Mercurial > dropbear

annotate svr-authpasswd.c @ 1629:258b57b208ae

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix for issue successfull login of disabled user (#78) This commit introduces fix for scenario: 1. Root login disabled on dropbear 2. PAM authentication model enabled While login as root user, after prompt for password user is being notified about login failrue, but after second attempt of prompt for password within same session, login becames succesfull. Signed-off-by: Pawel Rapkiewicz <[email protected]>
author vincentto13 <33652988+vincentto13@users.noreply.github.com>
date Wed, 20 Mar 2019 15:03:40 +0100
parents 5d2d1021ca00
children 228b086794b7
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
1 /*
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
2 * Dropbear - a SSH2 server
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
3 *
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
4 * Copyright (c) 2002,2003 Matt Johnston
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
5 * All rights reserved.
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
6 *
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
8 * of this software and associated documentation files (the "Software"), to deal
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
9 * in the Software without restriction, including without limitation the rights
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
11 * copies of the Software, and to permit persons to whom the Software is
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
12 * furnished to do so, subject to the following conditions:
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
13 *
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
14 * The above copyright notice and this permission notice shall be included in
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
15 * all copies or substantial portions of the Software.
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
16 *
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
23 * SOFTWARE. */
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
24
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
25 /* Validates a user password */
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
26
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
27 #include "includes.h"
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
28 #include "session.h"
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
29 #include "buffer.h"
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
30 #include "dbutil.h"
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
31 #include "auth.h"
692
c58a15983808 Allow configuring "allow blank password option" at runtime
Paul Eggleton <paul.eggleton@linux.intel.com>
parents: 677
diff changeset
32 #include "runopts.h"
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
33
1295
750ec4ec4cbe Convert #ifdef to #if, other build changes
Matt Johnston <matt@ucc.asn.au>
parents: 1122
diff changeset
34 #if DROPBEAR_SVR_PASSWORD_AUTH
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
35
1086
50f8a24953e6 note about constant_time_strcmp and lengths
Matt Johnston <matt@ucc.asn.au>
parents: 817
diff changeset
36 /* not constant time when strings are differing lengths.
50f8a24953e6 note about constant_time_strcmp and lengths
Matt Johnston <matt@ucc.asn.au>
parents: 817
diff changeset
37 string content isn't leaked, and crypt hashes are predictable length. */
817
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
38 static int constant_time_strcmp(const char* a, const char* b) {
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
39 size_t la = strlen(a);
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
40 size_t lb = strlen(b);
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
41
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
42 if (la != lb) {
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
43 return 1;
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
44 }
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
45
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
46 return constant_time_memcmp(a, b, la);
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
47 }
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
48
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
49 /* Process a password auth request, sending success or failure messages as
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
50 * appropriate */
1616
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
51 void svr_auth_password(int valid_user) {
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
52
70
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents: 68
diff changeset
53 char * passwdcrypt = NULL; /* the crypt from /etc/passwd or /etc/shadow */
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents: 68
diff changeset
54 char * testcrypt = NULL; /* crypt generated from the user's password sent */
1616
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
55 char * password = NULL;
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
56 unsigned int passwordlen;
70
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents: 68
diff changeset
57 unsigned int changepw;
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
58
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
59 /* check if client wants to change password */
179
161557a9dde8 * fix longstanding bug with connections being closed on failure to
Matt Johnston <matt@ucc.asn.au>
parents: 158
diff changeset
60 changepw = buf_getbool(ses.payload);
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
61 if (changepw) {
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
62 /* not implemented by this server */
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
63 send_msg_userauth_failure(0, 1);
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
64 return;
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
65 }
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
66
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
67 password = buf_getstring(ses.payload, &passwordlen);
1616
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
68 if (valid_user) {
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
69 /* the first bytes of passwdcrypt are the salt */
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
70 passwdcrypt = ses.authstate.pw_passwd;
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
71 testcrypt = crypt(password, passwdcrypt);
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
72 }
54
a48ba599292a burn the buffer a bit earlier
Matt Johnston <matt@ucc.asn.au>
parents: 53
diff changeset
73 m_burn(password, passwordlen);
a48ba599292a burn the buffer a bit earlier
Matt Johnston <matt@ucc.asn.au>
parents: 53
diff changeset
74 m_free(password);
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
75
1616
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
76 /* After we have got the payload contents we can exit if the username
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
77 is invalid. Invalid users have already been logged. */
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
78 if (!valid_user) {
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
79 send_msg_userauth_failure(0, 1);
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
80 return;
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
81 }
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
82
790
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
83 if (testcrypt == NULL) {
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
84 /* crypt() with an invalid salt like "!!" */
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
85 dropbear_log(LOG_WARNING, "User account '%s' is locked",
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
86 ses.authstate.pw_name);
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
87 send_msg_userauth_failure(0, 1);
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
88 return;
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
89 }
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
90
628
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
91 /* check for empty password */
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
92 if (passwdcrypt[0] == '\0') {
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
93 dropbear_log(LOG_WARNING, "User '%s' has blank password, rejected",
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
94 ses.authstate.pw_name);
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
95 send_msg_userauth_failure(0, 1);
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
96 return;
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
97 }
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
98
817
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
99 if (constant_time_strcmp(testcrypt, passwdcrypt) == 0) {
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
100 /* successful authentication */
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
101 dropbear_log(LOG_NOTICE,
594
a98a2138364a Improve capitalisation for all logged strings
Matt Johnston <matt@ucc.asn.au>
parents: 464
diff changeset
102 "Password auth succeeded for '%s' from %s",
464
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents: 179
diff changeset
103 ses.authstate.pw_name,
158
364a75cfebab Log the IP along with auth success/fail attempts
Matt Johnston <matt@ucc.asn.au>
parents: 119
diff changeset
104 svr_ses.addrstring);
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
105 send_msg_userauth_success();
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
106 } else {
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
107 dropbear_log(LOG_WARNING,
594
a98a2138364a Improve capitalisation for all logged strings
Matt Johnston <matt@ucc.asn.au>
parents: 464
diff changeset
108 "Bad password attempt for '%s' from %s",
464
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents: 179
diff changeset
109 ses.authstate.pw_name,
158
364a75cfebab Log the IP along with auth success/fail attempts
Matt Johnston <matt@ucc.asn.au>
parents: 119
diff changeset
110 svr_ses.addrstring);
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
111 send_msg_userauth_failure(0, 1);
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
112 }
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
113 }
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
114
68
eee77ac31ccc cleaning up the pubkey defines
Matt Johnston <matt@ucc.asn.au>
parents: 54
diff changeset
115 #endif