- stevesk@cvs.openbsd.org 2002/03/29 19:18:33

[openssh.git] / sshd.c

diff --git a/sshd.c b/sshd.c
index d34b1a79d8c6b33bd074b63698b0cfd6e3f89a94..541e9932ea8e3a46e90fcd4f55b1d880c7eb1448 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -42,7 +42,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.233 2002/03/19 10:35:39 markus Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.238 2002/03/23 20:57:26 stevesk Exp $");
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -521,6 +521,7 @@ privsep_preauth_child(void)
 {
        u_int32_t rand[256];
        int i;
+       struct passwd *pw;
 
        /* Enable challenge-response authentication for privilege separation */
        privsep_challenge_enable();
@@ -532,28 +533,70 @@ privsep_preauth_child(void)
        /* Demote the private keys to public keys. */
        demote_sensitive_data();
 
+       if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL)
+               fatal("%s: no user", SSH_PRIVSEP_USER);
+       memset(pw->pw_passwd, 0, strlen(pw->pw_passwd));
+       endpwent();
+
        /* Change our root directory*/
        if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
                fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
                    strerror(errno));
        if (chdir("/") == -1)
-               fatal("chdir(/)");
-               
+               fatal("chdir(\"/\"): %s", strerror(errno));
+
        /* Drop our privileges */
-       setegid(options.unprivileged_group);
-       setgid(options.unprivileged_group);
-       seteuid(options.unprivileged_user);
-       setuid(options.unprivileged_user);
+       debug3("privsep user:group %u:%u", (u_int)pw->pw_uid,
+           (u_int)pw->pw_gid);
+       do_setusercontext(pw);
 }
 
-static void
-privsep_postauth(Authctxt *authctxt, pid_t pid)
+static Authctxt*
+privsep_preauth(void)
 {
-       extern Authctxt *x_authctxt;
+       Authctxt *authctxt = NULL;
        int status;
+       pid_t pid;
+
+       /* Set up unprivileged child process to deal with network data */
+       monitor = monitor_init();
+       /* Store a pointer to the kex for later rekeying */
+       monitor->m_pkex = &xxx_kex;
+
+       pid = fork();
+       if (pid == -1) {
+               fatal("fork of unprivileged child failed");
+       } else if (pid != 0) {
+               debug2("Network child is on pid %d", pid);
+
+               close(monitor->m_recvfd);
+               authctxt = monitor_child_preauth(monitor);
+               close(monitor->m_sendfd);
 
-       /* Wait for the child's exit status */
-       waitpid(pid, &status, 0);
+               /* Sync memory */
+               monitor_sync(monitor);
+
+               /* Wait for the child's exit status */
+               waitpid(pid, &status, 0);
+
+               return (authctxt);
+       } else {
+               /* child */
+
+               close(monitor->m_sendfd);
+
+               /* Demote the child */
+               if (getuid() == 0 || geteuid() == 0)
+                       privsep_preauth_child();
+               setproctitle("%s", "[net]");
+       }
+       return (NULL);
+}
+
+static void
+privsep_postauth(Authctxt *authctxt)
+{
+       extern Authctxt *x_authctxt;
 
        /* XXX - Remote port forwarding */
        x_authctxt = authctxt;
@@ -564,7 +607,7 @@ privsep_postauth(Authctxt *authctxt, pid_t pid)
                use_privsep = 0;
                return;
        }
-       
+
        /* Authentication complete */
        alarm(0);
        if (startup_pipe != -1) {
@@ -579,7 +622,7 @@ privsep_postauth(Authctxt *authctxt, pid_t pid)
        if (monitor->m_pid == -1)
                fatal("fork of unprivileged child failed");
        else if (monitor->m_pid != 0) {
-               debug2("User child is on pid %d", pid);
+               debug2("User child is on pid %d", monitor->m_pid);
                close(monitor->m_recvfd);
                monitor_child_postauth(monitor);
 
@@ -599,7 +642,6 @@ privsep_postauth(Authctxt *authctxt, pid_t pid)
        monitor_apply_keystate(monitor);
 }
 
-
 static char *
 list_hostkey_types(void)
 {
@@ -1374,36 +1416,9 @@ main(int ac, char **av)
 
        packet_set_nonblocking();
 
-       if (!use_privsep)
-               goto skip_privilegeseparation;
-               
-       /* Set up unprivileged child process to deal with network data */
-       monitor = monitor_init();
-       /* Store a pointer to the kex for later rekeying */
-       monitor->m_pkex = &xxx_kex;
-
-       pid = fork();
-       if (pid == -1)
-               fatal("fork of unprivileged child failed");
-       else if (pid != 0) {
-               debug2("Network child is on pid %d", pid);
-
-               close(monitor->m_recvfd);
-               authctxt = monitor_child_preauth(monitor);
-               close(monitor->m_sendfd);
-
-               /* Sync memory */
-               monitor_sync(monitor);
-               goto authenticated;
-       } else {
-               close(monitor->m_sendfd);
-
-               /* Demote the child */
-               if (getuid() == 0 || geteuid() == 0)
-                       privsep_preauth_child();
-       }
-
- skip_privilegeseparation:
+       if (use_privsep)
+               if ((authctxt = privsep_preauth()) != NULL)
+                       goto authenticated;
 
        /* perform the key exchange */
        /* authenticate user and start session */
@@ -1414,20 +1429,23 @@ main(int ac, char **av)
                do_ssh1_kex();
                authctxt = do_authentication();
        }
-       if (use_privsep)
+       /*
+        * If we use privilege separation, the unprivileged child transfers
+        * the current keystate and exits
+        */
+       if (use_privsep) {
                mm_send_keystate(monitor);
-
-       /* If we use privilege separation, the unprivileged child exits */
-       if (use_privsep)
                exit(0);
+       }
 
  authenticated:
-       /* 
+       /*
         * In privilege separation, we fork another child and prepare
         * file descriptor passing.
         */
        if (use_privsep) {
-               privsep_postauth(authctxt, pid);
+               privsep_postauth(authctxt);
+               /* the monitor process [priv] will not return */
                if (!compat20)
                        destroy_sensitive_data();
        }