- markus@cvs.openbsd.org 2001/02/12 16:16:23

[openssh.git] / auth2.c

diff --git a/auth2.c b/auth2.c
index bab1c2ed83777a33ae092f3359186aaa55209a12..3cd946877333cdbdf2763564fabbe5dc69b6c43a 100644 (file)
--- a/auth2.c
+++ b/auth2.c
@@ -23,35 +23,28 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth2.c,v 1.28 2001/01/18 17:00:00 markus Exp $");
+RCSID("$OpenBSD: auth2.c,v 1.41 2001/02/12 16:16:23 markus Exp $");
 
-#ifdef HAVE_OSF_SIA
-# include <sia.h>
-# include <siad.h>
-#endif
-
-#include <openssl/dsa.h>
-#include <openssl/rsa.h>
 #include <openssl/evp.h>
 
+#include "ssh2.h"
 #include "xmalloc.h"
 #include "rsa.h"
-#include "ssh.h"
 #include "pty.h"
 #include "packet.h"
 #include "buffer.h"
+#include "log.h"
 #include "servconf.h"
 #include "compat.h"
 #include "channels.h"
 #include "bufaux.h"
-#include "ssh2.h"
 #include "auth.h"
 #include "session.h"
 #include "dispatch.h"
-#include "auth.h"
 #include "key.h"
+#include "cipher.h"
 #include "kex.h"
-
+#include "pathnames.h"
 #include "uidswap.h"
 #include "auth-options.h"
 
@@ -63,10 +56,6 @@ extern int session_id2_len;
 #ifdef WITH_AIXAUTHENTICATE
 extern char *aixloginmsg;
 #endif
-#ifdef HAVE_OSF_SIA
-extern int saved_argc;
-extern char **saved_argv;
-#endif
 
 static Authctxt        *x_authctxt = NULL;
 static int one = 1;
@@ -104,12 +93,12 @@ Authmethod authmethods[] = {
        {"publickey",
                userauth_pubkey,
                &options.pubkey_authentication},
-       {"keyboard-interactive",
-               userauth_kbdint,
-               &options.kbd_interactive_authentication},
        {"password",
                userauth_passwd,
                &options.password_authentication},
+       {"keyboard-interactive",
+               userauth_kbdint,
+               &options.kbd_interactive_authentication},
        {NULL, NULL, NULL}
 };
 
@@ -124,13 +113,10 @@ do_authentication2()
 
        x_authctxt = authctxt;          /*XXX*/
 
-#ifdef AFS
-       /* If machine has AFS, set process authentication group. */
-       if (k_hasafs()) {
-               k_setpag();
-               k_unlog();
-       }
-#endif
+       /* challenge-reponse is implemented via keyboard interactive */
+       if (options.challenge_reponse_authentication)
+               options.kbd_interactive_authentication = 1;
+
        dispatch_init(&protocol_error);
        dispatch_set(SSH2_MSG_SERVICE_REQUEST, &input_service_request);
        dispatch_run(DISPATCH_BLOCK, &authctxt->success, authctxt);
@@ -244,7 +230,8 @@ input_userauth_request(int type, int plen, void *ctxt)
                    authctxt->user);
 
        /* Special handling for root */
-       if (authenticated && authctxt->pw->pw_uid == 0 && !auth_root_allowed())
+       if (authenticated && authctxt->pw->pw_uid == 0 &&
+           !auth_root_allowed(method))
                authenticated = 0;
 
 #ifdef USE_PAM
@@ -297,17 +284,18 @@ done:
        return;
 }
 
-void   
+void
 userauth_reply(Authctxt *authctxt, int authenticated)
 {
        char *methods;
 
        /* XXX todo: check if multiple auth methods are needed */
-       if (authenticated) {
+       if (authenticated == 1) {
 #ifdef WITH_AIXAUTHENTICATE
                /* We don't have a pty yet, so just label the line as "ssh" */
-               if (loginsuccess(authctxt->user?authctxt->user:"NOUSER", 
-                       get_canonical_hostname(), "ssh", &aixloginmsg) < 0)
+               if (loginsuccess(authctxt->user?authctxt->user:"NOUSER",
+                   get_canonical_hostname(options.reverse_mapping_check),
+                   "ssh", &aixloginmsg) < 0)
                        aixloginmsg = NULL;
 #endif /* WITH_AIXAUTHENTICATE */
                /* turn off userauth */
@@ -319,7 +307,7 @@ userauth_reply(Authctxt *authctxt, int authenticated)
                authctxt->success = 1;
        } else {
                if (authctxt->failures++ > AUTH_FAIL_MAX)
-                        packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
+                       packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
                methods = authmethods_get();
                packet_start(SSH2_MSG_USERAUTH_FAILURE);
                packet_put_cstring(methods);
@@ -338,11 +326,11 @@ userauth_none(Authctxt *authctxt)
        if (m != NULL)
                m->enabled = NULL;
        packet_done();
-        userauth_banner();
+       userauth_banner();
 
        if (authctxt->valid == 0)
                return(0);
-               
+
 #ifdef HAVE_CYGWIN
        if (check_nt_auth(1, authctxt->pw->pw_uid) == 0)
                return(0);
@@ -350,9 +338,7 @@ userauth_none(Authctxt *authctxt)
 #ifdef USE_PAM
        return auth_pam_password(authctxt->pw, "");
 #elif defined(HAVE_OSF_SIA)
-       return (sia_validate_user(NULL, saved_argc, saved_argv, 
-               get_canonical_hostname(), authctxt->user?authctxt->user:"NOUSER", 
-                       NULL, 0, NULL, "") == SIASUCCESS);
+       return 0;
 #else /* !HAVE_OSF_SIA && !USE_PAM */
        return auth_password(authctxt->pw, "");
 #endif /* USE_PAM */
@@ -377,9 +363,7 @@ userauth_passwd(Authctxt *authctxt)
 #ifdef USE_PAM
            auth_pam_password(authctxt->pw, password) == 1)
 #elif defined(HAVE_OSF_SIA)
-           sia_validate_user(NULL, saved_argc, saved_argv, 
-                       get_canonical_hostname(), authctxt->user?authctxt->user:"NOUSER", 
-                       NULL, 0, NULL, password) == SIASUCCESS)
+           auth_sia_password(authctxt->user, password) == 1)
 #else /* !USE_PAM && !HAVE_OSF_SIA */
            auth_password(authctxt->pw, password) == 1)
 #endif /* USE_PAM */
@@ -402,7 +386,8 @@ userauth_kbdint(Authctxt *authctxt)
 
        debug("keyboard-interactive language %s devs %s", lang, devs);
 
-       authenticated = auth2_challenge(authctxt, devs);
+       if (options.challenge_reponse_authentication)
+               authenticated = auth2_challenge(authctxt, devs);
 
 #ifdef USE_PAM
        if (authenticated == 0)
@@ -506,7 +491,7 @@ userauth_pubkey(Authctxt *authctxt)
                                packet_put_string(pkblob, blen);
                                packet_send();
                                packet_write_wait();
-                               authenticated = -1;
+                               authctxt->postponed = 1;
                        }
                }
                if (authenticated != 1)
@@ -583,7 +568,7 @@ authmethod_lookup(const char *name)
 int
 user_key_allowed(struct passwd *pw, Key *key)
 {
-       char line[8192], file[1024];
+       char line[8192], file[MAXPATHLEN];
        int found_key = 0;
        FILE *f;
        u_long linenum = 0;
@@ -598,7 +583,7 @@ user_key_allowed(struct passwd *pw, Key *key)
 
        /* The authorized keys. */
        snprintf(file, sizeof file, "%.500s/%.100s", pw->pw_dir,
-           SSH_USER_PERMITTED_KEYS2);
+           _PATH_SSH_USER_PERMITTED_KEYS2);
 
        /* Fail quietly if file does not exist */
        if (stat(file, &st) < 0) {
@@ -626,10 +611,10 @@ user_key_allowed(struct passwd *pw, Key *key)
                            key_type(key), pw->pw_name, file);
                        fail = 1;
                } else {
-                       /* Check path to SSH_USER_PERMITTED_KEYS */
+                       /* Check path to _PATH_SSH_USER_PERMITTED_KEYS */
                        int i;
                        static const char *check[] = {
-                               "", SSH_USER_DIR, NULL
+                               "", _PATH_SSH_USER_DIR, NULL
                        };
                        for (i = 0; check[i]; i++) {
                                snprintf(line, sizeof line, "%.500s/%.100s",
@@ -686,7 +671,7 @@ user_key_allowed(struct passwd *pw, Key *key)
                        }
                }
                if (key_equal(found, key) &&
-                   auth_parse_options(pw, options, linenum) == 1) {
+                   auth_parse_options(pw, options, file, linenum) == 1) {
                        found_key = 1;
                        debug("matching key found: file %s, line %ld",
                            file, linenum);