X-Git-Url: http://andersk.mit.edu/gitweb/openssh.git/blobdiff_plain/7f8f5e0088488617fb831354fc78bcf29af297a8..ecdde3d8ca7e9973b300fdcad476578a167a5206:/auth-passwd.c diff --git a/auth-passwd.c b/auth-passwd.c index 055a0362..c849abdc 100644 --- a/auth-passwd.c +++ b/auth-passwd.c @@ -11,30 +11,7 @@ * incompatible with the protocol description in the RFC file, it must be * called by a name other than "ssh" or "Secure Shell". * - * * Copyright (c) 1999 Dug Song. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES - * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. - * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - * - * * Copyright (c) 2000 Markus Friedl. All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -59,26 +36,32 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth-passwd.c,v 1.17 2000/09/07 20:27:49 deraadt Exp $"); +RCSID("$OpenBSD: auth-passwd.c,v 1.21 2001/02/12 16:16:23 markus Exp $"); #if !defined(USE_PAM) && !defined(HAVE_OSF_SIA) #include "packet.h" -#include "ssh.h" -#include "servconf.h" #include "xmalloc.h" +#include "log.h" +#include "servconf.h" +#include "auth.h" #ifdef WITH_AIXAUTHENTICATE # include #endif -#ifdef HAVE_HPUX_TRUSTED_SYSTEM_PW +#ifdef __hpux # include # include #endif -#ifdef HAVE_SHADOW_H +#ifdef HAVE_SCO_PROTECTED_PW +# include +# include +# include +#endif /* HAVE_SCO_PROTECTED_PW */ +#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) # include #endif -#ifdef HAVE_GETPWANAM +#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) # include # include # include @@ -105,15 +88,18 @@ auth_password(struct passwd * pw, const char *password) char *encrypted_password; char *pw_password; char *salt; -#ifdef HAVE_SHADOW_H +#ifdef __hpux + struct pr_passwd *spw; +#endif +#ifdef HAVE_SCO_PROTECTED_PW + struct pr_passwd *spw; +#endif /* HAVE_SCO_PROTECTED_PW */ +#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) struct spwd *spw; #endif -#ifdef HAVE_GETPWANAM +#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) struct passwd_adjunct *spw; #endif -# ifdef HAVE_HPUX_TRUSTED_SYSTEM_PW - struct pr_passwd *prpw; -#endif #ifdef WITH_AIXAUTHENTICATE char *authmsg; char *loginmsg; @@ -124,7 +110,7 @@ auth_password(struct passwd * pw, const char *password) if (pw == NULL) return 0; #ifndef HAVE_CYGWIN - if (pw->pw_uid == 0 && options.permit_root_login == 2) + if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES) return 0; #endif #ifdef HAVE_CYGWIN @@ -132,7 +118,7 @@ auth_password(struct passwd * pw, const char *password) * Empty password is only possible on NT if the user has _really_ * an empty password and authentication is done, though. */ - if (!is_winnt) + if (!is_winnt) #endif if (*password == '\0' && options.permit_empty_passwd == 0) return 0; @@ -148,15 +134,6 @@ auth_password(struct passwd * pw, const char *password) } #endif -#ifdef SKEY - if (options.skey_authentication == 1) { - int ret = auth_skey_password(pw, password); - if (ret == 1 || ret == 0) - return ret; - /* Fall back to ordinary passwd authentication. */ - } -#endif - #ifdef WITH_AIXAUTHENTICATE return (authenticate(pw->pw_name,password,&reenter,&authmsg) == 0); #endif @@ -170,39 +147,38 @@ auth_password(struct passwd * pw, const char *password) } #endif -# ifdef HAVE_HPUX_TRUSTED_SYSTEM_PW - prpw = getprpwnam(pw->pw_name); - pw_password = prpw->ufld.fd_encrypt; -#else - pw_password = pw->pw_passwd; -#endif - /* Check for users with no password. */ - if (strcmp(password, "") == 0 && strcmp(pw_password, "") == 0) - return 1; + pw_password = pw->pw_passwd; + /* + * Various interfaces to shadow or protected password data + */ #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) spw = getspnam(pw->pw_name); - if (spw != NULL) - { - /* Check for users with no password. */ - if (strcmp(password, "") == 0 && strcmp(spw->sp_pwdp, "") == 0) - return 1; - + if (spw != NULL) pw_password = spw->sp_pwdp; - } #endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */ + +#ifdef HAVE_SCO_PROTECTED_PW + spw = getprpwnam(pw->pw_name); + if (spw != NULL) + pw_password = spw->ufld.fd_encrypt; +#endif /* HAVE_SCO_PROTECTED_PW */ + #if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) if (issecure() && (spw = getpwanam(pw->pw_name)) != NULL) - { - /* Check for users with no password. */ - if (strcmp(password, "") == 0 && strcmp(spw->pwa_passwd, "") == 0) - return 1; - pw_password = spw->pwa_passwd; - } #endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */ +#if defined(__hpux) + if (iscomsec() && (spw = getprpwnam(pw->pw_name)) != NULL) + pw_password = spw->ufld.fd_encrypt; +#endif /* defined(__hpux) */ + + /* Check for users with no password. */ + if ((password[0] == '\0') && (pw_password[0] == '\0')) + return 1; + if (pw_password[0] != '\0') salt = pw_password; else @@ -213,13 +189,16 @@ auth_password(struct passwd * pw, const char *password) encrypted_password = md5_crypt(password, salt); else encrypted_password = crypt(password, salt); -#else /* HAVE_MD5_PASSWORDS */ -# ifdef HAVE_HPUX_TRUSTED_SYSTEM_PW - encrypted_password = bigcrypt(password, salt); +#else /* HAVE_MD5_PASSWORDS */ +# ifdef __hpux + if (iscomsec()) + encrypted_password = bigcrypt(password, salt); + else + encrypted_password = crypt(password, salt); # else encrypted_password = crypt(password, salt); -# endif /* HAVE_HPUX_TRUSTED_SYSTEM_PW */ -#endif /* HAVE_MD5_PASSWORDS */ +# endif /* __hpux */ +#endif /* HAVE_MD5_PASSWORDS */ /* Authentication is accepted if the encrypted passwords are identical. */ return (strcmp(encrypted_password, pw_password) == 0);