- djm@cvs.openbsd.org 2003/01/10 10:29:35

[openssh.git] / auth1.c

diff --git a/auth1.c b/auth1.c
index 4d2b92a22aebb6daeed9554a4cb585282974fba1..1af30e0ec727cb83535f45ef8be9650b9273f597 100644 (file)
--- a/auth1.c
+++ b/auth1.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth1.c,v 1.43 2002/09/09 06:48:06 itojun Exp $");
+RCSID("$OpenBSD: auth1.c,v 1.45 2002/11/21 23:03:51 deraadt Exp $");
 
 #include "xmalloc.h"
 #include "rsa.h"
@@ -118,17 +118,24 @@ do_authloop(Authctxt *authctxt)
 
                                if (kdata[0] == 4) { /* KRB_PROT_VERSION */
 #ifdef KRB4
-                                       KTEXT_ST tkt;
-
+                                       KTEXT_ST tkt, reply;
                                        tkt.length = dlen;
                                        if (tkt.length < MAX_KTXT_LEN)
                                                memcpy(tkt.dat, kdata, tkt.length);
 
-                                       if (auth_krb4(authctxt, &tkt, &client_user)) {
+                                       if (PRIVSEP(auth_krb4(authctxt, &tkt,
+                                           &client_user, &reply))) {
                                                authenticated = 1;
                                                snprintf(info, sizeof(info),
                                                    " tktuser %.100s",
                                                    client_user);
+
+                                               packet_start(
+                                                   SSH_SMSG_AUTH_KERBEROS_RESPONSE);
+                                               packet_put_string((char *)
+                                                   reply.dat, reply.length);
+                                               packet_send();
+                                               packet_write_wait();
                                        }
 #endif /* KRB4 */
                                } else {
@@ -143,7 +150,7 @@ do_authloop(Authctxt *authctxt)
                                                snprintf(info, sizeof(info),
                                                    " tktuser %.100s",
                                                    client_user);
- 
+
                                                /* Send response to client */
                                                packet_start(
                                                    SSH_SMSG_AUTH_KERBEROS_RESPONSE);
@@ -304,6 +311,15 @@ do_authloop(Authctxt *authctxt)
                        fatal("INTERNAL ERROR: authenticated invalid user %s",
                            authctxt->user);
 
+#ifdef _UNICOS
+               if (type == SSH_CMSG_AUTH_PASSWORD && !authenticated)
+                       cray_login_failure(authctxt->user, IA_UDBERR);
+               if (authenticated && cray_access_denied(authctxt->user)) {
+                       authenticated = 0;
+                       fatal("Access denied for user %s.",authctxt->user);
+               }
+#endif /* _UNICOS */
+
 #ifdef HAVE_CYGWIN
                if (authenticated &&
                    !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, pw)) {