blob: 662f85f63104ee5cf1ea161ac3e46e3136776c45 [file] [log] [blame]
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001/*
Damien Miller95def091999-11-25 00:26:21 +11002 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
5 * Created: Sat Mar 18 05:11:38 1995 ylo
6 * Password authentication. This file contains the functions to check whether
7 * the password is valid for the user.
8 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10009
10#include "includes.h"
Damien Millerdd1c7ba1999-11-19 15:53:20 +110011
Damien Millerbeb4ba51999-12-28 15:09:35 +110012#ifndef USE_PAM
Damien Millerdd1c7ba1999-11-19 15:53:20 +110013
Damien Miller5f056372000-04-16 12:31:48 +100014RCSID("$Id: auth-passwd.c,v 1.18 2000/04/16 02:31:49 damien Exp $");
Damien Millerd4a8b7e1999-10-27 13:42:43 +100015
16#include "packet.h"
17#include "ssh.h"
18#include "servconf.h"
19#include "xmalloc.h"
Damien Miller2cb210f1999-11-13 15:40:10 +110020
Damien Miller1fa154b2000-01-23 10:32:03 +110021#ifdef WITH_AIXAUTHENTICATE
22#include <login.h>
23#endif
24
Damien Miller2cb210f1999-11-13 15:40:10 +110025#ifdef HAVE_SHADOW_H
Damien Millerbeb4ba51999-12-28 15:09:35 +110026# include <shadow.h>
Damien Miller2cb210f1999-11-13 15:40:10 +110027#endif
Damien Millerbeb4ba51999-12-28 15:09:35 +110028#if defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT)
29# include "md5crypt.h"
30#endif /* defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT) */
Damien Millerdd1c7ba1999-11-19 15:53:20 +110031
Damien Miller95def091999-11-25 00:26:21 +110032/*
33 * Tries to authenticate the user using password. Returns true if
34 * authentication succeeds.
35 */
Damien Miller4af51302000-04-16 11:18:38 +100036int
Damien Miller95def091999-11-25 00:26:21 +110037auth_password(struct passwd * pw, const char *password)
Damien Millerd4a8b7e1999-10-27 13:42:43 +100038{
Damien Miller95def091999-11-25 00:26:21 +110039 extern ServerOptions options;
40 char *encrypted_password;
Damien Miller2e1b0821999-12-25 10:11:29 +110041 char *pw_password;
42 char *salt;
Damien Miller2cb210f1999-11-13 15:40:10 +110043#ifdef HAVE_SHADOW_H
Damien Miller95def091999-11-25 00:26:21 +110044 struct spwd *spw;
Damien Miller2cb210f1999-11-13 15:40:10 +110045#endif
Damien Miller1fa154b2000-01-23 10:32:03 +110046#ifdef WITH_AIXAUTHENTICATE
47 char *authmsg;
48 char *loginmsg;
49 int reenter = 1;
50#endif
Damien Millerd4a8b7e1999-10-27 13:42:43 +100051
Damien Millerece22a81999-12-30 09:48:15 +110052 /* deny if no user. */
53 if (pw == NULL)
54 return 0;
Damien Miller5428f641999-11-25 11:54:57 +110055 if (pw->pw_uid == 0 && options.permit_root_login == 2)
Damien Miller95def091999-11-25 00:26:21 +110056 return 0;
Damien Miller5428f641999-11-25 11:54:57 +110057 if (*password == '\0' && options.permit_empty_passwd == 0)
Damien Miller95def091999-11-25 00:26:21 +110058 return 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100059
Damien Millerd4a8b7e1999-10-27 13:42:43 +100060#ifdef SKEY
Damien Miller95def091999-11-25 00:26:21 +110061 if (options.skey_authentication == 1) {
Damien Milleraae6c611999-12-06 11:47:28 +110062 int ret = auth_skey_password(pw, password);
63 if (ret == 1 || ret == 0)
64 return ret;
Damien Miller95def091999-11-25 00:26:21 +110065 /* Fall back to ordinary passwd authentication. */
66 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +100067#endif
Damien Miller1fa154b2000-01-23 10:32:03 +110068
69#ifdef WITH_AIXAUTHENTICATE
70 return (authenticate(pw->pw_name,password,&reenter,&authmsg) == 0);
71#endif
72
Damien Milleraae6c611999-12-06 11:47:28 +110073#ifdef KRB4
74 if (options.kerberos_authentication == 1) {
75 int ret = auth_krb4_password(pw, password);
76 if (ret == 1 || ret == 0)
77 return ret;
Damien Miller95def091999-11-25 00:26:21 +110078 /* Fall back to ordinary passwd authentication. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100079 }
Damien Milleraae6c611999-12-06 11:47:28 +110080#endif
Damien Miller95def091999-11-25 00:26:21 +110081
82 /* Check for users with no password. */
Damien Miller5428f641999-11-25 11:54:57 +110083 if (strcmp(password, "") == 0 && strcmp(pw->pw_passwd, "") == 0)
Damien Miller95def091999-11-25 00:26:21 +110084 return 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100085
Damien Miller2e1b0821999-12-25 10:11:29 +110086 pw_password = pw->pw_passwd;
87
Damien Millercb7e5f91999-12-21 21:03:09 +110088#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
Damien Miller95def091999-11-25 00:26:21 +110089 spw = getspnam(pw->pw_name);
Damien Miller8eb0fd61999-12-31 08:49:13 +110090 if (spw != NULL)
91 {
92 /* Check for users with no password. */
93 if (strcmp(password, "") == 0 && strcmp(spw->sp_pwdp, "") == 0)
94 return 1;
Damien Miller2cb210f1999-11-13 15:40:10 +110095
Damien Miller8eb0fd61999-12-31 08:49:13 +110096 pw_password = spw->sp_pwdp;
97 }
Damien Millercb7e5f91999-12-21 21:03:09 +110098#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
Damien Miller2e1b0821999-12-25 10:11:29 +110099
100 if (pw_password[0] != '\0')
101 salt = pw_password;
102 else
103 salt = "xx";
104
105#ifdef HAVE_MD5_PASSWORDS
106 if (is_md5_salt(salt))
107 encrypted_password = md5_crypt(password, salt);
108 else
109 encrypted_password = crypt(password, salt);
110#else /* HAVE_MD5_PASSWORDS */
111 encrypted_password = crypt(password, salt);
112#endif /* HAVE_MD5_PASSWORDS */
113
114 /* Authentication is accepted if the encrypted passwords are identical. */
115 return (strcmp(encrypted_password, pw_password) == 0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000116}
Damien Millerbeb4ba51999-12-28 15:09:35 +1100117#endif /* !USE_PAM */