Mercurial > dropbear

diff svr-auth.c @ 782:e0084f136cb8

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
If running as non-root only allow that user to log in
author Matt Johnston <matt@ucc.asn.au>
date Wed, 17 Apr 2013 22:29:18 +0800
parents c58a15983808
children 7dcb46da72d9 d7784616409a
line wrap: on
line diff
--- a/svr-auth.c	Tue Apr 16 22:16:32 2013 +0800
+++ b/svr-auth.c	Wed Apr 17 22:29:18 2013 +0800
@@ -226,6 +226,7 @@
 
 	char* listshell = NULL;
 	char* usershell = NULL;
+	int   uid;
 	TRACE(("enter checkusername"))
 	if (userlen > MAX_USERNAME_LEN) {
 		return DROPBEAR_FAILURE;
@@ -255,6 +256,18 @@
 		return DROPBEAR_FAILURE;
 	}
 
+	/* check if we are running as non-root, and login user is different from the server */
+	uid = geteuid();
+	if (uid != 0 && uid != ses.authstate.pw_uid) {
+		TRACE(("running as nonroot, only server uid is allowed"))
+		dropbear_log(LOG_WARNING,
+				"Login attempt with wrong user %s from %s",
+				ses.authstate.pw_name,
+				svr_ses.addrstring);
+		send_msg_userauth_failure(0, 1);
+		return DROPBEAR_FAILURE;
+	}
+
 	/* check for non-root if desired */
 	if (svr_opts.norootlogin && ses.authstate.pw_uid == 0) {
 		TRACE(("leave checkusername: root login disabled"))