crypto/openssh/auth-pam.c

   1 /*
   2  * Copyright (c) 2000 Damien Miller.  All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  * 1. Redistributions of source code must retain the above copyright
   8  *    notice, this list of conditions and the following disclaimer.
   9  * 2. Redistributions in binary form must reproduce the above copyright
  10  *    notice, this list of conditions and the following disclaimer in the
  11  *    documentation and/or other materials provided with the distribution.
  12  *
  13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  14  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  15  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  16  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  17  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  18  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  19  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  20  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  21  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  22  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  23  */
  24
  25 #include "includes.h"
  26
  27 #ifdef USE_PAM
  28 #include "xmalloc.h"
  29 #include "log.h"
  30 #include "auth.h"
  31 #include "auth-options.h"
  32 #include "auth-pam.h"
  33 #include "servconf.h"
  34 #include "canohost.h"
  35 #include "readpass.h"
  36
  37 extern char *__progname;
  38
  39 extern int use_privsep;
  40
  41 RCSID("$Id: auth-pam.c,v 1.54 2002/07/28 20:24:08 stevesk Exp $");
  42 RCSID("$FreeBSD: src/crypto/openssh/auth-pam.c,v 1.2.2.4 2003/02/03 17:31:06 des Exp $");
  43 RCSID("$DragonFly: src/crypto/openssh/Attic/auth-pam.c,v 1.2 2003/06/17 04:24:36 dillon Exp $");
  44
  45 #define NEW_AUTHTOK_MSG \
  46         "Warning: Your password has expired, please change it now."
  47 #define NEW_AUTHTOK_MSG_PRIVSEP \
  48         "Your password has expired, the session cannot proceed."
  49
  50 static int do_pam_conversation(int num_msg, const struct pam_message **msg,
  51         struct pam_response **resp, void *appdata_ptr);
  52
  53 /* module-local variables */
  54 static struct pam_conv conv = {
  55         (int (*)())do_pam_conversation,
  56         NULL
  57 };
  58 static char *__pam_msg = NULL;
  59 static pam_handle_t *__pamh = NULL;
  60 static const char *__pampasswd = NULL;
  61
  62 /* states for do_pam_conversation() */
  63 enum { INITIAL_LOGIN, OTHER } pamstate = INITIAL_LOGIN;
  64 /* remember whether pam_acct_mgmt() returned PAM_NEW_AUTHTOK_REQD */
  65 static int password_change_required = 0;
  66 /* remember whether the last pam_authenticate() succeeded or not */
  67 static int was_authenticated = 0;
  68
  69 /* Remember what has been initialised */
  70 static int session_opened = 0;
  71 static int creds_set = 0;
  72
  73 /* accessor which allows us to switch conversation structs according to
  74  * the authentication method being used */
  75 void do_pam_set_conv(struct pam_conv *conv)
  76 {
  77         pam_set_item(__pamh, PAM_CONV, conv);
  78 }
  79
  80 /* start an authentication run */
  81 int do_pam_authenticate(int flags)
  82 {
  83         int retval = pam_authenticate(__pamh, flags);
  84         was_authenticated = (retval == PAM_SUCCESS);
  85         return retval;
  86 }
  87
  88 /*
  89  * PAM conversation function.
  90  * There are two states this can run in.
  91  *
  92  * INITIAL_LOGIN mode simply feeds the password from the client into
  93  * PAM in response to PAM_PROMPT_ECHO_OFF, and collects output
  94  * messages with into __pam_msg.  This is used during initial
  95  * authentication to bypass the normal PAM password prompt.
  96  *
  97  * OTHER mode handles PAM_PROMPT_ECHO_OFF with read_passphrase()
  98  * and outputs messages to stderr. This mode is used if pam_chauthtok()
  99  * is called to update expired passwords.
 100  */
 101 static int do_pam_conversation(int num_msg, const struct pam_message **msg,
 102         struct pam_response **resp, void *appdata_ptr)
 103 {
 104         struct pam_response *reply;
 105         int count;
 106         char buf[1024];
 107
 108         /* PAM will free this later */
 109         reply = xmalloc(num_msg * sizeof(*reply));
 110
 111         for (count = 0; count < num_msg; count++) {
 112                 if (pamstate == INITIAL_LOGIN) {
 113                         /*
 114                          * We can't use stdio yet, queue messages for
 115                          * printing later
 116                          */
 117                         switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
 118                         case PAM_PROMPT_ECHO_ON:
 119                                 xfree(reply);
 120                                 return PAM_CONV_ERR;
 121                         case PAM_PROMPT_ECHO_OFF:
 122                                 if (__pampasswd == NULL) {
 123                                         xfree(reply);
 124                                         return PAM_CONV_ERR;
 125                                 }
 126                                 reply[count].resp = xstrdup(__pampasswd);
 127                                 reply[count].resp_retcode = PAM_SUCCESS;
 128                                 break;
 129                         case PAM_ERROR_MSG:
 130                         case PAM_TEXT_INFO:
 131                                 if (PAM_MSG_MEMBER(msg, count, msg) != NULL) {
 132                                         message_cat(&__pam_msg,
 133                                             PAM_MSG_MEMBER(msg, count, msg));
 134                                 }
 135                                 reply[count].resp = xstrdup("");
 136                                 reply[count].resp_retcode = PAM_SUCCESS;
 137                                 break;
 138                         default:
 139                                 xfree(reply);
 140                                 return PAM_CONV_ERR;
 141                         }
 142                 } else {
 143                         /*
 144                          * stdio is connected, so interact directly
 145                          */
 146                         switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
 147                         case PAM_PROMPT_ECHO_ON:
 148                                 fputs(PAM_MSG_MEMBER(msg, count, msg), stderr);
 149                                 fgets(buf, sizeof(buf), stdin);
 150                                 reply[count].resp = xstrdup(buf);
 151                                 reply[count].resp_retcode = PAM_SUCCESS;
 152                                 break;
 153                         case PAM_PROMPT_ECHO_OFF:
 154                                 reply[count].resp =
 155                                     read_passphrase(PAM_MSG_MEMBER(msg, count,
 156                                         msg), RP_ALLOW_STDIN);
 157                                 reply[count].resp_retcode = PAM_SUCCESS;
 158                                 break;
 159                         case PAM_ERROR_MSG:
 160                         case PAM_TEXT_INFO:
 161                                 if (PAM_MSG_MEMBER(msg, count, msg) != NULL)
 162                                         fprintf(stderr, "%s\n",
 163                                             PAM_MSG_MEMBER(msg, count, msg));
 164                                 reply[count].resp = xstrdup("");
 165                                 reply[count].resp_retcode = PAM_SUCCESS;
 166                                 break;
 167                         default:
 168                                 xfree(reply);
 169                                 return PAM_CONV_ERR;
 170                         }
 171                 }
 172         }
 173
 174         *resp = reply;
 175
 176         return PAM_SUCCESS;
 177 }
 178
 179 /* Called at exit to cleanly shutdown PAM */
 180 void do_pam_cleanup_proc(void *context)
 181 {
 182         int pam_retval = PAM_SUCCESS;
 183
 184         if (__pamh && session_opened) {
 185                 pam_retval = pam_close_session(__pamh, 0);
 186                 if (pam_retval != PAM_SUCCESS)
 187                         log("Cannot close PAM session[%d]: %.200s",
 188                             pam_retval, PAM_STRERROR(__pamh, pam_retval));
 189         }
 190
 191         if (__pamh && creds_set) {
 192                 pam_retval = pam_setcred(__pamh, PAM_DELETE_CRED);
 193                 if (pam_retval != PAM_SUCCESS)
 194                         debug("Cannot delete credentials[%d]: %.200s",
 195                             pam_retval, PAM_STRERROR(__pamh, pam_retval));
 196         }
 197
 198         if (__pamh) {
 199                 pam_retval = pam_end(__pamh, pam_retval);
 200                 if (pam_retval != PAM_SUCCESS)
 201                         log("Cannot release PAM authentication[%d]: %.200s",
 202                             pam_retval, PAM_STRERROR(__pamh, pam_retval));
 203         }
 204 }
 205
 206 /* Attempt password authentation using PAM */
 207 int auth_pam_password(Authctxt *authctxt, const char *password)
 208 {
 209         extern ServerOptions options;
 210         int pam_retval;
 211         struct passwd *pw = authctxt->pw;
 212
 213         do_pam_set_conv(&conv);
 214
 215         /* deny if no user. */
 216         if (pw == NULL)
 217                 return 0;
 218         if (pw->pw_uid == 0 && options.permit_root_login == PERMIT_NO_PASSWD)
 219                 return 0;
 220         if (*password == '\0' && options.permit_empty_passwd == 0)
 221                 return 0;
 222
 223         __pampasswd = password;
 224
 225         pamstate = INITIAL_LOGIN;
 226         pam_retval = do_pam_authenticate(
 227             options.permit_empty_passwd == 0 ? PAM_DISALLOW_NULL_AUTHTOK : 0);
 228         if (pam_retval == PAM_SUCCESS) {
 229                 debug("PAM Password authentication accepted for "
 230                     "user \"%.100s\"", pw->pw_name);
 231                 return 1;
 232         } else {
 233                 debug("PAM Password authentication for \"%.100s\" "
 234                     "failed[%d]: %s", pw->pw_name, pam_retval,
 235                     PAM_STRERROR(__pamh, pam_retval));
 236                 return 0;
 237         }
 238 }
 239
 240 /* Do account management using PAM */
 241 int do_pam_account(char *username, char *remote_user)
 242 {
 243         int pam_retval;
 244
 245         do_pam_set_conv(&conv);
 246
 247         if (remote_user) {
 248                 debug("PAM setting ruser to \"%.200s\"", remote_user);
 249                 pam_retval = pam_set_item(__pamh, PAM_RUSER, remote_user);
 250                 if (pam_retval != PAM_SUCCESS)
 251                         fatal("PAM set ruser failed[%d]: %.200s", pam_retval,
 252                             PAM_STRERROR(__pamh, pam_retval));
 253         }
 254
 255         pam_retval = pam_acct_mgmt(__pamh, 0);
 256         debug2("pam_acct_mgmt() = %d", pam_retval);
 257         switch (pam_retval) {
 258                 case PAM_SUCCESS:
 259                         /* This is what we want */
 260                         break;
 261 #if 0
 262                 case PAM_NEW_AUTHTOK_REQD:
 263                         message_cat(&__pam_msg, use_privsep ?
 264                             NEW_AUTHTOK_MSG_PRIVSEP : NEW_AUTHTOK_MSG);
 265                         /* flag that password change is necessary */
 266                         password_change_required = 1;
 267                         /* disallow other functionality for now */
 268                         no_port_forwarding_flag |= 2;
 269                         no_agent_forwarding_flag |= 2;
 270                         no_x11_forwarding_flag |= 2;
 271                         break;
 272 #endif
 273                 default:
 274                         log("PAM rejected by account configuration[%d]: "
 275                             "%.200s", pam_retval, PAM_STRERROR(__pamh,
 276                             pam_retval));
 277                         return(0);
 278         }
 279
 280         return(1);
 281 }
 282
 283 /* Do PAM-specific session initialisation */
 284 void do_pam_session(char *username, const char *ttyname)
 285 {
 286         int pam_retval;
 287
 288         do_pam_set_conv(&conv);
 289
 290         if (ttyname != NULL) {
 291                 debug("PAM setting tty to \"%.200s\"", ttyname);
 292                 pam_retval = pam_set_item(__pamh, PAM_TTY, ttyname);
 293                 if (pam_retval != PAM_SUCCESS)
 294                         fatal("PAM set tty failed[%d]: %.200s",
 295                             pam_retval, PAM_STRERROR(__pamh, pam_retval));
 296         }
 297
 298         pam_retval = pam_open_session(__pamh, 0);
 299         if (pam_retval != PAM_SUCCESS)
 300                 fatal("PAM session setup failed[%d]: %.200s",
 301                     pam_retval, PAM_STRERROR(__pamh, pam_retval));
 302
 303         session_opened = 1;
 304 }
 305
 306 /* Set PAM credentials */
 307 void do_pam_setcred(int init)
 308 {
 309         int pam_retval;
 310
 311         if (__pamh == NULL)
 312                 return;
 313
 314         do_pam_set_conv(&conv);
 315
 316         debug("PAM establishing creds");
 317         pam_retval = pam_setcred(__pamh,
 318             init ? PAM_ESTABLISH_CRED : PAM_REINITIALIZE_CRED);
 319         if (pam_retval != PAM_SUCCESS) {
 320                 if (was_authenticated)
 321                         fatal("PAM setcred failed[%d]: %.200s",
 322                             pam_retval, PAM_STRERROR(__pamh, pam_retval));
 323                 else
 324                         debug("PAM setcred failed[%d]: %.200s",
 325                             pam_retval, PAM_STRERROR(__pamh, pam_retval));
 326         } else
 327                 creds_set = 1;
 328 }
 329
 330 /* accessor function for file scope static variable */
 331 int is_pam_password_change_required(void)
 332 {
 333         return password_change_required;
 334 }
 335
 336 /*
 337  * Have user change authentication token if pam_acct_mgmt() indicated
 338  * it was expired.  This needs to be called after an interactive
 339  * session is established and the user's pty is connected to
 340  * stdin/stdout/stderr.
 341  */
 342 void do_pam_chauthtok(void)
 343 {
 344         int pam_retval;
 345
 346         do_pam_set_conv(&conv);
 347
 348         if (password_change_required) {
 349                 if (use_privsep)
 350                         fatal("Password changing is currently unsupported"
 351                             " with privilege separation");
 352                 pamstate = OTHER;
 353                 pam_retval = pam_chauthtok(__pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
 354                 if (pam_retval != PAM_SUCCESS)
 355                         fatal("PAM pam_chauthtok failed[%d]: %.200s",
 356                             pam_retval, PAM_STRERROR(__pamh, pam_retval));
 357 #if 0
 358                 /* XXX: This would need to be done in the parent process,
 359                  * but there's currently no way to pass such request. */
 360                 no_port_forwarding_flag &= ~2;
 361                 no_agent_forwarding_flag &= ~2;
 362                 no_x11_forwarding_flag &= ~2;
 363                 if (!no_port_forwarding_flag && options.allow_tcp_forwarding)
 364                         channel_permit_all_opens();
 365 #endif
 366         }
 367 }
 368
 369 /* Cleanly shutdown PAM */
 370 void finish_pam(void)
 371 {
 372         do_pam_cleanup_proc(NULL);
 373         fatal_remove_cleanup(&do_pam_cleanup_proc, NULL);
 374 }
 375
 376 /* Start PAM authentication for specified account */
 377 void start_pam(const char *user)
 378 {
 379         int pam_retval;
 380         extern ServerOptions options;
 381         extern u_int utmp_len;
 382         const char *rhost;
 383
 384         debug("Starting up PAM with username \"%.200s\"", user);
 385
 386         pam_retval = pam_start(SSHD_PAM_SERVICE, user, &conv, &__pamh);
 387
 388         if (pam_retval != PAM_SUCCESS)
 389                 fatal("PAM initialisation failed[%d]: %.200s",
 390                     pam_retval, PAM_STRERROR(__pamh, pam_retval));
 391
 392         rhost = get_remote_name_or_ip(utmp_len, options.verify_reverse_mapping);
 393         debug("PAM setting rhost to \"%.200s\"", rhost);
 394
 395         pam_retval = pam_set_item(__pamh, PAM_RHOST, rhost);
 396         if (pam_retval != PAM_SUCCESS)
 397                 fatal("PAM set rhost failed[%d]: %.200s", pam_retval,
 398                     PAM_STRERROR(__pamh, pam_retval));
 399 #ifdef PAM_TTY_KLUDGE
 400         /*
 401          * Some PAM modules (e.g. pam_time) require a TTY to operate,
 402          * and will fail in various stupid ways if they don't get one.
 403          * sshd doesn't set the tty until too late in the auth process and may
 404          * not even need one (for tty-less connections)
 405          * Kludge: Set a fake PAM_TTY
 406          */
 407         pam_retval = pam_set_item(__pamh, PAM_TTY, "NODEVssh");
 408         if (pam_retval != PAM_SUCCESS)
 409                 fatal("PAM set tty failed[%d]: %.200s",
 410                     pam_retval, PAM_STRERROR(__pamh, pam_retval));
 411 #endif /* PAM_TTY_KLUDGE */
 412
 413         fatal_add_cleanup(&do_pam_cleanup_proc, NULL);
 414 }
 415
 416 /* Return list of PAM environment strings */
 417 char **fetch_pam_environment(void)
 418 {
 419 #ifdef HAVE_PAM_GETENVLIST
 420         return(pam_getenvlist(__pamh));
 421 #else /* HAVE_PAM_GETENVLIST */
 422         return(NULL);
 423 #endif /* HAVE_PAM_GETENVLIST */
 424 }
 425
 426 void free_pam_environment(char **env)
 427 {
 428         int i;
 429
 430         if (env != NULL) {
 431                 for (i = 0; env[i] != NULL; i++)
 432                         xfree(env[i]);
 433         }
 434 }
 435
 436 /* Print any messages that have been generated during authentication */
 437 /* or account checking to stderr */
 438 void print_pam_messages(void)
 439 {
 440         if (__pam_msg != NULL)
 441                 fputs(__pam_msg, stderr);
 442 }
 443
 444 /* Append a message to buffer */
 445 void message_cat(char **p, const char *a)
 446 {
 447         char *cp;
 448         size_t new_len;
 449
 450         new_len = strlen(a);
 451
 452         if (*p) {
 453                 size_t len = strlen(*p);
 454
 455                 *p = xrealloc(*p, new_len + len + 2);
 456                 cp = *p + len;
 457         } else
 458                 *p = cp = xmalloc(new_len + 2);
 459
 460         memcpy(cp, a, new_len);
 461         cp[new_len] = '\n';
 462         cp[new_len + 1] = '\0';
 463 }
 464
 465 #endif /* USE_PAM */