- (stevesk) OpenSSH CVS update:

[openssh.git] / auth-pam.c

diff --git a/auth-pam.c b/auth-pam.c
index 19187163c6b8e4ca609b0edd035d6074126f1b57..ea62a774875dcec68058868ea8e35f44d58cb6aa 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -50,10 +50,26 @@ static const char *pampasswd = NULL;
 static char *pam_msg = NULL;
 
 /* states for pamconv() */
-typedef enum { INITIAL_LOGIN, OTHER } pamstates;
-static pamstates pamstate = INITIAL_LOGIN;
+enum { INITIAL_LOGIN, OTHER } pamstate = INITIAL_LOGIN;
 /* remember whether pam_acct_mgmt() returned PAM_NEWAUTHTOK_REQD */
 static int password_change_required = 0;
+/* remember whether the last pam_authenticate() succeeded or not */
+static int was_authenticated = 0;
+
+/* accessor which allows us to switch conversation structs according to
+ * the authentication method being used */
+void pam_set_conv(struct pam_conv *conv)
+{
+       pam_set_item(pamh, PAM_CONV, conv);
+}
+
+/* start an authentication run */
+int do_pam_authenticate(int flags)
+{
+       int retval = pam_authenticate(pamh, flags);
+       was_authenticated = (retval == PAM_SUCCESS);
+       return retval;
+}
 
 /*
  * PAM conversation function.
@@ -83,11 +99,16 @@ static int pamconv(int num_msg, const struct pam_message **msg,
        for (count = 0; count < num_msg; count++) {
                switch ((*msg)[count].msg_style) {
                        case PAM_PROMPT_ECHO_ON:
-                               fputs((*msg)[count].msg, stderr);
-                               fgets(buf, sizeof(buf), stdin);
-                               reply[count].resp = xstrdup(buf);
-                               reply[count].resp_retcode = PAM_SUCCESS;
-                               break;
+                               if (pamstate == INITIAL_LOGIN) {
+                                       free(reply);
+                                       return PAM_CONV_ERR;
+                               } else {
+                                       fputs((*msg)[count].msg, stderr);
+                                       fgets(buf, sizeof(buf), stdin);
+                                       reply[count].resp = xstrdup(buf);
+                                       reply[count].resp_retcode = PAM_SUCCESS;
+                                       break;
+                               }
                        case PAM_PROMPT_ECHO_OFF:
                                if (pamstate == INITIAL_LOGIN) {
                                        if (pampasswd == NULL) {
@@ -95,8 +116,10 @@ static int pamconv(int num_msg, const struct pam_message **msg,
                                                return PAM_CONV_ERR;
                                        }
                                        reply[count].resp = xstrdup(pampasswd);
-                               } else
-                                       reply[count].resp = xstrdup(read_passphrase((*msg)[count].msg, 1));
+                               } else {
+                                       reply[count].resp = 
+                                               xstrdup(read_passphrase((*msg)[count].msg, 1));
+                               }
                                reply[count].resp_retcode = PAM_SUCCESS;
                                break;
                        case PAM_ERROR_MSG:
@@ -132,20 +155,20 @@ void pam_cleanup_proc(void *context)
        {
                pam_retval = pam_close_session(pamh, 0);
                if (pam_retval != PAM_SUCCESS) {
-                       log("Cannot close PAM session: %.200s", 
-                               PAM_STRERROR(pamh, pam_retval));
+                       log("Cannot close PAM session[%d]: %.200s", 
+                               pam_retval, PAM_STRERROR(pamh, pam_retval));
                }
 
                pam_retval = pam_setcred(pamh, PAM_DELETE_CRED);
                if (pam_retval != PAM_SUCCESS) {
-                       debug("Cannot delete credentials: %.200s", 
-                               PAM_STRERROR(pamh, pam_retval));
+                       debug("Cannot delete credentials[%d]: %.200s", 
+                               pam_retval, PAM_STRERROR(pamh, pam_retval));
                }
 
                pam_retval = pam_end(pamh, pam_retval);
                if (pam_retval != PAM_SUCCESS) {
-                       log("Cannot release PAM authentication: %.200s", 
-                               PAM_STRERROR(pamh, pam_retval));
+                       log("Cannot release PAM authentication[%d]: %.200s", 
+                               pam_retval, PAM_STRERROR(pamh, pam_retval));
                }
        }
 }
@@ -156,6 +179,8 @@ int auth_pam_password(struct passwd *pw, const char *password)
        extern ServerOptions options;
        int pam_retval;
 
+       pam_set_conv(&conv);
+
        /* deny if no user. */
        if (pw == NULL)
                return 0;
@@ -167,14 +192,14 @@ int auth_pam_password(struct passwd *pw, const char *password)
        pampasswd = password;
        
        pamstate = INITIAL_LOGIN;
-       pam_retval = pam_authenticate(pamh, 0);
+       pam_retval = do_pam_authenticate(0);
        if (pam_retval == PAM_SUCCESS) {
                debug("PAM Password authentication accepted for user \"%.100s\"", 
                        pw->pw_name);
                return 1;
        } else {
-               debug("PAM Password authentication for \"%.100s\" failed: %s", 
-                       pw->pw_name, PAM_STRERROR(pamh, pam_retval));
+               debug("PAM Password authentication for \"%.100s\" failed[%d]: %s", 
+                       pw->pw_name, pam_retval, PAM_STRERROR(pamh, pam_retval));
                return 0;
        }
 }
@@ -188,16 +213,16 @@ int do_pam_account(char *username, char *remote_user)
        pam_retval = pam_set_item(pamh, PAM_RHOST, 
                get_canonical_hostname());
        if (pam_retval != PAM_SUCCESS) {
-               fatal("PAM set rhost failed: %.200s", 
-                       PAM_STRERROR(pamh, pam_retval));
+               fatal("PAM set rhost failed[%d]: %.200s", 
+                       pam_retval, PAM_STRERROR(pamh, pam_retval));
        }
 
        if (remote_user != NULL) {
                debug("PAM setting ruser to \"%.200s\"", remote_user);
                pam_retval = pam_set_item(pamh, PAM_RUSER, remote_user);
                if (pam_retval != PAM_SUCCESS) {
-                       fatal("PAM set ruser failed: %.200s", 
-                               PAM_STRERROR(pamh, pam_retval));
+                       fatal("PAM set ruser failed[%d]: %.200s", 
+                               pam_retval, PAM_STRERROR(pamh, pam_retval));
                }
        }
 
@@ -212,8 +237,8 @@ int do_pam_account(char *username, char *remote_user)
                        password_change_required = 1;
                        break;
                default:
-                       log("PAM rejected by account configuration: %.200s", 
-                               PAM_STRERROR(pamh, pam_retval));
+                       log("PAM rejected by account configuration[%d]: %.200s", 
+                               pam_retval, PAM_STRERROR(pamh, pam_retval));
                        return(0);
        }
        
@@ -229,45 +254,63 @@ void do_pam_session(char *username, const char *ttyname)
                debug("PAM setting tty to \"%.200s\"", ttyname);
                pam_retval = pam_set_item(pamh, PAM_TTY, ttyname);
                if (pam_retval != PAM_SUCCESS) {
-                       fatal("PAM set tty failed: %.200s", 
-                               PAM_STRERROR(pamh, pam_retval));
+                       fatal("PAM set tty failed[%d]: %.200s", 
+                               pam_retval, PAM_STRERROR(pamh, pam_retval));
                }
        }
 
        pam_retval = pam_open_session(pamh, 0);
        if (pam_retval != PAM_SUCCESS) {
-               fatal("PAM session setup failed: %.200s", 
-                       PAM_STRERROR(pamh, pam_retval));
+               fatal("PAM session setup failed[%d]: %.200s", 
+                       pam_retval, PAM_STRERROR(pamh, pam_retval));
        }
 }
 
 /* Set PAM credentials */ 
-void do_pam_setcred()
+void do_pam_setcred(void)
 {
        int pam_retval;
  
        debug("PAM establishing creds");
        pam_retval = pam_setcred(pamh, PAM_ESTABLISH_CRED);
        if (pam_retval != PAM_SUCCESS) {
-               fatal("PAM setcred failed: %.200s", 
-                       PAM_STRERROR(pamh, pam_retval));
+               if(was_authenticated) {
+                       fatal("PAM setcred failed[%d]: %.200s", 
+                               pam_retval, PAM_STRERROR(pamh, pam_retval));
+               } else {
+                       debug("PAM setcred failed[%d]: %.200s", 
+                               pam_retval, PAM_STRERROR(pamh, pam_retval));
+               }
        }
 }
 
+/* accessor function for file scope static variable */
+int pam_password_change_required(void)
+{
+       return password_change_required;
+}
+
 /* 
  * Have user change authentication token if pam_acct_mgmt() indicated
  * it was expired.  This needs to be called after an interactive
  * session is established and the user's pty is connected to
  * stdin/stout/stderr.
  */
-void do_pam_chauthtok()
+void do_pam_chauthtok(void)
 {
        int pam_retval;
 
        if (password_change_required) {
                pamstate = OTHER;
+               /*
+                * XXX: should we really loop forever?
+                */
                do {
                        pam_retval = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
+                       if (pam_retval != PAM_SUCCESS) {
+                               log("PAM pam_chauthtok failed[%d]: %.200s", 
+                                       pam_retval, PAM_STRERROR(pamh, pam_retval));
+                       }
                } while (pam_retval != PAM_SUCCESS);
        }
 }
@@ -289,8 +332,8 @@ void start_pam(struct passwd *pw)
        pam_retval = pam_start(SSHD_PAM_SERVICE, pw->pw_name, &conv, &pamh);
 
        if (pam_retval != PAM_SUCCESS) {
-               fatal("PAM initialisation failed: %.200s", 
-                       PAM_STRERROR(pamh, pam_retval));
+               fatal("PAM initialisation failed[%d]: %.200s", 
+                       pam_retval, PAM_STRERROR(pamh, pam_retval));
        }
 
 #ifdef PAM_TTY_KLUDGE
@@ -303,8 +346,8 @@ void start_pam(struct passwd *pw)
         */
        pam_retval = pam_set_item(pamh, PAM_TTY, "ssh");
        if (pam_retval != PAM_SUCCESS) {
-               fatal("PAM set tty failed: %.200s", 
-                       PAM_STRERROR(pamh, pam_retval));
+               fatal("PAM set tty failed[%d]: %.200s", 
+                       pam_retval, PAM_STRERROR(pamh, pam_retval));
        }
 #endif /* PAM_TTY_KLUDGE */