From 882a3870e4321ce1b81a7ec9f7799242bc3f0eb0 Mon Sep 17 00:00:00 2001 From: djm Date: Wed, 22 Jan 2003 04:42:26 +0000 Subject: [PATCH] - (djm) Reorganise PAM & SIA password handling to eliminate some common code --- ChangeLog | 1 + auth-pam.c | 8 ----- auth-passwd.c | 89 +++++++++++++++++++++++++-------------------------- auth-sia.c | 2 +- 4 files changed, 46 insertions(+), 54 deletions(-) diff --git a/ChangeLog b/ChangeLog index a3fdefd2..b548277a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,7 @@ Add a -t life option to ssh-agent that set the default lifetime. The default can still be overriden by using -t in ssh-add. OK markus@ + - (djm) Reorganise PAM & SIA password handling to eliminate some common code 20030120 - (djm) Fix compilation for NetBSD from dtucker@zip.com.au diff --git a/auth-pam.c b/auth-pam.c index 3f0f32f7..c91de9da 100644 --- a/auth-pam.c +++ b/auth-pam.c @@ -210,14 +210,6 @@ int auth_pam_password(Authctxt *authctxt, const char *password) do_pam_set_conv(&conv); - /* deny if no user. */ - if (pw == NULL) - return 0; - if (pw->pw_uid == 0 && options.permit_root_login == PERMIT_NO_PASSWD) - return 0; - if (*password == '\0' && options.permit_empty_passwd == 0) - return 0; - __pampasswd = password; pamstate = INITIAL_LOGIN; diff --git a/auth-passwd.c b/auth-passwd.c index 185db7d6..cbf093f0 100644 --- a/auth-passwd.c +++ b/auth-passwd.c @@ -92,52 +92,51 @@ extern char *aixloginmsg; int auth_password(Authctxt *authctxt, const char *password) { -#if defined(USE_PAM) - if (*password == '\0' && options.permit_empty_passwd == 0) - return 0; - return auth_pam_password(authctxt, password); -#elif defined(HAVE_OSF_SIA) - if (*password == '\0' && options.permit_empty_passwd == 0) - return 0; - return auth_sia_password(authctxt, password); -#else +#if !defined(USE_PAM) && !defined(HAVE_OSF_SIA) struct passwd * pw = authctxt->pw; char *encrypted_password; char *pw_password; char *salt; -#if defined(__hpux) || defined(HAVE_SECUREWARE) +# if defined(__hpux) || defined(HAVE_SECUREWARE) struct pr_passwd *spw; -#endif /* __hpux || HAVE_SECUREWARE */ -#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) +# endif /* __hpux || HAVE_SECUREWARE */ +# if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) struct spwd *spw; -#endif -#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) +# endif +# if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) struct passwd_adjunct *spw; -#endif -#ifdef WITH_AIXAUTHENTICATE +# endif +# ifdef WITH_AIXAUTHENTICATE char *authmsg; int authsuccess; int reenter = 1; -#endif +# endif +#endif /* !defined(USE_PAM) && !defined(HAVE_OSF_SIA) */ /* deny if no user. */ if (pw == NULL) return 0; #ifndef HAVE_CYGWIN - if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES) + if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_NO_PASSWD) return 0; #endif if (*password == '\0' && options.permit_empty_passwd == 0) return 0; -#ifdef KRB5 + +#if defined(USE_PAM) + return auth_pam_password(authctxt, password); +#elif defined(HAVE_OSF_SIA) + return auth_sia_password(authctxt, password); +#else +# ifdef KRB5 if (options.kerberos_authentication == 1) { int ret = auth_krb5_password(authctxt, password); if (ret == 1 || ret == 0) return ret; /* Fall back to ordinary passwd authentication. */ } -#endif -#ifdef HAVE_CYGWIN +# endif +# ifdef HAVE_CYGWIN if (is_winnt) { HANDLE hToken = cygwin_logon_user(pw, password); @@ -146,8 +145,8 @@ auth_password(Authctxt *authctxt, const char *password) cygwin_set_impersonation_token(hToken); return 1; } -#endif -#ifdef WITH_AIXAUTHENTICATE +# endif +# ifdef WITH_AIXAUTHENTICATE authsuccess = (authenticate(pw->pw_name,password,&reenter,&authmsg) == 0); if (authsuccess) @@ -158,47 +157,47 @@ auth_password(Authctxt *authctxt, const char *password) aixloginmsg = NULL; return(authsuccess); -#endif -#ifdef KRB4 +# endif +# ifdef KRB4 if (options.kerberos_authentication == 1) { int ret = auth_krb4_password(authctxt, password); if (ret == 1 || ret == 0) return ret; /* Fall back to ordinary passwd authentication. */ } -#endif -#ifdef BSD_AUTH +# endif +# ifdef BSD_AUTH if (auth_userokay(pw->pw_name, authctxt->style, "auth-ssh", (char *)password) == 0) return 0; else return 1; -#endif +# endif pw_password = pw->pw_passwd; /* * Various interfaces to shadow or protected password data */ -#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) +# if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) spw = getspnam(pw->pw_name); if (spw != NULL) pw_password = spw->sp_pwdp; -#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */ +# endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */ -#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) +# if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) if (issecure() && (spw = getpwanam(pw->pw_name)) != NULL) pw_password = spw->pwa_passwd; -#endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */ +# endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */ -#ifdef HAVE_SECUREWARE +# ifdef HAVE_SECUREWARE if ((spw = getprpwnam(pw->pw_name)) != NULL) pw_password = spw->ufld.fd_encrypt; -#endif /* HAVE_SECUREWARE */ +# endif /* HAVE_SECUREWARE */ -#if defined(__hpux) && !defined(HAVE_SECUREWARE) +# if defined(__hpux) && !defined(HAVE_SECUREWARE) if (iscomsec() && (spw = getprpwnam(pw->pw_name)) != NULL) pw_password = spw->ufld.fd_encrypt; -#endif /* defined(__hpux) && !defined(HAVE_SECUREWARE) */ +# endif /* defined(__hpux) && !defined(HAVE_SECUREWARE) */ /* Check for users with no password. */ if ((password[0] == '\0') && (pw_password[0] == '\0')) @@ -209,25 +208,25 @@ auth_password(Authctxt *authctxt, const char *password) else salt = "xx"; -#ifdef HAVE_MD5_PASSWORDS +# ifdef HAVE_MD5_PASSWORDS if (is_md5_salt(salt)) encrypted_password = md5_crypt(password, salt); else encrypted_password = crypt(password, salt); -#else /* HAVE_MD5_PASSWORDS */ -# if defined(__hpux) && !defined(HAVE_SECUREWARE) +# else /* HAVE_MD5_PASSWORDS */ +# if defined(__hpux) && !defined(HAVE_SECUREWARE) if (iscomsec()) encrypted_password = bigcrypt(password, salt); else encrypted_password = crypt(password, salt); -# else -# ifdef HAVE_SECUREWARE - encrypted_password = bigcrypt(password, salt); # else +# ifdef HAVE_SECUREWARE + encrypted_password = bigcrypt(password, salt); +# else encrypted_password = crypt(password, salt); -# endif /* HAVE_SECUREWARE */ -# endif /* __hpux && !defined(HAVE_SECUREWARE) */ -#endif /* HAVE_MD5_PASSWORDS */ +# endif /* HAVE_SECUREWARE */ +# endif /* __hpux && !defined(HAVE_SECUREWARE) */ +# endif /* HAVE_MD5_PASSWORDS */ /* Authentication is accepted if the encrypted passwords are identical. */ return (strcmp(encrypted_password, pw_password) == 0); diff --git a/auth-sia.c b/auth-sia.c index 58b17c16..071e154d 100644 --- a/auth-sia.c +++ b/auth-sia.c @@ -57,7 +57,7 @@ auth_sia_password(Authctxt *authctxt, char *pass) host = get_canonical_hostname(options.verify_reverse_mapping); - if (!user || !pass || pass[0] == '\0') + if (pass[0] == '\0') return(0); if (sia_ses_init(&ent, saved_argc, saved_argv, host, user, NULL, 0, -- 2.45.2