- Uniformly use .In for header file references.
[dragonfly.git] / lib / libskey / skey.3
CommitLineData
984263bc
MD
1.\" Copyright (c) 1996
2.\" David L. Nugent. All Rights reserved.
1bf4b486 3.\"
984263bc
MD
4.\" Redistribution and use in source and binary forms, with or without
5.\" modification, are permitted provided that the following conditions
6.\" are met:
7.\" 1. Redistributions of source code must retain the above copyright
8.\" notice, this list of conditions and the following disclaimer.
9.\" 2. Redistributions in binary form must reproduce the above copyright
10.\" notice, this list of conditions and the following disclaimer in the
11.\" documentation and/or other materials provided with the distribution.
1bf4b486 12.\"
984263bc
MD
13.\" THIS SOFTWARE IS PROVIDED BY DAVID L. NUGENT AND CONTRIBUTORS ``AS IS'' AND
14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16.\" ARE DISCLAIMED. IN NO EVENT SHALL DAVID L. NUGENT OR CONTRIBUTORS BE LIABLE
17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23.\" SUCH DAMAGE.
24.\"
25.\" $FreeBSD: src/lib/libskey/skey.3,v 1.10.2.1 2000/04/22 16:36:00 phantom Exp $
44cb301e 26.\" $DragonFly: src/lib/libskey/skey.3,v 1.5 2006/05/26 19:39:38 swildner Exp $
984263bc
MD
27.\"
28.Dd December 22, 1996
29.Dt SKEY 3
30.Os
31.Sh NAME
32.Nm skeylookup ,
33.Nm skeyverify ,
34.Nm skeychallenge ,
35.Nm skeyinfo ,
36.Nm skeyaccess ,
37.Nm skey_getpass ,
38.Nm skey_crypt
39.Nd library routines for S/Key password control table access
40.Sh LIBRARY
41.Lb libskey
42.Sh SYNOPSIS
44cb301e
SW
43.In stdio.h
44.In skey.h
984263bc
MD
45.Ft int
46.Fn skeylookup "struct skey *mp" "const char *name"
47.Ft int
48.Fn skeyverify "struct skey *mp" "char *response"
49.Ft int
50.Fn skeychallenge "struct skey *mp" "const char *name" "char *challenge"
51.Ft int
52.Fn skeyinfo "struct skey *mp" "const char *name" "char *ss"
53.Ft int
54.Fn skeyaccess "char *user" "const char *port" "const char *host" "const char *addr"
55.Ft char *
56.Fn skey_getpass "const char *prompt" "struct passwd *pwd" "int pwok"
57.Ft const char *
58.Fn skey_crypt "char *pp" "char *salt" "struct passwd *pwd" "int pwok"
59.Sh DESCRIPTION
60These routes support the S/Key one time password system used for
61accessing computer systems.
62See
1bf4b486 63.Xr skey 1
984263bc
MD
64for more information about the S/Key system itself.
65.Pp
66.Pp
67.Fn skeylookup
68finds an entry in the one-time password database.
69On success (an entry is found corresponding to the given name),
70they skey structure passed by the caller is filled and 0 is
71returned, with the file read/write pointer positioned at the
72beginning of the record found.
73If no entry is found corresponding to the given name, the file
74read/write pointer is positioned at end of file and the routine
75returns 1.
76If the database cannot be opened or an access error occurs,
77.Fn skeylookup
78returns -1.
79.Pp
80The
81.Fn skeyinfo
82function looks up skey info for user 'name'.
83If successful, the caller's skey structure is filled and
84.Fn skeyinfo
85returns 0.
86If an optional challenge string buffer is given, it is updated.
87If unsuccessful (e.g. if the name is unknown, or the database
88cannot be accessed) -1 is returned.
89.Pp
90.Fn skeychallenge
91returns an skey challenge string for 'name'.
92If successful, the caller's skey structure is filled, and
93the function returns 0, with the file read/write pointer
94left at the start of the record.
95If unsuccessful (ie. the name was not found), the function
96returns -1 and the database is closed.
97.Pp
98.Fn skeyverify
99verifies a response to an s/key challenge.
100If this function returns 0, the verify was successful and
101the database was updated.
102If 1 is returned, the verify failed and the database remains
103unchanged.
104If -1 is returned, some sort of error occurred with the database,
105and the database is left unchanged.
106The s/key database is always closed by this call.
107.Pp
108The
109.Fn skey_getpass
110function may be used to read regular or s/key passwords.
111The prompt to use is passed to the function, along with the
112full (secure) struct passwd for the user to be verified.
113.Fn skey_getpass
114uses the standard library getpass on the first attempt at
115retrieving the user's password, and if that is blank, turns
116echo back on and retrieves the S/Key password.
117In either case, the entered string is returned back to the
118caller.
119.Pp
120The
121.Fn skey_crypt
122is a wrapper function for the standard library
123.Xr crypt 3 ,
124which returns the encrypted UNIX password if either the given
125s/key or regular passwords are ok.
126.Fn skey_crypt
127first attempts verification of the given password via the skey
128method, and will return the encrypted password from the
129passwd structure if it can be verified, as though the user had
130actually entered the correct UNIX password.
131If s/key password verification does not work, then the password
132is encrypted in the usual way and the result passed back to the
133caller.
134If the passwd structure pointer is NULL,
135.Fn skey_crypt
136returns a non-NULL string which could not possibly be a valid
137UNIX password (namely, a string containing ":").
138.Pp
139The
140.Fn skeyaccess
141function determines whether traditional UNIX (non-S/Key) passwords
142are permitted for any combination of user name, group member,
143terminal port, host name, and network. If UNIX passwords are allowed,
144.Fn skeyaccess
145returns a non-zero value. If UNIX passwords are not allowed, it
146returns 0. See
147.Xr skey.access 5
148for more information on the layout and structure of the
149skey.access configuration file which this function uses.
150.Sh RETURN VALUES
151See above.
152.Sh SEE ALSO
153.Xr skey 1 ,
154.Xr skey.access 5
984263bc
MD
155.Sh AUTHORS
156.An Phil Karn ,
157.An Neil M. Haller ,
158.An John S. Walden ,
159.An Scott Chasin
0b84df5c
SW
160.Sh BUGS
161No advisory locking is done on the s/key database to guard against
162simultaneous access from multiple processes.
163This is not normally a problem when keys are added to or updated
164in the file, but may be problematic when keys are removed.