatal here */
 195                 if ((err = pam_putenv(sshpam_handle, env)) != PAM_SUCCESS) {
 196                         error("PAM: pam_putenv: %s",
 197                             pam_strerror(sshpam_handle, sshpam_err));
 198                 }
 199 #endif
 200         }
 201 }
 202
 203 /*
 204  * Conversation function for authentication thread.
 205  */
 206 static int
 207 sshpam_thread_conv(int n, const struct pam_message **msg,
 208     struct pam_response **resp, void *data)
 209 {
 210         Buffer buffer;
 211         struct pam_ctxt *ctxt;
 212         struct pam_response *reply;
 213         int i;
 214
 215         *resp = NULL;
 216
 217         ctxt = data;
 218         if (n <= 0 || n > PAM_MAX_NUM_MSG)
 219                 return (PAM_CONV_ERR);
 220
 221         if ((reply = malloc(n * sizeof(*reply))) == NULL)
 222                 return (PAM_CONV_ERR);
 223         memset(reply, 0, n * sizeof(*reply));
 224
 225         buffer_init(&buffer);
 226         for (i = 0; i < n; ++i) {
 227                 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
 228                 case PAM_PROMPT_ECHO_OFF:
 229                         buffer_put_cstring(&buffer,
 230                             PAM_MSG_MEMBER(msg, i, msg));
 231                         if (ssh_msg_send(ctxt->pam_csock,
 232                             PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
 233                                 goto fail;
 234                         if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
 235                                 goto fail;
 236                         if (buffer_get_char(&buffer) != PAM_AUTHTOK)
 237                                 goto fail;
 238                         reply[i].resp = buffer_get_string(&buffer, NULL);
 239                         break;
 240                 case PAM_PROMPT_ECHO_ON:
 241                         buffer_put_cstring(&buffer,
 242                             PAM_MSG_MEMBER(msg, i, msg));
 243                         if (ssh_msg_send(ctxt->pam_csock,
 244                             PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
 245                                 goto fail;
 246                         if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
 247                                 goto fail;
 248                         if (buffer_get_char(&buffer) != PAM_AUTHTOK)
 249                                 goto fail;
 250                         reply[i].resp = buffer_get_string(&buffer, NULL);
 251                         break;
 252                 case PAM_ERROR_MSG:
 253                         buffer_put_cstring(&buffer,
 254                             PAM_MSG_MEMBER(msg, i, msg));
 255                         if (ssh_msg_send(ctxt->pam_csock,
 256                             PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
 257                                 goto fail;
 258                         break;
 259                 case PAM_TEXT_INFO:
 260                         buffer_put_cstring(&buffer,
 261                             PAM_MSG_MEMBER(msg, i, msg));
 262                         if (ssh_msg_send(ctxt->pam_csock,
 263                             PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
 264                                 goto fail;
 265                         break;
 266                 default:
 267                         goto fail;
 268                 }
 269                 buffer_clear(&buffer);
 270         }
 271         buffer_free(&buffer);
 272         *resp = reply;
 273         return (PAM_SUCCESS);
 274
 275  fail:
 276         for(i = 0; i < n; i++) {
 277                 if (reply[i].resp != NULL)
 278                         xfree(reply[i].resp);
 279         }
 280         xfree(reply);
 281         buffer_free(&buffer);
 282         return (PAM_CONV_ERR);
 283 }
 284
 285 /*
 286  * Authentication thread.
 287  */
 288 static void *
 289 sshpam_thread(void *ctxtp)
 290 {
 291         struct pam_ctxt *ctxt = ctxtp;
 292         Buffer buffer;
 293         struct pam_conv sshpam_conv;
 294 #ifndef USE_POSIX_THREADS
 295         extern char **environ;
 296         char **env_from_pam;
 297         u_int i;
 298         const char *pam_user;
 299
 300         pam_get_item(sshpam_handle, PAM_USER, (const void **)&pam_user);
 301         setproctitle("%s [pam]", pam_user);
 302         environ[0] = NULL;
 303 #endif
 304
 305         sshpam_conv.conv = sshpam_thread_conv;
 306         sshpam_conv.appdata_ptr = ctxt;
 307
 308         buffer_init(&buffer);
 309         sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
 310             (const void *)&sshpam_conv);
 311         if (sshpam_err != PAM_SUCCESS)
 312                 goto auth_fail;
 313         sshpam_err = pam_authenticate(sshpam_handle, 0);
 314         if (sshpam_err != PAM_SUCCESS)
 315                 goto auth_fail;
 316
 317         if (compat20) {
 318                 if (!do_pam_account())
 319                         goto auth_fail;
 320                 if (sshpam_new_authtok_reqd) {
 321                         sshpam_err = pam_chauthtok(sshpam_handle,
 322                             PAM_CHANGE_EXPIRED_AUTHTOK);
 323                         if (sshpam_err != PAM_SUCCESS)
 324                                 goto auth_fail;
 325                         pam_password_change_required(0);
 326                 }
 327         }
 328
 329         buffer_put_cstring(&buffer, "OK");
 330
 331 #ifndef USE_POSIX_THREADS
 332         /* Export variables set by do_pam_account */
 333         buffer_put_int(&buffer, sshpam_account_status);
 334         buffer_put_int(&buffer, sshpam_new_authtok_reqd);
 335
 336         /* Export any environment strings set in child */
 337         for(i = 0; environ[i] != NULL; i++)
 338                 ; /* Count */
 339         buffer_put_int(&buffer, i);
 340         for(i = 0; environ[i] != NULL; i++)
 341                 buffer_put_cstring(&buffer, environ[i]);
 342
 343         /* Export any environment strings set by PAM in child */
 344         env_from_pam = pam_getenvlist(sshpam_handle);
 345         for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
 346                 ; /* Count */
 347         buffer_put_int(&buffer, i);
 348         for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
 349                 buffer_put_cstring(&buffer, env_from_pam[i]);
 350 #endif /* USE_POSIX_THREADS */
 351
 352         /* XXX - can't do much about an error here */
 353         ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
 354         buffer_free(&buffer);
 355         pthread_exit(NULL);
 356
 357  auth_fail:
 358         buffer_put_cstring(&buffer,
 359             pam_strerror(sshpam_handle, sshpam_err));
 360         /* XXX - can't do much about an error here */
 361         ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
 362         buffer_free(&buffer);
 363         pthread_exit(NULL);
 364
 365         return (NULL); /* Avoid warning for non-pthread case */
 366 }
 367
 368 void
 369 sshpam_thread_cleanup(void)
 370 {
 371         struct pam_ctxt *ctxt = cleanup_ctxt;
 372
 373         if (ctxt != NULL && ctxt->pam_thread != 0) {
 374                 pthread_cancel(ctxt->pam_thread);
 375                 pthread_join(ctxt->pam_thread, NULL);
 376                 close(ctxt->pam_psock);
 377                 close(ctxt->pam_csock);
 378                 memset(ctxt, 0, sizeof(*ctxt));
 379                 cleanup_ctxt = NULL;
 380         }
 381 }
 382
 383 static int
 384 sshpam_null_conv(int n, const struct pam_message **msg,
 385     struct pam_response **resp, void *data)
 386 {
 387         return (PAM_CONV_ERR);
 388 }
 389
 390 static struct pam_conv null_conv = { sshpam_null_conv, NULL };
 391
 392 void
 393 sshpam_cleanup(void)
 394 {
 395         debug("PAM: cleanup");
 396         if (sshpam_handle == NULL)
 397                 return;
 398         pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
 399         if (sshpam_cred_established) {
 400                 pam_setcred(sshpam_handle, PAM_DELETE_CRED);
 401                 sshpam_cred_established = 0;
 402         }
 403         if (sshpam_session_open) {
 404                 pam_close_session(sshpam_handle, PAM_SILENT);
 405                 sshpam_session_open = 0;
 406         }
 407         sshpam_authenticated = sshpam_new_authtok_reqd = 0;
 408         pam_end(sshpam_handle, sshpam_err);
 409         sshpam_handle = NULL;
 410 }
 411
 412 static int
 413 sshpam_init(const char *user)
 414 {
 415         extern u_int utmp_len;
 416         extern char *__progname;
 417         const char *pam_rhost, *pam_user;
 418
 419         if (sshpam_handle != NULL) {
 420                 /* We already have a PAM context; check if the user matches */
 421                 sshpam_err = pam_get_item(sshpam_handle,
 422                     PAM_USER, (const void **)&pam_user);
 423                 if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0)
 424                         return (0);
 425                 pam_end(sshpam_handle, sshpam_err);
 426                 sshpam_handle = NULL;
 427         }
 428         debug("PAM: initializing for \"%s\"", user);
 429         sshpam_err =
 430             pam_start(SSHD_PAM_SERVICE, user, &null_conv, &sshpam_handle);
 431         if (sshpam_err != PAM_SUCCESS) {
 432                 pam_end(sshpam_handle, sshpam_err);
 433                 sshpam_handle = NULL;
 434                 return (-1);
 435         }
 436         pam_rhost = get_remote_name_or_ip(utmp_len, options.use_dns);
 437         debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
 438         sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
 439         if (sshpam_err != PAM_SUCCESS) {
 440                 pam_end(sshpam_handle, sshpam_err);
 441                 sshpam_handle = NULL;
 442                 return (-1);
 443         }
 444 #ifdef PAM_TTY_KLUDGE
 445         /*
 446          * Some silly PAM modules (e.g. pam_time) require a TTY to operate.
 447          * sshd doesn't set the tty until too late in the auth process and
 448          * may not even set one (for tty-less connections)
 449          */
 450         debug("PAM: setting PAM_TTY to \"ssh\"");
 451         sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, "ssh");
 452         if (sshpam_err != PAM_SUCCESS) {
 453                 pam_end(sshpam_handle, sshpam_err);
 454                 sshpam_handle = NULL;
 455                 return (-1);
 456         }
 457 #endif
 458         return (0);
 459 }
 460
 461 static void *
 462 sshpam_init_ctx(Authctxt *authctxt)
 463 {
 464         struct pam_ctxt *ctxt;
 465         int socks[2];
 466
 467         /* Refuse to start if we don't have PAM enabled */
 468         if (!options.use_pam)
 469                 return NULL;
 470
 471         /* Initialize PAM */
 472         if (sshpam_init(authctxt->user) == -1) {
 473                 error("PAM: initialization failed");
 474                 return (NULL);
 475         }
 476
 477         ctxt = xmalloc(sizeof *ctxt);
 478         memset(ctxt, 0, sizeof(*ctxt));
 479
 480         /* Start the authentication thread */
 481         if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
 482                 error("PAM: failed create sockets: %s", strerror(errno));
 483                 xfree(ctxt);
 484                 return (NULL);
 485         }
 486         ctxt->pam_psock = socks[0];
 487         ctxt->pam_csock = socks[1];
 488         if (pthread_create(&ctxt->pam_thread, NULL, sshpam_thread, ctxt) == -1) {
 489                 error("PAM: failed to start authentication thread: %s",
 490                     strerror(errno));
 491                 close(socks[0]);
 492                 close(socks[1]);
 493                 xfree(ctxt);
 494                 return (NULL);
 495         }
 496         cleanup_ctxt = ctxt;
 497         return (ctxt);
 498 }
 499
 500 static int
 501 sshpam_query(void *ctx, char **name, char **info,
 502     u_int *num, char ***prompts, u_int **echo_on)
 503 {
 504         Buffer buffer;
 505         struct pam_ctxt *ctxt = ctx;
 506         size_t plen;
 507         u_char type;
 508         char *msg;
 509         size_t len;
 510
 511         buffer_init(&buffer);
 512         *name = xstrdup("");
 513         *info = xstrdup("");
 514         *prompts = xmalloc(sizeof(char *));
 515         **prompts = NULL;
 516         plen = 0;
 517         *echo_on = xmalloc(sizeof(u_int));
 518         while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) {
 519                 type = buffer_get_char(&buffer);
 520                 msg = buffer_get_string(&buffer, NULL);
 521                 switch (type) {
 522                 case PAM_PROMPT_ECHO_ON:
 523                 case PAM_PROMPT_ECHO_OFF:
 524                         *num = 1;
 525                         len = plen + strlen(msg) + 1;
 526                         **prompts = xrealloc(**prompts, len);
 527                         plen += snprintf(**prompts + plen, len, "%s", msg);
 528                         **echo_on = (type == PAM_PROMPT_ECHO_ON);
 529                         xfree(msg);
 530                         return (0);
 531                 case PAM_ERROR_MSG:
 532                 case PAM_TEXT_INFO:
 533                         /* accumulate messages */
 534                         len = plen + strlen(msg) + 2;
 535                         **prompts = xrealloc(**prompts, len);
 536                         plen += snprintf(**prompts + plen, len, "%s\n", msg);
 537                         xfree(msg);
 538                         break;
 539                 case PAM_SUCCESS:
 540                 case PAM_AUTH_ERR:
 541                         if (**prompts != NULL) {
 542                                 /* drain any accumulated messages */
 543                                 debug("PAM: %s", **prompts);
 544                                 buffer_append(&loginmsg, **prompts,
 545                                     strlen(**prompts));
 546                                 xfree(**prompts);
 547                                 **prompts = NULL;
 548                         }
 549                         if (type == PAM_SUCCESS) {
 550                                 import_environments(&buffer);
 551                                 *num = 0;
 552                                 **echo_on = 0;
 553                                 ctxt->pam_done = 1;
 554                                 xfree(msg);
 555                                 return (0);
 556                         }
 557                         error("PAM: %s", msg);
 558                         /* FALLTHROUGH */
 559                 default:
 560                         *num = 0;
 561                         **echo_on = 0;
 562                         xfree(msg);
 563                         ctxt->pam_done = -1;
 564                         return (-1);
 565                 }
 566         }
 567         return (-1);
 568 }
 569
 570 /* XXX - see also comment in auth-chall.c:verify_response */
 571 static int
 572 sshpam_respond(void *ctx, u_int num, char **resp)
 573 {
 574         Buffer buffer;
 575         struct pam_ctxt *ctxt = ctx;
 576
 577         debug2("PAM: %s", __func__);
 578         switch (ctxt->pam_done) {
 579         case 1:
 580                 sshpam_authenticated = 1;
 581                 return (0);
 582         case 0:
 583                 break;
 584         default:
 585                 return (-1);
 586         }
 587         if (num != 1) {
 588                 error("PAM: expected one response, got %u", num);
 589                 return (-1);
 590         }
 591         buffer_init(&buffer);
 592         buffer_put_cstring(&buffer, *resp);
 593         if (ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer) == -1) {
 594                 buffer_free(&buffer);
 595                 return (-1);
 596         }
 597         buffer_free(&buffer);
 598         return (1);
 599 }
 600
 601 static void
 602 sshpam_free_ctx(void *ctxtp)
 603 {
 604         struct pam_ctxt *ctxt = ctxtp;
 605
 606         sshpam_thread_cleanup();
 607         xfree(ctxt);
 608         /*
 609          * We don't call sshpam_cleanup() here because we may need the PAM
 610          * handle at a later stage, e.g. when setting up a session.  It's
 611          * still on the cleanup list, so pam_end() *will* be called before
 612          * the server process terminates.
 613          */
 614 }
 615
 616 KbdintDevice sshpam_device = {
 617         "pam",
 618         sshpam_init_ctx,
 619         sshpam_query,
 620         sshpam_respond,
 621         sshpam_free_ctx
 622 };
 623
 624 KbdintDevice mm_sshpam_device = {
 625         "pam",
 626         mm_sshpam_init_ctx,
 627         mm_sshpam_query,
 628         mm_sshpam_respond,
 629         mm_sshpam_free_ctx
 630 };
 631
 632 /*
 633  * This replaces auth-pam.c
 634  */
 635 void
 636 start_pam(const char *user)
 637 {
 638         if (!options.use_pam)
 639                 fatal("PAM: initialisation requested when UsePAM=no");
 640
 641         if (sshpam_init(user) == -1)
 642                 fatal("PAM: initialisation failed");
 643 }
 644
 645 void
 646 finish_pam(void)
 647 {
 648         sshpam_cleanup();
 649 }
 650
 651 u_int
 652 do_pam_account(void)
 653 {
 654         if (sshpam_account_status != -1)
 655                 return (sshpam_account_status);
 656
 657         sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
 658         debug3("%s: pam_acct_mgmt = %d", __func__, sshpam_err);
 659
 660         if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
 661                 sshpam_account_status = 0;
 662                 return (sshpam_account_status);
 663         }
 664
 665         if (sshpam_err == PAM_NEW_AUTHTOK_REQD)
 666                 pam_password_change_required(1);
 667
 668         sshpam_account_status = 1;
 669         return (sshpam_account_status);
 670 }
 671
 672 void
 673 do_pam_set_tty(const char *tty)
 674 {
 675         if (tty != NULL) {
 676                 debug("PAM: setting PAM_TTY to \"%s\"", tty);
 677                 sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, tty);
 678                 if (sshpam_err != PAM_SUCCESS)
 679                         fatal("PAM: failed to set PAM_TTY: %s",
 680                             pam_strerror(sshpam_handle, sshpam_err));
 681         }
 682 }
 683
 684 void
 685 do_pam_setcred(int init)
 686 {
 687         sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
 688             (const void *)&null_conv);
 689         if (sshpam_err != PAM_SUCCESS)
 690                 fatal("PAM: failed to set PAM_CONV: %s",
 691                     pam_strerror(sshpam_handle, sshpam_err));
 692         if (init) {
 693                 debug("PAM: establishing credentials");
 694                 sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED);
 695         } else {
 696                 debug("PAM: reinitializing credentials");
 697                 sshpam_err = pam_setcred(sshpam_handle, PAM_REINITIALIZE_CRED);
 698         }
 699         if (sshpam_err == PAM_SUCCESS) {
 700                 sshpam_cred_established = 1;
 701                 return;
 702         }
 703         if (sshpam_authenticated)
 704                 fatal("PAM: pam_setcred(): %s",
 705                     pam_strerror(sshpam_handle, sshpam_err));
 706         else
 707                 debug("PAM: pam_setcred(): %s",
 708                     pam_strerror(sshpam_handle, sshpam_err));
 709 }
 710
 711 int
 712 is_pam_password_change_required(void)
 713 {
 714         return (sshpam_new_authtok_reqd);
 715 }
 716
 717 static int
 718 pam_tty_conv(int n, const struct pam_message **msg,
 719     struct pam_response **resp, void *data)
 720 {
 721         char input[PAM_MAX_MSG_SIZE];
 722         struct pam_response *reply;
 723         int i;
 724
 725         *resp = NULL;
 726
 727         if (n <= 0 || n > PAM_MAX_NUM_MSG || !isatty(STDIN_FILENO))
 728                 return (PAM_CONV_ERR);
 729
 730         if ((reply = malloc(n * sizeof(*reply))) == NULL)
 731                 return (PAM_CONV_ERR);
 732         memset(reply, 0, n * sizeof(*reply));
 733
 734         for (i = 0; i < n; ++i) {
 735                 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
 736                 case PAM_PROMPT_ECHO_OFF:
 737                         reply[i].resp =
 738                             read_passphrase(PAM_MSG_MEMBER(msg, i, msg),
 739                             RP_ALLOW_STDIN);
 740                         reply[i].resp_retcode = PAM_SUCCESS;
 741                         break;
 742                 case PAM_PROMPT_ECHO_ON:
 743                         fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
 744                         fgets(input, sizeof input, stdin);
 745                         reply[i].resp = xstrdup(input);
 746                         reply[i].resp_retcode = PAM_SUCCESS;
 747                         break;
 748                 case PAM_ERROR_MSG:
 749                 case PAM_TEXT_INFO:
 750                         fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
 751                         reply[i].resp_retcode = PAM_SUCCESS;
 752                         break;
 753                 default:
 754                         goto fail;
 755                 }
 756         }
 757         *resp = reply;
 758         return (PAM_SUCCESS);
 759
 760  fail:
 761         for(i = 0; i < n; i++) {
 762                 if (reply[i].resp != NULL)
 763                         xfree(reply[i].resp);
 764         }
 765         xfree(reply);
 766         return (PAM_CONV_ERR);
 767 }
 768
 769 static struct pam_conv tty_conv = { pam_tty_conv, NULL };
 770
 771 /*
 772  * XXX this should be done in the authentication phase, but ssh1 doesn't
 773  * support that
 774  */
 775 void
 776 do_pam_chauthtok(void)
 777 {
 778         if (use_privsep)
 779                 fatal("Password expired (unable to change with privsep)");
 780         sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
 781             (const void *)&tty_conv);
 782         if (sshpam_err != PAM_SUCCESS)
 783                 fatal("PAM: failed to set PAM_CONV: %s",
 784                     pam_strerror(sshpam_handle, sshpam_err));
 785         debug("PAM: changing password");
 786         sshpam_err = pam_chauthtok(sshpam_handle, PAM_CHANGE_EXPIRED_AUTHTOK);
 787         if (sshpam_err != PAM_SUCCESS)
 788                 fatal("PAM: pam_chauthtok(): %s",
 789                     pam_strerror(sshpam_handle, sshpam_err));
 790 }
 791
 792 void
 793 do_pam_session(void)
 794 {
 795         sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
 796             (const void *)&tty_conv);
 797         if (sshpam_err != PAM_SUCCESS)
 798                 fatal("PAM: failed to set PAM_CONV: %s",
 799                     pam_strerror(sshpam_handle, sshpam_err));
 800         sshpam_err = pam_open_session(sshpam_handle, 0);
 801         if (sshpam_err != PAM_SUCCESS)
 802                 fatal("PAM: pam_open_session(): %s",
 803                     pam_strerror(sshpam_handle, sshpam_err));
 804         sshpam_session_open = 1;
 805 }
 806
 807 /*
 808  * Set a PAM environment string. We need to do this so that the session
 809  * modules can handle things like Kerberos/GSI credentials that appear
 810  * during the ssh authentication process.
 811  */
 812 int
 813 do_pam_putenv(char *name, char *value)
 814 {
 815         int ret = 1;
 816 #ifdef HAVE_PAM_PUTENV
 817         char *compound;
 818         size_t len;
 819
 820         len = strlen(name) + strlen(value) + 2;
 821         compound = xmalloc(len);
 822
 823         snprintf(compound, len, "%s=%s", name, value);
 824         ret = pam_putenv(sshpam_handle, compound);
 825         xfree(compound);
 826 #endif
 827
 828         return (ret);
 829 }
 830
 831 void
 832 print_pam_messages(void)
 833 {
 834         /* XXX */
 835 }
 836
 837 char **
 838 fetch_pam_child_environment(void)
 839 {
 840         return sshpam_env;
 841 }
 842
 843 char **
 844 fetch_pam_environment(void)
 845 {
 846         return (pam_getenvlist(sshpam_handle));
 847 }
 848
 849 void
 850 free_pam_environment(char **env)
 851 {
 852         char **envp;
 853
 854         if (env == NULL)
 855                 return;
 856
 857         for (envp = env; *envp; envp++)
 858                 xfree(*envp);
 859         xfree(env);
 860 }
 861
 862 #endif /* USE_PAM */