2 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * As far as I am concerned, the code I have written for this software
6 * can be used freely for any purpose. Any derived versions of this
7 * software must be clearly marked as such, and if the derived work is
8 * incompatible with the protocol description in the RFC file, it must be
9 * called by a name other than "ssh" or "Secure Shell".
12 * Copyright (c) 2000 Markus Friedl. All rights reserved.
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in the
21 * documentation and/or other materials provided with the distribution.
23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
24 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
27 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36 RCSID("$OpenBSD: auth.c,v 1.10 2000/09/07 21:13:36 markus Exp $");
53 #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
55 #endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
63 extern ServerOptions options;
66 * Check if the user is allowed to log in via ssh. If user is listed in
67 * DenyUsers or user's primary group is listed in DenyGroups, false will
68 * be returned. If AllowUsers isn't empty and user isn't listed there, or
69 * if AllowGroups isn't empty and user isn't listed there, false will be
71 * If the user's shell is not executable, false will be returned.
72 * Otherwise true is returned.
75 allowed_user(struct passwd * pw)
81 #ifdef WITH_AIXAUTHENTICATE
83 #endif /* WITH_AIXAUTHENTICATE */
84 #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) && \
85 defined(HAS_SHADOW_EXPIRE)
88 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
92 spw = getspnam(pw->pw_name);
94 int days = time(NULL) / 86400;
96 /* Check account expiry */
97 if ((spw->sp_expire > 0) && (days > spw->sp_expire))
100 /* Check password expiry */
101 if ((spw->sp_lstchg > 0) && (spw->sp_inact > 0) &&
102 (days > (spw->sp_lstchg + spw->sp_inact)))
106 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
112 * Get the shell from the password data. An empty shell field is
113 * legal, and means /bin/sh.
115 shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
117 /* deny if shell does not exists or is not executable */
118 if (stat(shell, &st) != 0)
120 if (!((st.st_mode & S_IFREG) && (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP))))
123 /* Return false if user is listed in DenyUsers */
124 if (options.num_deny_users > 0) {
127 for (i = 0; i < options.num_deny_users; i++)
128 if (match_pattern(pw->pw_name, options.deny_users[i]))
131 /* Return false if AllowUsers isn't empty and user isn't listed there */
132 if (options.num_allow_users > 0) {
135 for (i = 0; i < options.num_allow_users; i++)
136 if (match_pattern(pw->pw_name, options.allow_users[i]))
138 /* i < options.num_allow_users iff we break for loop */
139 if (i >= options.num_allow_users)
142 /* Get the primary group name if we need it. Return false if it fails */
143 if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
144 grp = getgrgid(pw->pw_gid);
148 /* Return false if user's group is listed in DenyGroups */
149 if (options.num_deny_groups > 0) {
152 for (i = 0; i < options.num_deny_groups; i++)
153 if (match_pattern(grp->gr_name, options.deny_groups[i]))
157 * Return false if AllowGroups isn't empty and user's group
160 if (options.num_allow_groups > 0) {
163 for (i = 0; i < options.num_allow_groups; i++)
164 if (match_pattern(grp->gr_name, options.allow_groups[i]))
166 /* i < options.num_allow_groups iff we break for
168 if (i >= options.num_allow_groups)
173 #ifdef WITH_AIXAUTHENTICATE
174 if (loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) {
175 if (loginmsg && *loginmsg) {
176 /* Remove embedded newlines (if any) */
178 for (p = loginmsg; *p; p++) {
182 /* Remove trailing newline */
184 log("Login restricted for %s: %.100s", pw->pw_name, loginmsg);
188 #endif /* WITH_AIXAUTHENTICATE */
190 /* We found no reason not to let this user try to log on... */