dropbear: svr-auth.c annotate

annotate svr-auth.c @ 1155:80b45616e1f3

fix build when ENABLE_CLI_INTERACT_AUTH is disabled The session.h defines clientsession.cipher_none_after_auth only when ENABLE_CLI_INTERACT_AUTH is defined, but cli-session.c will always try to set that member. export cipher_none_after_auth all the time.

author	Mike Frysinger <vapier@gentoo.org>
date	Wed, 21 Oct 2015 22:39:31 +0800
parents	43a8ea69b24c
children	9169e4e7cbee

rev	line source
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	1 /*
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	2 * Dropbear - a SSH2 server
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	3 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	4 * Copyright (c) 2002,2003 Matt Johnston
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	5 * All rights reserved.
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	6 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	7 * Permission is hereby granted, free of charge, to any person obtaining a copy
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	8 * of this software and associated documentation files (the "Software"), to deal
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	9 * in the Software without restriction, including without limitation the rights
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	11 * copies of the Software, and to permit persons to whom the Software is
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	12 * furnished to do so, subject to the following conditions:
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	13 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	14 * The above copyright notice and this permission notice shall be included in
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	15 * all copies or substantial portions of the Software.
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	16 *
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	23 * SOFTWARE. */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	24
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	25 /* This file (auth.c) handles authentication requests, passing it to the
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	26 * particular type (auth-passwd, auth-pubkey). */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	27
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	28 #include "includes.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	29 #include "dbutil.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	30 #include "session.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	31 #include "buffer.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	32 #include "ssh.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	33 #include "packet.h"
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	34 #include "auth.h"
24 469950e86d0f switching to global vars Matt Johnston <matt@ucc.asn.au> parents: 22 diff changeset	35 #include "runopts.h"
858 220f55d540ae rename random.h to dbrandom.h since some OSes have a system random.h Matt Johnston <matt@ucc.asn.au> parents: 852 diff changeset	36 #include "dbrandom.h"
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	37
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	38 static void authclear();
1100 7b84c3492a95 Turn username, servicename and methodname local variables into char * Gaël PORTAY <gael.portay@gmail.com> parents: 1094 diff changeset	39 static int checkusername(char *username, unsigned int userlen);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	40
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	41 /* initialise the first time for a session, resetting all parameters */
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	42 void svr_authinitialise() {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	43
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	44 ses.authstate.failcount = 0;
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	45 ses.authstate.pw_name = NULL;
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	46 ses.authstate.pw_dir = NULL;
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	47 ses.authstate.pw_shell = NULL;
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	48 ses.authstate.pw_passwd = NULL;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	49 authclear();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	50
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	51 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	52
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	53 /* Reset the auth state, but don't reset the failcount. This is for if the
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	54 * user decides to try with a different username etc, and is also invoked
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	55 * on initialisation */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	56 static void authclear() {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	57
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	58 memset(&ses.authstate, 0, sizeof(ses.authstate));
68 eee77ac31ccc cleaning up the pubkey defines Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	59 #ifdef ENABLE_SVR_PUBKEY_AUTH
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	60 ses.authstate.authtypes \|= AUTH_TYPE_PUBKEY;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	61 #endif
121 9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	62 #if defined(ENABLE_SVR_PASSWORD_AUTH) \|\| defined(ENABLE_SVR_PAM_AUTH)
35 0ad5fb979f42 set the isserver flag (oops) Matt Johnston <matt@ucc.asn.au> parents: 33 diff changeset	63 if (!svr_opts.noauthpass) {
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	64 ses.authstate.authtypes \|= AUTH_TYPE_PASSWORD;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	65 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	66 #endif
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	67 if (ses.authstate.pw_name) {
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	68 m_free(ses.authstate.pw_name);
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	69 }
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	70 if (ses.authstate.pw_shell) {
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	71 m_free(ses.authstate.pw_shell);
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	72 }
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	73 if (ses.authstate.pw_dir) {
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	74 m_free(ses.authstate.pw_dir);
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	75 }
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	76 if (ses.authstate.pw_passwd) {
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	77 m_free(ses.authstate.pw_passwd);
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	78 }
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	79
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	80 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	81
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	82 /* Send a banner message if specified to the client. The client might
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	83 * ignore this, but possibly serves as a legal "no trespassing" sign */
818 8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 808 diff changeset	84 void send_msg_userauth_banner(buffer *banner) {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	85
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	86 TRACE(("enter send_msg_userauth_banner"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	87
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	88 CHECKCLEARTOWRITE();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	89
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	90 buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_BANNER);
835 4095b6d7c9fc Merge in changes from the past couple of releases Matt Johnston <matt@ucc.asn.au> parents: 801 818 diff changeset	91 buf_putbufstring(ses.writepayload, banner);
1122 aaf576b27a10 Merge pull request #13 from gazoo74/fix-warnings Matt Johnston <matt@ucc.asn.au> parents: 1100 diff changeset	92 buf_putstring(ses.writepayload, "en", 2);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	93
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	94 encrypt_packet();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	95
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	96 TRACE(("leave send_msg_userauth_banner"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	97 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	98
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	99 /* handle a userauth request, check validity, pass to password or pubkey
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	100 * checking, and handle success or failure */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	101 void recv_msg_userauth_request() {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	102
1100 7b84c3492a95 Turn username, servicename and methodname local variables into char * Gaël PORTAY <gael.portay@gmail.com> parents: 1094 diff changeset	103 char username = NULL, servicename = NULL, *methodname = NULL;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	104 unsigned int userlen, servicelen, methodlen;
808 d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	105 int valid_user = 0;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	106
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	107 TRACE(("enter recv_msg_userauth_request"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	108
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	109 /* ignore packets if auth is already done */
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	110 if (ses.authstate.authdone == 1) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	111 TRACE(("leave recv_msg_userauth_request: authdone already"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	112 return;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	113 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	114
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	115 /* send the banner if it exists, it will only exist once */
24 469950e86d0f switching to global vars Matt Johnston <matt@ucc.asn.au> parents: 22 diff changeset	116 if (svr_opts.banner) {
818 8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 808 diff changeset	117 send_msg_userauth_banner(svr_opts.banner);
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 808 diff changeset	118 buf_free(svr_opts.banner);
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 808 diff changeset	119 svr_opts.banner = NULL;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	120 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	121
1122 aaf576b27a10 Merge pull request #13 from gazoo74/fix-warnings Matt Johnston <matt@ucc.asn.au> parents: 1100 diff changeset	122 username = buf_getstring(ses.payload, &userlen);
aaf576b27a10 Merge pull request #13 from gazoo74/fix-warnings Matt Johnston <matt@ucc.asn.au> parents: 1100 diff changeset	123 servicename = buf_getstring(ses.payload, &servicelen);
aaf576b27a10 Merge pull request #13 from gazoo74/fix-warnings Matt Johnston <matt@ucc.asn.au> parents: 1100 diff changeset	124 methodname = buf_getstring(ses.payload, &methodlen);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	125
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	126 /* only handle 'ssh-connection' currently */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	127 if (servicelen != SSH_SERVICE_CONNECTION_LEN
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	128 && (strncmp(servicename, SSH_SERVICE_CONNECTION,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	129 SSH_SERVICE_CONNECTION_LEN) != 0)) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	130
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	131 /* TODO - disconnect here */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	132 m_free(username);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	133 m_free(servicename);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	134 m_free(methodname);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	135 dropbear_exit("unknown service in auth");
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	136 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	137
808 d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	138 /* check username is good before continuing.
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	139 * the 'incrfail' varies depending on the auth method to
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	140 * avoid giving away which users exist on the system through
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	141 * the time delay. */
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	142 if (checkusername(username, userlen) == DROPBEAR_SUCCESS) {
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	143 valid_user = 1;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	144 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	145
676 0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	146 /* user wants to know what methods are supported */
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	147 if (methodlen == AUTH_METHOD_NONE_LEN &&
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	148 strncmp(methodname, AUTH_METHOD_NONE,
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	149 AUTH_METHOD_NONE_LEN) == 0) {
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	150 TRACE(("recv_msg_userauth_request: 'none' request"))
808 d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	151 if (valid_user
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	152 && svr_opts.allowblankpass
692 c58a15983808 Allow configuring "allow blank password option" at runtime Paul Eggleton <paul.eggleton@linux.intel.com> parents: 678 diff changeset	153 && !svr_opts.noauthpass
676 0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	154 && !(svr_opts.norootpass && ses.authstate.pw_uid == 0)
677 55b84e59aaad Fix empty password immediate login Matt Johnston <matt@ucc.asn.au> parents: 676 diff changeset	155 && ses.authstate.pw_passwd[0] == '\0')
676 0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	156 {
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	157 dropbear_log(LOG_NOTICE,
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	158 "Auth succeeded with blank password for '%s' from %s",
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	159 ses.authstate.pw_name,
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	160 svr_ses.addrstring);
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	161 send_msg_userauth_success();
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	162 goto out;
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	163 }
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	164 else
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	165 {
808 d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	166 /* 'none' has no failure delay */
676 0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	167 send_msg_userauth_failure(0, 0);
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	168 goto out;
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	169 }
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	170 }
0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	171
68 eee77ac31ccc cleaning up the pubkey defines Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	172 #ifdef ENABLE_SVR_PASSWORD_AUTH
24 469950e86d0f switching to global vars Matt Johnston <matt@ucc.asn.au> parents: 22 diff changeset	173 if (!svr_opts.noauthpass &&
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	174 !(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	175 /* user wants to try password auth */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	176 if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	177 strncmp(methodname, AUTH_METHOD_PASSWORD,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	178 AUTH_METHOD_PASSWORD_LEN) == 0) {
808 d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	179 if (valid_user) {
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	180 svr_auth_password();
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	181 goto out;
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	182 }
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	183 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	184 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	185 #endif
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	186
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 118 diff changeset	187 #ifdef ENABLE_SVR_PAM_AUTH
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	188 if (!svr_opts.noauthpass &&
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	189 !(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	190 /* user wants to try password auth */
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	191 if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	192 strncmp(methodname, AUTH_METHOD_PASSWORD,
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	193 AUTH_METHOD_PASSWORD_LEN) == 0) {
808 d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	194 if (valid_user) {
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	195 svr_auth_pam();
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	196 goto out;
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	197 }
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	198 }
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	199 }
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	200 #endif
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	201
68 eee77ac31ccc cleaning up the pubkey defines Matt Johnston <matt@ucc.asn.au> parents: 35 diff changeset	202 #ifdef ENABLE_SVR_PUBKEY_AUTH
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	203 /* user wants to try pubkey auth */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	204 if (methodlen == AUTH_METHOD_PUBKEY_LEN &&
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	205 strncmp(methodname, AUTH_METHOD_PUBKEY,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	206 AUTH_METHOD_PUBKEY_LEN) == 0) {
808 d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	207 if (valid_user) {
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	208 svr_auth_pubkey();
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	209 } else {
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	210 /* pubkey has no failure delay */
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	211 send_msg_userauth_failure(0, 0);
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	212 }
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	213 goto out;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	214 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	215 #endif
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	216
808 d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	217 /* nothing matched, we just fail with a delay */
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	218 send_msg_userauth_failure(0, 1);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	219
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	220 out:
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	221
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	222 m_free(username);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	223 m_free(servicename);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	224 m_free(methodname);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	225 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	226
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	227
676 0edf08895a33 Return immediate success for blank passwords if allowed Matt Johnston <matt@ucc.asn.au> parents: 628 diff changeset	228 /* Check that the username exists and isn't disallowed (root), and has a valid shell.
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	229 * returns DROPBEAR_SUCCESS on valid username, DROPBEAR_FAILURE on failure */
1100 7b84c3492a95 Turn username, servicename and methodname local variables into char * Gaël PORTAY <gael.portay@gmail.com> parents: 1094 diff changeset	230 static int checkusername(char *username, unsigned int userlen) {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	231
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	232 char* listshell = NULL;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	233 char* usershell = NULL;
852 7540c0822374 Various cleanups and fixes for warnings Matt Johnston <matt@ucc.asn.au> parents: 835 diff changeset	234 uid_t uid;
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	235 TRACE(("enter checkusername"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	236 if (userlen > MAX_USERNAME_LEN) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	237 return DROPBEAR_FAILURE;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	238 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	239
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	240 /* new user or username has changed */
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	241 if (ses.authstate.username == NULL \|\|
f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	242 strcmp(username, ses.authstate.username) != 0) {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	243 /* the username needs resetting */
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	244 if (ses.authstate.username != NULL) {
594 a98a2138364a Improve capitalisation for all logged strings Matt Johnston <matt@ucc.asn.au> parents: 573 diff changeset	245 dropbear_log(LOG_WARNING, "Client trying multiple usernames from %s",
158 364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 121 diff changeset	246 svr_ses.addrstring);
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	247 m_free(ses.authstate.username);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	248 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	249 authclear();
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	250 fill_passwd(username);
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	251 ses.authstate.username = m_strdup(username);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	252 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	253
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	254 /* check that user exists */
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	255 if (!ses.authstate.pw_name) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	256 TRACE(("leave checkusername: user '%s' doesn't exist", username))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	257 dropbear_log(LOG_WARNING,
594 a98a2138364a Improve capitalisation for all logged strings Matt Johnston <matt@ucc.asn.au> parents: 573 diff changeset	258 "Login attempt for nonexistent user from %s",
158 364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 121 diff changeset	259 svr_ses.addrstring);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	260 return DROPBEAR_FAILURE;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	261 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	262
782 e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	263 /* check if we are running as non-root, and login user is different from the server */
e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	264 uid = geteuid();
e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	265 if (uid != 0 && uid != ses.authstate.pw_uid) {
e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	266 TRACE(("running as nonroot, only server uid is allowed"))
e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	267 dropbear_log(LOG_WARNING,
e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	268 "Login attempt with wrong user %s from %s",
e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	269 ses.authstate.pw_name,
e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	270 svr_ses.addrstring);
e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	271 return DROPBEAR_FAILURE;
e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	272 }
e0084f136cb8 If running as non-root only allow that user to log in Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	273
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	274 /* check for non-root if desired */
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	275 if (svr_opts.norootlogin && ses.authstate.pw_uid == 0) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	276 TRACE(("leave checkusername: root login disabled"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	277 dropbear_log(LOG_WARNING, "root login rejected");
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	278 return DROPBEAR_FAILURE;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	279 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	280
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	281 TRACE(("shell is %s", ses.authstate.pw_shell))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	282
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	283 /* check that the shell is set */
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	284 usershell = ses.authstate.pw_shell;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	285 if (usershell[0] == '\0') {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	286 /* empty shell in /etc/passwd means /bin/sh according to passwd(5) */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	287 usershell = "/bin/sh";
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	288 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	289
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	290 /* check the shell is valid. If /etc/shells doesn't exist, getusershell()
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	291 * should return some standard shells like "/bin/sh" and "/bin/csh" (this
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	292 * is platform-specific) */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	293 setusershell();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	294 while ((listshell = getusershell()) != NULL) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	295 TRACE(("test shell is '%s'", listshell))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	296 if (strcmp(listshell, usershell) == 0) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	297 /* have a match */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	298 goto goodshell;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	299 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	300 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	301 /* no matching shell */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	302 endusershell();
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	303 TRACE(("no matching shell"))
594 a98a2138364a Improve capitalisation for all logged strings Matt Johnston <matt@ucc.asn.au> parents: 573 diff changeset	304 dropbear_log(LOG_WARNING, "User '%s' has invalid shell, rejected",
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	305 ses.authstate.pw_name);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	306 return DROPBEAR_FAILURE;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	307
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	308 goodshell:
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	309 endusershell();
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	310 TRACE(("matching shell"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	311
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	312 TRACE(("uid = %d", ses.authstate.pw_uid))
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	313 TRACE(("leave checkusername"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	314 return DROPBEAR_SUCCESS;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	315 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	316
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	317 /* Send a failure message to the client, in responds to a userauth_request.
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	318 * Partial indicates whether to set the "partial success" flag,
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	319 * incrfail is whether to count this failure in the failure count (which
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	320 * is limited. This function also handles disconnection after too many
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	321 * failures */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	322 void send_msg_userauth_failure(int partial, int incrfail) {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	323
70 b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	324 buffer *typebuf = NULL;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	325
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	326 TRACE(("enter send_msg_userauth_failure"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	327
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	328 CHECKCLEARTOWRITE();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	329
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	330 buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_FAILURE);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	331
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	332 /* put a list of allowed types */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	333 typebuf = buf_new(30); /* long enough for PUBKEY and PASSWORD */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	334
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	335 if (ses.authstate.authtypes & AUTH_TYPE_PUBKEY) {
1094 c45d65392c1a Fix pointer differ in signess warnings [-Werror=pointer-sign] Gaël PORTAY <gael.portay@gmail.com> parents: 940 diff changeset	336 buf_putbytes(typebuf, (const unsigned char *)AUTH_METHOD_PUBKEY, AUTH_METHOD_PUBKEY_LEN);
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	337 if (ses.authstate.authtypes & AUTH_TYPE_PASSWORD) {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	338 buf_putbyte(typebuf, ',');
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	339 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	340 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	341
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	342 if (ses.authstate.authtypes & AUTH_TYPE_PASSWORD) {
1094 c45d65392c1a Fix pointer differ in signess warnings [-Werror=pointer-sign] Gaël PORTAY <gael.portay@gmail.com> parents: 940 diff changeset	343 buf_putbytes(typebuf, (const unsigned char *)AUTH_METHOD_PASSWORD, AUTH_METHOD_PASSWORD_LEN);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	344 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	345
761 ac2158e3e403 ecc kind of works, needs fixing/testing Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	346 buf_putbufstring(ses.writepayload, typebuf);
300 baea1d43e7eb Some cleanups/fixes for various TRACE statements Matt Johnston <matt@ucc.asn.au> parents: 165 diff changeset	347
761 ac2158e3e403 ecc kind of works, needs fixing/testing Matt Johnston <matt@ucc.asn.au> parents: 692 diff changeset	348 TRACE(("auth fail: methods %d, '%.*s'", ses.authstate.authtypes,
762 a78a38e402d1 - Fix various hardcoded uses of SHA1 Matt Johnston <matt@ucc.asn.au> parents: 761 diff changeset	349 typebuf->len, typebuf->data))
300 baea1d43e7eb Some cleanups/fixes for various TRACE statements Matt Johnston <matt@ucc.asn.au> parents: 165 diff changeset	350
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	351 buf_free(typebuf);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	352
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	353 buf_putbyte(ses.writepayload, partial ? 1 : 0);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	354 encrypt_packet();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	355
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	356 if (incrfail) {
573 d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 501 diff changeset	357 unsigned int delay;
d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 501 diff changeset	358 genrandom((unsigned char*)&delay, sizeof(delay));
808 d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	359 /* We delay for 300ms +- 50ms */
d7784616409a improve auth failure delays to avoid indicating which users exist Matt Johnston <matt@ucc.asn.au> parents: 782 diff changeset	360 delay = 250000 + (delay % 100000);
573 d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 501 diff changeset	361 usleep(delay);
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	362 ses.authstate.failcount++;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	363 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	364
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	365 if (ses.authstate.failcount >= MAX_AUTH_TRIES) {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	366 char * userstr;
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	367 /* XXX - send disconnect ? */
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	368 TRACE(("Max auth tries reached, exiting"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	369
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	370 if (ses.authstate.pw_name == NULL) {
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	371 userstr = "is invalid";
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	372 } else {
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	373 userstr = ses.authstate.pw_name;
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	374 }
158 364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 121 diff changeset	375 dropbear_exit("Max auth tries reached - user '%s' from %s",
364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 121 diff changeset	376 userstr, svr_ses.addrstring);
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	377 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	378
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	379 TRACE(("leave send_msg_userauth_failure"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	380 }
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	381
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	382 /* Send a success message to the user, and set the "authdone" flag */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	383 void send_msg_userauth_success() {
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	384
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	385 TRACE(("enter send_msg_userauth_success"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	386
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	387 CHECKCLEARTOWRITE();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	388
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	389 buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_SUCCESS);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	390 encrypt_packet();
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	391
501 d58c478bd399 Add support for [email protected] delayed compression. Matt Johnston <matt@ucc.asn.au> parents: 483 diff changeset	392 /* authdone must be set after encrypt_packet() for
d58c478bd399 Add support for [email protected] delayed compression. Matt Johnston <matt@ucc.asn.au> parents: 483 diff changeset	393 * delayed-zlib mode */
33 f789045062e6 Progressing client support Matt Johnston <matt@ucc.asn.au> parents: 24 diff changeset	394 ses.authstate.authdone = 1;
1139 43a8ea69b24c Fix problem where auth timeout wasn't checked when waiting for ident Matt Johnston <matt@ucc.asn.au> parents: 1122 diff changeset	395 ses.connect_time = 0;
43a8ea69b24c Fix problem where auth timeout wasn't checked when waiting for ident Matt Johnston <matt@ucc.asn.au> parents: 1122 diff changeset	396
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	397
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 454 diff changeset	398 if (ses.authstate.pw_uid == 0) {
21 d7cc5b484a2e - Port restriction code back in Matt Johnston <matt@ucc.asn.au> parents: 11 diff changeset	399 ses.allowprivport = 1;
d7cc5b484a2e - Port restriction code back in Matt Johnston <matt@ucc.asn.au> parents: 11 diff changeset	400 }
d7cc5b484a2e - Port restriction code back in Matt Johnston <matt@ucc.asn.au> parents: 11 diff changeset	401
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	402 /* Remove from the list of pre-auth sockets. Should be m_close(), since if
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	403 * we fail, we might end up leaking connection slots, and disallow new
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	404 * logins - a nasty situation. */
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	405 m_close(svr_ses.childpipe);
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	406
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	407 TRACE(("leave send_msg_userauth_success"))
4 fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	408
fe6bca95afa7 Makefile.in contains updated files required Matt Johnston <matt@ucc.asn.au> parents: diff changeset	409 }

Mercurial > dropbear

annotate svr-auth.c @ 1155:80b45616e1f3