- (djm) Swapped tests for no_libsocket and no_libnsl in configure.in.

[openssh.git] / auth2.c

diff --git a/auth2.c b/auth2.c
index 768feddeb6678717b1d53c3c8adb4204db73b8ff..88fca2c9bb5734bd81847e211bdf8f5b6224ede5 100644 (file)
--- a/auth2.c
+++ b/auth2.c
@@ -23,12 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth2.c,v 1.33 2001/01/22 08:32:53 markus Exp $");
-
-#ifdef HAVE_OSF_SIA
-# include <sia.h>
-# include <siad.h>
-#endif
+RCSID("$OpenBSD: auth2.c,v 1.42 2001/02/13 22:49:40 markus Exp $");
 
 #include <openssl/evp.h>
 
@@ -46,9 +41,8 @@ RCSID("$OpenBSD: auth2.c,v 1.33 2001/01/22 08:32:53 markus Exp $");
 #include "auth.h"
 #include "session.h"
 #include "dispatch.h"
-#include "auth.h"
-#include "cipher.h"
 #include "key.h"
+#include "cipher.h"
 #include "kex.h"
 #include "pathnames.h"
 #include "uidswap.h"
@@ -62,10 +56,6 @@ extern int session_id2_len;
 #ifdef WITH_AIXAUTHENTICATE
 extern char *aixloginmsg;
 #endif
-#ifdef HAVE_OSF_SIA
-extern int saved_argc;
-extern char **saved_argv;
-#endif
 
 static Authctxt        *x_authctxt = NULL;
 static int one = 1;
@@ -103,12 +93,12 @@ Authmethod authmethods[] = {
        {"publickey",
                userauth_pubkey,
                &options.pubkey_authentication},
-       {"keyboard-interactive",
-               userauth_kbdint,
-               &options.kbd_interactive_authentication},
        {"password",
                userauth_passwd,
                &options.password_authentication},
+       {"keyboard-interactive",
+               userauth_kbdint,
+               &options.kbd_interactive_authentication},
        {NULL, NULL, NULL}
 };
 
@@ -123,13 +113,10 @@ do_authentication2()
 
        x_authctxt = authctxt;          /*XXX*/
 
-#ifdef AFS
-       /* If machine has AFS, set process authentication group. */
-       if (k_hasafs()) {
-               k_setpag();
-               k_unlog();
-       }
-#endif
+       /* challenge-reponse is implemented via keyboard interactive */
+       if (options.challenge_reponse_authentication)
+               options.kbd_interactive_authentication = 1;
+
        dispatch_init(&protocol_error);
        dispatch_set(SSH2_MSG_SERVICE_REQUEST, &input_service_request);
        dispatch_run(DISPATCH_BLOCK, &authctxt->success, authctxt);
@@ -202,7 +189,6 @@ input_userauth_request(int type, int plen, void *ctxt)
        if (authctxt->attempt++ == 0) {
                /* setup auth context */
                struct passwd *pw = NULL;
-               setproctitle("%s", user);
                pw = getpwnam(user);
                if (pw && allowed_user(pw) && strcmp(service, "ssh-connection")==0) {
                        authctxt->pw = pwcopy(pw);
@@ -217,6 +203,7 @@ input_userauth_request(int type, int plen, void *ctxt)
                        start_pam("NOUSER");
 #endif
                }
+               setproctitle("%s", pw ? user : "unknown");
                authctxt->user = xstrdup(user);
                authctxt->service = xstrdup(service);
                authctxt->style = style ? xstrdup(style) : NULL; /* currently unused */
@@ -243,11 +230,13 @@ input_userauth_request(int type, int plen, void *ctxt)
                    authctxt->user);
 
        /* Special handling for root */
-       if (authenticated && authctxt->pw->pw_uid == 0 && !auth_root_allowed())
+       if (authenticated && authctxt->pw->pw_uid == 0 &&
+           !auth_root_allowed(method))
                authenticated = 0;
 
 #ifdef USE_PAM
-       if (authenticated && authctxt->user && !do_pam_account(authctxt->user, NULL))
+       if (authenticated && authctxt->user && !do_pam_account(authctxt->user,
+           NULL))
                authenticated = 0;
 #endif /* USE_PAM */
 
@@ -296,17 +285,18 @@ done:
        return;
 }
 
-void   
+void
 userauth_reply(Authctxt *authctxt, int authenticated)
 {
        char *methods;
 
        /* XXX todo: check if multiple auth methods are needed */
-       if (authenticated) {
+       if (authenticated == 1) {
 #ifdef WITH_AIXAUTHENTICATE
                /* We don't have a pty yet, so just label the line as "ssh" */
-               if (loginsuccess(authctxt->user?authctxt->user:"NOUSER", 
-                       get_canonical_hostname(), "ssh", &aixloginmsg) < 0)
+               if (loginsuccess(authctxt->user?authctxt->user:"NOUSER",
+                   get_canonical_hostname(options.reverse_mapping_check),
+                   "ssh", &aixloginmsg) < 0)
                        aixloginmsg = NULL;
 #endif /* WITH_AIXAUTHENTICATE */
                /* turn off userauth */
@@ -318,7 +308,7 @@ userauth_reply(Authctxt *authctxt, int authenticated)
                authctxt->success = 1;
        } else {
                if (authctxt->failures++ > AUTH_FAIL_MAX)
-                        packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
+                       packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
                methods = authmethods_get();
                packet_start(SSH2_MSG_USERAUTH_FAILURE);
                packet_put_cstring(methods);
@@ -337,11 +327,11 @@ userauth_none(Authctxt *authctxt)
        if (m != NULL)
                m->enabled = NULL;
        packet_done();
-        userauth_banner();
+       userauth_banner();
 
        if (authctxt->valid == 0)
                return(0);
-               
+
 #ifdef HAVE_CYGWIN
        if (check_nt_auth(1, authctxt->pw->pw_uid) == 0)
                return(0);
@@ -349,9 +339,7 @@ userauth_none(Authctxt *authctxt)
 #ifdef USE_PAM
        return auth_pam_password(authctxt->pw, "");
 #elif defined(HAVE_OSF_SIA)
-       return (sia_validate_user(NULL, saved_argc, saved_argv, 
-               get_canonical_hostname(), authctxt->user?authctxt->user:"NOUSER", 
-                       NULL, 0, NULL, "") == SIASUCCESS);
+       return 0;
 #else /* !HAVE_OSF_SIA && !USE_PAM */
        return auth_password(authctxt->pw, "");
 #endif /* USE_PAM */
@@ -376,9 +364,7 @@ userauth_passwd(Authctxt *authctxt)
 #ifdef USE_PAM
            auth_pam_password(authctxt->pw, password) == 1)
 #elif defined(HAVE_OSF_SIA)
-           sia_validate_user(NULL, saved_argc, saved_argv, 
-                       get_canonical_hostname(), authctxt->user?authctxt->user:"NOUSER", 
-                       NULL, 0, NULL, password) == SIASUCCESS)
+           auth_sia_password(authctxt->user, password) == 1)
 #else /* !USE_PAM && !HAVE_OSF_SIA */
            auth_password(authctxt->pw, password) == 1)
 #endif /* USE_PAM */
@@ -401,7 +387,8 @@ userauth_kbdint(Authctxt *authctxt)
 
        debug("keyboard-interactive language %s devs %s", lang, devs);
 
-       authenticated = auth2_challenge(authctxt, devs);
+       if (options.challenge_reponse_authentication)
+               authenticated = auth2_challenge(authctxt, devs);
 
 #ifdef USE_PAM
        if (authenticated == 0)
@@ -505,7 +492,7 @@ userauth_pubkey(Authctxt *authctxt)
                                packet_put_string(pkblob, blen);
                                packet_send();
                                packet_write_wait();
-                               authenticated = -1;
+                               authctxt->postponed = 1;
                        }
                }
                if (authenticated != 1)