X-Git-Url: http://andersk.mit.edu/gitweb/openssh.git/blobdiff_plain/91885a4d5370e317c337cdc779bfdd654d921a1a..8afe456df0b0ccd989631f6f6e35f61e9abedea0:/auth1.c diff --git a/auth1.c b/auth1.c index c52f6389..1f6fcb29 100644 --- a/auth1.c +++ b/auth1.c @@ -10,7 +10,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth1.c,v 1.35 2002/02/03 17:53:25 markus Exp $"); +RCSID("$OpenBSD: auth1.c,v 1.40 2002/04/10 08:21:47 markus Exp $"); #include "xmalloc.h" #include "rsa.h" @@ -24,15 +24,10 @@ RCSID("$OpenBSD: auth1.c,v 1.35 2002/02/03 17:53:25 markus Exp $"); #include "auth.h" #include "channels.h" #include "session.h" -#include "misc.h" #include "uidswap.h" -#include "monitor.h" #include "monitor_wrap.h" /* import */ -extern int use_privsep; -extern int mm_recvfd; - extern ServerOptions options; /* @@ -89,13 +84,7 @@ do_authloop(Authctxt *authctxt) #if defined(KRB4) || defined(KRB5) (!options.kerberos_authentication || options.kerberos_or_local_passwd) && #endif -#ifdef USE_PAM - auth_pam_password(pw, "")) { -#elif defined(HAVE_OSF_SIA) - 0) { -#else - auth_password(authctxt, "")) { -#endif + PRIVSEP(auth_password(authctxt, ""))) { auth_log(authctxt, 1, "without authentication", ""); return; } @@ -251,17 +240,8 @@ do_authloop(Authctxt *authctxt) password = packet_get_string(&dlen); packet_check_eom(); -#ifdef USE_PAM - /* Do PAM auth with password */ - authenticated = auth_pam_password(pw, password); -#elif defined(HAVE_OSF_SIA) - /* Do SIA auth with password */ - authenticated = auth_sia_password(authctxt->user, - password); -#else /* !USE_PAM && !HAVE_OSF_SIA */ /* Try authentication with the password. */ - authenticated = auth_password(authctxt, password); -#endif /* USE_PAM */ + authenticated = PRIVSEP(auth_password(authctxt, password)); memset(password, 0, strlen(password)); xfree(password); @@ -326,7 +306,8 @@ do_authloop(Authctxt *authctxt) authenticated = 0; #endif #ifdef USE_PAM - if (authenticated && !do_pam_account(pw->pw_name, client_user)) + if (!use_privsep && authenticated && + !do_pam_account(pw->pw_name, client_user)) authenticated = 0; #endif @@ -364,10 +345,8 @@ Authctxt * do_authentication(void) { Authctxt *authctxt; - struct passwd *pw = NULL, *pwent; u_int ulen; - int allowed; - char *p, *user, *style = NULL; + char *user, *style = NULL; /* Get the name of the user that we wish to log in as. */ packet_read_expect(SSH_CMSG_USER); @@ -379,38 +358,31 @@ do_authentication(void) if ((style = strchr(user, ':')) != NULL) *style++ = '\0'; +#ifdef KRB5 /* XXX - SSH.com Kerberos v5 braindeath. */ - if ((p = strchr(user, '@')) != NULL) - *p = '\0'; + if ((datafellows & SSH_BUG_K5USER) && + options.kerberos_authentication) { + char *p; + if ((p = strchr(user, '@')) != NULL) + *p = '\0'; + } +#endif authctxt = authctxt_new(); authctxt->user = user; authctxt->style = style; /* Verify that the user is a valid user. */ - if (!use_privsep) { - pwent = getpwnam(user); - allowed = pwent ? allowed_user(pwent) : 0; - } else - pwent = mm_getpwnamallow(mm_recvfd, user, &allowed); - if (pwent && allowed) { + if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) authctxt->valid = 1; - pw = pwcopy(pwent); - } else { + else debug("do_authentication: illegal user %s", user); - pw = NULL; - } - /* Free memory */ - if (use_privsep) - pwfree(pwent); - - authctxt->pw = pw; - setproctitle("%s%s", use_privsep ? " [net]" : "", - pw ? user : "unknown"); + setproctitle("%s%s", authctxt->pw ? user : "unknown", + use_privsep ? " [net]" : ""); #ifdef USE_PAM - start_pam(pw == NULL ? "NOUSER" : user); + PRIVSEP(start_pam(authctxt->pw == NULL ? "NOUSER" : user)); #endif /* @@ -418,7 +390,8 @@ do_authentication(void) * the server. (Unless you are running Windows) */ #ifndef HAVE_CYGWIN - if (getuid() != 0 && pw && pw->pw_uid != getuid()) + if (!use_privsep && getuid() != 0 && authctxt->pw && + authctxt->pw->pw_uid != getuid()) packet_disconnect("Cannot change user when server not running as root."); #endif