- (djm) Unbreak PAM auth for protocol 1. Report from Pekka Savola

[openssh.git] / auth-pam.c

diff --git a/auth-pam.c b/auth-pam.c
index 6d76f890d9cdd3b34584d6cf7b7f76570e07bd25..e8a9b77bc97a98ef6d62331c0519a4795cfc9b22 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -28,11 +28,14 @@
 #include "ssh.h"
 #include "xmalloc.h"
 #include "log.h"
+#include "auth.h"
 #include "auth-pam.h"
 #include "servconf.h"
 #include "canohost.h"
 #include "readpass.h"
 
+extern char *__progname;
+
 RCSID("$Id$");
 
 #define NEW_AUTHTOK_MSG \
@@ -85,7 +88,7 @@ int do_pam_authenticate(int flags)
  * messages with into __pam_msg.  This is used during initial
  * authentication to bypass the normal PAM password prompt.
  *
- * OTHER mode handles PAM_PROMPT_ECHO_OFF with read_passphrase(prompt, 1)
+ * OTHER mode handles PAM_PROMPT_ECHO_OFF with read_passphrase()
  * and outputs messages to stderr. This mode is used if pam_chauthtok()
  * is called to update expired passwords.
  */
@@ -144,9 +147,9 @@ static int do_pam_conversation(int num_msg, const struct pam_message **msg,
                                reply[count].resp_retcode = PAM_SUCCESS;
                                break;
                        case PAM_PROMPT_ECHO_OFF:
-                               reply[count].resp = xstrdup(
-                                   read_passphrase(PAM_MSG_MEMBER(msg, count, 
-                                   msg), 1));
+                               reply[count].resp = 
+                                   read_passphrase(PAM_MSG_MEMBER(msg, count,
+                                       msg), RP_ALLOW_STDIN);
                                reply[count].resp_retcode = PAM_SUCCESS;
                                break;
                        case PAM_ERROR_MSG:
@@ -172,7 +175,7 @@ static int do_pam_conversation(int num_msg, const struct pam_message **msg,
 /* Called at exit to cleanly shutdown PAM */
 void do_pam_cleanup_proc(void *context)
 {
-       int pam_retval;
+       int pam_retval = PAM_SUCCESS;
 
        if (__pamh && session_opened) {
                pam_retval = pam_close_session(__pamh, 0);
@@ -197,17 +200,18 @@ void do_pam_cleanup_proc(void *context)
 }
 
 /* Attempt password authentation using PAM */
-int auth_pam_password(struct passwd *pw, const char *password)
+int auth_pam_password(Authctxt *authctxt, const char *password)
 {
        extern ServerOptions options;
        int pam_retval;
+       struct passwd *pw = authctxt->pw;
 
        do_pam_set_conv(&conv);
 
        /* deny if no user. */
        if (pw == NULL)
                return 0;
-       if (pw->pw_uid == 0 && options.permit_root_login == 2)
+       if (pw->pw_uid == 0 && options.permit_root_login == PERMIT_NO_PASSWD)
                return 0;
        if (*password == '\0' && options.permit_empty_passwd == 0)
                return 0;
@@ -215,7 +219,8 @@ int auth_pam_password(struct passwd *pw, const char *password)
        __pampasswd = password;
 
        pamstate = INITIAL_LOGIN;
-       pam_retval = do_pam_authenticate(0);
+       pam_retval = do_pam_authenticate(
+           options.permit_empty_passwd == 0 ? PAM_DISALLOW_NULL_AUTHTOK : 0);
        if (pam_retval == PAM_SUCCESS) {
                debug("PAM Password authentication accepted for "
                    "user \"%.100s\"", pw->pw_name);
@@ -244,15 +249,18 @@ int do_pam_account(char *username, char *remote_user)
        }
 
        pam_retval = pam_acct_mgmt(__pamh, 0);
+       debug2("pam_acct_mgmt() = %d", pam_retval);
        switch (pam_retval) {
                case PAM_SUCCESS:
                        /* This is what we want */
                        break;
+#if 0
                case PAM_NEW_AUTHTOK_REQD:
                        message_cat(&__pam_msg, NEW_AUTHTOK_MSG);
                        /* flag that password change is necessary */
                        password_change_required = 1;
                        break;
+#endif
                default:
                        log("PAM rejected by account configuration[%d]: "
                            "%.200s", pam_retval, PAM_STRERROR(__pamh, 
@@ -268,6 +276,8 @@ void do_pam_session(char *username, const char *ttyname)
 {
        int pam_retval;
 
+       do_pam_set_conv(&conv);
+
        if (ttyname != NULL) {
                debug("PAM setting tty to \"%.200s\"", ttyname);
                pam_retval = pam_set_item(__pamh, PAM_TTY, ttyname);
@@ -280,16 +290,20 @@ void do_pam_session(char *username, const char *ttyname)
        if (pam_retval != PAM_SUCCESS)
                fatal("PAM session setup failed[%d]: %.200s",
                    pam_retval, PAM_STRERROR(__pamh, pam_retval));
+
        session_opened = 1;
 }
 
 /* Set PAM credentials */
-void do_pam_setcred(void)
+void do_pam_setcred(int init)
 {
        int pam_retval;
 
+       do_pam_set_conv(&conv);
+
        debug("PAM establishing creds");
-       pam_retval = pam_setcred(__pamh, PAM_ESTABLISH_CRED);
+       pam_retval = pam_setcred(__pamh, 
+           init ? PAM_ESTABLISH_CRED : PAM_REINITIALIZE_CRED);
        if (pam_retval != PAM_SUCCESS) {
                if (was_authenticated)
                        fatal("PAM setcred failed[%d]: %.200s",
@@ -317,16 +331,14 @@ void do_pam_chauthtok(void)
 {
        int pam_retval;
 
+       do_pam_set_conv(&conv);
+
        if (password_change_required) {
                pamstate = OTHER;
-               /* XXX: should we really loop forever? */
-               do {
-                       pam_retval = pam_chauthtok(__pamh, 
-                           PAM_CHANGE_EXPIRED_AUTHTOK);
-                       if (pam_retval != PAM_SUCCESS)
-                               log("PAM pam_chauthtok failed[%d]: %.200s",
-                                   pam_retval, PAM_STRERROR(__pamh, pam_retval));
-               } while (pam_retval != PAM_SUCCESS);
+               pam_retval = pam_chauthtok(__pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
+               if (pam_retval != PAM_SUCCESS)
+                       fatal("PAM pam_chauthtok failed[%d]: %.200s",
+                           pam_retval, PAM_STRERROR(__pamh, pam_retval));
        }
 }
 
@@ -342,6 +354,8 @@ void start_pam(const char *user)
 {
        int pam_retval;
        extern ServerOptions options;
+       extern u_int utmp_len;
+       const char *rhost;
 
        debug("Starting up PAM with username \"%.200s\"", user);
 
@@ -351,10 +365,10 @@ void start_pam(const char *user)
                fatal("PAM initialisation failed[%d]: %.200s",
                    pam_retval, PAM_STRERROR(__pamh, pam_retval));
 
-       debug("PAM setting rhost to \"%.200s\"",
-           get_canonical_hostname(options.reverse_mapping_check));
-       pam_retval = pam_set_item(__pamh, PAM_RHOST,
-               get_canonical_hostname(options.reverse_mapping_check));
+       rhost = get_remote_name_or_ip(utmp_len, options.verify_reverse_mapping);
+       debug("PAM setting rhost to \"%.200s\"", rhost);
+
+       pam_retval = pam_set_item(__pamh, PAM_RHOST, rhost);
        if (pam_retval != PAM_SUCCESS)
                fatal("PAM set rhost failed[%d]: %.200s", pam_retval,
                    PAM_STRERROR(__pamh, pam_retval));
@@ -366,7 +380,7 @@ void start_pam(const char *user)
         * not even need one (for tty-less connections)
         * Kludge: Set a fake PAM_TTY
         */
-       pam_retval = pam_set_item(__pamh, PAM_TTY, "ssh");
+       pam_retval = pam_set_item(__pamh, PAM_TTY, "NODEVssh");
        if (pam_retval != PAM_SUCCESS)
                fatal("PAM set tty failed[%d]: %.200s",
                    pam_retval, PAM_STRERROR(__pamh, pam_retval));