X-Git-Url: http://andersk.mit.edu/gitweb/openssh.git/blobdiff_plain/a8a21a53bf8e9f5701c04c6229264a1329730220..ef51930f93f523426b6c383a1802061fbede93be:/auth1.c diff --git a/auth1.c b/auth1.c index 2ea638b9..676c8a66 100644 --- a/auth1.c +++ b/auth1.c @@ -10,7 +10,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth1.c,v 1.31 2001/12/27 20:39:58 markus Exp $"); +RCSID("$OpenBSD: auth1.c,v 1.43 2002/09/09 06:48:06 itojun Exp $"); #include "xmalloc.h" #include "rsa.h" @@ -22,9 +22,10 @@ RCSID("$OpenBSD: auth1.c,v 1.31 2001/12/27 20:39:58 markus Exp $"); #include "servconf.h" #include "compat.h" #include "auth.h" +#include "channels.h" #include "session.h" -#include "misc.h" #include "uidswap.h" +#include "monitor_wrap.h" /* import */ extern ServerOptions options; @@ -71,7 +72,6 @@ do_authloop(Authctxt *authctxt) char *client_user, *password; char info[1024]; u_int dlen; - int plen, nlen, elen; u_int ulen; int type = 0; struct passwd *pw = authctxt->pw; @@ -84,13 +84,7 @@ do_authloop(Authctxt *authctxt) #if defined(KRB4) || defined(KRB5) (!options.kerberos_authentication || options.kerberos_or_local_passwd) && #endif -#ifdef USE_PAM - auth_pam_password(pw, "")) { -#elif defined(HAVE_OSF_SIA) - 0) { -#else - auth_password(authctxt, "")) { -#endif + PRIVSEP(auth_password(authctxt, ""))) { auth_log(authctxt, 1, "without authentication", ""); return; } @@ -109,7 +103,7 @@ do_authloop(Authctxt *authctxt) info[0] = '\0'; /* Get a packet from the client. */ - type = packet_read(&plen); + type = packet_read(); /* Process the packet. */ switch (type) { @@ -120,7 +114,7 @@ do_authloop(Authctxt *authctxt) verbose("Kerberos authentication disabled."); } else { char *kdata = packet_get_string(&dlen); - packet_done(); + packet_check_eom(); if (kdata[0] == 4) { /* KRB_PROT_VERSION */ #ifdef KRB4 @@ -139,15 +133,27 @@ do_authloop(Authctxt *authctxt) #endif /* KRB4 */ } else { #ifdef KRB5 - krb5_data tkt; + krb5_data tkt, reply; tkt.length = dlen; tkt.data = kdata; - if (auth_krb5(authctxt, &tkt, &client_user)) { + if (PRIVSEP(auth_krb5(authctxt, &tkt, + &client_user, &reply))) { authenticated = 1; snprintf(info, sizeof(info), " tktuser %.100s", client_user); + + /* Send response to client */ + packet_start( + SSH_SMSG_AUTH_KERBEROS_RESPONSE); + packet_put_string((char *) + reply.data, reply.length); + packet_send(); + packet_write_wait(); + + if (reply.length) + xfree(reply.data); } #endif /* KRB5 */ } @@ -180,7 +186,7 @@ do_authloop(Authctxt *authctxt) * IP-spoofing on a local network.) */ client_user = packet_get_string(&ulen); - packet_done(); + packet_check_eom(); /* Try to authenticate using /etc/hosts.equiv and .rhosts. */ authenticated = auth_rhosts(pw, client_user); @@ -203,14 +209,14 @@ do_authloop(Authctxt *authctxt) /* Get the client host key. */ client_host_key = key_new(KEY_RSA1); bits = packet_get_int(); - packet_get_bignum(client_host_key->rsa->e, &elen); - packet_get_bignum(client_host_key->rsa->n, &nlen); + packet_get_bignum(client_host_key->rsa->e); + packet_get_bignum(client_host_key->rsa->n); if (bits != BN_num_bits(client_host_key->rsa->n)) verbose("Warning: keysize mismatch for client_host_key: " "actual %d, announced %d", - BN_num_bits(client_host_key->rsa->n), bits); - packet_done(); + BN_num_bits(client_host_key->rsa->n), bits); + packet_check_eom(); authenticated = auth_rhosts_rsa(pw, client_user, client_host_key); @@ -227,8 +233,8 @@ do_authloop(Authctxt *authctxt) /* RSA authentication requested. */ if ((n = BN_new()) == NULL) fatal("do_authloop: BN_new failed"); - packet_get_bignum(n, &nlen); - packet_done(); + packet_get_bignum(n); + packet_check_eom(); authenticated = auth_rsa(pw, n); BN_clear_free(n); break; @@ -244,19 +250,10 @@ do_authloop(Authctxt *authctxt) * not visible to an outside observer. */ password = packet_get_string(&dlen); - packet_done(); + packet_check_eom(); -#ifdef USE_PAM - /* Do PAM auth with password */ - authenticated = auth_pam_password(pw, password); -#elif defined(HAVE_OSF_SIA) - /* Do SIA auth with password */ - authenticated = auth_sia_password(authctxt->user, - password); -#else /* !USE_PAM && !HAVE_OSF_SIA */ /* Try authentication with the password. */ - authenticated = auth_password(authctxt, password); -#endif /* USE_PAM */ + authenticated = PRIVSEP(auth_password(authctxt, password)); memset(password, 0, strlen(password)); xfree(password); @@ -282,7 +279,7 @@ do_authloop(Authctxt *authctxt) if (options.challenge_response_authentication == 1) { char *response = packet_get_string(&dlen); debug("got response '%s'", response); - packet_done(); + packet_check_eom(); authenticated = verify_response(authctxt, response); memset(response, 'r', dlen); xfree(response); @@ -307,6 +304,15 @@ do_authloop(Authctxt *authctxt) fatal("INTERNAL ERROR: authenticated invalid user %s", authctxt->user); +#ifdef _UNICOS + if (type == SSH_CMSG_AUTH_PASSWORD && !authenticated) + cray_login_failure(authctxt->user, IA_UDBERR); + if (authenticated && cray_access_denied(authctxt->user)) { + authenticated = 0; + fatal("Access denied for user %s.",authctxt->user); + } +#endif /* _UNICOS */ + #ifdef HAVE_CYGWIN if (authenticated && !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, pw)) { @@ -316,12 +322,14 @@ do_authloop(Authctxt *authctxt) } #else /* Special handling for root */ - if (authenticated && authctxt->pw->pw_uid == 0 && + if (!use_privsep && + authenticated && authctxt->pw->pw_uid == 0 && !auth_root_allowed(get_authname(type))) authenticated = 0; #endif #ifdef USE_PAM - if (authenticated && !do_pam_account(pw->pw_name, client_user)) + if (!use_privsep && authenticated && + !do_pam_account(pw->pw_name, client_user)) authenticated = 0; #endif @@ -337,11 +345,6 @@ do_authloop(Authctxt *authctxt) return; if (authctxt->failures++ > AUTH_FAIL_MAX) { -#ifdef WITH_AIXAUTHENTICATE - loginfailed(authctxt->user, - get_canonical_hostname(options.reverse_mapping_check), - "ssh"); -#endif /* WITH_AIXAUTHENTICATE */ packet_disconnect(AUTH_FAIL_MSG, authctxt->user); } @@ -355,49 +358,48 @@ do_authloop(Authctxt *authctxt) * Performs authentication of an incoming connection. Session key has already * been exchanged and encryption is enabled. */ -void +Authctxt * do_authentication(void) { Authctxt *authctxt; - struct passwd *pw; - int plen; u_int ulen; - char *p, *user, *style = NULL; + char *user, *style = NULL; /* Get the name of the user that we wish to log in as. */ - packet_read_expect(&plen, SSH_CMSG_USER); + packet_read_expect(SSH_CMSG_USER); /* Get the user name. */ user = packet_get_string(&ulen); - packet_done(); + packet_check_eom(); if ((style = strchr(user, ':')) != NULL) *style++ = '\0'; +#ifdef KRB5 /* XXX - SSH.com Kerberos v5 braindeath. */ - if ((p = strchr(user, '@')) != NULL) - *p = '\0'; + if ((datafellows & SSH_BUG_K5USER) && + options.kerberos_authentication) { + char *p; + if ((p = strchr(user, '@')) != NULL) + *p = '\0'; + } +#endif authctxt = authctxt_new(); authctxt->user = user; authctxt->style = style; /* Verify that the user is a valid user. */ - pw = getpwnam(user); - if (pw && allowed_user(pw)) { + if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) authctxt->valid = 1; - pw = pwcopy(pw); - } else { + else debug("do_authentication: illegal user %s", user); - pw = NULL; - } - authctxt->pw = pw; - setproctitle("%s", pw ? user : "unknown"); + setproctitle("%s%s", authctxt->pw ? user : "unknown", + use_privsep ? " [net]" : ""); #ifdef USE_PAM - if (pw) - start_pam(user); + PRIVSEP(start_pam(authctxt->pw == NULL ? "NOUSER" : user)); #endif /* @@ -405,7 +407,8 @@ do_authentication(void) * the server. (Unless you are running Windows) */ #ifndef HAVE_CYGWIN - if (getuid() != 0 && pw && pw->pw_uid != getuid()) + if (!use_privsep && getuid() != 0 && authctxt->pw && + authctxt->pw->pw_uid != getuid()) packet_disconnect("Cannot change user when server not running as root."); #endif @@ -420,6 +423,5 @@ do_authentication(void) packet_send(); packet_write_wait(); - /* Perform session preparation. */ - do_authenticated(authctxt); + return (authctxt); }