auth-krb5.c

   1 /*
   2  *    Kerberos v5 authentication and ticket-passing routines.
   3  *
   4  * $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
   5  */
   6 /*
   7  * Copyright (c) 2002 Daniel Kouril.  All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  */
  29
  30 #include "includes.h"
  31 RCSID("$OpenBSD: auth-krb5.c,v 1.11 2003/07/16 15:02:06 markus Exp $");
  32
  33 #include "ssh.h"
  34 #include "ssh1.h"
  35 #include "packet.h"
  36 #include "xmalloc.h"
  37 #include "log.h"
  38 #include "servconf.h"
  39 #include "uidswap.h"
  40 #include "auth.h"
  41
  42 #ifdef KRB5
  43
  44 #include <krb5.h>
  45
  46 extern ServerOptions     options;
  47
  48 static int
  49 krb5_init(void *context)
  50 {
  51         Authctxt *authctxt = (Authctxt *)context;
  52         krb5_error_code problem;
  53         static int cleanup_registered = 0;
  54
  55         if (authctxt->krb5_ctx == NULL) {
  56                 problem = krb5_init_context(&authctxt->krb5_ctx);
  57                 if (problem)
  58                         return (problem);
  59                 krb5_init_ets(authctxt->krb5_ctx);
  60         }
  61         if (!cleanup_registered) {
  62                 fatal_add_cleanup(krb5_cleanup_proc, authctxt);
  63                 cleanup_registered = 1;
  64         }
  65         return (0);
  66 }
  67
  68 /*
  69  * Try krb5 authentication. server_user is passed for logging purposes
  70  * only, in auth is received ticket, in client is returned principal
  71  * from the ticket
  72  */
  73 int
  74 auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *reply)
  75 {
  76         krb5_error_code problem;
  77         krb5_principal server;
  78         krb5_ticket *ticket;
  79         int fd, ret;
  80
  81         ret = 0;
  82         server = NULL;
  83         ticket = NULL;
  84         reply->length = 0;
  85
  86         problem = krb5_init(authctxt);
  87         if (problem)
  88                 goto err;
  89
  90         problem = krb5_auth_con_init(authctxt->krb5_ctx,
  91             &authctxt->krb5_auth_ctx);
  92         if (problem)
  93                 goto err;
  94
  95         fd = packet_get_connection_in();
  96 #ifdef HEIMDAL
  97         problem = krb5_auth_con_setaddrs_from_fd(authctxt->krb5_ctx,
  98             authctxt->krb5_auth_ctx, &fd);
  99 #else
 100         problem = krb5_auth_con_genaddrs(authctxt->krb5_ctx,
 101             authctxt->krb5_auth_ctx,fd,
 102             KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR |
 103             KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR);
 104 #endif
 105         if (problem)
 106                 goto err;
 107
 108         problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
 109             KRB5_NT_SRV_HST, &server);
 110         if (problem)
 111                 goto err;
 112
 113         problem = krb5_rd_req(authctxt->krb5_ctx, &authctxt->krb5_auth_ctx,
 114             auth, server, NULL, NULL, &ticket);
 115         if (problem)
 116                 goto err;
 117
 118 #ifdef HEIMDAL
 119         problem = krb5_copy_principal(authctxt->krb5_ctx, ticket->client,
 120             &authctxt->krb5_user);
 121 #else
 122         problem = krb5_copy_principal(authctxt->krb5_ctx,
 123                                       ticket->enc_part2->client,
 124                                       &authctxt->krb5_user);
 125 #endif
 126         if (problem)
 127                 goto err;
 128
 129         /* if client wants mutual auth */
 130         problem = krb5_mk_rep(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
 131             reply);
 132         if (problem)
 133                 goto err;
 134
 135         /* Check .k5login authorization now. */
 136         if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
 137             authctxt->pw->pw_name))
 138                 goto err;
 139
 140         if (client)
 141                 krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
 142                     client);
 143
 144         ret = 1;
 145  err:
 146         if (server)
 147                 krb5_free_principal(authctxt->krb5_ctx, server);
 148         if (ticket)
 149                 krb5_free_ticket(authctxt->krb5_ctx, ticket);
 150         if (!ret && reply->length) {
 151                 xfree(reply->data);
 152                 memset(reply, 0, sizeof(*reply));
 153         }
 154
 155         if (problem) {
 156                 if (authctxt->krb5_ctx != NULL)
 157                         debug("Kerberos v5 authentication failed: %s",
 158                             krb5_get_err_text(authctxt->krb5_ctx, problem));
 159                 else
 160                         debug("Kerberos v5 authentication failed: %d",
 161                             problem);
 162         }
 163
 164         return (ret);
 165 }
 166
 167 int
 168 auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt)
 169 {
 170         krb5_error_code problem;
 171         krb5_ccache ccache = NULL;
 172         char *pname;
 173         krb5_creds **creds;
 174
 175         if (authctxt->pw == NULL || authctxt->krb5_user == NULL)
 176                 return (0);
 177
 178         temporarily_use_uid(authctxt->pw);
 179
 180 #ifdef HEIMDAL
 181         problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops, &ccache);
 182 #else
 183 {
 184         char ccname[40];
 185         int tmpfd;
 186
 187         snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
 188
 189         if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
 190                 logit("mkstemp(): %.100s", strerror(errno));
 191                 problem = errno;
 192                 goto fail;
 193         }
 194         if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
 195                 logit("fchmod(): %.100s", strerror(errno));
 196                 close(tmpfd);
 197                 problem = errno;
 198                 goto fail;
 199         }
 200         close(tmpfd);
 201         problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &ccache);
 202 }
 203 #endif
 204         if (problem)
 205                 goto fail;
 206
 207         problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
 208             authctxt->krb5_user);
 209         if (problem)
 210                 goto fail;
 211
 212 #ifdef HEIMDAL
 213         problem = krb5_rd_cred2(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
 214             ccache, tgt);
 215         if (problem)
 216                 goto fail;
 217 #else
 218         problem = krb5_rd_cred(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
 219             tgt, &creds, NULL);
 220         if (problem)
 221                 goto fail;
 222         problem = krb5_cc_store_cred(authctxt->krb5_ctx, ccache, *creds);
 223         if (problem)
 224                 goto fail;
 225 #endif
 226
 227         authctxt->krb5_fwd_ccache = ccache;
 228         ccache = NULL;
 229
 230         authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
 231
 232         problem = krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
 233             &pname);
 234         if (problem)
 235                 goto fail;
 236
 237         debug("Kerberos v5 TGT accepted (%s)", pname);
 238
 239         restore_uid();
 240
 241         return (1);
 242
 243  fail:
 244         if (problem)
 245                 debug("Kerberos v5 TGT passing failed: %s",
 246                     krb5_get_err_text(authctxt->krb5_ctx, problem));
 247         if (ccache)
 248                 krb5_cc_destroy(authctxt->krb5_ctx, ccache);
 249
 250         restore_uid();
 251
 252         return (0);
 253 }
 254
 255 int
 256 auth_krb5_password(Authctxt *authctxt, const char *password)
 257 {
 258 #ifndef HEIMDAL
 259         krb5_creds creds;
 260         krb5_principal server;
 261         char ccname[40];
 262         int tmpfd;
 263 #endif
 264         krb5_error_code problem;
 265         krb5_ccache ccache = NULL;
 266
 267         if (authctxt->pw == NULL)
 268                 return (0);
 269
 270         temporarily_use_uid(authctxt->pw);
 271
 272         problem = krb5_init(authctxt);
 273         if (problem)
 274                 goto out;
 275
 276         problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
 277                     &authctxt->krb5_user);
 278         if (problem)
 279                 goto out;
 280
 281 #ifdef HEIMDAL
 282         problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops, &ccache);
 283         if (problem)
 284                 goto out;
 285
 286         problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
 287                 authctxt->krb5_user);
 288         if (problem)
 289                 goto out;
 290
 291         restore_uid();
 292
 293         problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
 294             ccache, password, 1, NULL);
 295
 296         temporarily_use_uid(authctxt->pw);
 297
 298         if (problem)
 299                 goto out;
 300         problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops,
 301             &authctxt->krb5_fwd_ccache);
 302         if (problem)
 303                 goto out;
 304
 305         problem = krb5_cc_copy_cache(authctxt->krb5_ctx, ccache,
 306             authctxt->krb5_fwd_ccache);
 307         krb5_cc_destroy(authctxt->krb5_ctx, ccache);
 308         ccache = NULL;
 309         if (problem)
 310                 goto out;
 311
 312 #else
 313         problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
 314             authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
 315         if (problem)
 316                 goto out;
 317
 318         problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
 319             KRB5_NT_SRV_HST, &server);
 320         if (problem)
 321                 goto out;
 322
 323         restore_uid();
 324         problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
 325             NULL, NULL, NULL);
 326         krb5_free_principal(authctxt->krb5_ctx, server);
 327         temporarily_use_uid(authctxt->pw);
 328         if (problem)
 329                 goto out;
 330
 331         if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
 332                           authctxt->pw->pw_name)) {
 333                 problem = -1;
 334                 goto out;
 335         }
 336
 337         snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
 338
 339         if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
 340                 logit("mkstemp(): %.100s", strerror(errno));
 341                 problem = errno;
 342                 goto out;
 343         }
 344
 345         if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
 346                 logit("fchmod(): %.100s", strerror(errno));
 347                 close(tmpfd);
 348                 problem = errno;
 349                 goto out;
 350         }
 351         close(tmpfd);
 352
 353         problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
 354         if (problem)
 355                 goto out;
 356
 357         problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
 358                                      authctxt->krb5_user);
 359         if (problem)
 360                 goto out;
 361
 362         problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
 363                                  &creds);
 364         if (problem)
 365                 goto out;
 366 #endif
 367
 368         authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
 369
 370  out:
 371         restore_uid();
 372
 373         if (problem) {
 374                 if (ccache)
 375                         krb5_cc_destroy(authctxt->krb5_ctx, ccache);
 376
 377                 if (authctxt->krb5_ctx != NULL && problem!=-1)
 378                         debug("Kerberos password authentication failed: %s",
 379                             krb5_get_err_text(authctxt->krb5_ctx, problem));
 380                 else
 381                         debug("Kerberos password authentication failed: %d",
 382                             problem);
 383
 384                 krb5_cleanup_proc(authctxt);
 385
 386                 if (options.kerberos_or_local_passwd)
 387                         return (-1);
 388                 else
 389                         return (0);
 390         }
 391         return (1);
 392 }
 393
 394 void
 395 krb5_cleanup_proc(void *context)
 396 {
 397         Authctxt *authctxt = (Authctxt *)context;
 398
 399         debug("krb5_cleanup_proc called");
 400         if (authctxt->krb5_fwd_ccache) {
 401                 krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
 402                 authctxt->krb5_fwd_ccache = NULL;
 403         }
 404         if (authctxt->krb5_user) {
 405                 krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
 406                 authctxt->krb5_user = NULL;
 407         }
 408         if (authctxt->krb5_auth_ctx) {
 409                 krb5_auth_con_free(authctxt->krb5_ctx,
 410                     authctxt->krb5_auth_ctx);
 411                 authctxt->krb5_auth_ctx = NULL;
 412         }
 413         if (authctxt->krb5_ctx) {
 414                 krb5_free_context(authctxt->krb5_ctx);
 415                 authctxt->krb5_ctx = NULL;
 416         }
 417 }
 418
 419 #endif /* KRB5 */