X-Git-Url: http://andersk.mit.edu/gitweb/openssh.git/blobdiff_plain/0bbfbdeb598634309db949a6a451d1bb7d7504ef..4278ff63eceba288225b85bf82506c680d427821:/auth-passwd.c diff --git a/auth-passwd.c b/auth-passwd.c index c6fdc82d..988297cb 100644 --- a/auth-passwd.c +++ b/auth-passwd.c @@ -11,30 +11,7 @@ * incompatible with the protocol description in the RFC file, it must be * called by a name other than "ssh" or "Secure Shell". * - * * Copyright (c) 1999 Dug Song. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. - * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - * - * * Copyright (c) 2000 Markus Friedl. All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -59,15 +36,19 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth-passwd.c,v 1.17 2000/09/07 20:27:49 deraadt Exp $"); +RCSID("$OpenBSD: auth-passwd.c,v 1.23 2001/06/26 16:15:23 dugsong Exp $"); #if !defined(USE_PAM) && !defined(HAVE_OSF_SIA) #include "packet.h" -#include "ssh.h" -#include "servconf.h" #include "xmalloc.h" +#include "log.h" +#include "servconf.h" +#include "auth.h" +#ifdef HAVE_CRYPT_H +# include +#endif #ifdef WITH_AIXAUTHENTICATE # include #endif @@ -75,6 +56,11 @@ RCSID("$OpenBSD: auth-passwd.c,v 1.17 2000/09/07 20:27:49 deraadt Exp $"); # include # include #endif +#ifdef HAVE_SCO_PROTECTED_PW +# include +# include +# include +#endif /* HAVE_SCO_PROTECTED_PW */ #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) # include #endif @@ -94,29 +80,32 @@ RCSID("$OpenBSD: auth-passwd.c,v 1.17 2000/09/07 20:27:49 deraadt Exp $"); #define is_winnt (GetVersion() < 0x80000000) #endif + +extern ServerOptions options; + /* * Tries to authenticate the user using password. Returns true if * authentication succeeds. */ int -auth_password(struct passwd * pw, const char *password) +auth_password(Authctxt *authctxt, const char *password) { - extern ServerOptions options; + struct passwd * pw = authctxt->pw; char *encrypted_password; char *pw_password; char *salt; #ifdef __hpux struct pr_passwd *spw; #endif +#ifdef HAVE_SCO_PROTECTED_PW + struct pr_passwd *spw; +#endif /* HAVE_SCO_PROTECTED_PW */ #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) struct spwd *spw; #endif #if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) struct passwd_adjunct *spw; #endif -# ifdef HAVE_HPUX_TRUSTED_SYSTEM_PW - struct pr_passwd *prpw; -#endif #ifdef WITH_AIXAUTHENTICATE char *authmsg; char *loginmsg; @@ -127,7 +116,7 @@ auth_password(struct passwd * pw, const char *password) if (pw == NULL) return 0; #ifndef HAVE_CYGWIN - if (pw->pw_uid == 0 && options.permit_root_login == 2) + if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES) return 0; #endif #ifdef HAVE_CYGWIN @@ -135,11 +124,18 @@ auth_password(struct passwd * pw, const char *password) * Empty password is only possible on NT if the user has _really_ * an empty password and authentication is done, though. */ - if (!is_winnt) + if (!is_winnt) #endif if (*password == '\0' && options.permit_empty_passwd == 0) return 0; - +#ifdef KRB5 + if (options.kerberos_authentication == 1) { + int ret = auth_krb5_password(authctxt, password); + if (ret == 1 || ret == 0) + return ret; + /* Fall back to ordinary passwd authentication. */ + } +#endif #ifdef HAVE_CYGWIN if (is_winnt) { HANDLE hToken = cygwin_logon_user(pw, password); @@ -150,30 +146,24 @@ auth_password(struct passwd * pw, const char *password) return 1; } #endif - -#ifdef SKEY - if (options.skey_authentication == 1) { - int ret = auth_skey_password(pw, password); - if (ret == 1 || ret == 0) - return ret; - /* Fall back to ordinary passwd authentication. */ - } -#endif - #ifdef WITH_AIXAUTHENTICATE return (authenticate(pw->pw_name,password,&reenter,&authmsg) == 0); #endif - #ifdef KRB4 if (options.kerberos_authentication == 1) { - int ret = auth_krb4_password(pw, password); + int ret = auth_krb4_password(authctxt, password); if (ret == 1 || ret == 0) return ret; /* Fall back to ordinary passwd authentication. */ } #endif - - +#ifdef BSD_AUTH + if (auth_userokay(pw->pw_name, authctxt->style, "auth-ssh", + (char *)password) == 0) + return 0; + else + return 1; +#endif pw_password = pw->pw_passwd; /* @@ -181,13 +171,21 @@ auth_password(struct passwd * pw, const char *password) */ #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) spw = getspnam(pw->pw_name); - if (spw != NULL) + if (spw != NULL) pw_password = spw->sp_pwdp; #endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */ + +#ifdef HAVE_SCO_PROTECTED_PW + spw = getprpwnam(pw->pw_name); + if (spw != NULL) + pw_password = spw->ufld.fd_encrypt; +#endif /* HAVE_SCO_PROTECTED_PW */ + #if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) if (issecure() && (spw = getpwanam(pw->pw_name)) != NULL) pw_password = spw->pwa_passwd; #endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */ + #if defined(__hpux) if (iscomsec() && (spw = getprpwnam(pw->pw_name)) != NULL) pw_password = spw->ufld.fd_encrypt; @@ -207,7 +205,7 @@ auth_password(struct passwd * pw, const char *password) encrypted_password = md5_crypt(password, salt); else encrypted_password = crypt(password, salt); -#else /* HAVE_MD5_PASSWORDS */ +#else /* HAVE_MD5_PASSWORDS */ # ifdef __hpux if (iscomsec()) encrypted_password = bigcrypt(password, salt); @@ -216,7 +214,7 @@ auth_password(struct passwd * pw, const char *password) # else encrypted_password = crypt(password, salt); # endif /* __hpux */ -#endif /* HAVE_MD5_PASSWORDS */ +#endif /* HAVE_MD5_PASSWORDS */ /* Authentication is accepted if the encrypted passwords are identical. */ return (strcmp(encrypted_password, pw_password) == 0);