dropbear: svr-auth.c comparison

comparison svr-auth.c @ 808:d7784616409a

improve auth failure delays to avoid indicating which users exist

author	Matt Johnston <matt@ucc.asn.au>
date	Sun, 26 May 2013 18:39:24 +0800
parents	e0084f136cb8
children	8fe36617bf4e

comparison

equal deleted inserted replaced

-:e0084f136cb8
+:d7784616409a
 * checking, and handle success or failure */
 void recv_msg_userauth_request() {
 	unsigned char *username = NULL, *servicename = NULL, *methodname = NULL;
 	unsigned int userlen, servicelen, methodlen;
+	int valid_user = 0;
 	TRACE(("enter recv_msg_userauth_request"))
 	/* ignore packets if auth is already done */
 	if (ses.authstate.authdone == 1) {
 	/* send the banner if it exists, it will only exist once */
 	if (svr_opts.banner) {
 		send_msg_userauth_banner();
 	}
 	username = buf_getstring(ses.payload, &userlen);
 	servicename = buf_getstring(ses.payload, &servicelen);
 	methodname = buf_getstring(ses.payload, &methodlen);
 	/* only handle 'ssh-connection' currently */
 		m_free(servicename);
 		m_free(methodname);
 		dropbear_exit("unknown service in auth");
 	}
-	/* check username is good before continuing */
+	/* check username is good before continuing.
-	if (checkusername(username, userlen) == DROPBEAR_FAILURE) {
+	 * the 'incrfail' varies depending on the auth method to
-		/* username is invalid/no shell/etc - send failure */
+	 * avoid giving away which users exist on the system through
-		TRACE(("sending checkusername failure"))
+	 * the time delay. */
-		send_msg_userauth_failure(0, 1);
+	if (checkusername(username, userlen) == DROPBEAR_SUCCESS) {
-		goto out;
+		valid_user = 1;
 	}
 	/* user wants to know what methods are supported */
 	if (methodlen == AUTH_METHOD_NONE_LEN &&
 			strncmp(methodname, AUTH_METHOD_NONE,
 				AUTH_METHOD_NONE_LEN) == 0) {
 		TRACE(("recv_msg_userauth_request: 'none' request"))
-		if (svr_opts.allowblankpass
+		if (valid_user
+				&& svr_opts.allowblankpass
 				&& !svr_opts.noauthpass
 				&& !(svr_opts.norootpass && ses.authstate.pw_uid == 0)
 				&& ses.authstate.pw_passwd[0] == '\0')
 		{
 			dropbear_log(LOG_NOTICE,
 			send_msg_userauth_success();
 			goto out;
 		}
 		else
 		{
+			/* 'none' has no failure delay */
 			send_msg_userauth_failure(0, 0);
 			goto out;
 		}
 	}
 			!(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
 		/* user wants to try password auth */
 		if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
 				strncmp(methodname, AUTH_METHOD_PASSWORD,
 					AUTH_METHOD_PASSWORD_LEN) == 0) {
-			svr_auth_password();
+			if (valid_user) {
-			goto out;
+				svr_auth_password();
+				goto out;
+			}
 		}
 	}
 #endif
 #ifdef ENABLE_SVR_PAM_AUTH
 			!(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
 		/* user wants to try password auth */
 		if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
 				strncmp(methodname, AUTH_METHOD_PASSWORD,
 					AUTH_METHOD_PASSWORD_LEN) == 0) {
-			svr_auth_pam();
+			if (valid_user) {
-			goto out;
+				svr_auth_pam();
+				goto out;
+			}
 		}
 	}
 #endif
 #ifdef ENABLE_SVR_PUBKEY_AUTH
 	/* user wants to try pubkey auth */
 	if (methodlen == AUTH_METHOD_PUBKEY_LEN &&
 			strncmp(methodname, AUTH_METHOD_PUBKEY,
 				AUTH_METHOD_PUBKEY_LEN) == 0) {
-		svr_auth_pubkey();
+		if (valid_user) {
+			svr_auth_pubkey();
+		} else {
+			/* pubkey has no failure delay */
+			send_msg_userauth_failure(0, 0);
+		}
 		goto out;
 	}
 #endif
-	/* nothing matched, we just fail */
+	/* nothing matched, we just fail with a delay */
 	send_msg_userauth_failure(0, 1);
 out:
 	m_free(username);
 	if (!ses.authstate.pw_name) {
 		TRACE(("leave checkusername: user '%s' doesn't exist", username))
 		dropbear_log(LOG_WARNING,
 				"Login attempt for nonexistent user from %s",
 				svr_ses.addrstring);
-		send_msg_userauth_failure(0, 1);
 		return DROPBEAR_FAILURE;
 	}
 	/* check if we are running as non-root, and login user is different from the server */
 	uid = geteuid();
 		TRACE(("running as nonroot, only server uid is allowed"))
 		dropbear_log(LOG_WARNING,
 				"Login attempt with wrong user %s from %s",
 				ses.authstate.pw_name,
 				svr_ses.addrstring);
-		send_msg_userauth_failure(0, 1);
 		return DROPBEAR_FAILURE;
 	}
 	/* check for non-root if desired */
 	if (svr_opts.norootlogin && ses.authstate.pw_uid == 0) {
 		TRACE(("leave checkusername: root login disabled"))
 		dropbear_log(LOG_WARNING, "root login rejected");
-		send_msg_userauth_failure(0, 1);
 		return DROPBEAR_FAILURE;
 	}
 	TRACE(("shell is %s", ses.authstate.pw_shell))
 	/* no matching shell */
 	endusershell();
 	TRACE(("no matching shell"))
 	dropbear_log(LOG_WARNING, "User '%s' has invalid shell, rejected",
 				ses.authstate.pw_name);
-	send_msg_userauth_failure(0, 1);
 	return DROPBEAR_FAILURE;
 goodshell:
 	endusershell();
 	TRACE(("matching shell"))
 	TRACE(("uid = %d", ses.authstate.pw_uid))
 	TRACE(("leave checkusername"))
 	return DROPBEAR_SUCCESS;
 }
 /* Send a failure message to the client, in responds to a userauth_request.
 * Partial indicates whether to set the "partial success" flag,
 * incrfail is whether to count this failure in the failure count (which
 	encrypt_packet();
 	if (incrfail) {
 		unsigned int delay;
 		genrandom((unsigned char*)&delay, sizeof(delay));
-		/* We delay for 300ms +- 50ms, 0.1ms granularity */
+		/* We delay for 300ms +- 50ms */
-		delay = 250000 + (delay % 1000)*100;
+		delay = 250000 + (delay % 100000);
 		usleep(delay);
 		ses.authstate.failcount++;
 	}
 	if (ses.authstate.failcount >= MAX_AUTH_TRIES) {

Mercurial > dropbear

comparison svr-auth.c @ 808:d7784616409a