blob: bc378a32b15a87ff652cc2f5c801a211662f2241 [file] [log] [blame]
Damien Miller4f9f42a2003-05-10 19:28:02 +10001/*-
2 * Copyright (c) 2002 Networks Associates Technology, Inc.
3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project by ThinkSec AS and
6 * NAI Labs, the Security Research Division of Network Associates, Inc.
7 * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
8 * DARPA CHATS research program.
Damien Millere69f18c2000-06-12 16:38:54 +10009 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
Damien Millere69f18c2000-06-12 16:38:54 +100018 *
Damien Miller4f9f42a2003-05-10 19:28:02 +100019 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
Damien Millere72b7af1999-12-30 15:08:44 +110030 */
31
Damien Miller25d93422003-05-18 20:45:47 +100032/* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
Damien Millere72b7af1999-12-30 15:08:44 +110033#include "includes.h"
Damien Miller341c6e62003-09-02 23:18:52 +100034RCSID("$Id: auth-pam.c,v 1.70 2003/09/02 13:18:53 djm Exp $");
Damien Millere72b7af1999-12-30 15:08:44 +110035
36#ifdef USE_PAM
Damien Miller4f9f42a2003-05-10 19:28:02 +100037#include <security/pam_appl.h>
38
Kevin Stevese683e762002-04-04 19:02:28 +000039#include "auth.h"
Damien Miller63dc3e92001-02-07 12:58:33 +110040#include "auth-pam.h"
Damien Miller4f9f42a2003-05-10 19:28:02 +100041#include "buffer.h"
42#include "bufaux.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000043#include "canohost.h"
Damien Miller4f9f42a2003-05-10 19:28:02 +100044#include "log.h"
45#include "monitor_wrap.h"
46#include "msg.h"
47#include "packet.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000048#include "readpass.h"
Damien Miller4f9f42a2003-05-10 19:28:02 +100049#include "servconf.h"
50#include "ssh2.h"
51#include "xmalloc.h"
Damien Miller1f499fd2003-08-25 13:08:49 +100052#include "auth-options.h"
Damien Millere72b7af1999-12-30 15:08:44 +110053
Damien Miller4e448a32003-05-14 15:11:48 +100054extern ServerOptions options;
55
Damien Miller4f9f42a2003-05-10 19:28:02 +100056#define __unused
Kevin Steves85ecbe72001-04-20 17:43:47 +000057
Damien Miller4f9f42a2003-05-10 19:28:02 +100058#ifdef USE_POSIX_THREADS
59#include <pthread.h>
60/*
61 * Avoid namespace clash when *not* using pthreads for systems *with*
62 * pthreads, which unconditionally define pthread_t via sys/types.h
63 * (e.g. Linux)
64 */
65typedef pthread_t sp_pthread_t;
66#else
67/*
68 * Simulate threads with processes.
69 */
70typedef pid_t sp_pthread_t;
Kevin Steves63007d42002-07-21 17:57:01 +000071
Damien Miller4f9f42a2003-05-10 19:28:02 +100072static void
73pthread_exit(void *value __unused)
74{
75 _exit(0);
76}
Damien Miller2f6a0ad2000-05-31 11:20:11 +100077
Damien Miller4f9f42a2003-05-10 19:28:02 +100078static int
79pthread_create(sp_pthread_t *thread, const void *attr __unused,
80 void *(*thread_start)(void *), void *arg)
81{
82 pid_t pid;
Damien Millere72b7af1999-12-30 15:08:44 +110083
Damien Miller4f9f42a2003-05-10 19:28:02 +100084 switch ((pid = fork())) {
85 case -1:
86 error("fork(): %s", strerror(errno));
87 return (-1);
88 case 0:
89 thread_start(arg);
90 _exit(1);
91 default:
92 *thread = pid;
93 return (0);
94 }
95}
Damien Millere72b7af1999-12-30 15:08:44 +110096
Damien Miller4f9f42a2003-05-10 19:28:02 +100097static int
98pthread_cancel(sp_pthread_t thread)
99{
100 return (kill(thread, SIGTERM));
101}
102
103static int
104pthread_join(sp_pthread_t thread, void **value __unused)
105{
106 int status;
107
108 waitpid(thread, &status, 0);
109 return (status);
110}
111#endif
112
113
114static pam_handle_t *sshpam_handle;
115static int sshpam_err;
116static int sshpam_authenticated;
117static int sshpam_new_authtok_reqd;
118static int sshpam_session_open;
119static int sshpam_cred_established;
120
121struct pam_ctxt {
122 sp_pthread_t pam_thread;
123 int pam_psock;
124 int pam_csock;
125 int pam_done;
Damien Millere72b7af1999-12-30 15:08:44 +1100126};
Damien Millere72b7af1999-12-30 15:08:44 +1100127
Damien Miller4f9f42a2003-05-10 19:28:02 +1000128static void sshpam_free_ctx(void *);
Damien Miller9d5705a2000-09-16 16:09:27 +1100129
130/*
Damien Miller4f9f42a2003-05-10 19:28:02 +1000131 * Conversation function for authentication thread.
Damien Miller9d5705a2000-09-16 16:09:27 +1100132 */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000133static int
Damien Miller1f499fd2003-08-25 13:08:49 +1000134sshpam_thread_conv(int n, const struct pam_message **msg,
135 struct pam_response **resp, void *data)
Damien Millere72b7af1999-12-30 15:08:44 +1100136{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000137 Buffer buffer;
138 struct pam_ctxt *ctxt;
Kevin Steves38b050a2002-07-23 00:44:07 +0000139 int i;
140
Damien Miller4f9f42a2003-05-10 19:28:02 +1000141 ctxt = data;
142 if (n <= 0 || n > PAM_MAX_NUM_MSG)
143 return (PAM_CONV_ERR);
144 *resp = xmalloc(n * sizeof **resp);
145 buffer_init(&buffer);
146 for (i = 0; i < n; ++i) {
147 resp[i]->resp_retcode = 0;
148 resp[i]->resp = NULL;
149 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
150 case PAM_PROMPT_ECHO_OFF:
151 buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
152 ssh_msg_send(ctxt->pam_csock,
153 PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
154 ssh_msg_recv(ctxt->pam_csock, &buffer);
155 if (buffer_get_char(&buffer) != PAM_AUTHTOK)
156 goto fail;
157 resp[i]->resp = buffer_get_string(&buffer, NULL);
158 break;
159 case PAM_PROMPT_ECHO_ON:
160 buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
161 ssh_msg_send(ctxt->pam_csock,
162 PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
163 ssh_msg_recv(ctxt->pam_csock, &buffer);
164 if (buffer_get_char(&buffer) != PAM_AUTHTOK)
165 goto fail;
166 resp[i]->resp = buffer_get_string(&buffer, NULL);
167 break;
168 case PAM_ERROR_MSG:
169 buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
170 ssh_msg_send(ctxt->pam_csock,
171 PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
172 break;
173 case PAM_TEXT_INFO:
174 buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
175 ssh_msg_send(ctxt->pam_csock,
176 PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
177 break;
178 default:
179 goto fail;
180 }
181 buffer_clear(&buffer);
Kevin Steves38b050a2002-07-23 00:44:07 +0000182 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000183 buffer_free(&buffer);
184 return (PAM_SUCCESS);
185 fail:
186 while (i)
187 xfree(resp[--i]);
188 xfree(*resp);
189 *resp = NULL;
190 buffer_free(&buffer);
191 return (PAM_CONV_ERR);
Kevin Steves38b050a2002-07-23 00:44:07 +0000192}
193
Damien Miller4f9f42a2003-05-10 19:28:02 +1000194/*
195 * Authentication thread.
196 */
197static void *
198sshpam_thread(void *ctxtp)
Damien Millere72b7af1999-12-30 15:08:44 +1100199{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000200 struct pam_ctxt *ctxt = ctxtp;
201 Buffer buffer;
Damien Millerf4b6f102003-09-02 23:12:06 +1000202 struct pam_conv sshpam_conv;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000203#ifndef USE_POSIX_THREADS
204 const char *pam_user;
205
206 pam_get_item(sshpam_handle, PAM_USER, (const void **)&pam_user);
207 setproctitle("%s [pam]", pam_user);
208#endif
209
Damien Millerf4b6f102003-09-02 23:12:06 +1000210 sshpam_conv.conv = sshpam_thread_conv;
211 sshpam_conv.appdata_ptr = ctxt;
212
Damien Miller4f9f42a2003-05-10 19:28:02 +1000213 buffer_init(&buffer);
214 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
215 (const void *)&sshpam_conv);
216 if (sshpam_err != PAM_SUCCESS)
217 goto auth_fail;
218 sshpam_err = pam_authenticate(sshpam_handle, 0);
219 if (sshpam_err != PAM_SUCCESS)
220 goto auth_fail;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000221 buffer_put_cstring(&buffer, "OK");
222 ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
223 buffer_free(&buffer);
224 pthread_exit(NULL);
225
226 auth_fail:
227 buffer_put_cstring(&buffer,
228 pam_strerror(sshpam_handle, sshpam_err));
229 ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
230 buffer_free(&buffer);
231 pthread_exit(NULL);
232
233 return (NULL); /* Avoid warning for non-pthread case */
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000234}
235
Damien Miller4f9f42a2003-05-10 19:28:02 +1000236static void
237sshpam_thread_cleanup(void *ctxtp)
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000238{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000239 struct pam_ctxt *ctxt = ctxtp;
Kevin Stevesef4eea92001-02-05 12:42:17 +0000240
Damien Miller4f9f42a2003-05-10 19:28:02 +1000241 pthread_cancel(ctxt->pam_thread);
242 pthread_join(ctxt->pam_thread, NULL);
243 close(ctxt->pam_psock);
244 close(ctxt->pam_csock);
245}
Kevin Stevesef4eea92001-02-05 12:42:17 +0000246
Damien Miller4f9f42a2003-05-10 19:28:02 +1000247static int
Damien Miller1f499fd2003-08-25 13:08:49 +1000248sshpam_null_conv(int n, const struct pam_message **msg,
249 struct pam_response **resp, void *data)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000250{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000251 return (PAM_CONV_ERR);
252}
Damien Miller63dc3e92001-02-07 12:58:33 +1100253
Damien Miller4f9f42a2003-05-10 19:28:02 +1000254static struct pam_conv null_conv = { sshpam_null_conv, NULL };
255
256static void
257sshpam_cleanup(void *arg)
258{
259 (void)arg;
260 debug("PAM: cleanup");
261 pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
262 if (sshpam_cred_established) {
263 pam_setcred(sshpam_handle, PAM_DELETE_CRED);
264 sshpam_cred_established = 0;
265 }
266 if (sshpam_session_open) {
267 pam_close_session(sshpam_handle, PAM_SILENT);
268 sshpam_session_open = 0;
269 }
270 sshpam_authenticated = sshpam_new_authtok_reqd = 0;
271 pam_end(sshpam_handle, sshpam_err);
272 sshpam_handle = NULL;
273}
274
275static int
276sshpam_init(const char *user)
277{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000278 extern u_int utmp_len;
279 const char *pam_rhost, *pam_user;
280
281 if (sshpam_handle != NULL) {
282 /* We already have a PAM context; check if the user matches */
283 sshpam_err = pam_get_item(sshpam_handle,
284 PAM_USER, (const void **)&pam_user);
285 if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0)
286 return (0);
287 fatal_remove_cleanup(sshpam_cleanup, NULL);
288 pam_end(sshpam_handle, sshpam_err);
289 sshpam_handle = NULL;
290 }
291 debug("PAM: initializing for \"%s\"", user);
292 sshpam_err = pam_start("sshd", user, &null_conv, &sshpam_handle);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000293 if (sshpam_err != PAM_SUCCESS) {
294 pam_end(sshpam_handle, sshpam_err);
295 sshpam_handle = NULL;
296 return (-1);
297 }
Damien Miller3a961dc2003-06-03 10:25:48 +1000298 pam_rhost = get_remote_name_or_ip(utmp_len, options.use_dns);
Damien Miller46337202003-06-02 11:04:39 +1000299 debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
Damien Miller25d93422003-05-18 20:45:47 +1000300 sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
301 if (sshpam_err != PAM_SUCCESS) {
Damien Miller1f499fd2003-08-25 13:08:49 +1000302 pam_end(sshpam_handle, sshpam_err);
Damien Miller25d93422003-05-18 20:45:47 +1000303 sshpam_handle = NULL;
304 return (-1);
305 }
306#ifdef PAM_TTY_KLUDGE
307 /*
308 * Some silly PAM modules (e.g. pam_time) require a TTY to operate.
309 * sshd doesn't set the tty until too late in the auth process and
310 * may not even set one (for tty-less connections)
311 */
312 debug("PAM: setting PAM_TTY to \"ssh\"");
313 sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, "ssh");
314 if (sshpam_err != PAM_SUCCESS) {
315 pam_end(sshpam_handle, sshpam_err);
316 sshpam_handle = NULL;
317 return (-1);
318 }
319#endif
Damien Miller4f9f42a2003-05-10 19:28:02 +1000320 fatal_add_cleanup(sshpam_cleanup, NULL);
321 return (0);
322}
323
324static void *
325sshpam_init_ctx(Authctxt *authctxt)
326{
327 struct pam_ctxt *ctxt;
328 int socks[2];
329
Damien Miller4e448a32003-05-14 15:11:48 +1000330 /* Refuse to start if we don't have PAM enabled */
331 if (!options.use_pam)
332 return NULL;
333
Damien Miller4f9f42a2003-05-10 19:28:02 +1000334 /* Initialize PAM */
335 if (sshpam_init(authctxt->user) == -1) {
336 error("PAM: initialization failed");
337 return (NULL);
338 }
339
340 ctxt = xmalloc(sizeof *ctxt);
341 ctxt->pam_done = 0;
342
343 /* Start the authentication thread */
344 if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
345 error("PAM: failed create sockets: %s", strerror(errno));
346 xfree(ctxt);
347 return (NULL);
348 }
349 ctxt->pam_psock = socks[0];
350 ctxt->pam_csock = socks[1];
351 if (pthread_create(&ctxt->pam_thread, NULL, sshpam_thread, ctxt) == -1) {
352 error("PAM: failed to start authentication thread: %s",
353 strerror(errno));
354 close(socks[0]);
355 close(socks[1]);
356 xfree(ctxt);
357 return (NULL);
358 }
359 fatal_add_cleanup(sshpam_thread_cleanup, ctxt);
360 return (ctxt);
361}
362
363static int
364sshpam_query(void *ctx, char **name, char **info,
365 u_int *num, char ***prompts, u_int **echo_on)
366{
367 Buffer buffer;
368 struct pam_ctxt *ctxt = ctx;
369 size_t plen;
370 u_char type;
371 char *msg;
Damien Miller7f2d7952003-07-30 14:53:11 +1000372 size_t len;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000373
374 buffer_init(&buffer);
375 *name = xstrdup("");
376 *info = xstrdup("");
377 *prompts = xmalloc(sizeof(char *));
378 **prompts = NULL;
379 plen = 0;
380 *echo_on = xmalloc(sizeof(u_int));
381 while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) {
382 type = buffer_get_char(&buffer);
383 msg = buffer_get_string(&buffer, NULL);
384 switch (type) {
385 case PAM_PROMPT_ECHO_ON:
386 case PAM_PROMPT_ECHO_OFF:
387 *num = 1;
Damien Miller7f2d7952003-07-30 14:53:11 +1000388 len = plen + strlen(msg) + 1;
389 **prompts = xrealloc(**prompts, len);
390 plen += snprintf(**prompts + plen, len, "%s", msg);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000391 **echo_on = (type == PAM_PROMPT_ECHO_ON);
392 xfree(msg);
393 return (0);
394 case PAM_ERROR_MSG:
395 case PAM_TEXT_INFO:
396 /* accumulate messages */
Damien Miller7f2d7952003-07-30 14:53:11 +1000397 len = plen + strlen(msg) + 1;
398 **prompts = xrealloc(**prompts, len);
399 plen += snprintf(**prompts + plen, len, "%s", msg);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000400 xfree(msg);
401 break;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000402 case PAM_SUCCESS:
403 case PAM_AUTH_ERR:
404 if (**prompts != NULL) {
405 /* drain any accumulated messages */
406#if 0 /* XXX - not compatible with privsep */
407 packet_start(SSH2_MSG_USERAUTH_BANNER);
408 packet_put_cstring(**prompts);
409 packet_put_cstring("");
410 packet_send();
411 packet_write_wait();
412#endif
413 xfree(**prompts);
414 **prompts = NULL;
415 }
416 if (type == PAM_SUCCESS) {
417 *num = 0;
418 **echo_on = 0;
419 ctxt->pam_done = 1;
420 xfree(msg);
421 return (0);
422 }
423 error("PAM: %s", msg);
424 default:
425 *num = 0;
426 **echo_on = 0;
427 xfree(msg);
428 ctxt->pam_done = -1;
429 return (-1);
430 }
431 }
432 return (-1);
433}
434
435/* XXX - see also comment in auth-chall.c:verify_response */
436static int
437sshpam_respond(void *ctx, u_int num, char **resp)
438{
439 Buffer buffer;
440 struct pam_ctxt *ctxt = ctx;
441
442 debug2("PAM: %s", __func__);
443 switch (ctxt->pam_done) {
444 case 1:
445 sshpam_authenticated = 1;
446 return (0);
447 case 0:
448 break;
449 default:
450 return (-1);
451 }
452 if (num != 1) {
453 error("PAM: expected one response, got %u", num);
454 return (-1);
455 }
456 buffer_init(&buffer);
457 buffer_put_cstring(&buffer, *resp);
458 ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer);
459 buffer_free(&buffer);
460 return (1);
461}
462
463static void
464sshpam_free_ctx(void *ctxtp)
465{
466 struct pam_ctxt *ctxt = ctxtp;
467
468 fatal_remove_cleanup(sshpam_thread_cleanup, ctxt);
469 sshpam_thread_cleanup(ctxtp);
470 xfree(ctxt);
471 /*
472 * We don't call sshpam_cleanup() here because we may need the PAM
473 * handle at a later stage, e.g. when setting up a session. It's
474 * still on the cleanup list, so pam_end() *will* be called before
475 * the server process terminates.
476 */
477}
478
479KbdintDevice sshpam_device = {
480 "pam",
481 sshpam_init_ctx,
482 sshpam_query,
483 sshpam_respond,
484 sshpam_free_ctx
485};
486
487KbdintDevice mm_sshpam_device = {
488 "pam",
489 mm_sshpam_init_ctx,
490 mm_sshpam_query,
491 mm_sshpam_respond,
492 mm_sshpam_free_ctx
493};
494
495/*
496 * This replaces auth-pam.c
497 */
498void
499start_pam(const char *user)
500{
Damien Miller9d507da2003-05-14 15:31:12 +1000501 if (!options.use_pam)
502 fatal("PAM: initialisation requested when UsePAM=no");
503
Damien Miller4f9f42a2003-05-10 19:28:02 +1000504 if (sshpam_init(user) == -1)
505 fatal("PAM: initialisation failed");
506}
507
508void
509finish_pam(void)
510{
511 fatal_remove_cleanup(sshpam_cleanup, NULL);
512 sshpam_cleanup(NULL);
513}
514
Damien Miller1f499fd2003-08-25 13:08:49 +1000515u_int
516do_pam_account(void)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000517{
Damien Miller1f499fd2003-08-25 13:08:49 +1000518 sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
519 debug3("%s: pam_acct_mgmt = %d", __func__, sshpam_err);
520
521 if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD)
522 return (0);
523
524 if (sshpam_err == PAM_NEW_AUTHTOK_REQD) {
525 sshpam_new_authtok_reqd = 1;
526
527 /* Prevent forwardings until password changed */
528 no_port_forwarding_flag |= 2;
529 no_agent_forwarding_flag |= 2;
530 no_x11_forwarding_flag |= 2;
531 }
532
Damien Miller4f9f42a2003-05-10 19:28:02 +1000533 return (1);
534}
535
536void
Damien Miller341c6e62003-09-02 23:18:52 +1000537do_pam_session(void)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000538{
539 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
540 (const void *)&null_conv);
541 if (sshpam_err != PAM_SUCCESS)
542 fatal("PAM: failed to set PAM_CONV: %s",
543 pam_strerror(sshpam_handle, sshpam_err));
Damien Miller341c6e62003-09-02 23:18:52 +1000544 sshpam_err = pam_open_session(sshpam_handle, 0);
545 if (sshpam_err != PAM_SUCCESS)
546 fatal("PAM: pam_open_session(): %s",
547 pam_strerror(sshpam_handle, sshpam_err));
548 sshpam_session_open = 1;
549}
550
551void
552do_pam_set_tty(const char *tty)
553{
Darren Tuckerf38db7f2003-08-08 13:43:37 +1000554 if (tty != NULL) {
555 debug("PAM: setting PAM_TTY to \"%s\"", tty);
556 sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, tty);
557 if (sshpam_err != PAM_SUCCESS)
558 fatal("PAM: failed to set PAM_TTY: %s",
559 pam_strerror(sshpam_handle, sshpam_err));
560 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000561}
562
563void
564do_pam_setcred(int init)
565{
566 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
567 (const void *)&null_conv);
568 if (sshpam_err != PAM_SUCCESS)
569 fatal("PAM: failed to set PAM_CONV: %s",
570 pam_strerror(sshpam_handle, sshpam_err));
571 if (init) {
572 debug("PAM: establishing credentials");
573 sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED);
574 } else {
575 debug("PAM: reinitializing credentials");
576 sshpam_err = pam_setcred(sshpam_handle, PAM_REINITIALIZE_CRED);
577 }
578 if (sshpam_err == PAM_SUCCESS) {
579 sshpam_cred_established = 1;
580 return;
581 }
582 if (sshpam_authenticated)
583 fatal("PAM: pam_setcred(): %s",
584 pam_strerror(sshpam_handle, sshpam_err));
585 else
586 debug("PAM: pam_setcred(): %s",
587 pam_strerror(sshpam_handle, sshpam_err));
588}
589
590int
591is_pam_password_change_required(void)
592{
593 return (sshpam_new_authtok_reqd);
594}
595
596static int
Damien Miller1f499fd2003-08-25 13:08:49 +1000597pam_chauthtok_conv(int n, const struct pam_message **msg,
598 struct pam_response **resp, void *data)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000599{
600 char input[PAM_MAX_MSG_SIZE];
601 int i;
602
603 if (n <= 0 || n > PAM_MAX_NUM_MSG)
604 return (PAM_CONV_ERR);
605 *resp = xmalloc(n * sizeof **resp);
606 for (i = 0; i < n; ++i) {
607 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
608 case PAM_PROMPT_ECHO_OFF:
609 resp[i]->resp =
610 read_passphrase(PAM_MSG_MEMBER(msg, i, msg),
611 RP_ALLOW_STDIN);
612 resp[i]->resp_retcode = PAM_SUCCESS;
613 break;
614 case PAM_PROMPT_ECHO_ON:
615 fputs(PAM_MSG_MEMBER(msg, i, msg), stderr);
616 fgets(input, sizeof input, stdin);
617 resp[i]->resp = xstrdup(input);
618 resp[i]->resp_retcode = PAM_SUCCESS;
619 break;
620 case PAM_ERROR_MSG:
621 case PAM_TEXT_INFO:
622 fputs(PAM_MSG_MEMBER(msg, i, msg), stderr);
623 resp[i]->resp_retcode = PAM_SUCCESS;
624 break;
625 default:
626 goto fail;
627 }
628 }
629 return (PAM_SUCCESS);
630 fail:
631 while (i)
632 xfree(resp[--i]);
633 xfree(*resp);
634 *resp = NULL;
635 return (PAM_CONV_ERR);
636}
637
638/*
639 * XXX this should be done in the authentication phase, but ssh1 doesn't
640 * support that
641 */
642void
643do_pam_chauthtok(void)
644{
Damien Millerf4b6f102003-09-02 23:12:06 +1000645 struct pam_conv pam_conv;
646
647 pam_conv.conv = pam_chauthtok_conv;
648 pam_conv.appdata_ptr = NULL;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000649
650 if (use_privsep)
Damien Miller1f499fd2003-08-25 13:08:49 +1000651 fatal("Password expired (unable to change with privsep)");
Damien Miller4f9f42a2003-05-10 19:28:02 +1000652 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
653 (const void *)&pam_conv);
654 if (sshpam_err != PAM_SUCCESS)
655 fatal("PAM: failed to set PAM_CONV: %s",
656 pam_strerror(sshpam_handle, sshpam_err));
657 debug("PAM: changing password");
658 sshpam_err = pam_chauthtok(sshpam_handle, PAM_CHANGE_EXPIRED_AUTHTOK);
659 if (sshpam_err != PAM_SUCCESS)
660 fatal("PAM: pam_chauthtok(): %s",
661 pam_strerror(sshpam_handle, sshpam_err));
662}
663
Darren Tucker49aaf4a2003-08-26 11:58:16 +1000664/*
665 * Set a PAM environment string. We need to do this so that the session
666 * modules can handle things like Kerberos/GSI credentials that appear
667 * during the ssh authentication process.
668 */
669
670int
671do_pam_putenv(char *name, char *value)
672{
673 char *compound;
674 int ret = 1;
675
676#ifdef HAVE_PAM_PUTENV
677 compound = xmalloc(strlen(name)+strlen(value)+2);
678 if (compound) {
679 sprintf(compound,"%s=%s",name,value);
680 ret = pam_putenv(sshpam_handle,compound);
681 xfree(compound);
682 }
683#endif
684 return (ret);
685}
686
Damien Miller4f9f42a2003-05-10 19:28:02 +1000687void
688print_pam_messages(void)
689{
690 /* XXX */
691}
692
693char **
694fetch_pam_environment(void)
695{
696#ifdef HAVE_PAM_GETENVLIST
697 debug("PAM: retrieving environment");
698 return (pam_getenvlist(sshpam_handle));
699#else
700 return (NULL);
701#endif
702}
703
704void
705free_pam_environment(char **env)
706{
707 char **envp;
708
Damien Millere27c6cc2003-05-16 18:21:01 +1000709 if (env == NULL)
710 return;
711
Damien Miller4f9f42a2003-05-10 19:28:02 +1000712 for (envp = env; *envp; envp++)
713 xfree(*envp);
714 xfree(env);
Damien Millere72b7af1999-12-30 15:08:44 +1100715}
716
717#endif /* USE_PAM */