- (djm) Bug #564: Perform PAM account checks for all authentications when

[openssh.git] / monitor.c

diff --git a/monitor.c b/monitor.c
index 700925c8c5eff5727adc682905969d6fec13befe..80b1a8fba291ca86b3a590b776792dc48748c246 100644 (file)
--- a/monitor.c
+++ b/monitor.c
@@ -25,7 +25,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: monitor.c,v 1.40 2003/05/14 08:57:49 markus Exp $");
+RCSID("$OpenBSD: monitor.c,v 1.45 2003/07/22 13:35:22 markus Exp $");
 
 #include <openssl/dh.h>
 
@@ -93,7 +93,7 @@ struct {
        u_int olen;
 } child_state;
 
-/* Functions on the montior that answer unprivileged requests */
+/* Functions on the monitor that answer unprivileged requests */
 
 int mm_answer_moduli(int, Buffer *);
 int mm_answer_sign(int, Buffer *);
@@ -118,15 +118,13 @@ int mm_answer_sessid(int, Buffer *);
 
 #ifdef USE_PAM
 int mm_answer_pam_start(int, Buffer *);
+int mm_answer_pam_account(int, Buffer *);
 int mm_answer_pam_init_ctx(int, Buffer *);
 int mm_answer_pam_query(int, Buffer *);
 int mm_answer_pam_respond(int, Buffer *);
 int mm_answer_pam_free_ctx(int, Buffer *);
 #endif
 
-#ifdef KRB4
-int mm_answer_krb4(int, Buffer *);
-#endif
 #ifdef KRB5
 int mm_answer_krb5(int, Buffer *);
 #endif
@@ -141,7 +139,7 @@ static int key_blobtype = MM_NOKEY;
 static char *hostbased_cuser = NULL;
 static char *hostbased_chost = NULL;
 static char *auth_method = "unknown";
-static int session_id2_len = 0;
+static u_int session_id2_len = 0;
 static u_char *session_id2 = NULL;
 static pid_t monitor_child_pid;
 
@@ -168,6 +166,7 @@ struct mon_table mon_dispatch_proto20[] = {
     {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
 #ifdef USE_PAM
     {MONITOR_REQ_PAM_START, MON_ONCE, mm_answer_pam_start},
+    {MONITOR_REQ_PAM_ACCOUNT, 0, mm_answer_pam_account},
     {MONITOR_REQ_PAM_INIT_CTX, MON_ISAUTH, mm_answer_pam_init_ctx},
     {MONITOR_REQ_PAM_QUERY, MON_ISAUTH, mm_answer_pam_query},
     {MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
@@ -217,14 +216,12 @@ struct mon_table mon_dispatch_proto15[] = {
 #endif
 #ifdef USE_PAM
     {MONITOR_REQ_PAM_START, MON_ONCE, mm_answer_pam_start},
+    {MONITOR_REQ_PAM_ACCOUNT, 0, mm_answer_pam_account},
     {MONITOR_REQ_PAM_INIT_CTX, MON_ISAUTH, mm_answer_pam_init_ctx},
     {MONITOR_REQ_PAM_QUERY, MON_ISAUTH, mm_answer_pam_query},
     {MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
     {MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
 #endif
-#ifdef KRB4
-    {MONITOR_REQ_KRB4, MON_ONCE|MON_AUTH, mm_answer_krb4},
-#endif
 #ifdef KRB5
     {MONITOR_REQ_KRB5, MON_ONCE|MON_AUTH, mm_answer_krb5},
 #endif
@@ -301,6 +298,18 @@ monitor_child_preauth(struct monitor *pmonitor)
                        if (authctxt->pw->pw_uid == 0 &&
                            !auth_root_allowed(auth_method))
                                authenticated = 0;
+#ifdef USE_PAM
+                       /* PAM needs to perform account checks after auth */
+                       if (options.use_pam) {
+                               Buffer m;
+
+                               buffer_init(&m);
+                               mm_request_receive_expect(pmonitor->m_sendfd, 
+                                   MONITOR_REQ_PAM_ACCOUNT, &m);
+                               authenticated = mm_answer_pam_account(pmonitor->m_sendfd, &m);
+                               buffer_free(&m);
+                       }
+#endif
                }
 
                if (ent->flags & MON_AUTHDECIDE) {
@@ -777,9 +786,28 @@ mm_answer_pam_start(int socket, Buffer *m)
 
        xfree(user);
 
+       monitor_permit(mon_dispatch, MONITOR_REQ_PAM_ACCOUNT, 1);
+
        return (0);
 }
 
+int
+mm_answer_pam_account(int socket, Buffer *m)
+{
+       u_int ret;
+       
+       if (!options.use_pam)
+               fatal("UsePAM not set, but ended up in %s anyway", __func__);
+
+       ret = do_pam_account();
+
+       buffer_put_int(m, ret);
+
+       mm_request_send(socket, MONITOR_ANS_PAM_ACCOUNT, m);
+
+       return (ret);
+}
+
 static void *sshpam_ctxt, *sshpam_authok;
 extern KbdintDevice sshpam_device;
 
@@ -1157,14 +1185,14 @@ mm_record_login(Session *s, struct passwd *pw)
        }
        /* Record that there was a login on that tty from the remote host. */
        record_login(s->pid, s->tty, pw->pw_name, pw->pw_uid,
-           get_remote_name_or_ip(utmp_len, options.verify_reverse_mapping),
+           get_remote_name_or_ip(utmp_len, options.use_dns),
            (struct sockaddr *)&from, fromlen);
 }
 
 static void
 mm_session_close(Session *s)
 {
-       debug3("%s: session %d pid %d", __func__, s->self, s->pid);
+       debug3("%s: session %d pid %ld", __func__, s->self, (long)s->pid);
        if (s->ttyfd != -1) {
                debug3("%s: tty %s ptyfd %d",  __func__, s->tty, s->ptyfd);
                fatal_remove_cleanup(session_pty_cleanup2, (void *)s);
@@ -1428,52 +1456,6 @@ mm_answer_rsa_response(int socket, Buffer *m)
        return (success);
 }
 
-#ifdef KRB4
-int
-mm_answer_krb4(int socket, Buffer *m)
-{
-       KTEXT_ST auth, reply;
-       char  *client, *p;
-       int success;
-       u_int alen;
-
-       reply.length = auth.length = 0;
- 
-       p = buffer_get_string(m, &alen);
-       if (alen >=  MAX_KTXT_LEN)
-                fatal("%s: auth too large", __func__);
-       memcpy(auth.dat, p, alen);
-       auth.length = alen;
-       memset(p, 0, alen);
-       xfree(p);
-
-       success = options.kerberos_authentication &&
-           authctxt->valid &&
-           auth_krb4(authctxt, &auth, &client, &reply);
-
-       memset(auth.dat, 0, alen);
-       buffer_clear(m);
-       buffer_put_int(m, success);
-
-       if (success) {
-               buffer_put_cstring(m, client);
-               buffer_put_string(m, reply.dat, reply.length);
-               if (client)
-                       xfree(client);
-               if (reply.length)
-                       memset(reply.dat, 0, reply.length);
-       }
-
-       debug3("%s: sending result %d", __func__, success);
-       mm_request_send(socket, MONITOR_ANS_KRB4, m);
-
-       auth_method = "kerberos";
-
-       /* Causes monitor loop to terminate if authenticated */
-       return (success);
-}
-#endif
-
 #ifdef KRB5
 int
 mm_answer_krb5(int socket, Buffer *m)