auth-pam.c

   1 /*-
   2  * Copyright (c) 2002 Networks Associates Technology, Inc.
   3  * All rights reserved.
   4  *
   5  * This software was developed for the FreeBSD Project by ThinkSec AS and
   6  * NAI Labs, the Security Research Division of Network Associates, Inc.
   7  * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
   8  * DARPA CHATS research program.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31 /*
  32  * Copyright (c) 2003,2004 Damien Miller <djm@mindrot.org>
  33  * Copyright (c) 2003,2004 Darren Tucker <dtucker@zip.com.au>
  34  *
  35  * Permission to use, copy, modify, and distribute this software for any
  36  * purpose with or without fee is hereby granted, provided that the above
  37  * copyright notice and this permission notice appear in all copies.
  38  *
  39  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  40  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  41  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  42  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  43  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  44  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  45  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  46  */
  47
  48 /* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
  49 #include "includes.h"
  50 RCSID("$Id$");
  51
  52 #ifdef USE_PAM
  53 #if defined(HAVE_SECURITY_PAM_APPL_H)
  54 #include <security/pam_appl.h>
  55 #elif defined (HAVE_PAM_PAM_APPL_H)
  56 #include <pam/pam_appl.h>
  57 #endif
  58
  59 #include "auth.h"
  60 #include "auth-pam.h"
  61 #include "buffer.h"
  62 #include "bufaux.h"
  63 #include "canohost.h"
  64 #include "log.h"
  65 #include "monitor_wrap.h"
  66 #include "msg.h"
  67 #include "packet.h"
  68 #include "misc.h"
  69 #include "servconf.h"
  70 #include "ssh2.h"
  71 #include "xmalloc.h"
  72 #include "auth-options.h"
  73
  74 extern ServerOptions options;
  75 extern Buffer loginmsg;
  76 extern int compat20;
  77 extern u_int utmp_len;
  78
  79 #ifdef USE_POSIX_THREADS
  80 #include <pthread.h>
  81 /*
  82  * Avoid namespace clash when *not* using pthreads for systems *with*
  83  * pthreads, which unconditionally define pthread_t via sys/types.h
  84  * (e.g. Linux)
  85  */
  86 typedef pthread_t sp_pthread_t;
  87 #else
  88 typedef pid_t sp_pthread_t;
  89 #endif
  90
  91 struct pam_ctxt {
  92         sp_pthread_t     pam_thread;
  93         int              pam_psock;
  94         int              pam_csock;
  95         int              pam_done;
  96 };
  97
  98 static void sshpam_free_ctx(void *);
  99 static struct pam_ctxt *cleanup_ctxt;
 100
 101 #ifndef USE_POSIX_THREADS
 102 /*
 103  * Simulate threads with processes.
 104  */
 105
 106 static int sshpam_thread_status = -1;
 107 static mysig_t sshpam_oldsig;
 108
 109 static void
 110 sshpam_sigchld_handler(int sig)
 111 {
 112         signal(SIGCHLD, SIG_DFL);
 113         if (cleanup_ctxt == NULL)
 114                 return; /* handler called after PAM cleanup, shouldn't happen */
 115         if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG)
 116              == -1) {
 117                 /* PAM thread has not exitted, privsep slave must have */
 118                 kill(cleanup_ctxt->pam_thread, SIGTERM);
 119                 if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0)
 120                     == -1)
 121                         return; /* could not wait */
 122         }
 123         if (WIFSIGNALED(sshpam_thread_status) &&
 124             WTERMSIG(sshpam_thread_status) == SIGTERM)
 125                 return; /* terminated by pthread_cancel */
 126         if (!WIFEXITED(sshpam_thread_status))
 127                 fatal("PAM: authentication thread exited unexpectedly");
 128         if (WEXITSTATUS(sshpam_thread_status) != 0)
 129                 fatal("PAM: authentication thread exited uncleanly");
 130 }
 131
 132 static void
 133 pthread_exit(void *value __unused)
 134 {
 135         _exit(0);
 136 }
 137
 138 static int
 139 pthread_create(sp_pthread_t *thread, const void *attr __unused,
 140     void *(*thread_start)(void *), void *arg)
 141 {
 142         pid_t pid;
 143
 144         sshpam_thread_status = -1;
 145         switch ((pid = fork())) {
 146         case -1:
 147                 error("fork(): %s", strerror(errno));
 148                 return (-1);
 149         case 0:
 150                 thread_start(arg);
 151                 _exit(1);
 152         default:
 153                 *thread = pid;
 154                 sshpam_oldsig = signal(SIGCHLD, sshpam_sigchld_handler);
 155                 return (0);
 156         }
 157 }
 158
 159 static int
 160 pthread_cancel(sp_pthread_t thread)
 161 {
 162         signal(SIGCHLD, sshpam_oldsig);
 163         return (kill(thread, SIGTERM));
 164 }
 165
 166 static int
 167 pthread_join(sp_pthread_t thread, void **value __unused)
 168 {
 169         int status;
 170
 171         if (sshpam_thread_status != -1)
 172                 return (sshpam_thread_status);
 173         signal(SIGCHLD, sshpam_oldsig);
 174         waitpid(thread, &status, 0);
 175         return (status);
 176 }
 177 #endif
 178
 179
 180 static pam_handle_t *sshpam_handle = NULL;
 181 static int sshpam_err = 0;
 182 static int sshpam_authenticated = 0;
 183 static int sshpam_session_open = 0;
 184 static int sshpam_cred_established = 0;
 185 static int sshpam_account_status = -1;
 186 static char **sshpam_env = NULL;
 187 static Authctxt *sshpam_authctxt = NULL;
 188 static const char *sshpam_password = NULL;
 189
 190 /* Some PAM implementations don't implement this */
 191 #ifndef HAVE_PAM_GETENVLIST
 192 static char **
 193 pam_getenvlist(pam_handle_t *pamh)
 194 {
 195         /*
 196          * XXX - If necessary, we can still support envrionment passing
 197          * for platforms without pam_getenvlist by searching for known
 198          * env vars (e.g. KRB5CCNAME) from the PAM environment.
 199          */
 200          return NULL;
 201 }
 202 #endif
 203
 204 void
 205 sshpam_password_change_required(int reqd)
 206 {
 207         debug3("%s %d", __func__, reqd);
 208         if (sshpam_authctxt == NULL)
 209                 fatal("%s: PAM authctxt not initialized", __func__);
 210         sshpam_authctxt->force_pwchange = reqd;
 211         if (reqd) {
 212                 no_port_forwarding_flag |= 2;
 213                 no_agent_forwarding_flag |= 2;
 214                 no_x11_forwarding_flag |= 2;
 215         } else {
 216                 no_port_forwarding_flag &= ~2;
 217                 no_agent_forwarding_flag &= ~2;
 218                 no_x11_forwarding_flag &= ~2;
 219         }
 220 }
 221
 222 /* Import regular and PAM environment from subprocess */
 223 static void
 224 import_environments(Buffer *b)
 225 {
 226         char *env;
 227         u_int i, num_env;
 228         int err;
 229
 230         debug3("PAM: %s entering", __func__);
 231
 232 #ifndef USE_POSIX_THREADS
 233         /* Import variables set by do_pam_account */
 234         sshpam_account_status = buffer_get_int(b);
 235         sshpam_password_change_required(buffer_get_int(b));
 236
 237         /* Import environment from subprocess */
 238         num_env = buffer_get_int(b);
 239         sshpam_env = xmalloc((num_env + 1) * sizeof(*sshpam_env));
 240         debug3("PAM: num env strings %d", num_env);
 241         for(i = 0; i < num_env; i++)
 242                 sshpam_env[i] = buffer_get_string(b, NULL);
 243
 244         sshpam_env[num_env] = NULL;
 245
 246         /* Import PAM environment from subprocess */
 247         num_env = buffer_get_int(b);
 248         debug("PAM: num PAM env strings %d", num_env);
 249         for(i = 0; i < num_env; i++) {
 250                 env = buffer_get_string(b, NULL);
 251
 252 #ifdef HAVE_PAM_PUTENV
 253                 /* Errors are not fatal here */
 254                 if ((err = pam_putenv(sshpam_handle, env)) != PAM_SUCCESS) {
 255                         error("PAM: pam_putenv: %s",
 256                             pam_strerror(sshpam_handle, sshpam_err));
 257                 }
 258 #endif
 259         }
 260 #endif
 261 }
 262
 263 /*
 264  * Conversation function for authentication thread.
 265  */
 266 static int
 267 sshpam_thread_conv(int n, struct pam_message **msg,
 268     struct pam_response **resp, void *data)
 269 {
 270         Buffer buffer;
 271         struct pam_ctxt *ctxt;
 272         struct pam_response *reply;
 273         int i;
 274
 275         debug3("PAM: %s entering, %d messages", __func__, n);
 276         *resp = NULL;
 277
 278         if (data == NULL) {
 279                 error("PAM: conversation function passed a null context");
 280                 return (PAM_CONV_ERR);
 281         }
 282         ctxt = data;
 283         if (n <= 0 || n > PAM_MAX_NUM_MSG)
 284                 return (PAM_CONV_ERR);
 285
 286         if ((reply = malloc(n * sizeof(*reply))) == NULL)
 287                 return (PAM_CONV_ERR);
 288         memset(reply, 0, n * sizeof(*reply));
 289
 290         buffer_init(&buffer);
 291         for (i = 0; i < n; ++i) {
 292                 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
 293                 case PAM_PROMPT_ECHO_OFF:
 294                         buffer_put_cstring(&buffer,
 295                             PAM_MSG_MEMBER(msg, i, msg));
 296                         if (ssh_msg_send(ctxt->pam_csock,
 297                             PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
 298                                 goto fail;
 299                         if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
 300                                 goto fail;
 301                         if (buffer_get_char(&buffer) != PAM_AUTHTOK)
 302                                 goto fail;
 303                         reply[i].resp = buffer_get_string(&buffer, NULL);
 304                         break;
 305                 case PAM_PROMPT_ECHO_ON:
 306                         buffer_put_cstring(&buffer,
 307                             PAM_MSG_MEMBER(msg, i, msg));
 308                         if (ssh_msg_send(ctxt->pam_csock,
 309                             PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
 310                                 goto fail;
 311                         if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
 312                                 goto fail;
 313                         if (buffer_get_char(&buffer) != PAM_AUTHTOK)
 314                                 goto fail;
 315                         reply[i].resp = buffer_get_string(&buffer, NULL);
 316                         break;
 317                 case PAM_ERROR_MSG:
 318                         buffer_put_cstring(&buffer,
 319                             PAM_MSG_MEMBER(msg, i, msg));
 320                         if (ssh_msg_send(ctxt->pam_csock,
 321                             PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
 322                                 goto fail;
 323                         break;
 324                 case PAM_TEXT_INFO:
 325                         buffer_put_cstring(&buffer,
 326                             PAM_MSG_MEMBER(msg, i, msg));
 327                         if (ssh_msg_send(ctxt->pam_csock,
 328                             PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
 329                                 goto fail;
 330                         break;
 331                 default:
 332                         goto fail;
 333                 }
 334                 buffer_clear(&buffer);
 335         }
 336         buffer_free(&buffer);
 337         *resp = reply;
 338         return (PAM_SUCCESS);
 339
 340  fail:
 341         for(i = 0; i < n; i++) {
 342                 if (reply[i].resp != NULL)
 343                         xfree(reply[i].resp);
 344         }
 345         xfree(reply);
 346         buffer_free(&buffer);
 347         return (PAM_CONV_ERR);
 348 }
 349
 350 /*
 351  * Authentication thread.
 352  */
 353 static void *
 354 sshpam_thread(void *ctxtp)
 355 {
 356         struct pam_ctxt *ctxt = ctxtp;
 357         Buffer buffer;
 358         struct pam_conv sshpam_conv;
 359         int flags = (options.permit_empty_passwd == 0 ?
 360             PAM_DISALLOW_NULL_AUTHTOK : 0);
 361 #ifndef USE_POSIX_THREADS
 362         extern char **environ;
 363         char **env_from_pam;
 364         u_int i;
 365         const char *pam_user;
 366
 367         pam_get_item(sshpam_handle, PAM_USER, (void **)&pam_user);
 368         setproctitle("%s [pam]", pam_user);
 369         environ[0] = NULL;
 370 #endif
 371
 372         sshpam_conv.conv = sshpam_thread_conv;
 373         sshpam_conv.appdata_ptr = ctxt;
 374
 375         if (sshpam_authctxt == NULL)
 376                 fatal("%s: PAM authctxt not initialized", __func__);
 377
 378         buffer_init(&buffer);
 379         sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
 380             (const void *)&sshpam_conv);
 381         if (sshpam_err != PAM_SUCCESS)
 382                 goto auth_fail;
 383         sshpam_err = pam_authenticate(sshpam_handle, flags);
 384         if (sshpam_err != PAM_SUCCESS)
 385                 goto auth_fail;
 386
 387         if (compat20) {
 388                 if (!do_pam_account())
 389                         goto auth_fail;
 390                 if (sshpam_authctxt->force_pwchange) {
 391                         sshpam_err = pam_chauthtok(sshpam_handle,
 392                             PAM_CHANGE_EXPIRED_AUTHTOK);
 393                         if (sshpam_err != PAM_SUCCESS)
 394                                 goto auth_fail;
 395                         sshpam_password_change_required(0);
 396                 }
 397         }
 398
 399         buffer_put_cstring(&buffer, "OK");
 400
 401 #ifndef USE_POSIX_THREADS
 402         /* Export variables set by do_pam_account */
 403         buffer_put_int(&buffer, sshpam_account_status);
 404         buffer_put_int(&buffer, sshpam_authctxt->force_pwchange);
 405
 406         /* Export any environment strings set in child */
 407         for(i = 0; environ[i] != NULL; i++)
 408                 ; /* Count */
 409         buffer_put_int(&buffer, i);
 410         for(i = 0; environ[i] != NULL; i++)
 411                 buffer_put_cstring(&buffer, environ[i]);
 412
 413         /* Export any environment strings set by PAM in child */
 414         env_from_pam = pam_getenvlist(sshpam_handle);
 415         for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
 416                 ; /* Count */
 417         buffer_put_int(&buffer, i);
 418         for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
 419                 buffer_put_cstring(&buffer, env_from_pam[i]);
 420 #endif /* USE_POSIX_THREADS */
 421
 422         /* XXX - can't do much about an error here */
 423         ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
 424         buffer_free(&buffer);
 425         pthread_exit(NULL);
 426
 427  auth_fail:
 428         buffer_put_cstring(&buffer,
 429             pam_strerror(sshpam_handle, sshpam_err));
 430         /* XXX - can't do much about an error here */
 431         ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
 432         buffer_free(&buffer);
 433         pthread_exit(NULL);
 434
 435         return (NULL); /* Avoid warning for non-pthread case */
 436 }
 437
 438 void
 439 sshpam_thread_cleanup(void)
 440 {
 441         struct pam_ctxt *ctxt = cleanup_ctxt;
 442
 443         debug3("PAM: %s entering", __func__);
 444         if (ctxt != NULL && ctxt->pam_thread != 0) {
 445                 pthread_cancel(ctxt->pam_thread);
 446                 pthread_join(ctxt->pam_thread, NULL);
 447                 close(ctxt->pam_psock);
 448                 close(ctxt->pam_csock);
 449                 memset(ctxt, 0, sizeof(*ctxt));
 450                 cleanup_ctxt = NULL;
 451         }
 452 }
 453
 454 static int
 455 sshpam_null_conv(int n, struct pam_message **msg,
 456     struct pam_response **resp, void *data)
 457 {
 458         debug3("PAM: %s entering, %d messages", __func__, n);
 459         return (PAM_CONV_ERR);
 460 }
 461
 462 static struct pam_conv null_conv = { sshpam_null_conv, NULL };
 463
 464 void
 465 sshpam_cleanup(void)
 466 {
 467         debug("PAM: cleanup");
 468         if (sshpam_handle == NULL)
 469                 return;
 470         pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
 471         if (sshpam_cred_established) {
 472                 pam_setcred(sshpam_handle, PAM_DELETE_CRED);
 473                 sshpam_cred_established = 0;
 474         }
 475         if (sshpam_session_open) {
 476                 pam_close_session(sshpam_handle, PAM_SILENT);
 477                 sshpam_session_open = 0;
 478         }
 479         sshpam_authenticated = 0;
 480         pam_end(sshpam_handle, sshpam_err);
 481         sshpam_handle = NULL;
 482 }
 483
 484 static int
 485 sshpam_init(Authctxt *authctxt)
 486 {
 487         extern char *__progname;
 488         const char *pam_rhost, *pam_user, *user = authctxt->user;
 489
 490         if (sshpam_handle != NULL) {
 491                 /* We already have a PAM context; check if the user matches */
 492                 sshpam_err = pam_get_item(sshpam_handle,
 493                     PAM_USER, (void **)&pam_user);
 494                 if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0)
 495                         return (0);
 496                 pam_end(sshpam_handle, sshpam_err);
 497                 sshpam_handle = NULL;
 498         }
 499         debug("PAM: initializing for \"%s\"", user);
 500         sshpam_err =
 501             pam_start(SSHD_PAM_SERVICE, user, &null_conv, &sshpam_handle);
 502         sshpam_authctxt = authctxt;
 503
 504         if (sshpam_err != PAM_SUCCESS) {
 505                 pam_end(sshpam_handle, sshpam_err);
 506                 sshpam_handle = NULL;
 507                 return (-1);
 508         }
 509         pam_rhost = get_remote_name_or_ip(utmp_len, options.use_dns);
 510         debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
 511         sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
 512         if (sshpam_err != PAM_SUCCESS) {
 513                 pam_end(sshpam_handle, sshpam_err);
 514                 sshpam_handle = NULL;
 515                 return (-1);
 516         }
 517 #ifdef PAM_TTY_KLUDGE
 518         /*
 519          * Some silly PAM modules (e.g. pam_time) require a TTY to operate.
 520          * sshd doesn't set the tty until too late in the auth process and
 521          * may not even set one (for tty-less connections)
 522          */
 523         debug("PAM: setting PAM_TTY to \"ssh\"");
 524         sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, "ssh");
 525         if (sshpam_err != PAM_SUCCESS) {
 526                 pam_end(sshpam_handle, sshpam_err);
 527                 sshpam_handle = NULL;
 528                 return (-1);
 529         }
 530 #endif
 531         return (0);
 532 }
 533
 534 static void *
 535 sshpam_init_ctx(Authctxt *authctxt)
 536 {
 537         struct pam_ctxt *ctxt;
 538         int socks[2];
 539
 540         debug3("PAM: %s entering", __func__);
 541         /* Refuse to start if we don't have PAM enabled */
 542         if (!options.use_pam)
 543                 return NULL;
 544
 545         /* Initialize PAM */
 546         if (sshpam_init(authctxt) == -1) {
 547                 error("PAM: initialization failed");
 548                 return (NULL);
 549         }
 550
 551         ctxt = xmalloc(sizeof *ctxt);
 552         memset(ctxt, 0, sizeof(*ctxt));
 553
 554         /* Start the authentication thread */
 555         if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
 556                 error("PAM: failed create sockets: %s", strerror(errno));
 557                 xfree(ctxt);
 558                 return (NULL);
 559         }
 560         ctxt->pam_psock = socks[0];
 561         ctxt->pam_csock = socks[1];
 562         if (pthread_create(&ctxt->pam_thread, NULL, sshpam_thread, ctxt) == -1) {
 563                 error("PAM: failed to start authentication thread: %s",
 564                     strerror(errno));
 565                 close(socks[0]);
 566                 close(socks[1]);
 567                 xfree(ctxt);
 568                 return (NULL);
 569         }
 570         cleanup_ctxt = ctxt;
 571         return (ctxt);
 572 }
 573
 574 static int
 575 sshpam_query(void *ctx, char **name, char **info,
 576     u_int *num, char ***prompts, u_int **echo_on)
 577 {
 578         Buffer buffer;
 579         struct pam_ctxt *ctxt = ctx;
 580         size_t plen;
 581         u_char type;
 582         char *msg;
 583         size_t len;
 584
 585         debug3("PAM: %s entering", __func__);
 586         buffer_init(&buffer);
 587         *name = xstrdup("");
 588         *info = xstrdup("");
 589         *prompts = xmalloc(sizeof(char *));
 590         **prompts = NULL;
 591         plen = 0;
 592         *echo_on = xmalloc(sizeof(u_int));
 593         while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) {
 594                 type = buffer_get_char(&buffer);
 595                 msg = buffer_get_string(&buffer, NULL);
 596                 switch (type) {
 597                 case PAM_PROMPT_ECHO_ON:
 598                 case PAM_PROMPT_ECHO_OFF:
 599                         *num = 1;
 600                         len = plen + strlen(msg) + 1;
 601                         **prompts = xrealloc(**prompts, len);
 602                         plen += snprintf(**prompts + plen, len, "%s", msg);
 603                         **echo_on = (type == PAM_PROMPT_ECHO_ON);
 604                         xfree(msg);
 605                         return (0);
 606                 case PAM_ERROR_MSG:
 607                 case PAM_TEXT_INFO:
 608                         /* accumulate messages */
 609                         len = plen + strlen(msg) + 2;
 610                         **prompts = xrealloc(**prompts, len);
 611                         plen += snprintf(**prompts + plen, len, "%s\n", msg);
 612                         xfree(msg);
 613                         break;
 614                 case PAM_SUCCESS:
 615                 case PAM_AUTH_ERR:
 616                         if (**prompts != NULL) {
 617                                 /* drain any accumulated messages */
 618                                 debug("PAM: %s", **prompts);
 619                                 buffer_append(&loginmsg, **prompts,
 620                                     strlen(**prompts));
 621                                 xfree(**prompts);
 622                                 **prompts = NULL;
 623                         }
 624                         if (type == PAM_SUCCESS) {
 625                                 import_environments(&buffer);
 626                                 *num = 0;
 627                                 **echo_on = 0;
 628                                 ctxt->pam_done = 1;
 629                                 xfree(msg);
 630                                 return (0);
 631                         }
 632                         error("PAM: %s for %s%.100s from %.100s", msg,
 633                             sshpam_authctxt->valid ? "" : "illegal user ",
 634                             sshpam_authctxt->user,
 635                             get_remote_name_or_ip(utmp_len, options.use_dns));
 636                         /* FALLTHROUGH */
 637                 default:
 638                         *num = 0;
 639                         **echo_on = 0;
 640                         xfree(msg);
 641                         ctxt->pam_done = -1;
 642                         return (-1);
 643                 }
 644         }
 645         return (-1);
 646 }
 647
 648 /* XXX - see also comment in auth-chall.c:verify_response */
 649 static int
 650 sshpam_respond(void *ctx, u_int num, char **resp)
 651 {
 652         Buffer buffer;
 653         struct pam_ctxt *ctxt = ctx;
 654
 655         debug2("PAM: %s entering, %d responses", __func__, num);
 656         switch (ctxt->pam_done) {
 657         case 1:
 658                 sshpam_authenticated = 1;
 659                 return (0);
 660         case 0:
 661                 break;
 662         default:
 663                 return (-1);
 664         }
 665         if (num != 1) {
 666                 error("PAM: expected one response, got %u", num);
 667                 return (-1);
 668         }
 669         buffer_init(&buffer);
 670         buffer_put_cstring(&buffer, *resp);
 671         if (ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer) == -1) {
 672                 buffer_free(&buffer);
 673                 return (-1);
 674         }
 675         buffer_free(&buffer);
 676         return (1);
 677 }
 678
 679 static void
 680 sshpam_free_ctx(void *ctxtp)
 681 {
 682         struct pam_ctxt *ctxt = ctxtp;
 683
 684         debug3("PAM: %s entering", __func__);
 685         sshpam_thread_cleanup();
 686         xfree(ctxt);
 687         /*
 688          * We don't call sshpam_cleanup() here because we may need the PAM
 689          * handle at a later stage, e.g. when setting up a session.  It's
 690          * still on the cleanup list, so pam_end() *will* be called before
 691          * the server process terminates.
 692          */
 693 }
 694
 695 KbdintDevice sshpam_device = {
 696         "pam",
 697         sshpam_init_ctx,
 698         sshpam_query,
 699         sshpam_respond,
 700         sshpam_free_ctx
 701 };
 702
 703 KbdintDevice mm_sshpam_device = {
 704         "pam",
 705         mm_sshpam_init_ctx,
 706         mm_sshpam_query,
 707         mm_sshpam_respond,
 708         mm_sshpam_free_ctx
 709 };
 710
 711 /*
 712  * This replaces auth-pam.c
 713  */
 714 void
 715 start_pam(Authctxt *authctxt)
 716 {
 717         if (!options.use_pam)
 718                 fatal("PAM: initialisation requested when UsePAM=no");
 719
 720         if (sshpam_init(authctxt) == -1)
 721                 fatal("PAM: initialisation failed");
 722 }
 723
 724 void
 725 finish_pam(void)
 726 {
 727         sshpam_cleanup();
 728 }
 729
 730 u_int
 731 do_pam_account(void)
 732 {
 733         if (sshpam_account_status != -1)
 734                 return (sshpam_account_status);
 735
 736         sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
 737         debug3("PAM: %s pam_acct_mgmt = %d", __func__, sshpam_err);
 738
 739         if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
 740                 sshpam_account_status = 0;
 741                 return (sshpam_account_status);
 742         }
 743
 744         if (sshpam_err == PAM_NEW_AUTHTOK_REQD)
 745                 sshpam_password_change_required(1);
 746
 747         sshpam_account_status = 1;
 748         return (sshpam_account_status);
 749 }
 750
 751 void
 752 do_pam_set_tty(const char *tty)
 753 {
 754         if (tty != NULL) {
 755                 debug("PAM: setting PAM_TTY to \"%s\"", tty);
 756                 sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, tty);
 757                 if (sshpam_err != PAM_SUCCESS)
 758                         fatal("PAM: failed to set PAM_TTY: %s",
 759                             pam_strerror(sshpam_handle, sshpam_err));
 760         }
 761 }
 762
 763 void
 764 do_pam_setcred(int init)
 765 {
 766         sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
 767             (const void *)&null_conv);
 768         if (sshpam_err != PAM_SUCCESS)
 769                 fatal("PAM: failed to set PAM_CONV: %s",
 770                     pam_strerror(sshpam_handle, sshpam_err));
 771         if (init) {
 772                 debug("PAM: establishing credentials");
 773                 sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED);
 774         } else {
 775                 debug("PAM: reinitializing credentials");
 776                 sshpam_err = pam_setcred(sshpam_handle, PAM_REINITIALIZE_CRED);
 777         }
 778         if (sshpam_err == PAM_SUCCESS) {
 779                 sshpam_cred_established = 1;
 780                 return;
 781         }
 782         if (sshpam_authenticated)
 783                 fatal("PAM: pam_setcred(): %s",
 784                     pam_strerror(sshpam_handle, sshpam_err));
 785         else
 786                 debug("PAM: pam_setcred(): %s",
 787                     pam_strerror(sshpam_handle, sshpam_err));
 788 }
 789
 790 static int
 791 sshpam_tty_conv(int n, struct pam_message **msg,
 792     struct pam_response **resp, void *data)
 793 {
 794         char input[PAM_MAX_MSG_SIZE];
 795         struct pam_response *reply;
 796         int i;
 797
 798         debug3("PAM: %s called with %d messages", __func__, n);
 799
 800         *resp = NULL;
 801
 802         if (n <= 0 || n > PAM_MAX_NUM_MSG || !isatty(STDIN_FILENO))
 803                 return (PAM_CONV_ERR);
 804
 805         if ((reply = malloc(n * sizeof(*reply))) == NULL)
 806                 return (PAM_CONV_ERR);
 807         memset(reply, 0, n * sizeof(*reply));
 808
 809         for (i = 0; i < n; ++i) {
 810                 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
 811                 case PAM_PROMPT_ECHO_OFF:
 812                         reply[i].resp =
 813                             read_passphrase(PAM_MSG_MEMBER(msg, i, msg),
 814                             RP_ALLOW_STDIN);
 815                         reply[i].resp_retcode = PAM_SUCCESS;
 816                         break;
 817                 case PAM_PROMPT_ECHO_ON:
 818                         fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
 819                         fgets(input, sizeof input, stdin);
 820                         reply[i].resp = xstrdup(input);
 821                         reply[i].resp_retcode = PAM_SUCCESS;
 822                         break;
 823                 case PAM_ERROR_MSG:
 824                 case PAM_TEXT_INFO:
 825                         fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
 826                         reply[i].resp_retcode = PAM_SUCCESS;
 827                         break;
 828                 default:
 829                         goto fail;
 830                 }
 831         }
 832         *resp = reply;
 833         return (PAM_SUCCESS);
 834
 835  fail:
 836         for(i = 0; i < n; i++) {
 837                 if (reply[i].resp != NULL)
 838                         xfree(reply[i].resp);
 839         }
 840         xfree(reply);
 841         return (PAM_CONV_ERR);
 842 }
 843
 844 static struct pam_conv tty_conv = { sshpam_tty_conv, NULL };
 845
 846 /*
 847  * XXX this should be done in the authentication phase, but ssh1 doesn't
 848  * support that
 849  */
 850 void
 851 do_pam_chauthtok(void)
 852 {
 853         if (use_privsep)
 854                 fatal("Password expired (unable to change with privsep)");
 855         sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
 856             (const void *)&tty_conv);
 857         if (sshpam_err != PAM_SUCCESS)
 858                 fatal("PAM: failed to set PAM_CONV: %s",
 859                     pam_strerror(sshpam_handle, sshpam_err));
 860         debug("PAM: changing password");
 861         sshpam_err = pam_chauthtok(sshpam_handle, PAM_CHANGE_EXPIRED_AUTHTOK);
 862         if (sshpam_err != PAM_SUCCESS)
 863                 fatal("PAM: pam_chauthtok(): %s",
 864                     pam_strerror(sshpam_handle, sshpam_err));
 865 }
 866
 867 static int
 868 sshpam_store_conv(int n, struct pam_message **msg,
 869     struct pam_response **resp, void *data)
 870 {
 871         struct pam_response *reply;
 872         int i;
 873         size_t len;
 874
 875         debug3("PAM: %s called with %d messages", __func__, n);
 876         *resp = NULL;
 877
 878         if (n <= 0 || n > PAM_MAX_NUM_MSG)
 879                 return (PAM_CONV_ERR);
 880
 881         if ((reply = malloc(n * sizeof(*reply))) == NULL)
 882                 return (PAM_CONV_ERR);
 883         memset(reply, 0, n * sizeof(*reply));
 884
 885         for (i = 0; i < n; ++i) {
 886                 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
 887                 case PAM_ERROR_MSG:
 888                 case PAM_TEXT_INFO:
 889                         len = strlen(PAM_MSG_MEMBER(msg, i, msg));
 890                         buffer_append(&loginmsg, PAM_MSG_MEMBER(msg, i, msg), len);
 891                         buffer_append(&loginmsg, "\n", 1 );
 892                         reply[i].resp_retcode = PAM_SUCCESS;
 893                         break;
 894                 default:
 895                         goto fail;
 896                 }
 897         }
 898         *resp = reply;
 899         return (PAM_SUCCESS);
 900
 901  fail:
 902         for(i = 0; i < n; i++) {
 903                 if (reply[i].resp != NULL)
 904                         xfree(reply[i].resp);
 905         }
 906         xfree(reply);
 907         return (PAM_CONV_ERR);
 908 }
 909
 910 static struct pam_conv store_conv = { sshpam_store_conv, NULL };
 911
 912 void
 913 do_pam_session(void)
 914 {
 915         debug3("PAM: opening session");
 916         sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
 917             (const void *)&store_conv);
 918         if (sshpam_err != PAM_SUCCESS)
 919                 fatal("PAM: failed to set PAM_CONV: %s",
 920                     pam_strerror(sshpam_handle, sshpam_err));
 921         sshpam_err = pam_open_session(sshpam_handle, 0);
 922         if (sshpam_err != PAM_SUCCESS)
 923                 fatal("PAM: pam_open_session(): %s",
 924                     pam_strerror(sshpam_handle, sshpam_err));
 925         sshpam_session_open = 1;
 926 }
 927
 928 /*
 929  * Set a PAM environment string. We need to do this so that the session
 930  * modules can handle things like Kerberos/GSI credentials that appear
 931  * during the ssh authentication process.
 932  */
 933 int
 934 do_pam_putenv(char *name, char *value)
 935 {
 936         int ret = 1;
 937 #ifdef HAVE_PAM_PUTENV
 938         char *compound;
 939         size_t len;
 940
 941         len = strlen(name) + strlen(value) + 2;
 942         compound = xmalloc(len);
 943
 944         snprintf(compound, len, "%s=%s", name, value);
 945         ret = pam_putenv(sshpam_handle, compound);
 946         xfree(compound);
 947 #endif
 948
 949         return (ret);
 950 }
 951
 952 char **
 953 fetch_pam_child_environment(void)
 954 {
 955         return sshpam_env;
 956 }
 957
 958 char **
 959 fetch_pam_environment(void)
 960 {
 961         return (pam_getenvlist(sshpam_handle));
 962 }
 963
 964 void
 965 free_pam_environment(char **env)
 966 {
 967         char **envp;
 968
 969         if (env == NULL)
 970                 return;
 971
 972         for (envp = env; *envp; envp++)
 973                 xfree(*envp);
 974         xfree(env);
 975 }
 976
 977 /*
 978  * "Blind" conversation function for password authentication.  Assumes that
 979  * echo-off prompts are for the password and stores messages for later
 980  * display.
 981  */
 982 static int
 983 sshpam_passwd_conv(int n, struct pam_message **msg,
 984     struct pam_response **resp, void *data)
 985 {
 986         struct pam_response *reply;
 987         int i;
 988         size_t len;
 989
 990         debug3("PAM: %s called with %d messages", __func__, n);
 991
 992         *resp = NULL;
 993
 994         if (n <= 0 || n > PAM_MAX_NUM_MSG)
 995                 return (PAM_CONV_ERR);
 996
 997         if ((reply = malloc(n * sizeof(*reply))) == NULL)
 998                 return (PAM_CONV_ERR);
 999         memset(reply, 0, n * sizeof(*reply));
1000
1001         for (i = 0; i < n; ++i) {
1002                 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
1003                 case PAM_PROMPT_ECHO_OFF:
1004                         if (sshpam_password == NULL)
1005                                 goto fail;
1006                         reply[i].resp = xstrdup(sshpam_password);
1007                         reply[i].resp_retcode = PAM_SUCCESS;
1008                         break;
1009                 case PAM_ERROR_MSG:
1010                 case PAM_TEXT_INFO:
1011                         len = strlen(PAM_MSG_MEMBER(msg, i, msg));
1012                         if (len > 0) {
1013                                 buffer_append(&loginmsg,
1014                                     PAM_MSG_MEMBER(msg, i, msg), len);
1015                                 buffer_append(&loginmsg, "\n", 1);
1016                         }
1017                         reply[i].resp = xstrdup("");
1018                         reply[i].resp_retcode = PAM_SUCCESS;
1019                         break;
1020                 default:
1021                         goto fail;
1022                 }
1023         }
1024         *resp = reply;
1025         return (PAM_SUCCESS);
1026
1027  fail:
1028         for(i = 0; i < n; i++) {
1029                 if (reply[i].resp != NULL)
1030                         xfree(reply[i].resp);
1031         }
1032         xfree(reply);
1033         return (PAM_CONV_ERR);
1034 }
1035
1036 static struct pam_conv passwd_conv = { sshpam_passwd_conv, NULL };
1037
1038 /*
1039  * Attempt password authentication via PAM
1040  */
1041 int
1042 sshpam_auth_passwd(Authctxt *authctxt, const char *password)
1043 {
1044         int flags = (options.permit_empty_passwd == 0 ?
1045             PAM_DISALLOW_NULL_AUTHTOK : 0);
1046         static char badpw[] = "\b\n\r\177INCORRECT";
1047
1048         if (!options.use_pam || sshpam_handle == NULL)
1049                 fatal("PAM: %s called when PAM disabled or failed to "
1050                     "initialise.", __func__);
1051
1052         sshpam_password = password;
1053         sshpam_authctxt = authctxt;
1054
1055         /*
1056          * If the user logging in is invalid, or is root but is not permitted
1057          * by PermitRootLogin, use an invalid password to prevent leaking
1058          * information via timing (eg if the PAM config has a delay on fail).
1059          */
1060         if (!authctxt->valid || (authctxt->pw->pw_uid == 0 &&
1061              options.permit_root_login != PERMIT_YES))
1062                 sshpam_password = badpw;
1063
1064         sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
1065             (const void *)&passwd_conv);
1066         if (sshpam_err != PAM_SUCCESS)
1067                 fatal("PAM: %s: failed to set PAM_CONV: %s", __func__,
1068                     pam_strerror(sshpam_handle, sshpam_err));
1069
1070         sshpam_err = pam_authenticate(sshpam_handle, flags);
1071         sshpam_password = NULL;
1072         if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
1073                 debug("PAM: password authentication accepted for %.100s",
1074                     authctxt->user);
1075                return 1;
1076         } else {
1077                 debug("PAM: password authentication failed for %.100s: %s",
1078                     authctxt->valid ? authctxt->user : "an illegal user",
1079                     pam_strerror(sshpam_handle, sshpam_err));
1080                 return 0;
1081         }
1082 }
1083 #endif /* USE_PAM */