dropbear: svr-authpam.c annotate

annotate svr-authpam.c @ 1154:b1fabf797bd3

Don't display the MOTD when an explicit command is run. (possibly via authorized_keys(5) restrictions), even when a pseudo-terminal has been allocated for the session. In other words, only display the MOTD when the server starts the user's default shell.

author	Guilhem Moulin <guilhem@fripost.org>
date	Wed, 21 Oct 2015 22:08:47 +0800
parents	aaf576b27a10
children	c59c10803afd

rev	line source
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	1 /*
121 9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	2 * Dropbear SSH
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	3 *
121 9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	4 * Copyright (c) 2004 Martin Carlsson
9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	5 * Portions (c) 2004 Matt Johnston
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	6 * All rights reserved.
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	7 *
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	8 * Permission is hereby granted, free of charge, to any person obtaining a copy
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	9 * of this software and associated documentation files (the "Software"), to deal
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	10 * in the Software without restriction, including without limitation the rights
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	12 * copies of the Software, and to permit persons to whom the Software is
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	13 * furnished to do so, subject to the following conditions:
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	14 *
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	15 * The above copyright notice and this permission notice shall be included in
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	16 * all copies or substantial portions of the Software.
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	17 *
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	24 * SOFTWARE. */
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	25
121 9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	26 /* Validates a user password using PAM */
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	27
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	28 #include "includes.h"
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	29 #include "session.h"
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	30 #include "buffer.h"
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	31 #include "dbutil.h"
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	32 #include "auth.h"
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	33
432 517e76bdfb2d Make sure the #includes for pam only get hit if PAM is enabled. Matt Johnston <matt@ucc.asn.au> parents: 258 diff changeset	34 #ifdef ENABLE_SVR_PAM_AUTH
517e76bdfb2d Make sure the #includes for pam only get hit if PAM is enabled. Matt Johnston <matt@ucc.asn.au> parents: 258 diff changeset	35
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	36 #if defined(HAVE_SECURITY_PAM_APPL_H)
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	37 #include <security/pam_appl.h>
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	38 #elif defined (HAVE_PAM_PAM_APPL_H)
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	39 #include <pam/pam_appl.h>
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	40 #endif
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	41
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	42 struct UserDataS {
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	43 char* user;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	44 char* passwd;
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	45 };
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	46
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	47 /* PAM conversation function - for now we only handle one message */
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	48 int
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	49 pamConvFunc(int num_msg,
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	50 const struct pam_message **msg,
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	51 struct pam_response **respp,
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	52 void *appdata_ptr) {
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	53
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	54 int rc = PAM_SUCCESS;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	55 struct pam_response* resp = NULL;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	56 struct UserDataS* userDatap = (struct UserDataS*) appdata_ptr;
226 9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	57 unsigned int msg_len = 0;
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	58 unsigned int i = 0;
660 a842469ce8ad - Fix minor leak Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	59 char * compare_message = NULL;
226 9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	60
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	61 TRACE(("enter pamConvFunc"))
121 9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	62
9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	63 if (num_msg != 1) {
9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	64 /* If you're getting here - Dropbear probably can't support your pam
9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	65 * modules. This whole file is a bit of a hack around lack of
226 9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	66 * asynchronocity in PAM anyway. */
121 9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	67 dropbear_log(LOG_INFO, "pamConvFunc() called with >1 messages: not supported.");
9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	68 return PAM_CONV_ERR;
9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	69 }
660 a842469ce8ad - Fix minor leak Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	70
a842469ce8ad - Fix minor leak Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	71 /* make a copy we can strip */
a842469ce8ad - Fix minor leak Matt Johnston <matt@ucc.asn.au> parents: 594 diff changeset	72 compare_message = m_strdup((*msg)->msg);
121 9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	73
258 306499676384 * add -g (dbclient) and -a (dropbear) options for allowing non-local Matt Johnston <matt@ucc.asn.au> parents: 226 diff changeset	74 /* Make the string lowercase. */
226 9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	75 msg_len = strlen(compare_message);
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	76 for (i = 0; i < msg_len; i++) {
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	77 compare_message[i] = tolower(compare_message[i]);
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	78 }
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	79
258 306499676384 * add -g (dbclient) and -a (dropbear) options for allowing non-local Matt Johnston <matt@ucc.asn.au> parents: 226 diff changeset	80 /* If the string ends with ": ", remove the space.
306499676384 * add -g (dbclient) and -a (dropbear) options for allowing non-local Matt Johnston <matt@ucc.asn.au> parents: 226 diff changeset	81 ie "login: " vs "login:" */
226 9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	82 if (msg_len > 2
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	83 && compare_message[msg_len-2] == ':'
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	84 && compare_message[msg_len-1] == ' ') {
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	85 compare_message[msg_len-1] = '\0';
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	86 }
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	87
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	88 switch((*msg)->msg_style) {
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	89
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	90 case PAM_PROMPT_ECHO_OFF:
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	91
226 9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	92 if (!(strcmp(compare_message, "password:") == 0)) {
258 306499676384 * add -g (dbclient) and -a (dropbear) options for allowing non-local Matt Johnston <matt@ucc.asn.au> parents: 226 diff changeset	93 /* We don't recognise the prompt as asking for a password,
306499676384 * add -g (dbclient) and -a (dropbear) options for allowing non-local Matt Johnston <matt@ucc.asn.au> parents: 226 diff changeset	94 so can't handle it. Add more above as required for
594 a98a2138364a Improve capitalisation for all logged strings Matt Johnston <matt@ucc.asn.au> parents: 573 diff changeset	95 different pam modules/implementations. If you need
a98a2138364a Improve capitalisation for all logged strings Matt Johnston <matt@ucc.asn.au> parents: 573 diff changeset	96 to add an entry here please mail the Dropbear developer */
573 d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	97 dropbear_log(LOG_NOTICE, "PAM unknown prompt '%s' (no echo)",
226 9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	98 compare_message);
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	99 rc = PAM_CONV_ERR;
9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	100 break;
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	101 }
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	102
131 9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	103 /* You have to read the PAM module-writers' docs (do we look like
9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	104 * module writers? no.) to find out that the module will
9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	105 * free the pam_response and its resp element - ie we _must_ malloc
9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	106 * it here */
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	107 resp = (struct pam_response*) m_malloc(sizeof(struct pam_response));
121 9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	108 memset(resp, 0, sizeof(struct pam_response));
9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	109
131 9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	110 resp->resp = m_strdup(userDatap->passwd);
9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	111 m_burn(userDatap->passwd, strlen(userDatap->passwd));
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	112 (*respp) = resp;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	113 break;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	114
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	115
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	116 case PAM_PROMPT_ECHO_ON:
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	117
573 d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	118 if (!(
d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	119 (strcmp(compare_message, "login:" ) == 0)
d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	120 \|\| (strcmp(compare_message, "please enter username:") == 0)
d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	121 \|\| (strcmp(compare_message, "username:") == 0)
d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	122 )) {
258 306499676384 * add -g (dbclient) and -a (dropbear) options for allowing non-local Matt Johnston <matt@ucc.asn.au> parents: 226 diff changeset	123 /* We don't recognise the prompt as asking for a username,
306499676384 * add -g (dbclient) and -a (dropbear) options for allowing non-local Matt Johnston <matt@ucc.asn.au> parents: 226 diff changeset	124 so can't handle it. Add more above as required for
594 a98a2138364a Improve capitalisation for all logged strings Matt Johnston <matt@ucc.asn.au> parents: 573 diff changeset	125 different pam modules/implementations. If you need
a98a2138364a Improve capitalisation for all logged strings Matt Johnston <matt@ucc.asn.au> parents: 573 diff changeset	126 to add an entry here please mail the Dropbear developer */
573 d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	127 dropbear_log(LOG_NOTICE, "PAM unknown prompt '%s' (with echo)",
226 9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	128 compare_message);
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	129 rc = PAM_CONV_ERR;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	130 break;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	131 }
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	132
131 9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	133 /* You have to read the PAM module-writers' docs (do we look like
9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	134 * module writers? no.) to find out that the module will
9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	135 * free the pam_response and its resp element - ie we _must_ malloc
9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	136 * it here */
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	137 resp = (struct pam_response*) m_malloc(sizeof(struct pam_response));
121 9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	138 memset(resp, 0, sizeof(struct pam_response));
9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	139
131 9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	140 resp->resp = m_strdup(userDatap->user);
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	141 TRACE(("userDatap->user='%s'", userDatap->user))
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	142 (*respp) = resp;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	143 break;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	144
818 8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	145 case PAM_ERROR_MSG:
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	146 case PAM_TEXT_INFO:
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	147
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	148 if (msg_len > 0) {
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	149 buffer * pam_err = buf_new(msg_len + 4);
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	150 buf_setpos(pam_err, 0);
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	151 buf_putbytes(pam_err, "\r\n", 2);
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	152 buf_putbytes(pam_err, (*msg)->msg, msg_len);
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	153 buf_putbytes(pam_err, "\r\n", 2);
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	154 buf_setpos(pam_err, 0);
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	155
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	156 send_msg_userauth_banner(pam_err);
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	157 buf_free(pam_err);
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	158 }
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	159 break;
8fe36617bf4e Send PAM error messages as a banner messages Matt Johnston <matt@ucc.asn.au> parents: 660 diff changeset	160
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	161 default:
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	162 TRACE(("Unknown message type"))
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	163 rc = PAM_CONV_ERR;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	164 break;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	165 }
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	166
226 9a9c6d633972 channel.h: make definition extern Matt Johnston <matt@ucc.asn.au> parents: 179 diff changeset	167 m_free(compare_message);
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	168 TRACE(("leave pamConvFunc, rc %d", rc))
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	169
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	170 return rc;
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	171 }
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	172
3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	173 /* Process a password auth request, sending success or failure messages as
121 9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	174 * appropriate. To the client it looks like it's doing normal password auth (as
9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	175 * opposed to keyboard-interactive or something), so the pam module has to be
9337c9f9a607 PAM improvements Matt Johnston <matt@ucc.asn.au> parents: 119 diff changeset	176 * fairly standard (ie just "what's your username, what's your password, OK").
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	177 *
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	178 * Keyboard interactive would be a lot nicer, but since PAM is synchronous, it
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	179 * gets very messy trying to send the interactive challenges, and read the
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	180 * interactive responses, over the network. */
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	181 void svr_auth_pam() {
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	182
131 9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	183 struct UserDataS userData = {NULL, NULL};
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	184 struct pam_conv pamConv = {
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	185 pamConvFunc,
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	186 &userData /* submitted to pamvConvFunc as appdata_ptr */
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	187 };
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	188
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	189 pam_handle_t* pamHandlep = NULL;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	190
1122 aaf576b27a10 Merge pull request #13 from gazoo74/fix-warnings Matt Johnston <matt@ucc.asn.au> parents: 819 diff changeset	191 char * password = NULL;
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	192 unsigned int passwordlen;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	193
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	194 int rc = PAM_SUCCESS;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	195 unsigned char changepw;
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	196
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	197 /* check if client wants to change password */
179 161557a9dde8 * fix longstanding bug with connections being closed on failure to Matt Johnston <matt@ucc.asn.au> parents: 169 diff changeset	198 changepw = buf_getbool(ses.payload);
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	199 if (changepw) {
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	200 /* not implemented by this server */
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	201 send_msg_userauth_failure(0, 1);
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	202 goto cleanup;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	203 }
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	204
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	205 password = buf_getstring(ses.payload, &passwordlen);
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	206
131 9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	207 /* used to pass data to the PAM conversation function - don't bother with
9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	208 * strdup() etc since these are touched only by our own conversation
9c372a039532 strdup() variables correctly for the PAM conversation function Matt Johnston <matt@ucc.asn.au> parents: 127 diff changeset	209 * function (above) which takes care of it */
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 432 diff changeset	210 userData.user = ses.authstate.pw_name;
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	211 userData.passwd = password;
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	212
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	213 /* Init pam */
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	214 if ((rc = pam_start("sshd", NULL, &pamConv, &pamHandlep)) != PAM_SUCCESS) {
819 fee485ce81eb Get rid of spurious newlines in pam log messages Matt Johnston <matt@ucc.asn.au> parents: 818 diff changeset	215 dropbear_log(LOG_WARNING, "pam_start() failed, rc=%d, %s",
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	216 rc, pam_strerror(pamHandlep, rc));
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	217 goto cleanup;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	218 }
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	219
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	220 /* just to set it to something */
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	221 if ((rc = pam_set_item(pamHandlep, PAM_TTY, "ssh") != PAM_SUCCESS)) {
819 fee485ce81eb Get rid of spurious newlines in pam log messages Matt Johnston <matt@ucc.asn.au> parents: 818 diff changeset	222 dropbear_log(LOG_WARNING, "pam_set_item() failed, rc=%d, %s",
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	223 rc, pam_strerror(pamHandlep, rc));
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	224 goto cleanup;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	225 }
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	226
573 d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	227 #ifdef HAVE_PAM_FAIL_DELAY
d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	228 /* We have our own random delay code already, disable PAM's */
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	229 (void) pam_fail_delay(pamHandlep, 0 /* musec_delay */);
573 d3ea8b9672f0 - Test for pam_fail_delay() function in configure Matt Johnston <matt@ucc.asn.au> parents: 464 diff changeset	230 #endif
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	231
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	232 /* (void) pam_set_item(pamHandlep, PAM_FAIL_DELAY, (void) pamDelayFunc); /
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	233
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	234 if ((rc = pam_authenticate(pamHandlep, 0)) != PAM_SUCCESS) {
819 fee485ce81eb Get rid of spurious newlines in pam log messages Matt Johnston <matt@ucc.asn.au> parents: 818 diff changeset	235 dropbear_log(LOG_WARNING, "pam_authenticate() failed, rc=%d, %s",
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	236 rc, pam_strerror(pamHandlep, rc));
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	237 dropbear_log(LOG_WARNING,
594 a98a2138364a Improve capitalisation for all logged strings Matt Johnston <matt@ucc.asn.au> parents: 573 diff changeset	238 "Bad PAM password attempt for '%s' from %s",
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 432 diff changeset	239 ses.authstate.pw_name,
158 364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 131 diff changeset	240 svr_ses.addrstring);
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	241 send_msg_userauth_failure(0, 1);
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	242 goto cleanup;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	243 }
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	244
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	245 if ((rc = pam_acct_mgmt(pamHandlep, 0)) != PAM_SUCCESS) {
819 fee485ce81eb Get rid of spurious newlines in pam log messages Matt Johnston <matt@ucc.asn.au> parents: 818 diff changeset	246 dropbear_log(LOG_WARNING, "pam_acct_mgmt() failed, rc=%d, %s",
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	247 rc, pam_strerror(pamHandlep, rc));
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	248 dropbear_log(LOG_WARNING,
594 a98a2138364a Improve capitalisation for all logged strings Matt Johnston <matt@ucc.asn.au> parents: 573 diff changeset	249 "Bad PAM password attempt for '%s' from %s",
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 432 diff changeset	250 ses.authstate.pw_name,
158 364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 131 diff changeset	251 svr_ses.addrstring);
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	252 send_msg_userauth_failure(0, 1);
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	253 goto cleanup;
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	254 }
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	255
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	256 /* successful authentication */
158 364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 131 diff changeset	257 dropbear_log(LOG_NOTICE, "PAM password auth succeeded for '%s' from %s",
464 4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep Matt Johnston <matt@ucc.asn.au> parents: 432 diff changeset	258 ses.authstate.pw_name,
158 364a75cfebab Log the IP along with auth success/fail attempts Matt Johnston <matt@ucc.asn.au> parents: 131 diff changeset	259 svr_ses.addrstring);
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	260 send_msg_userauth_success();
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	261
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	262 cleanup:
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	263 if (password != NULL) {
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	264 m_burn(password, passwordlen);
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	265 m_free(password);
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	266 }
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	267 if (pamHandlep != NULL) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 158 diff changeset	268 TRACE(("pam_end"))
119 3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	269 (void) pam_end(pamHandlep, 0 /* pam_status */);
3394a7cb30cd propagate of 08347df3bca787bd3621602fe2b466c85c9dc3e2 and 717950f4061f1123659ee87c7c168805af920ab7 from branch 'matt.dbclient.rez' to 'matt.dbclient.authpam' Matt Johnston <matt@ucc.asn.au> parents: 57 diff changeset	270 }
57 3b2a5a1c4347 svr-authpam code merged and works. needs tidying a log Matt Johnston <matt@ucc.asn.au> parents: diff changeset	271 }
127 33d976eeb859 put the #ifdefs back in for authpam Matt Johnston <matt@ucc.asn.au> parents: 121 diff changeset	272
33d976eeb859 put the #ifdefs back in for authpam Matt Johnston <matt@ucc.asn.au> parents: 121 diff changeset	273 #endif /* ENABLE_SVR_PAM_AUTH */

Mercurial > dropbear

annotate svr-authpam.c @ 1154:b1fabf797bd3