Mercurial > dropbear

comparison svr-auth.c @ 676:0edf08895a33

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Return immediate success for blank passwords if allowed
author Matt Johnston <matt@ucc.asn.au>
date Wed, 09 May 2012 22:37:04 +0800
parents d40f3cc47aed
children 55b84e59aaad
comparison
equal deleted inserted replaced
675:dfdb9d9189ff 676:0edf08895a33
139 m_free(servicename); 139 m_free(servicename);
140 m_free(methodname); 140 m_free(methodname);
141 dropbear_exit("unknown service in auth"); 141 dropbear_exit("unknown service in auth");
142 } 142 }
143 143
144 /* user wants to know what methods are supported */
145 if (methodlen == AUTH_METHOD_NONE_LEN &&
146 strncmp(methodname, AUTH_METHOD_NONE,
147 AUTH_METHOD_NONE_LEN) == 0) {
148 TRACE(("recv_msg_userauth_request: 'none' request"))
149 send_msg_userauth_failure(0, 0);
150 goto out;
151 }
152
153 /* check username is good before continuing */ 144 /* check username is good before continuing */
154 if (checkusername(username, userlen) == DROPBEAR_FAILURE) { 145 if (checkusername(username, userlen) == DROPBEAR_FAILURE) {
155 /* username is invalid/no shell/etc - send failure */ 146 /* username is invalid/no shell/etc - send failure */
156 TRACE(("sending checkusername failure")) 147 TRACE(("sending checkusername failure"))
157 send_msg_userauth_failure(0, 1); 148 send_msg_userauth_failure(0, 1);
158 goto out; 149 goto out;
159 } 150 }
160 151
152 /* user wants to know what methods are supported */
153 if (methodlen == AUTH_METHOD_NONE_LEN &&
154 strncmp(methodname, AUTH_METHOD_NONE,
155 AUTH_METHOD_NONE_LEN) == 0) {
156 TRACE(("recv_msg_userauth_request: 'none' request"))
157 #ifdef ALLOW_BLANK_PASSWORD
158 if (!svr_opts.noauthpass
159 && !(svr_opts.norootpass && ses.authstate.pw_uid == 0)
160 && ses.authstate.pw_passwd == '\0')
161 {
162 dropbear_log(LOG_NOTICE,
163 "Auth succeeded with blank password for '%s' from %s",
164 ses.authstate.pw_name,
165 svr_ses.addrstring);
166 send_msg_userauth_success();
167 goto out;
168 }
169 else
170 #endif
171 {
172 send_msg_userauth_failure(0, 0);
173 goto out;
174 }
175 }
176
161 #ifdef ENABLE_SVR_PASSWORD_AUTH 177 #ifdef ENABLE_SVR_PASSWORD_AUTH
162 if (!svr_opts.noauthpass && 178 if (!svr_opts.noauthpass &&
163 !(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) { 179 !(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
164 /* user wants to try password auth */ 180 /* user wants to try password auth */
165 if (methodlen == AUTH_METHOD_PASSWORD_LEN && 181 if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
203 m_free(servicename); 219 m_free(servicename);
204 m_free(methodname); 220 m_free(methodname);
205 } 221 }
206 222
207 223
208 /* Check that the username exists, has a non-empty password, and has a valid 224 /* Check that the username exists and isn't disallowed (root), and has a valid shell.
209 * shell.
210 * returns DROPBEAR_SUCCESS on valid username, DROPBEAR_FAILURE on failure */ 225 * returns DROPBEAR_SUCCESS on valid username, DROPBEAR_FAILURE on failure */
211 static int checkusername(unsigned char *username, unsigned int userlen) { 226 static int checkusername(unsigned char *username, unsigned int userlen) {
212 227
213 char* listshell = NULL; 228 char* listshell = NULL;
214 char* usershell = NULL; 229 char* usershell = NULL;