blob: c6e5a17321602137d5fa25a1ba039d703168b8a6 [file] [log] [blame]
Damien Miller116e6df2002-05-22 15:06:28 +10001/*
Ben Lindstrom92a2e382001-03-05 06:59:27 +00002 * Copyright (c) 2000 Markus Friedl. All rights reserved.
Damien Millere4340be2000-09-16 13:29:08 +11003 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Damien Millerb38eff82000-04-01 11:09:21 +100023 */
24
25#include "includes.h"
Ben Lindstrom485075e2002-11-09 15:45:12 +000026RCSID("$OpenBSD: auth.c,v 1.46 2002/11/04 10:07:53 markus Exp $");
Damien Millerb38eff82000-04-01 11:09:21 +100027
Damien Millerd2c208a2000-05-17 22:00:02 +100028#ifdef HAVE_LOGIN_H
29#include <login.h>
30#endif
Damien Miller1f335fb2000-06-26 11:31:33 +100031#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
32#include <shadow.h>
33#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
Damien Millerb38eff82000-04-01 11:09:21 +100034
Ben Lindstrom68c3ce12001-06-10 17:24:51 +000035#ifdef HAVE_LIBGEN_H
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +000036#include <libgen.h>
Ben Lindstrom68c3ce12001-06-10 17:24:51 +000037#endif
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +000038
Ben Lindstrom226cfa02001-01-22 05:34:40 +000039#include "xmalloc.h"
40#include "match.h"
41#include "groupaccess.h"
42#include "log.h"
43#include "servconf.h"
Damien Millerefb4afe2000-04-12 18:45:05 +100044#include "auth.h"
Ben Lindstromdb65e8f2001-01-19 04:26:52 +000045#include "auth-options.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000046#include "canohost.h"
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +000047#include "buffer.h"
48#include "bufaux.h"
Ben Lindstrom83647ce2001-06-25 04:30:16 +000049#include "uidswap.h"
50#include "tildexpand.h"
Ben Lindstrom7ebb6352002-03-22 03:04:08 +000051#include "misc.h"
Ben Lindstroma574cda2002-05-15 16:16:14 +000052#include "bufaux.h"
53#include "packet.h"
Damien Millerefb4afe2000-04-12 18:45:05 +100054
Damien Millerb38eff82000-04-01 11:09:21 +100055/* import */
56extern ServerOptions options;
Damien Millerb38eff82000-04-01 11:09:21 +100057
Ben Lindstroma574cda2002-05-15 16:16:14 +000058/* Debugging messages */
59Buffer auth_debug;
60int auth_debug_init;
61
Damien Millerb38eff82000-04-01 11:09:21 +100062/*
Kevin Steves7b61cfa2001-01-14 19:11:00 +000063 * Check if the user is allowed to log in via ssh. If user is listed
64 * in DenyUsers or one of user's groups is listed in DenyGroups, false
65 * will be returned. If AllowUsers isn't empty and user isn't listed
66 * there, or if AllowGroups isn't empty and one of user's groups isn't
67 * listed there, false will be returned.
Damien Millerb38eff82000-04-01 11:09:21 +100068 * If the user's shell is not executable, false will be returned.
Damien Miller4af51302000-04-16 11:18:38 +100069 * Otherwise true is returned.
Damien Millerb38eff82000-04-01 11:09:21 +100070 */
Damien Millereba71ba2000-04-29 23:57:08 +100071int
Damien Millerb38eff82000-04-01 11:09:21 +100072allowed_user(struct passwd * pw)
73{
74 struct stat st;
Damien Miller48cb8aa2003-01-07 12:19:32 +110075 const char *hostname = NULL, *ipaddr = NULL, *passwd;
Damien Millere7cf07c2001-03-20 09:15:57 +110076 char *shell;
Damien Millerb38eff82000-04-01 11:09:21 +100077 int i;
78#ifdef WITH_AIXAUTHENTICATE
79 char *loginmsg;
80#endif /* WITH_AIXAUTHENTICATE */
Damien Miller06817f92003-01-07 23:55:59 +110081#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
Kevin Steves7b61cfa2001-01-14 19:11:00 +000082 struct spwd *spw;
Tim Rice458c6bf2003-01-08 20:04:27 -080083#if !defined(USE_PAM) && defined(HAS_SHADOW_EXPIRE)
84 time_t today;
85#endif
Damien Miller48cb8aa2003-01-07 12:19:32 +110086#endif
Damien Millerb38eff82000-04-01 11:09:21 +100087
88 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
Kevin Steves7b61cfa2001-01-14 19:11:00 +000089 if (!pw || !pw->pw_name)
Damien Millerb38eff82000-04-01 11:09:21 +100090 return 0;
91
Damien Miller06817f92003-01-07 23:55:59 +110092 /* Grab the password for locked account checking */
93#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
Damien Miller1f335fb2000-06-26 11:31:33 +100094 spw = getspnam(pw->pw_name);
Damien Miller06817f92003-01-07 23:55:59 +110095 if (!spw)
96 return 0;
Damien Miller48cb8aa2003-01-07 12:19:32 +110097 passwd = spw->sp_pwdp;
98#else
99 passwd = pw->pw_passwd;
100#endif
Damien Miller64004b52003-01-07 16:15:20 +1100101
Damien Miller48cb8aa2003-01-07 12:19:32 +1100102 /* check for locked account */
103 if (strcmp(passwd, "*LK*") == 0 || passwd[0] == '!') {
104 log("User %.100s not allowed because account is locked",
105 pw->pw_name);
106 return 0;
107 }
108
Damien Miller06817f92003-01-07 23:55:59 +1100109#if !defined(USE_PAM) && defined(HAVE_SHADOW_H) && \
110 !defined(DISABLE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
111#define DAY (24L * 60 * 60) /* 1 day in seconds */
Tim Rice458c6bf2003-01-08 20:04:27 -0800112 today = time(NULL) / DAY;
Damien Miller06817f92003-01-07 23:55:59 +1100113 debug3("allowed_user: today %d sp_expire %d sp_lstchg %d"
114 " sp_max %d", (int)today, (int)spw->sp_expire,
115 (int)spw->sp_lstchg, (int)spw->sp_max);
116
117 /*
118 * We assume account and password expiration occurs the
119 * day after the day specified.
120 */
121 if (spw->sp_expire != -1 && today > spw->sp_expire) {
122 log("Account %.100s has expired", pw->pw_name);
123 return 0;
124 }
125
126 if (spw->sp_lstchg == 0) {
127 log("User %.100s password has expired (root forced)",
128 pw->pw_name);
129 return 0;
130 }
131
132 if (spw->sp_max != -1 &&
133 today > spw->sp_lstchg + spw->sp_max) {
134 log("User %.100s password has expired (password aged)",
135 pw->pw_name);
136 return 0;
137 }
138#endif
139
Damien Milleref7df542000-05-19 00:03:23 +1000140 /*
141 * Get the shell from the password data. An empty shell field is
142 * legal, and means /bin/sh.
143 */
144 shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
145
146 /* deny if shell does not exists or is not executable */
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000147 if (stat(shell, &st) != 0) {
148 log("User %.100s not allowed because shell %.100s does not exist",
149 pw->pw_name, shell);
Damien Millerb38eff82000-04-01 11:09:21 +1000150 return 0;
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000151 }
Ben Lindstromb61e6df2002-03-22 01:15:33 +0000152 if (S_ISREG(st.st_mode) == 0 ||
153 (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)) == 0) {
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000154 log("User %.100s not allowed because shell %.100s is not executable",
155 pw->pw_name, shell);
Damien Millerb38eff82000-04-01 11:09:21 +1000156 return 0;
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000157 }
Damien Millerb38eff82000-04-01 11:09:21 +1000158
Ben Lindstrom3fb5d002002-03-05 01:42:42 +0000159 if (options.num_deny_users > 0 || options.num_allow_users > 0) {
160 hostname = get_canonical_hostname(options.verify_reverse_mapping);
161 ipaddr = get_remote_ipaddr();
162 }
163
Damien Millerb38eff82000-04-01 11:09:21 +1000164 /* Return false if user is listed in DenyUsers */
165 if (options.num_deny_users > 0) {
Damien Millerb38eff82000-04-01 11:09:21 +1000166 for (i = 0; i < options.num_deny_users; i++)
Ben Lindstrom6328ab32002-03-22 02:54:23 +0000167 if (match_user(pw->pw_name, hostname, ipaddr,
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000168 options.deny_users[i])) {
Ben Lindstrom6328ab32002-03-22 02:54:23 +0000169 log("User %.100s not allowed because listed in DenyUsers",
170 pw->pw_name);
Damien Millerb38eff82000-04-01 11:09:21 +1000171 return 0;
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000172 }
Damien Millerb38eff82000-04-01 11:09:21 +1000173 }
174 /* Return false if AllowUsers isn't empty and user isn't listed there */
175 if (options.num_allow_users > 0) {
Damien Millerb38eff82000-04-01 11:09:21 +1000176 for (i = 0; i < options.num_allow_users; i++)
Ben Lindstrom6328ab32002-03-22 02:54:23 +0000177 if (match_user(pw->pw_name, hostname, ipaddr,
Ben Lindstrom60260022001-07-04 04:56:44 +0000178 options.allow_users[i]))
Damien Millerb38eff82000-04-01 11:09:21 +1000179 break;
180 /* i < options.num_allow_users iff we break for loop */
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000181 if (i >= options.num_allow_users) {
182 log("User %.100s not allowed because not listed in AllowUsers",
183 pw->pw_name);
Damien Millerb38eff82000-04-01 11:09:21 +1000184 return 0;
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000185 }
Damien Millerb38eff82000-04-01 11:09:21 +1000186 }
Damien Millerb38eff82000-04-01 11:09:21 +1000187 if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000188 /* Get the user's group access list (primary and supplementary) */
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000189 if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
190 log("User %.100s not allowed because not in any group",
191 pw->pw_name);
Damien Millerb38eff82000-04-01 11:09:21 +1000192 return 0;
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000193 }
Damien Millerb38eff82000-04-01 11:09:21 +1000194
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000195 /* Return false if one of user's groups is listed in DenyGroups */
196 if (options.num_deny_groups > 0)
197 if (ga_match(options.deny_groups,
198 options.num_deny_groups)) {
199 ga_free();
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000200 log("User %.100s not allowed because a group is listed in DenyGroups",
201 pw->pw_name);
Damien Millerb38eff82000-04-01 11:09:21 +1000202 return 0;
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000203 }
Damien Millerb38eff82000-04-01 11:09:21 +1000204 /*
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000205 * Return false if AllowGroups isn't empty and one of user's groups
Damien Millerb38eff82000-04-01 11:09:21 +1000206 * isn't listed there
207 */
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000208 if (options.num_allow_groups > 0)
209 if (!ga_match(options.allow_groups,
210 options.num_allow_groups)) {
211 ga_free();
Ben Lindstrom6ef9ec62002-03-05 01:40:37 +0000212 log("User %.100s not allowed because none of user's groups are listed in AllowGroups",
213 pw->pw_name);
Damien Millerb38eff82000-04-01 11:09:21 +1000214 return 0;
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000215 }
216 ga_free();
Damien Millerb38eff82000-04-01 11:09:21 +1000217 }
218
219#ifdef WITH_AIXAUTHENTICATE
Ben Lindstrom97e38d82002-10-16 00:13:52 +0000220 /*
221 * Don't check loginrestrictions() for root account (use
222 * PermitRootLogin to control logins via ssh), or if running as
223 * non-root user (since loginrestrictions will always fail).
224 */
225 if ( (pw->pw_uid != 0) && (geteuid() == 0) &&
226 loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) {
Damien Millerf25c18d2003-01-07 17:38:58 +1100227 int loginrestrict_errno = errno;
228
Damien Millerd2c208a2000-05-17 22:00:02 +1000229 if (loginmsg && *loginmsg) {
230 /* Remove embedded newlines (if any) */
231 char *p;
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000232 for (p = loginmsg; *p; p++) {
Damien Millerd2c208a2000-05-17 22:00:02 +1000233 if (*p == '\n')
234 *p = ' ';
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000235 }
Damien Millerd2c208a2000-05-17 22:00:02 +1000236 /* Remove trailing newline */
237 *--p = '\0';
Damien Millerf25c18d2003-01-07 17:38:58 +1100238 log("Login restricted for %s: %.100s", pw->pw_name,
239 loginmsg);
Damien Millerd2c208a2000-05-17 22:00:02 +1000240 }
Damien Millerf25c18d2003-01-07 17:38:58 +1100241 /* Don't fail if /etc/nologin set */
242 if (!(loginrestrict_errno == EPERM &&
243 stat(_PATH_NOLOGIN, &st) == 0))
244 return 0;
Damien Millerd2c208a2000-05-17 22:00:02 +1000245 }
Damien Millerb38eff82000-04-01 11:09:21 +1000246#endif /* WITH_AIXAUTHENTICATE */
247
248 /* We found no reason not to let this user try to log on... */
249 return 1;
250}
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000251
252Authctxt *
253authctxt_new(void)
254{
Kevin Stevesef4eea92001-02-05 12:42:17 +0000255 Authctxt *authctxt = xmalloc(sizeof(*authctxt));
256 memset(authctxt, 0, sizeof(*authctxt));
257 return authctxt;
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000258}
259
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000260void
261auth_log(Authctxt *authctxt, int authenticated, char *method, char *info)
262{
263 void (*authlog) (const char *fmt,...) = verbose;
264 char *authmsg;
265
266 /* Raise logging level */
267 if (authenticated == 1 ||
268 !authctxt->valid ||
269 authctxt->failures >= AUTH_FAIL_LOG ||
270 strcmp(method, "password") == 0)
271 authlog = log;
272
273 if (authctxt->postponed)
274 authmsg = "Postponed";
275 else
276 authmsg = authenticated ? "Accepted" : "Failed";
277
278 authlog("%s %s for %s%.100s from %.200s port %d%s",
279 authmsg,
280 method,
281 authctxt->valid ? "" : "illegal user ",
Damien Millerf6552072001-11-12 11:06:06 +1100282 authctxt->user,
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000283 get_remote_ipaddr(),
284 get_remote_port(),
285 info);
Ben Lindstrome06eb682002-07-04 00:27:21 +0000286
287#ifdef WITH_AIXAUTHENTICATE
288 if (authenticated == 0 && strcmp(method, "password") == 0)
289 loginfailed(authctxt->user,
290 get_canonical_hostname(options.verify_reverse_mapping),
291 "ssh");
292#endif /* WITH_AIXAUTHENTICATE */
293
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000294}
295
296/*
Ben Lindstromd8a90212001-02-15 03:08:27 +0000297 * Check whether root logins are disallowed.
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000298 */
299int
Ben Lindstromd8a90212001-02-15 03:08:27 +0000300auth_root_allowed(char *method)
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000301{
Ben Lindstromd8a90212001-02-15 03:08:27 +0000302 switch (options.permit_root_login) {
303 case PERMIT_YES:
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000304 return 1;
Ben Lindstromd8a90212001-02-15 03:08:27 +0000305 break;
306 case PERMIT_NO_PASSWD:
307 if (strcmp(method, "password") != 0)
308 return 1;
309 break;
310 case PERMIT_FORCED_ONLY:
311 if (forced_command) {
312 log("Root login accepted for forced command.");
313 return 1;
314 }
315 break;
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000316 }
Ben Lindstromd8a90212001-02-15 03:08:27 +0000317 log("ROOT LOGIN REFUSED FROM %.200s", get_remote_ipaddr());
318 return 0;
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000319}
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000320
321
322/*
323 * Given a template and a passwd structure, build a filename
324 * by substituting % tokenised options. Currently, %% becomes '%',
325 * %h becomes the home directory and %u the username.
326 *
327 * This returns a buffer allocated by xmalloc.
328 */
329char *
330expand_filename(const char *filename, struct passwd *pw)
331{
332 Buffer buffer;
333 char *file;
334 const char *cp;
335
336 /*
337 * Build the filename string in the buffer by making the appropriate
338 * substitutions to the given file name.
339 */
340 buffer_init(&buffer);
341 for (cp = filename; *cp; cp++) {
342 if (cp[0] == '%' && cp[1] == '%') {
343 buffer_append(&buffer, "%", 1);
344 cp++;
345 continue;
346 }
347 if (cp[0] == '%' && cp[1] == 'h') {
348 buffer_append(&buffer, pw->pw_dir, strlen(pw->pw_dir));
349 cp++;
350 continue;
351 }
352 if (cp[0] == '%' && cp[1] == 'u') {
353 buffer_append(&buffer, pw->pw_name,
Damien Miller9f0f5c62001-12-21 14:45:46 +1100354 strlen(pw->pw_name));
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000355 cp++;
356 continue;
357 }
358 buffer_append(&buffer, cp, 1);
359 }
360 buffer_append(&buffer, "\0", 1);
361
362 /*
363 * Ensure that filename starts anchored. If not, be backward
364 * compatible and prepend the '%h/'
365 */
366 file = xmalloc(MAXPATHLEN);
367 cp = buffer_ptr(&buffer);
368 if (*cp != '/')
369 snprintf(file, MAXPATHLEN, "%s/%s", pw->pw_dir, cp);
370 else
371 strlcpy(file, cp, MAXPATHLEN);
372
373 buffer_free(&buffer);
374 return file;
375}
376
377char *
378authorized_keys_file(struct passwd *pw)
379{
380 return expand_filename(options.authorized_keys_file, pw);
381}
382
383char *
384authorized_keys_file2(struct passwd *pw)
385{
386 return expand_filename(options.authorized_keys_file2, pw);
387}
388
Ben Lindstrom83647ce2001-06-25 04:30:16 +0000389/* return ok if key exists in sysfile or userfile */
390HostStatus
391check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
392 const char *sysfile, const char *userfile)
393{
394 Key *found;
395 char *user_hostfile;
396 struct stat st;
Ben Lindstrom65366a82001-12-06 16:32:47 +0000397 HostStatus host_status;
Ben Lindstrom83647ce2001-06-25 04:30:16 +0000398
399 /* Check if we know the host and its host key. */
400 found = key_new(key->type);
401 host_status = check_host_in_hostfile(sysfile, host, key, found, NULL);
402
403 if (host_status != HOST_OK && userfile != NULL) {
404 user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
405 if (options.strict_modes &&
406 (stat(user_hostfile, &st) == 0) &&
407 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
Damien Miller9f0f5c62001-12-21 14:45:46 +1100408 (st.st_mode & 022) != 0)) {
Ben Lindstrom83647ce2001-06-25 04:30:16 +0000409 log("Authentication refused for %.100s: "
410 "bad owner or modes for %.200s",
411 pw->pw_name, user_hostfile);
412 } else {
413 temporarily_use_uid(pw);
414 host_status = check_host_in_hostfile(user_hostfile,
415 host, key, found, NULL);
416 restore_uid();
417 }
418 xfree(user_hostfile);
419 }
420 key_free(found);
421
422 debug2("check_key_in_hostfiles: key %s for %s", host_status == HOST_OK ?
423 "ok" : "not found", host);
424 return host_status;
425}
426
427
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000428/*
429 * Check a given file for security. This is defined as all components
Ben Lindstromd4ee3492002-08-20 18:42:13 +0000430 * of the path to the file must be owned by either the owner of
Ben Lindstrom60567ff2001-06-05 20:27:53 +0000431 * of the file or root and no directories must be group or world writable.
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000432 *
433 * XXX Should any specific check be done for sym links ?
434 *
435 * Takes an open file descriptor, the file name, a uid and and
436 * error buffer plus max size as arguments.
437 *
438 * Returns 0 on success and -1 on failure
439 */
440int
Ben Lindstrom248c0782001-07-04 03:40:39 +0000441secure_filename(FILE *f, const char *file, struct passwd *pw,
442 char *err, size_t errlen)
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000443{
Ben Lindstrom248c0782001-07-04 03:40:39 +0000444 uid_t uid = pw->pw_uid;
Ben Lindstromc3e49e72001-10-03 17:55:26 +0000445 char buf[MAXPATHLEN], homedir[MAXPATHLEN];
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000446 char *cp;
Ben Lindstrom485075e2002-11-09 15:45:12 +0000447 int comparehome = 0;
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000448 struct stat st;
449
450 if (realpath(file, buf) == NULL) {
451 snprintf(err, errlen, "realpath %s failed: %s", file,
452 strerror(errno));
453 return -1;
454 }
Ben Lindstrom485075e2002-11-09 15:45:12 +0000455 if (realpath(pw->pw_dir, homedir) != NULL)
456 comparehome = 1;
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000457
458 /* check the open file to avoid races */
459 if (fstat(fileno(f), &st) < 0 ||
460 (st.st_uid != 0 && st.st_uid != uid) ||
461 (st.st_mode & 022) != 0) {
462 snprintf(err, errlen, "bad ownership or modes for file %s",
463 buf);
464 return -1;
465 }
466
467 /* for each component of the canonical path, walking upwards */
468 for (;;) {
469 if ((cp = dirname(buf)) == NULL) {
470 snprintf(err, errlen, "dirname() failed");
471 return -1;
472 }
473 strlcpy(buf, cp, sizeof(buf));
474
475 debug3("secure_filename: checking '%s'", buf);
476 if (stat(buf, &st) < 0 ||
477 (st.st_uid != 0 && st.st_uid != uid) ||
478 (st.st_mode & 022) != 0) {
Damien Miller9f0f5c62001-12-21 14:45:46 +1100479 snprintf(err, errlen,
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000480 "bad ownership or modes for directory %s", buf);
481 return -1;
482 }
483
Damien Miller0ae6e002001-07-14 12:21:34 +1000484 /* If are passed the homedir then we can stop */
Ben Lindstrom485075e2002-11-09 15:45:12 +0000485 if (comparehome && strcmp(homedir, buf) == 0) {
Damien Miller0ae6e002001-07-14 12:21:34 +1000486 debug3("secure_filename: terminating check at '%s'",
487 buf);
488 break;
489 }
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000490 /*
491 * dirname should always complete with a "/" path,
492 * but we can be paranoid and check for "." too
493 */
494 if ((strcmp("/", buf) == 0) || (strcmp(".", buf) == 0))
495 break;
496 }
497 return 0;
498}
Ben Lindstrom2ae18f42002-03-22 01:24:38 +0000499
500struct passwd *
501getpwnamallow(const char *user)
502{
Ben Lindstromb481e132002-03-22 01:35:47 +0000503#ifdef HAVE_LOGIN_CAP
504 extern login_cap_t *lc;
505#ifdef BSD_AUTH
506 auth_session_t *as;
507#endif
508#endif
Ben Lindstrom2ae18f42002-03-22 01:24:38 +0000509 struct passwd *pw;
510
511 pw = getpwnam(user);
Damien Miller6f0a1882002-09-22 01:26:51 +1000512 if (pw == NULL) {
513 log("Illegal user %.100s from %.100s",
514 user, get_remote_ipaddr());
Ben Lindstromf5397c02002-11-09 16:11:10 +0000515#ifdef WITH_AIXAUTHENTICATE
516 loginfailed(user,
517 get_canonical_hostname(options.verify_reverse_mapping),
518 "ssh");
519#endif
Damien Miller6f0a1882002-09-22 01:26:51 +1000520 return (NULL);
521 }
522 if (!allowed_user(pw))
Ben Lindstromb481e132002-03-22 01:35:47 +0000523 return (NULL);
524#ifdef HAVE_LOGIN_CAP
525 if ((lc = login_getclass(pw->pw_class)) == NULL) {
526 debug("unable to get login class: %s", user);
527 return (NULL);
528 }
529#ifdef BSD_AUTH
530 if ((as = auth_open()) == NULL || auth_setpwd(as, pw) != 0 ||
Damien Miller13e35a02002-05-22 14:04:11 +1000531 auth_approval(as, lc, pw->pw_name, "ssh") <= 0) {
Ben Lindstromb481e132002-03-22 01:35:47 +0000532 debug("Approval failure for %s", user);
Ben Lindstrom2ae18f42002-03-22 01:24:38 +0000533 pw = NULL;
Ben Lindstromb481e132002-03-22 01:35:47 +0000534 }
535 if (as != NULL)
536 auth_close(as);
537#endif
538#endif
Ben Lindstromf34e4eb2002-03-22 03:08:30 +0000539 if (pw != NULL)
540 return (pwcopy(pw));
541 return (NULL);
Ben Lindstrom2ae18f42002-03-22 01:24:38 +0000542}
Ben Lindstroma574cda2002-05-15 16:16:14 +0000543
544void
545auth_debug_add(const char *fmt,...)
546{
547 char buf[1024];
548 va_list args;
549
550 if (!auth_debug_init)
551 return;
552
553 va_start(args, fmt);
554 vsnprintf(buf, sizeof(buf), fmt, args);
555 va_end(args);
556 buffer_put_cstring(&auth_debug, buf);
557}
558
559void
560auth_debug_send(void)
561{
562 char *msg;
563
564 if (!auth_debug_init)
565 return;
566 while (buffer_len(&auth_debug)) {
567 msg = buffer_get_string(&auth_debug, NULL);
568 packet_send_debug("%s", msg);
569 xfree(msg);
570 }
571}
572
573void
574auth_debug_reset(void)
575{
576 if (auth_debug_init)
577 buffer_clear(&auth_debug);
578 else {
579 buffer_init(&auth_debug);
580 auth_debug_init = 1;
581 }
582}