Cray fixes (bug 367) based on patch from Wendy Palm @ cray.

[openssh.git] / auth1.c

diff --git a/auth1.c b/auth1.c
index 4c295215f20c549a4c10be5594d5eb2d99d1efba..676c8a667d58899f27180a1a8956688cbf9892fc 100644 (file)
--- a/auth1.c
+++ b/auth1.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth1.c,v 1.37 2002/03/18 01:12:14 provos Exp $");
+RCSID("$OpenBSD: auth1.c,v 1.43 2002/09/09 06:48:06 itojun Exp $");
 
 #include "xmalloc.h"
 #include "rsa.h"
@@ -24,8 +24,8 @@ RCSID("$OpenBSD: auth1.c,v 1.37 2002/03/18 01:12:14 provos Exp $");
 #include "auth.h"
 #include "channels.h"
 #include "session.h"
-#include "misc.h"
 #include "uidswap.h"
+#include "monitor_wrap.h"
 
 /* import */
 extern ServerOptions options;
@@ -84,13 +84,7 @@ do_authloop(Authctxt *authctxt)
 #if defined(KRB4) || defined(KRB5)
            (!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
 #endif
-#ifdef USE_PAM
-           auth_pam_password(pw, "")) {
-#elif defined(HAVE_OSF_SIA)
-           0) {
-#else
-           auth_password(authctxt, "")) {
-#endif
+           PRIVSEP(auth_password(authctxt, ""))) {
                auth_log(authctxt, 1, "without authentication", "");
                return;
        }
@@ -139,15 +133,27 @@ do_authloop(Authctxt *authctxt)
 #endif /* KRB4 */
                                } else {
 #ifdef KRB5
-                                       krb5_data tkt;
+                                       krb5_data tkt, reply;
                                        tkt.length = dlen;
                                        tkt.data = kdata;
 
-                                       if (auth_krb5(authctxt, &tkt, &client_user)) {
+                                       if (PRIVSEP(auth_krb5(authctxt, &tkt,
+                                           &client_user, &reply))) {
                                                authenticated = 1;
                                                snprintf(info, sizeof(info),
                                                    " tktuser %.100s",
                                                    client_user);
+ 
+                                               /* Send response to client */
+                                               packet_start(
+                                                   SSH_SMSG_AUTH_KERBEROS_RESPONSE);
+                                               packet_put_string((char *)
+                                                   reply.data, reply.length);
+                                               packet_send();
+                                               packet_write_wait();
+
+                                               if (reply.length)
+                                                       xfree(reply.data);
                                        }
 #endif /* KRB5 */
                                }
@@ -209,7 +215,7 @@ do_authloop(Authctxt *authctxt)
                        if (bits != BN_num_bits(client_host_key->rsa->n))
                                verbose("Warning: keysize mismatch for client_host_key: "
                                    "actual %d, announced %d",
-                                    BN_num_bits(client_host_key->rsa->n), bits);
+                                   BN_num_bits(client_host_key->rsa->n), bits);
                        packet_check_eom();
 
                        authenticated = auth_rhosts_rsa(pw, client_user,
@@ -246,17 +252,8 @@ do_authloop(Authctxt *authctxt)
                        password = packet_get_string(&dlen);
                        packet_check_eom();
 
-#ifdef USE_PAM
-                       /* Do PAM auth with password */
-                       authenticated = auth_pam_password(pw, password);
-#elif defined(HAVE_OSF_SIA)
-                       /* Do SIA auth with password */
-                       authenticated = auth_sia_password(authctxt->user, 
-                           password);
-#else /* !USE_PAM && !HAVE_OSF_SIA */
                        /* Try authentication with the password. */
-                       authenticated = auth_password(authctxt, password);
-#endif /* USE_PAM */
+                       authenticated = PRIVSEP(auth_password(authctxt, password));
 
                        memset(password, 0, strlen(password));
                        xfree(password);
@@ -307,6 +304,15 @@ do_authloop(Authctxt *authctxt)
                        fatal("INTERNAL ERROR: authenticated invalid user %s",
                            authctxt->user);
 
+#ifdef _UNICOS
+               if (type == SSH_CMSG_AUTH_PASSWORD && !authenticated)
+                       cray_login_failure(authctxt->user, IA_UDBERR);
+               if (authenticated && cray_access_denied(authctxt->user)) {
+                       authenticated = 0;
+                       fatal("Access denied for user %s.",authctxt->user);
+               }
+#endif /* _UNICOS */
+
 #ifdef HAVE_CYGWIN
                if (authenticated &&
                    !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, pw)) {
@@ -316,12 +322,14 @@ do_authloop(Authctxt *authctxt)
                }
 #else
                /* Special handling for root */
-               if (authenticated && authctxt->pw->pw_uid == 0 &&
+               if (!use_privsep &&
+                   authenticated && authctxt->pw->pw_uid == 0 &&
                    !auth_root_allowed(get_authname(type)))
                        authenticated = 0;
 #endif
 #ifdef USE_PAM
-               if (authenticated && !do_pam_account(pw->pw_name, client_user))
+               if (!use_privsep && authenticated && 
+                   !do_pam_account(pw->pw_name, client_user))
                        authenticated = 0;
 #endif
 
@@ -337,11 +345,6 @@ do_authloop(Authctxt *authctxt)
                        return;
 
                if (authctxt->failures++ > AUTH_FAIL_MAX) {
-#ifdef WITH_AIXAUTHENTICATE
-                       loginfailed(authctxt->user,
-                           get_canonical_hostname(options.verify_reverse_mapping),
-                           "ssh");
-#endif /* WITH_AIXAUTHENTICATE */
                        packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
                }
 
@@ -359,9 +362,8 @@ Authctxt *
 do_authentication(void)
 {
        Authctxt *authctxt;
-       struct passwd *pw;
        u_int ulen;
-       char *p, *user, *style = NULL;
+       char *user, *style = NULL;
 
        /* Get the name of the user that we wish to log in as. */
        packet_read_expect(SSH_CMSG_USER);
@@ -373,29 +375,31 @@ do_authentication(void)
        if ((style = strchr(user, ':')) != NULL)
                *style++ = '\0';
 
+#ifdef KRB5
        /* XXX - SSH.com Kerberos v5 braindeath. */
-       if ((p = strchr(user, '@')) != NULL)
-               *p = '\0';
+       if ((datafellows & SSH_BUG_K5USER) &&
+           options.kerberos_authentication) {
+               char *p;
+               if ((p = strchr(user, '@')) != NULL)
+                       *p = '\0';
+       }
+#endif
 
        authctxt = authctxt_new();
        authctxt->user = user;
        authctxt->style = style;
 
        /* Verify that the user is a valid user. */
-       pw = getpwnamallow(user);
-       if (pw) {
+       if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
                authctxt->valid = 1;
-               pw = pwcopy(pw);
-       } else {
+       else
                debug("do_authentication: illegal user %s", user);
-               pw = NULL;
-       }
-       authctxt->pw = pw;
 
-       setproctitle("%s", pw ? user : "unknown");
+       setproctitle("%s%s", authctxt->pw ? user : "unknown",
+           use_privsep ? " [net]" : "");
 
 #ifdef USE_PAM
-       start_pam(pw == NULL ? "NOUSER" : user);
+       PRIVSEP(start_pam(authctxt->pw == NULL ? "NOUSER" : user));
 #endif
 
        /*
@@ -403,7 +407,8 @@ do_authentication(void)
         * the server. (Unless you are running Windows)
         */
 #ifndef HAVE_CYGWIN
-       if (getuid() != 0 && pw && pw->pw_uid != getuid())
+       if (!use_privsep && getuid() != 0 && authctxt->pw &&
+           authctxt->pw->pw_uid != getuid())
                packet_disconnect("Cannot change user when server not running as root.");
 #endif