[configure.ac] Make sure -lcrypto is before -lsocket for sco3. ok mouring@

[openssh.git] / session.c

diff --git a/session.c b/session.c
index 03a5ec5704c18ea76fb53f550ce76a564f5bd03d..864967565157ca762ba617821a1637d30d78f145 100644 (file)
--- a/session.c
+++ b/session.c
@@ -33,7 +33,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: session.c,v 1.170 2003/12/23 16:12:10 jakob Exp $");
+RCSID("$OpenBSD: session.c,v 1.172 2004/01/30 09:48:57 markus Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -58,6 +58,10 @@ RCSID("$OpenBSD: session.c,v 1.170 2003/12/23 16:12:10 jakob Exp $");
 #include "session.h"
 #include "monitor_wrap.h"
 
+#if defined(KRB5) && defined(USE_AFS)
+#include <kafs.h>
+#endif
+
 #ifdef GSSAPI
 #include "ssh-gss.h"
 #endif
@@ -189,6 +193,15 @@ auth_input_request_forwarding(struct passwd * pw)
        return 1;
 }
 
+static void
+display_loginmsg(void)
+{
+       if (buffer_len(&loginmsg) > 0) {
+               buffer_append(&loginmsg, "\0", 1);
+               printf("%s\n", (char *)buffer_ptr(&loginmsg));
+               buffer_clear(&loginmsg);
+       }
+}
 
 void
 do_authenticated(Authctxt *authctxt)
@@ -385,12 +398,8 @@ do_exec_no_pty(Session *s, const char *command)
        session_proctitle(s);
 
 #if defined(USE_PAM)
-       if (options.use_pam) {
+       if (options.use_pam)
                do_pam_setcred(1);
-               if (is_pam_password_change_required())
-                       packet_disconnect("Password change required but no "
-                           "TTY available");
-       }
 #endif /* USE_PAM */
 
        /* Fork the child. */
@@ -515,7 +524,8 @@ do_exec_pty(Session *s, const char *command)
 #if defined(USE_PAM)
        if (options.use_pam) {
                do_pam_set_tty(s->tty);
-               do_pam_setcred(1);
+               if (!use_privsep)
+                       do_pam_setcred(1);
        }
 #endif
 
@@ -693,9 +703,10 @@ do_login(Session *s, const char *command)
         * If password change is needed, do it now.
         * This needs to occur before the ~/.hushlogin check.
         */
-       if (options.use_pam && is_pam_password_change_required()) {
-               print_pam_messages();
+       if (options.use_pam && !use_privsep && s->authctxt->force_pwchange) {
+               display_loginmsg();
                do_pam_chauthtok();
+               s->authctxt->force_pwchange = 0;
                /* XXX - signal [net] parent to enable forwardings */
        }
 #endif
@@ -703,17 +714,7 @@ do_login(Session *s, const char *command)
        if (check_quietlogin(s, command))
                return;
 
-#ifdef USE_PAM
-       if (options.use_pam && !is_pam_password_change_required())
-               print_pam_messages();
-#endif /* USE_PAM */
-
-       /* display post-login message */
-       if (buffer_len(&loginmsg) > 0) {
-               buffer_append(&loginmsg, "\0", 1);
-               printf("%s\n", (char *)buffer_ptr(&loginmsg));
-       }
-       buffer_free(&loginmsg);
+       display_loginmsg();
 
 #ifndef NO_SSH_LASTLOG
        if (options.print_lastlog && s->last_login_time != 0) {
@@ -1239,6 +1240,12 @@ do_setusercontext(struct passwd *pw)
 # ifdef __bsdi__
                setpgid(0, 0);
 # endif
+# ifdef USE_PAM
+               if (options.use_pam) {
+                       do_pam_session();
+                       do_pam_setcred(0);
+               }
+# endif /* USE_PAM */
                if (setusercontext(lc, pw, pw->pw_uid,
                    (LOGIN_SETALL & ~LOGIN_SETPATH)) < 0) {
                        perror("unable to set user context");
@@ -1292,6 +1299,22 @@ do_setusercontext(struct passwd *pw)
                fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
 }
 
+static void
+do_pwchange(Session *s)
+{
+       fprintf(stderr, "WARNING: Your password has expired.\n");
+       if (s->ttyfd != -1) {
+               fprintf(stderr,
+                   "You must change your password now and login again!\n");
+               execl(_PATH_PASSWD_PROG, "passwd", (char *)NULL);
+               perror("passwd");
+       } else {
+               fprintf(stderr,
+                   "Password change required but no TTY available.\n");
+       }
+       exit(1);
+}
+
 static void
 launch_login(struct passwd *pw, const char *hostname)
 {
@@ -1313,6 +1336,40 @@ launch_login(struct passwd *pw, const char *hostname)
        exit(1);
 }
 
+static void
+child_close_fds(void)
+{
+       int i;
+
+       if (packet_get_connection_in() == packet_get_connection_out())
+               close(packet_get_connection_in());
+       else {
+               close(packet_get_connection_in());
+               close(packet_get_connection_out());
+       }
+       /*
+        * Close all descriptors related to channels.  They will still remain
+        * open in the parent.
+        */
+       /* XXX better use close-on-exec? -markus */
+       channel_close_all();
+
+       /*
+        * Close any extra file descriptors.  Note that there may still be
+        * descriptors left by system functions.  They will be closed later.
+        */
+       endpwent();
+
+       /*
+        * Close any extra open file descriptors so that we don\'t have them
+        * hanging around in clients.  Note that we want to do this after
+        * initgroups, because at least on Solaris 2.3 it leaves file
+        * descriptors open.
+        */
+       for (i = 3; i < 64; i++)
+               close(i);
+}
+
 /*
  * Performs common processing for the child, such as setting up the
  * environment, closing extra file descriptors, setting the user and group
@@ -1326,11 +1383,18 @@ do_child(Session *s, const char *command)
        char *argv[10];
        const char *shell, *shell0, *hostname = NULL;
        struct passwd *pw = s->pw;
-       u_int i;
 
        /* remove hostkey from the child's memory */
        destroy_sensitive_data();
 
+       /* Force a password change */
+       if (s->authctxt->force_pwchange) {
+               do_setusercontext(pw);
+               child_close_fds();
+               do_pwchange(s);
+               exit(1);
+       }
+
        /* login(1) is only called if we execute the login shell */
        if (options.use_login && command != NULL)
                options.use_login = 0;
@@ -1381,33 +1445,7 @@ do_child(Session *s, const char *command)
         * closed before building the environment, as we call
         * get_remote_ipaddr there.
         */
-       if (packet_get_connection_in() == packet_get_connection_out())
-               close(packet_get_connection_in());
-       else {
-               close(packet_get_connection_in());
-               close(packet_get_connection_out());
-       }
-       /*
-        * Close all descriptors related to channels.  They will still remain
-        * open in the parent.
-        */
-       /* XXX better use close-on-exec? -markus */
-       channel_close_all();
-
-       /*
-        * Close any extra file descriptors.  Note that there may still be
-        * descriptors left by system functions.  They will be closed later.
-        */
-       endpwent();
-
-       /*
-        * Close any extra open file descriptors so that we don\'t have them
-        * hanging around in clients.  Note that we want to do this after
-        * initgroups, because at least on Solaris 2.3 it leaves file
-        * descriptors open.
-        */
-       for (i = 3; i < 64; i++)
-               close(i);
+       child_close_fds();
 
        /*
         * Must take new environment into use so that .ssh/rc,
@@ -1415,7 +1453,7 @@ do_child(Session *s, const char *command)
         */
        environ = env;
 
-#ifdef KRB5
+#if defined(KRB5) && defined(USE_AFS)
        /*
         * At this point, we check to see if AFS is active and if we have
         * a valid Kerberos 5 TGT. If so, it seems like a good idea to see