blob: 9541640ae6a87347509b8cc9db01f0232db5e299 [file] [log] [blame]
Damien Millerb38eff82000-04-01 11:09:21 +10001/*
Ben Lindstrom92a2e382001-03-05 06:59:27 +00002 * Copyright (c) 2000 Markus Friedl. All rights reserved.
Damien Millere4340be2000-09-16 13:29:08 +11003 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Damien Millerb38eff82000-04-01 11:09:21 +100023 */
24
25#include "includes.h"
Damien Miller9f0f5c62001-12-21 14:45:46 +110026RCSID("$OpenBSD: auth.c,v 1.31 2001/12/19 07:18:56 deraadt Exp $");
Damien Millerb38eff82000-04-01 11:09:21 +100027
Damien Millerd2c208a2000-05-17 22:00:02 +100028#ifdef HAVE_LOGIN_H
29#include <login.h>
30#endif
Damien Miller1f335fb2000-06-26 11:31:33 +100031#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
32#include <shadow.h>
33#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
Damien Millerb38eff82000-04-01 11:09:21 +100034
Ben Lindstrom68c3ce12001-06-10 17:24:51 +000035#ifdef HAVE_LIBGEN_H
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +000036#include <libgen.h>
Ben Lindstrom68c3ce12001-06-10 17:24:51 +000037#endif
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +000038
Ben Lindstrom226cfa02001-01-22 05:34:40 +000039#include "xmalloc.h"
40#include "match.h"
41#include "groupaccess.h"
42#include "log.h"
43#include "servconf.h"
Damien Millerefb4afe2000-04-12 18:45:05 +100044#include "auth.h"
Ben Lindstromdb65e8f2001-01-19 04:26:52 +000045#include "auth-options.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000046#include "canohost.h"
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +000047#include "buffer.h"
48#include "bufaux.h"
Ben Lindstrom83647ce2001-06-25 04:30:16 +000049#include "uidswap.h"
50#include "tildexpand.h"
Damien Millerefb4afe2000-04-12 18:45:05 +100051
Damien Millerb38eff82000-04-01 11:09:21 +100052/* import */
53extern ServerOptions options;
Damien Millerb38eff82000-04-01 11:09:21 +100054
55/*
Kevin Steves7b61cfa2001-01-14 19:11:00 +000056 * Check if the user is allowed to log in via ssh. If user is listed
57 * in DenyUsers or one of user's groups is listed in DenyGroups, false
58 * will be returned. If AllowUsers isn't empty and user isn't listed
59 * there, or if AllowGroups isn't empty and one of user's groups isn't
60 * listed there, false will be returned.
Damien Millerb38eff82000-04-01 11:09:21 +100061 * If the user's shell is not executable, false will be returned.
Damien Miller4af51302000-04-16 11:18:38 +100062 * Otherwise true is returned.
Damien Millerb38eff82000-04-01 11:09:21 +100063 */
Damien Millereba71ba2000-04-29 23:57:08 +100064int
Damien Millerb38eff82000-04-01 11:09:21 +100065allowed_user(struct passwd * pw)
66{
67 struct stat st;
Ben Lindstrom60260022001-07-04 04:56:44 +000068 const char *hostname = NULL, *ipaddr = NULL;
Damien Millere7cf07c2001-03-20 09:15:57 +110069 char *shell;
Damien Millerb38eff82000-04-01 11:09:21 +100070 int i;
71#ifdef WITH_AIXAUTHENTICATE
72 char *loginmsg;
73#endif /* WITH_AIXAUTHENTICATE */
Kevin Stevesa58e0af2000-10-29 14:38:55 +000074#if !defined(USE_PAM) && defined(HAVE_SHADOW_H) && \
Damien Miller62dd94b2000-09-23 14:26:32 +110075 !defined(DISABLE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
Kevin Steves7b61cfa2001-01-14 19:11:00 +000076 struct spwd *spw;
Damien Millerb38eff82000-04-01 11:09:21 +100077
78 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
Kevin Steves7b61cfa2001-01-14 19:11:00 +000079 if (!pw || !pw->pw_name)
Damien Millerb38eff82000-04-01 11:09:21 +100080 return 0;
81
Damien Miller1f335fb2000-06-26 11:31:33 +100082 spw = getspnam(pw->pw_name);
Damien Millerc7088432000-07-02 18:44:54 +100083 if (spw != NULL) {
84 int days = time(NULL) / 86400;
Damien Miller1f335fb2000-06-26 11:31:33 +100085
Damien Millerc7088432000-07-02 18:44:54 +100086 /* Check account expiry */
Damien Miller62dd94b2000-09-23 14:26:32 +110087 if ((spw->sp_expire >= 0) && (days > spw->sp_expire))
Damien Millerc7088432000-07-02 18:44:54 +100088 return 0;
89
90 /* Check password expiry */
Kevin Stevesef4eea92001-02-05 12:42:17 +000091 if ((spw->sp_lstchg >= 0) && (spw->sp_max >= 0) &&
Damien Miller606f8802000-09-16 15:39:56 +110092 (days > (spw->sp_lstchg + spw->sp_max)))
Damien Millerc7088432000-07-02 18:44:54 +100093 return 0;
94 }
Damien Miller1f335fb2000-06-26 11:31:33 +100095#else
96 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
Kevin Steves7b61cfa2001-01-14 19:11:00 +000097 if (!pw || !pw->pw_name)
Damien Miller1f335fb2000-06-26 11:31:33 +100098 return 0;
99#endif
100
Damien Milleref7df542000-05-19 00:03:23 +1000101 /*
102 * Get the shell from the password data. An empty shell field is
103 * legal, and means /bin/sh.
104 */
105 shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
106
107 /* deny if shell does not exists or is not executable */
108 if (stat(shell, &st) != 0)
Damien Millerb38eff82000-04-01 11:09:21 +1000109 return 0;
110 if (!((st.st_mode & S_IFREG) && (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP))))
111 return 0;
112
Ben Lindstrom60260022001-07-04 04:56:44 +0000113 if (options.num_deny_users > 0 || options.num_allow_users > 0) {
114 hostname = get_canonical_hostname(options.reverse_mapping_check);
115 ipaddr = get_remote_ipaddr();
116 }
117
Damien Millerb38eff82000-04-01 11:09:21 +1000118 /* Return false if user is listed in DenyUsers */
119 if (options.num_deny_users > 0) {
Damien Millerb38eff82000-04-01 11:09:21 +1000120 for (i = 0; i < options.num_deny_users; i++)
Ben Lindstrom60260022001-07-04 04:56:44 +0000121 if (match_user(pw->pw_name, hostname, ipaddr,
122 options.deny_users[i]))
Damien Millerb38eff82000-04-01 11:09:21 +1000123 return 0;
124 }
125 /* Return false if AllowUsers isn't empty and user isn't listed there */
126 if (options.num_allow_users > 0) {
Damien Millerb38eff82000-04-01 11:09:21 +1000127 for (i = 0; i < options.num_allow_users; i++)
Ben Lindstrom60260022001-07-04 04:56:44 +0000128 if (match_user(pw->pw_name, hostname, ipaddr,
129 options.allow_users[i]))
Damien Millerb38eff82000-04-01 11:09:21 +1000130 break;
131 /* i < options.num_allow_users iff we break for loop */
132 if (i >= options.num_allow_users)
133 return 0;
134 }
Damien Millerb38eff82000-04-01 11:09:21 +1000135 if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000136 /* Get the user's group access list (primary and supplementary) */
137 if (ga_init(pw->pw_name, pw->pw_gid) == 0)
Damien Millerb38eff82000-04-01 11:09:21 +1000138 return 0;
139
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000140 /* Return false if one of user's groups is listed in DenyGroups */
141 if (options.num_deny_groups > 0)
142 if (ga_match(options.deny_groups,
143 options.num_deny_groups)) {
144 ga_free();
Damien Millerb38eff82000-04-01 11:09:21 +1000145 return 0;
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000146 }
Damien Millerb38eff82000-04-01 11:09:21 +1000147 /*
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000148 * Return false if AllowGroups isn't empty and one of user's groups
Damien Millerb38eff82000-04-01 11:09:21 +1000149 * isn't listed there
150 */
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000151 if (options.num_allow_groups > 0)
152 if (!ga_match(options.allow_groups,
153 options.num_allow_groups)) {
154 ga_free();
Damien Millerb38eff82000-04-01 11:09:21 +1000155 return 0;
Kevin Steves7b61cfa2001-01-14 19:11:00 +0000156 }
157 ga_free();
Damien Millerb38eff82000-04-01 11:09:21 +1000158 }
159
160#ifdef WITH_AIXAUTHENTICATE
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000161 if (loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) {
Damien Millerd2c208a2000-05-17 22:00:02 +1000162 if (loginmsg && *loginmsg) {
163 /* Remove embedded newlines (if any) */
164 char *p;
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000165 for (p = loginmsg; *p; p++) {
Damien Millerd2c208a2000-05-17 22:00:02 +1000166 if (*p == '\n')
167 *p = ' ';
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000168 }
Damien Millerd2c208a2000-05-17 22:00:02 +1000169 /* Remove trailing newline */
170 *--p = '\0';
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000171 log("Login restricted for %s: %.100s", pw->pw_name, loginmsg);
Damien Millerd2c208a2000-05-17 22:00:02 +1000172 }
Damien Millerb38eff82000-04-01 11:09:21 +1000173 return 0;
Damien Millerd2c208a2000-05-17 22:00:02 +1000174 }
Damien Millerb38eff82000-04-01 11:09:21 +1000175#endif /* WITH_AIXAUTHENTICATE */
176
177 /* We found no reason not to let this user try to log on... */
178 return 1;
179}
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000180
181Authctxt *
182authctxt_new(void)
183{
Kevin Stevesef4eea92001-02-05 12:42:17 +0000184 Authctxt *authctxt = xmalloc(sizeof(*authctxt));
185 memset(authctxt, 0, sizeof(*authctxt));
186 return authctxt;
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000187}
188
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000189void
190auth_log(Authctxt *authctxt, int authenticated, char *method, char *info)
191{
192 void (*authlog) (const char *fmt,...) = verbose;
193 char *authmsg;
194
195 /* Raise logging level */
196 if (authenticated == 1 ||
197 !authctxt->valid ||
198 authctxt->failures >= AUTH_FAIL_LOG ||
199 strcmp(method, "password") == 0)
200 authlog = log;
201
202 if (authctxt->postponed)
203 authmsg = "Postponed";
204 else
205 authmsg = authenticated ? "Accepted" : "Failed";
206
207 authlog("%s %s for %s%.100s from %.200s port %d%s",
208 authmsg,
209 method,
210 authctxt->valid ? "" : "illegal user ",
Damien Millerf6552072001-11-12 11:06:06 +1100211 authctxt->user,
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000212 get_remote_ipaddr(),
213 get_remote_port(),
214 info);
215}
216
217/*
Ben Lindstromd8a90212001-02-15 03:08:27 +0000218 * Check whether root logins are disallowed.
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000219 */
220int
Ben Lindstromd8a90212001-02-15 03:08:27 +0000221auth_root_allowed(char *method)
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000222{
Ben Lindstromd8a90212001-02-15 03:08:27 +0000223 switch (options.permit_root_login) {
224 case PERMIT_YES:
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000225 return 1;
Ben Lindstromd8a90212001-02-15 03:08:27 +0000226 break;
227 case PERMIT_NO_PASSWD:
228 if (strcmp(method, "password") != 0)
229 return 1;
230 break;
231 case PERMIT_FORCED_ONLY:
232 if (forced_command) {
233 log("Root login accepted for forced command.");
234 return 1;
235 }
236 break;
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000237 }
Ben Lindstromd8a90212001-02-15 03:08:27 +0000238 log("ROOT LOGIN REFUSED FROM %.200s", get_remote_ipaddr());
239 return 0;
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000240}
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000241
242
243/*
244 * Given a template and a passwd structure, build a filename
245 * by substituting % tokenised options. Currently, %% becomes '%',
246 * %h becomes the home directory and %u the username.
247 *
248 * This returns a buffer allocated by xmalloc.
249 */
250char *
251expand_filename(const char *filename, struct passwd *pw)
252{
253 Buffer buffer;
254 char *file;
255 const char *cp;
256
257 /*
258 * Build the filename string in the buffer by making the appropriate
259 * substitutions to the given file name.
260 */
261 buffer_init(&buffer);
262 for (cp = filename; *cp; cp++) {
263 if (cp[0] == '%' && cp[1] == '%') {
264 buffer_append(&buffer, "%", 1);
265 cp++;
266 continue;
267 }
268 if (cp[0] == '%' && cp[1] == 'h') {
269 buffer_append(&buffer, pw->pw_dir, strlen(pw->pw_dir));
270 cp++;
271 continue;
272 }
273 if (cp[0] == '%' && cp[1] == 'u') {
274 buffer_append(&buffer, pw->pw_name,
Damien Miller9f0f5c62001-12-21 14:45:46 +1100275 strlen(pw->pw_name));
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000276 cp++;
277 continue;
278 }
279 buffer_append(&buffer, cp, 1);
280 }
281 buffer_append(&buffer, "\0", 1);
282
283 /*
284 * Ensure that filename starts anchored. If not, be backward
285 * compatible and prepend the '%h/'
286 */
287 file = xmalloc(MAXPATHLEN);
288 cp = buffer_ptr(&buffer);
289 if (*cp != '/')
290 snprintf(file, MAXPATHLEN, "%s/%s", pw->pw_dir, cp);
291 else
292 strlcpy(file, cp, MAXPATHLEN);
293
294 buffer_free(&buffer);
295 return file;
296}
297
298char *
299authorized_keys_file(struct passwd *pw)
300{
301 return expand_filename(options.authorized_keys_file, pw);
302}
303
304char *
305authorized_keys_file2(struct passwd *pw)
306{
307 return expand_filename(options.authorized_keys_file2, pw);
308}
309
Ben Lindstrom83647ce2001-06-25 04:30:16 +0000310/* return ok if key exists in sysfile or userfile */
311HostStatus
312check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
313 const char *sysfile, const char *userfile)
314{
315 Key *found;
316 char *user_hostfile;
317 struct stat st;
Ben Lindstrom65366a82001-12-06 16:32:47 +0000318 HostStatus host_status;
Ben Lindstrom83647ce2001-06-25 04:30:16 +0000319
320 /* Check if we know the host and its host key. */
321 found = key_new(key->type);
322 host_status = check_host_in_hostfile(sysfile, host, key, found, NULL);
323
324 if (host_status != HOST_OK && userfile != NULL) {
325 user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
326 if (options.strict_modes &&
327 (stat(user_hostfile, &st) == 0) &&
328 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
Damien Miller9f0f5c62001-12-21 14:45:46 +1100329 (st.st_mode & 022) != 0)) {
Ben Lindstrom83647ce2001-06-25 04:30:16 +0000330 log("Authentication refused for %.100s: "
331 "bad owner or modes for %.200s",
332 pw->pw_name, user_hostfile);
333 } else {
334 temporarily_use_uid(pw);
335 host_status = check_host_in_hostfile(user_hostfile,
336 host, key, found, NULL);
337 restore_uid();
338 }
339 xfree(user_hostfile);
340 }
341 key_free(found);
342
343 debug2("check_key_in_hostfiles: key %s for %s", host_status == HOST_OK ?
344 "ok" : "not found", host);
345 return host_status;
346}
347
348
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000349/*
350 * Check a given file for security. This is defined as all components
351 * of the path to the file must either be owned by either the owner of
Ben Lindstrom60567ff2001-06-05 20:27:53 +0000352 * of the file or root and no directories must be group or world writable.
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000353 *
354 * XXX Should any specific check be done for sym links ?
355 *
356 * Takes an open file descriptor, the file name, a uid and and
357 * error buffer plus max size as arguments.
358 *
359 * Returns 0 on success and -1 on failure
360 */
361int
Ben Lindstrom248c0782001-07-04 03:40:39 +0000362secure_filename(FILE *f, const char *file, struct passwd *pw,
363 char *err, size_t errlen)
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000364{
Ben Lindstrom248c0782001-07-04 03:40:39 +0000365 uid_t uid = pw->pw_uid;
Ben Lindstromc3e49e72001-10-03 17:55:26 +0000366 char buf[MAXPATHLEN], homedir[MAXPATHLEN];
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000367 char *cp;
368 struct stat st;
369
370 if (realpath(file, buf) == NULL) {
371 snprintf(err, errlen, "realpath %s failed: %s", file,
372 strerror(errno));
373 return -1;
374 }
Ben Lindstromc3e49e72001-10-03 17:55:26 +0000375 if (realpath(pw->pw_dir, homedir) == NULL) {
376 snprintf(err, errlen, "realpath %s failed: %s", pw->pw_dir,
377 strerror(errno));
378 return -1;
379 }
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000380
381 /* check the open file to avoid races */
382 if (fstat(fileno(f), &st) < 0 ||
383 (st.st_uid != 0 && st.st_uid != uid) ||
384 (st.st_mode & 022) != 0) {
385 snprintf(err, errlen, "bad ownership or modes for file %s",
386 buf);
387 return -1;
388 }
389
390 /* for each component of the canonical path, walking upwards */
391 for (;;) {
392 if ((cp = dirname(buf)) == NULL) {
393 snprintf(err, errlen, "dirname() failed");
394 return -1;
395 }
396 strlcpy(buf, cp, sizeof(buf));
397
398 debug3("secure_filename: checking '%s'", buf);
399 if (stat(buf, &st) < 0 ||
400 (st.st_uid != 0 && st.st_uid != uid) ||
401 (st.st_mode & 022) != 0) {
Damien Miller9f0f5c62001-12-21 14:45:46 +1100402 snprintf(err, errlen,
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000403 "bad ownership or modes for directory %s", buf);
404 return -1;
405 }
406
Damien Miller0ae6e002001-07-14 12:21:34 +1000407 /* If are passed the homedir then we can stop */
Ben Lindstromc3e49e72001-10-03 17:55:26 +0000408 if (strcmp(homedir, buf) == 0) {
Damien Miller0ae6e002001-07-14 12:21:34 +1000409 debug3("secure_filename: terminating check at '%s'",
410 buf);
411 break;
412 }
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000413 /*
414 * dirname should always complete with a "/" path,
415 * but we can be paranoid and check for "." too
416 */
417 if ((strcmp("/", buf) == 0) || (strcmp(".", buf) == 0))
418 break;
419 }
420 return 0;
421}