-/*
- * Author: Damien Miller
- * Copyright (c) 1999 Damien Miller <djm@mindrot.org>
- * All rights reserved
- * Created: Thursday December 30 1999
- * PAM authentication and session management code.
+/*-
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed for the FreeBSD Project by ThinkSec AS and
+ * NAI Labs, the Security Research Division of Network Associates, Inc.
+ * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
+ * DARPA CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
*/
+/* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
#include "includes.h"
+RCSID("$Id$");
#ifdef USE_PAM
-#include "ssh.h"
-#include "xmalloc.h"
+#include <security/pam_appl.h>
+
+#include "auth.h"
+#include "auth-pam.h"
+#include "buffer.h"
+#include "bufaux.h"
+#include "canohost.h"
+#include "log.h"
+#include "monitor_wrap.h"
+#include "msg.h"
+#include "packet.h"
+#include "readpass.h"
#include "servconf.h"
+#include "ssh2.h"
+#include "xmalloc.h"
+#include "auth-options.h"
-RCSID("$Id$");
+extern ServerOptions options;
-/* Callbacks */
-static int pamconv(int num_msg, const struct pam_message **msg,
- struct pam_response **resp, void *appdata_ptr);
-void pam_cleanup_proc(void *context);
+#define __unused
-/* module-local variables */
-static struct pam_conv conv = {
- pamconv,
- NULL
-};
-static struct pam_handle_t *pamh = NULL;
-static const char *pampasswd = NULL;
-static char *pamconv_msg = NULL;
-
-/* PAM conversation function. This is really a kludge to get the password */
-/* into PAM and to pick up any messages generated by PAM into pamconv_msg */
-static int pamconv(int num_msg, const struct pam_message **msg,
- struct pam_response **resp, void *appdata_ptr)
-{
- struct pam_response *reply;
- int count;
- size_t msg_len;
- char *p;
-
- /* PAM will free this later */
- reply = malloc(num_msg * sizeof(*reply));
- if (reply == NULL)
- return PAM_CONV_ERR;
-
- for(count = 0; count < num_msg; count++) {
- switch (msg[count]->msg_style) {
- case PAM_PROMPT_ECHO_OFF:
- if (pampasswd == NULL) {
- free(reply);
- return PAM_CONV_ERR;
- }
- reply[count].resp_retcode = PAM_SUCCESS;
- reply[count].resp = xstrdup(pampasswd);
- break;
-
- case PAM_TEXT_INFO:
- reply[count].resp_retcode = PAM_SUCCESS;
- reply[count].resp = xstrdup("");
-
- if (msg[count]->msg == NULL)
- break;
-
- debug("Adding PAM message: %s", msg[count]->msg);
-
- msg_len = strlen(msg[count]->msg);
- if (pamconv_msg) {
- size_t n = strlen(pamconv_msg);
- pamconv_msg = xrealloc(pamconv_msg, n + msg_len + 2);
- p = pamconv_msg + n;
- } else {
- pamconv_msg = p = xmalloc(msg_len + 2);
- }
- memcpy(p, msg[count]->msg, msg_len);
- p[msg_len] = '\n';
- p[msg_len + 1] = '\0';
- break;
-
- case PAM_PROMPT_ECHO_ON:
- case PAM_ERROR_MSG:
- default:
- free(reply);
- return PAM_CONV_ERR;
- }
- }
+#ifdef USE_POSIX_THREADS
+#include <pthread.h>
+/*
+ * Avoid namespace clash when *not* using pthreads for systems *with*
+ * pthreads, which unconditionally define pthread_t via sys/types.h
+ * (e.g. Linux)
+ */
+typedef pthread_t sp_pthread_t;
+#else
+/*
+ * Simulate threads with processes.
+ */
+typedef pid_t sp_pthread_t;
+
+static void
+pthread_exit(void *value __unused)
+{
+ _exit(0);
+}
- *resp = reply;
+static int
+pthread_create(sp_pthread_t *thread, const void *attr __unused,
+ void *(*thread_start)(void *), void *arg)
+{
+ pid_t pid;
+
+ switch ((pid = fork())) {
+ case -1:
+ error("fork(): %s", strerror(errno));
+ return (-1);
+ case 0:
+ thread_start(arg);
+ _exit(1);
+ default:
+ *thread = pid;
+ return (0);
+ }
+}
- return PAM_SUCCESS;
+static int
+pthread_cancel(sp_pthread_t thread)
+{
+ return (kill(thread, SIGTERM));
}
-/* Called at exit to cleanly shutdown PAM */
-void pam_cleanup_proc(void *context)
+static int
+pthread_join(sp_pthread_t thread, void **value __unused)
{
- int pam_retval;
+ int status;
- if (pamh != NULL)
- {
- pam_retval = pam_close_session((pam_handle_t *)pamh, 0);
- if (pam_retval != PAM_SUCCESS) {
- log("Cannot close PAM session: %.200s",
- PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
- }
+ waitpid(thread, &status, 0);
+ return (status);
+}
+#endif
- pam_retval = pam_setcred((pam_handle_t *)pamh, PAM_DELETE_CRED);
- if (pam_retval != PAM_SUCCESS) {
- log("Cannot delete credentials: %.200s",
- PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
- }
- pam_retval = pam_end((pam_handle_t *)pamh, pam_retval);
- if (pam_retval != PAM_SUCCESS) {
- log("Cannot release PAM authentication: %.200s",
- PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+static pam_handle_t *sshpam_handle;
+static int sshpam_err;
+static int sshpam_authenticated;
+static int sshpam_new_authtok_reqd;
+static int sshpam_session_open;
+static int sshpam_cred_established;
+
+struct pam_ctxt {
+ sp_pthread_t pam_thread;
+ int pam_psock;
+ int pam_csock;
+ int pam_done;
+};
+
+static void sshpam_free_ctx(void *);
+
+/*
+ * Conversation function for authentication thread.
+ */
+static int
+sshpam_thread_conv(int n, const struct pam_message **msg,
+ struct pam_response **resp, void *data)
+{
+ Buffer buffer;
+ struct pam_ctxt *ctxt;
+ int i;
+
+ ctxt = data;
+ if (n <= 0 || n > PAM_MAX_NUM_MSG)
+ return (PAM_CONV_ERR);
+ *resp = xmalloc(n * sizeof **resp);
+ buffer_init(&buffer);
+ for (i = 0; i < n; ++i) {
+ resp[i]->resp_retcode = 0;
+ resp[i]->resp = NULL;
+ switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
+ case PAM_PROMPT_ECHO_OFF:
+ buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+ ssh_msg_send(ctxt->pam_csock,
+ PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+ ssh_msg_recv(ctxt->pam_csock, &buffer);
+ if (buffer_get_char(&buffer) != PAM_AUTHTOK)
+ goto fail;
+ resp[i]->resp = buffer_get_string(&buffer, NULL);
+ break;
+ case PAM_PROMPT_ECHO_ON:
+ buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+ ssh_msg_send(ctxt->pam_csock,
+ PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+ ssh_msg_recv(ctxt->pam_csock, &buffer);
+ if (buffer_get_char(&buffer) != PAM_AUTHTOK)
+ goto fail;
+ resp[i]->resp = buffer_get_string(&buffer, NULL);
+ break;
+ case PAM_ERROR_MSG:
+ buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+ ssh_msg_send(ctxt->pam_csock,
+ PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+ break;
+ case PAM_TEXT_INFO:
+ buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+ ssh_msg_send(ctxt->pam_csock,
+ PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+ break;
+ default:
+ goto fail;
}
+ buffer_clear(&buffer);
}
+ buffer_free(&buffer);
+ return (PAM_SUCCESS);
+ fail:
+ while (i)
+ xfree(resp[--i]);
+ xfree(*resp);
+ *resp = NULL;
+ buffer_free(&buffer);
+ return (PAM_CONV_ERR);
}
-/* Attempt password authentation using PAM */
-int auth_pam_password(struct passwd *pw, const char *password)
+/*
+ * Authentication thread.
+ */
+static void *
+sshpam_thread(void *ctxtp)
{
- extern ServerOptions options;
- int pam_retval;
+ struct pam_ctxt *ctxt = ctxtp;
+ Buffer buffer;
+ struct pam_conv sshpam_conv;
+#ifndef USE_POSIX_THREADS
+ const char *pam_user;
+
+ pam_get_item(sshpam_handle, PAM_USER, (const void **)&pam_user);
+ setproctitle("%s [pam]", pam_user);
+#endif
+
+ sshpam_conv.conv = sshpam_thread_conv;
+ sshpam_conv.appdata_ptr = ctxt;
+
+ buffer_init(&buffer);
+ sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+ (const void *)&sshpam_conv);
+ if (sshpam_err != PAM_SUCCESS)
+ goto auth_fail;
+ sshpam_err = pam_authenticate(sshpam_handle, 0);
+ if (sshpam_err != PAM_SUCCESS)
+ goto auth_fail;
+ buffer_put_cstring(&buffer, "OK");
+ ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
+ buffer_free(&buffer);
+ pthread_exit(NULL);
+
+ auth_fail:
+ buffer_put_cstring(&buffer,
+ pam_strerror(sshpam_handle, sshpam_err));
+ ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
+ buffer_free(&buffer);
+ pthread_exit(NULL);
+
+ return (NULL); /* Avoid warning for non-pthread case */
+}
- /* deny if no user. */
- if (pw == NULL)
- return 0;
- if (pw->pw_uid == 0 && options.permit_root_login == 2)
- return 0;
- if (*password == '\0' && options.permit_empty_passwd == 0)
- return 0;
+static void
+sshpam_thread_cleanup(void *ctxtp)
+{
+ struct pam_ctxt *ctxt = ctxtp;
- pampasswd = password;
-
- pam_retval = pam_authenticate((pam_handle_t *)pamh, 0);
- if (pam_retval == PAM_SUCCESS) {
- debug("PAM Password authentication accepted for user \"%.100s\"", pw->pw_name);
- return 1;
- } else {
- debug("PAM Password authentication for \"%.100s\" failed: %s",
- pw->pw_name, PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
- return 0;
+ pthread_cancel(ctxt->pam_thread);
+ pthread_join(ctxt->pam_thread, NULL);
+ close(ctxt->pam_psock);
+ close(ctxt->pam_csock);
+}
+
+static int
+sshpam_null_conv(int n, const struct pam_message **msg,
+ struct pam_response **resp, void *data)
+{
+ return (PAM_CONV_ERR);
+}
+
+static struct pam_conv null_conv = { sshpam_null_conv, NULL };
+
+static void
+sshpam_cleanup(void *arg)
+{
+ (void)arg;
+ debug("PAM: cleanup");
+ pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
+ if (sshpam_cred_established) {
+ pam_setcred(sshpam_handle, PAM_DELETE_CRED);
+ sshpam_cred_established = 0;
+ }
+ if (sshpam_session_open) {
+ pam_close_session(sshpam_handle, PAM_SILENT);
+ sshpam_session_open = 0;
+ }
+ sshpam_authenticated = sshpam_new_authtok_reqd = 0;
+ pam_end(sshpam_handle, sshpam_err);
+ sshpam_handle = NULL;
+}
+
+static int
+sshpam_init(const char *user)
+{
+ extern u_int utmp_len;
+ const char *pam_rhost, *pam_user;
+
+ if (sshpam_handle != NULL) {
+ /* We already have a PAM context; check if the user matches */
+ sshpam_err = pam_get_item(sshpam_handle,
+ PAM_USER, (const void **)&pam_user);
+ if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0)
+ return (0);
+ fatal_remove_cleanup(sshpam_cleanup, NULL);
+ pam_end(sshpam_handle, sshpam_err);
+ sshpam_handle = NULL;
+ }
+ debug("PAM: initializing for \"%s\"", user);
+ sshpam_err = pam_start("sshd", user, &null_conv, &sshpam_handle);
+ if (sshpam_err != PAM_SUCCESS) {
+ pam_end(sshpam_handle, sshpam_err);
+ sshpam_handle = NULL;
+ return (-1);
+ }
+ pam_rhost = get_remote_name_or_ip(utmp_len, options.use_dns);
+ debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
+ sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
+ if (sshpam_err != PAM_SUCCESS) {
+ pam_end(sshpam_handle, sshpam_err);
+ sshpam_handle = NULL;
+ return (-1);
+ }
+#ifdef PAM_TTY_KLUDGE
+ /*
+ * Some silly PAM modules (e.g. pam_time) require a TTY to operate.
+ * sshd doesn't set the tty until too late in the auth process and
+ * may not even set one (for tty-less connections)
+ */
+ debug("PAM: setting PAM_TTY to \"ssh\"");
+ sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, "ssh");
+ if (sshpam_err != PAM_SUCCESS) {
+ pam_end(sshpam_handle, sshpam_err);
+ sshpam_handle = NULL;
+ return (-1);
}
+#endif
+ fatal_add_cleanup(sshpam_cleanup, NULL);
+ return (0);
}
-/* Do account management using PAM */
-int do_pam_account(char *username, char *remote_user)
+static void *
+sshpam_init_ctx(Authctxt *authctxt)
{
- int pam_retval;
+ struct pam_ctxt *ctxt;
+ int socks[2];
- debug("PAM setting rhost to \"%.200s\"", get_canonical_hostname());
- pam_retval = pam_set_item((pam_handle_t *)pamh, PAM_RHOST,
- get_canonical_hostname());
- if (pam_retval != PAM_SUCCESS) {
- fatal("PAM set rhost failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+ /* Refuse to start if we don't have PAM enabled */
+ if (!options.use_pam)
+ return NULL;
+
+ /* Initialize PAM */
+ if (sshpam_init(authctxt->user) == -1) {
+ error("PAM: initialization failed");
+ return (NULL);
}
- if (remote_user != NULL) {
- debug("PAM setting ruser to \"%.200s\"", remote_user);
- pam_retval = pam_set_item((pam_handle_t *)pamh, PAM_RUSER, remote_user);
- if (pam_retval != PAM_SUCCESS) {
- fatal("PAM set ruser failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+ ctxt = xmalloc(sizeof *ctxt);
+ ctxt->pam_done = 0;
+
+ /* Start the authentication thread */
+ if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
+ error("PAM: failed create sockets: %s", strerror(errno));
+ xfree(ctxt);
+ return (NULL);
+ }
+ ctxt->pam_psock = socks[0];
+ ctxt->pam_csock = socks[1];
+ if (pthread_create(&ctxt->pam_thread, NULL, sshpam_thread, ctxt) == -1) {
+ error("PAM: failed to start authentication thread: %s",
+ strerror(errno));
+ close(socks[0]);
+ close(socks[1]);
+ xfree(ctxt);
+ return (NULL);
+ }
+ fatal_add_cleanup(sshpam_thread_cleanup, ctxt);
+ return (ctxt);
+}
+
+static int
+sshpam_query(void *ctx, char **name, char **info,
+ u_int *num, char ***prompts, u_int **echo_on)
+{
+ Buffer buffer;
+ struct pam_ctxt *ctxt = ctx;
+ size_t plen;
+ u_char type;
+ char *msg;
+ size_t len;
+
+ buffer_init(&buffer);
+ *name = xstrdup("");
+ *info = xstrdup("");
+ *prompts = xmalloc(sizeof(char *));
+ **prompts = NULL;
+ plen = 0;
+ *echo_on = xmalloc(sizeof(u_int));
+ while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) {
+ type = buffer_get_char(&buffer);
+ msg = buffer_get_string(&buffer, NULL);
+ switch (type) {
+ case PAM_PROMPT_ECHO_ON:
+ case PAM_PROMPT_ECHO_OFF:
+ *num = 1;
+ len = plen + strlen(msg) + 1;
+ **prompts = xrealloc(**prompts, len);
+ plen += snprintf(**prompts + plen, len, "%s", msg);
+ **echo_on = (type == PAM_PROMPT_ECHO_ON);
+ xfree(msg);
+ return (0);
+ case PAM_ERROR_MSG:
+ case PAM_TEXT_INFO:
+ /* accumulate messages */
+ len = plen + strlen(msg) + 1;
+ **prompts = xrealloc(**prompts, len);
+ plen += snprintf(**prompts + plen, len, "%s", msg);
+ xfree(msg);
+ break;
+ case PAM_SUCCESS:
+ case PAM_AUTH_ERR:
+ if (**prompts != NULL) {
+ /* drain any accumulated messages */
+#if 0 /* XXX - not compatible with privsep */
+ packet_start(SSH2_MSG_USERAUTH_BANNER);
+ packet_put_cstring(**prompts);
+ packet_put_cstring("");
+ packet_send();
+ packet_write_wait();
+#endif
+ xfree(**prompts);
+ **prompts = NULL;
+ }
+ if (type == PAM_SUCCESS) {
+ *num = 0;
+ **echo_on = 0;
+ ctxt->pam_done = 1;
+ xfree(msg);
+ return (0);
+ }
+ error("PAM: %s", msg);
+ default:
+ *num = 0;
+ **echo_on = 0;
+ xfree(msg);
+ ctxt->pam_done = -1;
+ return (-1);
}
}
+ return (-1);
+}
- pam_retval = pam_acct_mgmt((pam_handle_t *)pamh, 0);
- if (pam_retval != PAM_SUCCESS) {
- log("PAM rejected by account configuration: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
- return(0);
+/* XXX - see also comment in auth-chall.c:verify_response */
+static int
+sshpam_respond(void *ctx, u_int num, char **resp)
+{
+ Buffer buffer;
+ struct pam_ctxt *ctxt = ctx;
+
+ debug2("PAM: %s", __func__);
+ switch (ctxt->pam_done) {
+ case 1:
+ sshpam_authenticated = 1;
+ return (0);
+ case 0:
+ break;
+ default:
+ return (-1);
}
-
- return(1);
+ if (num != 1) {
+ error("PAM: expected one response, got %u", num);
+ return (-1);
+ }
+ buffer_init(&buffer);
+ buffer_put_cstring(&buffer, *resp);
+ ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer);
+ buffer_free(&buffer);
+ return (1);
+}
+
+static void
+sshpam_free_ctx(void *ctxtp)
+{
+ struct pam_ctxt *ctxt = ctxtp;
+
+ fatal_remove_cleanup(sshpam_thread_cleanup, ctxt);
+ sshpam_thread_cleanup(ctxtp);
+ xfree(ctxt);
+ /*
+ * We don't call sshpam_cleanup() here because we may need the PAM
+ * handle at a later stage, e.g. when setting up a session. It's
+ * still on the cleanup list, so pam_end() *will* be called before
+ * the server process terminates.
+ */
}
-/* Do PAM-specific session initialisation */
-void do_pam_session(char *username, const char *ttyname)
+KbdintDevice sshpam_device = {
+ "pam",
+ sshpam_init_ctx,
+ sshpam_query,
+ sshpam_respond,
+ sshpam_free_ctx
+};
+
+KbdintDevice mm_sshpam_device = {
+ "pam",
+ mm_sshpam_init_ctx,
+ mm_sshpam_query,
+ mm_sshpam_respond,
+ mm_sshpam_free_ctx
+};
+
+/*
+ * This replaces auth-pam.c
+ */
+void
+start_pam(const char *user)
{
- int pam_retval;
+ if (!options.use_pam)
+ fatal("PAM: initialisation requested when UsePAM=no");
- if (ttyname != NULL) {
- debug("PAM setting tty to \"%.200s\"", ttyname);
- pam_retval = pam_set_item((pam_handle_t *)pamh, PAM_TTY, ttyname);
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM set tty failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+ if (sshpam_init(user) == -1)
+ fatal("PAM: initialisation failed");
+}
+
+void
+finish_pam(void)
+{
+ fatal_remove_cleanup(sshpam_cleanup, NULL);
+ sshpam_cleanup(NULL);
+}
+
+u_int
+do_pam_account(void)
+{
+ sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
+ debug3("%s: pam_acct_mgmt = %d", __func__, sshpam_err);
+
+ if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD)
+ return (0);
+
+ if (sshpam_err == PAM_NEW_AUTHTOK_REQD) {
+ sshpam_new_authtok_reqd = 1;
+
+ /* Prevent forwardings until password changed */
+ no_port_forwarding_flag |= 2;
+ no_agent_forwarding_flag |= 2;
+ no_x11_forwarding_flag |= 2;
}
- pam_retval = pam_open_session((pam_handle_t *)pamh, 0);
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM session setup failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+ return (1);
}
-/* Set PAM credentials */
-void do_pam_setcred()
+void
+do_pam_session(const char *user, const char *tty)
{
- int pam_retval;
-
- debug("PAM establishing creds");
- pam_retval = pam_setcred((pam_handle_t *)pamh, PAM_ESTABLISH_CRED);
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM setcred failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+ sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+ (const void *)&null_conv);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: failed to set PAM_CONV: %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ if (tty != NULL) {
+ debug("PAM: setting PAM_TTY to \"%s\"", tty);
+ sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, tty);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: failed to set PAM_TTY: %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ }
+ sshpam_err = pam_open_session(sshpam_handle, 0);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: pam_open_session(): %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ sshpam_session_open = 1;
}
-/* Cleanly shutdown PAM */
-void finish_pam(void)
+void
+do_pam_setcred(int init)
{
- pam_cleanup_proc(NULL);
- fatal_remove_cleanup(&pam_cleanup_proc, NULL);
+ sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+ (const void *)&null_conv);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: failed to set PAM_CONV: %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ if (init) {
+ debug("PAM: establishing credentials");
+ sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED);
+ } else {
+ debug("PAM: reinitializing credentials");
+ sshpam_err = pam_setcred(sshpam_handle, PAM_REINITIALIZE_CRED);
+ }
+ if (sshpam_err == PAM_SUCCESS) {
+ sshpam_cred_established = 1;
+ return;
+ }
+ if (sshpam_authenticated)
+ fatal("PAM: pam_setcred(): %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ else
+ debug("PAM: pam_setcred(): %s",
+ pam_strerror(sshpam_handle, sshpam_err));
}
-/* Start PAM authentication for specified account */
-void start_pam(struct passwd *pw)
+int
+is_pam_password_change_required(void)
{
- int pam_retval;
+ return (sshpam_new_authtok_reqd);
+}
- debug("Starting up PAM with username \"%.200s\"", pw->pw_name);
+static int
+pam_chauthtok_conv(int n, const struct pam_message **msg,
+ struct pam_response **resp, void *data)
+{
+ char input[PAM_MAX_MSG_SIZE];
+ int i;
+
+ if (n <= 0 || n > PAM_MAX_NUM_MSG)
+ return (PAM_CONV_ERR);
+ *resp = xmalloc(n * sizeof **resp);
+ for (i = 0; i < n; ++i) {
+ switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
+ case PAM_PROMPT_ECHO_OFF:
+ resp[i]->resp =
+ read_passphrase(PAM_MSG_MEMBER(msg, i, msg),
+ RP_ALLOW_STDIN);
+ resp[i]->resp_retcode = PAM_SUCCESS;
+ break;
+ case PAM_PROMPT_ECHO_ON:
+ fputs(PAM_MSG_MEMBER(msg, i, msg), stderr);
+ fgets(input, sizeof input, stdin);
+ resp[i]->resp = xstrdup(input);
+ resp[i]->resp_retcode = PAM_SUCCESS;
+ break;
+ case PAM_ERROR_MSG:
+ case PAM_TEXT_INFO:
+ fputs(PAM_MSG_MEMBER(msg, i, msg), stderr);
+ resp[i]->resp_retcode = PAM_SUCCESS;
+ break;
+ default:
+ goto fail;
+ }
+ }
+ return (PAM_SUCCESS);
+ fail:
+ while (i)
+ xfree(resp[--i]);
+ xfree(*resp);
+ *resp = NULL;
+ return (PAM_CONV_ERR);
+}
- pam_retval = pam_start(SSHD_PAM_SERVICE, pw->pw_name, &conv,
- (pam_handle_t**)&pamh);
- if (pam_retval != PAM_SUCCESS)
- fatal("PAM initialisation failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+/*
+ * XXX this should be done in the authentication phase, but ssh1 doesn't
+ * support that
+ */
+void
+do_pam_chauthtok(void)
+{
+ struct pam_conv pam_conv;
+
+ pam_conv.conv = pam_chauthtok_conv;
+ pam_conv.appdata_ptr = NULL;
+
+ if (use_privsep)
+ fatal("Password expired (unable to change with privsep)");
+ sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+ (const void *)&pam_conv);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: failed to set PAM_CONV: %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+ debug("PAM: changing password");
+ sshpam_err = pam_chauthtok(sshpam_handle, PAM_CHANGE_EXPIRED_AUTHTOK);
+ if (sshpam_err != PAM_SUCCESS)
+ fatal("PAM: pam_chauthtok(): %s",
+ pam_strerror(sshpam_handle, sshpam_err));
+}
+
+/*
+ * Set a PAM environment string. We need to do this so that the session
+ * modules can handle things like Kerberos/GSI credentials that appear
+ * during the ssh authentication process.
+ */
+
+int
+do_pam_putenv(char *name, char *value)
+{
+ char *compound;
+ int ret = 1;
+
+#ifdef HAVE_PAM_PUTENV
+ compound = xmalloc(strlen(name)+strlen(value)+2);
+ if (compound) {
+ sprintf(compound,"%s=%s",name,value);
+ ret = pam_putenv(sshpam_handle,compound);
+ xfree(compound);
+ }
+#endif
+ return (ret);
+}
- fatal_add_cleanup(&pam_cleanup_proc, NULL);
+void
+print_pam_messages(void)
+{
+ /* XXX */
}
-/* Return list of PAM enviornment strings */
-char **fetch_pam_environment(void)
+char **
+fetch_pam_environment(void)
{
#ifdef HAVE_PAM_GETENVLIST
- return(pam_getenvlist((pam_handle_t *)pamh));
-#else /* HAVE_PAM_GETENVLIST */
- return(NULL);
-#endif /* HAVE_PAM_GETENVLIST */
+ debug("PAM: retrieving environment");
+ return (pam_getenvlist(sshpam_handle));
+#else
+ return (NULL);
+#endif
}
-/* Print any messages that have been generated during authentication */
-/* or account checking to stderr */
-void print_pam_messages(void)
+void
+free_pam_environment(char **env)
{
- if (pamconv_msg != NULL)
- fprintf(stderr, pamconv_msg);
+ char **envp;
+
+ if (env == NULL)
+ return;
+
+ for (envp = env; *envp; envp++)
+ xfree(*envp);
+ xfree(env);
}
#endif /* USE_PAM */
andersk / openssh.git / blobdiff