blob: cb8754ec7d95653fb9050215dc764443ea00b836 [file] [log] [blame]
Damien Miller4f9f42a2003-05-10 19:28:02 +10001/*-
2 * Copyright (c) 2002 Networks Associates Technology, Inc.
3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project by ThinkSec AS and
6 * NAI Labs, the Security Research Division of Network Associates, Inc.
7 * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
8 * DARPA CHATS research program.
Damien Millere69f18c2000-06-12 16:38:54 +10009 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
Damien Millere69f18c2000-06-12 16:38:54 +100018 *
Damien Miller4f9f42a2003-05-10 19:28:02 +100019 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
Damien Millere72b7af1999-12-30 15:08:44 +110030 */
Damien Miller26314f62004-06-01 11:28:20 +100031/*
32 * Copyright (c) 2003,2004 Damien Miller <djm@mindrot.org>
33 * Copyright (c) 2003,2004 Darren Tucker <dtucker@zip.com.au>
34 *
35 * Permission to use, copy, modify, and distribute this software for any
36 * purpose with or without fee is hereby granted, provided that the above
37 * copyright notice and this permission notice appear in all copies.
38 *
39 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
40 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
41 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
42 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
43 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
44 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
45 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
46 */
Damien Millere72b7af1999-12-30 15:08:44 +110047
Damien Miller25d93422003-05-18 20:45:47 +100048/* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
Damien Millere72b7af1999-12-30 15:08:44 +110049#include "includes.h"
Damien Miller6645e7a2006-03-15 14:42:54 +110050
51#include <sys/types.h>
52#include <sys/stat.h>
53#include <sys/wait.h>
Darren Tucker341dae52006-07-13 08:45:14 +100054
55#include <errno.h>
Damien Miller6645e7a2006-03-15 14:42:54 +110056#include <signal.h>
Damien Millere72b7af1999-12-30 15:08:44 +110057
58#ifdef USE_PAM
Damien Miller0f47c532004-01-02 18:01:30 +110059#if defined(HAVE_SECURITY_PAM_APPL_H)
Damien Miller4f9f42a2003-05-10 19:28:02 +100060#include <security/pam_appl.h>
Damien Miller0f47c532004-01-02 18:01:30 +110061#elif defined (HAVE_PAM_PAM_APPL_H)
62#include <pam/pam_appl.h>
63#endif
Damien Miller4f9f42a2003-05-10 19:28:02 +100064
Darren Tuckerf08bdb52005-05-26 19:59:48 +100065/* OpenGroup RFC86.0 and XSSO specify no "const" on arguments */
66#ifdef PAM_SUN_CODEBASE
67# define sshpam_const /* Solaris, HP-UX, AIX */
68#else
69# define sshpam_const const /* LinuxPAM, OpenPAM */
70#endif
71
Kevin Stevese683e762002-04-04 19:02:28 +000072#include "auth.h"
Damien Miller63dc3e92001-02-07 12:58:33 +110073#include "auth-pam.h"
Damien Miller4f9f42a2003-05-10 19:28:02 +100074#include "buffer.h"
75#include "bufaux.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000076#include "canohost.h"
Damien Miller4f9f42a2003-05-10 19:28:02 +100077#include "log.h"
78#include "monitor_wrap.h"
79#include "msg.h"
80#include "packet.h"
Darren Tuckerb6db1722004-05-13 17:29:35 +100081#include "misc.h"
Damien Miller4f9f42a2003-05-10 19:28:02 +100082#include "servconf.h"
83#include "ssh2.h"
84#include "xmalloc.h"
Damien Miller1f499fd2003-08-25 13:08:49 +100085#include "auth-options.h"
Damien Millere72b7af1999-12-30 15:08:44 +110086
Damien Miller4e448a32003-05-14 15:11:48 +100087extern ServerOptions options;
Darren Tucker18df00c2003-11-18 12:42:07 +110088extern Buffer loginmsg;
Darren Tucker07705c72003-12-18 15:34:31 +110089extern int compat20;
Darren Tucker2a9bf4b2004-04-18 11:00:26 +100090extern u_int utmp_len;
Damien Miller4e448a32003-05-14 15:11:48 +100091
Darren Tucker328118a2005-05-25 16:18:09 +100092/* so we don't silently change behaviour */
Damien Miller4f9f42a2003-05-10 19:28:02 +100093#ifdef USE_POSIX_THREADS
Darren Tucker328118a2005-05-25 16:18:09 +100094# error "USE_POSIX_THREADS replaced by UNSUPPORTED_POSIX_THREADS_HACK"
95#endif
96
97/*
98 * Formerly known as USE_POSIX_THREADS, using this is completely unsupported
99 * and generally a bad idea. Use at own risk and do not expect support if
100 * this breaks.
101 */
102#ifdef UNSUPPORTED_POSIX_THREADS_HACK
Damien Miller4f9f42a2003-05-10 19:28:02 +1000103#include <pthread.h>
104/*
Damien Millera8e06ce2003-11-21 23:48:55 +1100105 * Avoid namespace clash when *not* using pthreads for systems *with*
106 * pthreads, which unconditionally define pthread_t via sys/types.h
Damien Miller4f9f42a2003-05-10 19:28:02 +1000107 * (e.g. Linux)
108 */
Damien Millera8e06ce2003-11-21 23:48:55 +1100109typedef pthread_t sp_pthread_t;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000110#else
Darren Tucker1b27c8f2004-01-13 22:35:58 +1100111typedef pid_t sp_pthread_t;
112#endif
113
114struct pam_ctxt {
115 sp_pthread_t pam_thread;
116 int pam_psock;
117 int pam_csock;
118 int pam_done;
119};
120
121static void sshpam_free_ctx(void *);
122static struct pam_ctxt *cleanup_ctxt;
123
Darren Tucker328118a2005-05-25 16:18:09 +1000124#ifndef UNSUPPORTED_POSIX_THREADS_HACK
Damien Miller4f9f42a2003-05-10 19:28:02 +1000125/*
126 * Simulate threads with processes.
127 */
Kevin Steves63007d42002-07-21 17:57:01 +0000128
Darren Tucker749bc952004-01-14 22:14:04 +1100129static int sshpam_thread_status = -1;
130static mysig_t sshpam_oldsig;
131
Damien Miller94cf4c82005-07-17 17:04:47 +1000132static void
Darren Tucker749bc952004-01-14 22:14:04 +1100133sshpam_sigchld_handler(int sig)
134{
Darren Tuckerb53355e2004-05-24 11:55:36 +1000135 signal(SIGCHLD, SIG_DFL);
Darren Tucker7ae09622004-01-14 23:07:56 +1100136 if (cleanup_ctxt == NULL)
137 return; /* handler called after PAM cleanup, shouldn't happen */
Darren Tuckerb53355e2004-05-24 11:55:36 +1000138 if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG)
Damien Miller37294fb2005-07-17 17:18:49 +1000139 <= 0) {
Darren Tuckerb53355e2004-05-24 11:55:36 +1000140 /* PAM thread has not exitted, privsep slave must have */
141 kill(cleanup_ctxt->pam_thread, SIGTERM);
142 if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0)
Darren Tucker5d423f42004-07-11 16:54:08 +1000143 <= 0)
Darren Tuckerb53355e2004-05-24 11:55:36 +1000144 return; /* could not wait */
145 }
Darren Tucker749bc952004-01-14 22:14:04 +1100146 if (WIFSIGNALED(sshpam_thread_status) &&
147 WTERMSIG(sshpam_thread_status) == SIGTERM)
148 return; /* terminated by pthread_cancel */
149 if (!WIFEXITED(sshpam_thread_status))
150 fatal("PAM: authentication thread exited unexpectedly");
151 if (WEXITSTATUS(sshpam_thread_status) != 0)
152 fatal("PAM: authentication thread exited uncleanly");
153}
154
Damien Miller4f9f42a2003-05-10 19:28:02 +1000155static void
156pthread_exit(void *value __unused)
157{
158 _exit(0);
159}
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000160
Damien Miller4f9f42a2003-05-10 19:28:02 +1000161static int
162pthread_create(sp_pthread_t *thread, const void *attr __unused,
163 void *(*thread_start)(void *), void *arg)
164{
165 pid_t pid;
Darren Tucker4f1adad2005-07-16 11:33:06 +1000166 struct pam_ctxt *ctx = arg;
Damien Millere72b7af1999-12-30 15:08:44 +1100167
Darren Tuckerb9b60212004-03-04 20:03:54 +1100168 sshpam_thread_status = -1;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000169 switch ((pid = fork())) {
170 case -1:
171 error("fork(): %s", strerror(errno));
172 return (-1);
173 case 0:
Darren Tucker4f1adad2005-07-16 11:33:06 +1000174 close(ctx->pam_psock);
175 ctx->pam_psock = -1;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000176 thread_start(arg);
177 _exit(1);
178 default:
179 *thread = pid;
Darren Tucker4f1adad2005-07-16 11:33:06 +1000180 close(ctx->pam_csock);
181 ctx->pam_csock = -1;
Darren Tucker749bc952004-01-14 22:14:04 +1100182 sshpam_oldsig = signal(SIGCHLD, sshpam_sigchld_handler);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000183 return (0);
184 }
185}
Damien Millere72b7af1999-12-30 15:08:44 +1100186
Damien Miller4f9f42a2003-05-10 19:28:02 +1000187static int
188pthread_cancel(sp_pthread_t thread)
189{
Darren Tucker7ae09622004-01-14 23:07:56 +1100190 signal(SIGCHLD, sshpam_oldsig);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000191 return (kill(thread, SIGTERM));
192}
193
194static int
195pthread_join(sp_pthread_t thread, void **value __unused)
196{
197 int status;
198
Darren Tucker749bc952004-01-14 22:14:04 +1100199 if (sshpam_thread_status != -1)
200 return (sshpam_thread_status);
201 signal(SIGCHLD, sshpam_oldsig);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000202 waitpid(thread, &status, 0);
203 return (status);
204}
205#endif
206
207
Damien Miller5c3a5582003-09-23 22:12:38 +1000208static pam_handle_t *sshpam_handle = NULL;
209static int sshpam_err = 0;
210static int sshpam_authenticated = 0;
Damien Miller5c3a5582003-09-23 22:12:38 +1000211static int sshpam_session_open = 0;
212static int sshpam_cred_established = 0;
Darren Tucker07705c72003-12-18 15:34:31 +1100213static int sshpam_account_status = -1;
Damien Millerc756e9b2003-11-17 21:41:42 +1100214static char **sshpam_env = NULL;
Darren Tucker17addf02004-03-30 20:57:57 +1000215static Authctxt *sshpam_authctxt = NULL;
Darren Tucker450a1582004-05-30 20:43:59 +1000216static const char *sshpam_password = NULL;
Darren Tucker36a3d602005-01-20 12:43:38 +1100217static char badpw[] = "\b\n\r\177INCORRECT";
Damien Miller4f9f42a2003-05-10 19:28:02 +1000218
Damien Millerc756e9b2003-11-17 21:41:42 +1100219/* Some PAM implementations don't implement this */
220#ifndef HAVE_PAM_GETENVLIST
221static char **
222pam_getenvlist(pam_handle_t *pamh)
223{
224 /*
Damien Millera8e06ce2003-11-21 23:48:55 +1100225 * XXX - If necessary, we can still support envrionment passing
Damien Millerc756e9b2003-11-17 21:41:42 +1100226 * for platforms without pam_getenvlist by searching for known
227 * env vars (e.g. KRB5CCNAME) from the PAM environment.
228 */
229 return NULL;
230}
231#endif
232
Darren Tucker21dd0892004-08-16 23:12:05 +1000233/*
234 * Some platforms, notably Solaris, do not enforce password complexity
235 * rules during pam_chauthtok() if the real uid of the calling process
236 * is 0, on the assumption that it's being called by "passwd" run by root.
237 * This wraps pam_chauthtok and sets/restore the real uid so PAM will do
238 * the right thing.
239 */
240#ifdef SSHPAM_CHAUTHTOK_NEEDS_RUID
241static int
242sshpam_chauthtok_ruid(pam_handle_t *pamh, int flags)
243{
244 int result;
245
246 if (sshpam_authctxt == NULL)
247 fatal("PAM: sshpam_authctxt not initialized");
248 if (setreuid(sshpam_authctxt->pw->pw_uid, -1) == -1)
249 fatal("%s: setreuid failed: %s", __func__, strerror(errno));
250 result = pam_chauthtok(pamh, flags);
251 if (setreuid(0, -1) == -1)
252 fatal("%s: setreuid failed: %s", __func__, strerror(errno));
253 return result;
254}
255# define pam_chauthtok(a,b) (sshpam_chauthtok_ruid((a), (b)))
256#endif
257
Darren Tucker07705c72003-12-18 15:34:31 +1100258void
Darren Tucker17db1c42004-06-19 12:54:38 +1000259sshpam_password_change_required(int reqd)
Darren Tucker07705c72003-12-18 15:34:31 +1100260{
Darren Tuckera8df9242004-01-15 00:15:07 +1100261 debug3("%s %d", __func__, reqd);
Darren Tucker17addf02004-03-30 20:57:57 +1000262 if (sshpam_authctxt == NULL)
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100263 fatal("%s: PAM authctxt not initialized", __func__);
Darren Tucker17addf02004-03-30 20:57:57 +1000264 sshpam_authctxt->force_pwchange = reqd;
Darren Tucker07705c72003-12-18 15:34:31 +1100265 if (reqd) {
266 no_port_forwarding_flag |= 2;
267 no_agent_forwarding_flag |= 2;
268 no_x11_forwarding_flag |= 2;
269 } else {
270 no_port_forwarding_flag &= ~2;
271 no_agent_forwarding_flag &= ~2;
272 no_x11_forwarding_flag &= ~2;
Darren Tucker07705c72003-12-18 15:34:31 +1100273 }
274}
Darren Tucker1921ed92004-02-10 13:23:28 +1100275
Damien Millerc756e9b2003-11-17 21:41:42 +1100276/* Import regular and PAM environment from subprocess */
277static void
278import_environments(Buffer *b)
279{
280 char *env;
281 u_int i, num_env;
282 int err;
283
Darren Tuckera8df9242004-01-15 00:15:07 +1100284 debug3("PAM: %s entering", __func__);
285
Darren Tucker328118a2005-05-25 16:18:09 +1000286#ifndef UNSUPPORTED_POSIX_THREADS_HACK
Darren Tucker07705c72003-12-18 15:34:31 +1100287 /* Import variables set by do_pam_account */
288 sshpam_account_status = buffer_get_int(b);
Darren Tucker17db1c42004-06-19 12:54:38 +1000289 sshpam_password_change_required(buffer_get_int(b));
Darren Tucker07705c72003-12-18 15:34:31 +1100290
Damien Millerc756e9b2003-11-17 21:41:42 +1100291 /* Import environment from subprocess */
292 num_env = buffer_get_int(b);
Darren Tuckerd8093e42006-05-04 16:24:34 +1000293 if (num_env > 1024)
294 fatal("%s: received %u environment variables, expected <= 1024",
295 __func__, num_env);
296 sshpam_env = xcalloc(num_env + 1, sizeof(*sshpam_env));
Damien Millerc756e9b2003-11-17 21:41:42 +1100297 debug3("PAM: num env strings %d", num_env);
298 for(i = 0; i < num_env; i++)
299 sshpam_env[i] = buffer_get_string(b, NULL);
300
301 sshpam_env[num_env] = NULL;
302
303 /* Import PAM environment from subprocess */
304 num_env = buffer_get_int(b);
305 debug("PAM: num PAM env strings %d", num_env);
306 for(i = 0; i < num_env; i++) {
307 env = buffer_get_string(b, NULL);
308
Darren Tucker8a1624c2003-11-18 12:45:35 +1100309#ifdef HAVE_PAM_PUTENV
Damien Millerc756e9b2003-11-17 21:41:42 +1100310 /* Errors are not fatal here */
311 if ((err = pam_putenv(sshpam_handle, env)) != PAM_SUCCESS) {
312 error("PAM: pam_putenv: %s",
313 pam_strerror(sshpam_handle, sshpam_err));
314 }
Darren Tucker8a1624c2003-11-18 12:45:35 +1100315#endif
Damien Millerc756e9b2003-11-17 21:41:42 +1100316 }
Darren Tucker4b385d42004-03-04 19:54:10 +1100317#endif
Damien Millerc756e9b2003-11-17 21:41:42 +1100318}
319
Damien Miller9d5705a2000-09-16 16:09:27 +1100320/*
Damien Miller4f9f42a2003-05-10 19:28:02 +1000321 * Conversation function for authentication thread.
Damien Miller9d5705a2000-09-16 16:09:27 +1100322 */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000323static int
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000324sshpam_thread_conv(int n, sshpam_const struct pam_message **msg,
Damien Miller1f499fd2003-08-25 13:08:49 +1000325 struct pam_response **resp, void *data)
Damien Millere72b7af1999-12-30 15:08:44 +1100326{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000327 Buffer buffer;
328 struct pam_ctxt *ctxt;
Damien Miller5c3a5582003-09-23 22:12:38 +1000329 struct pam_response *reply;
Kevin Steves38b050a2002-07-23 00:44:07 +0000330 int i;
331
Darren Tuckerba53b832004-02-17 20:46:59 +1100332 debug3("PAM: %s entering, %d messages", __func__, n);
Damien Miller5c3a5582003-09-23 22:12:38 +1000333 *resp = NULL;
334
Darren Tucker59e06022004-06-30 20:34:31 +1000335 if (data == NULL) {
336 error("PAM: conversation function passed a null context");
337 return (PAM_CONV_ERR);
338 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000339 ctxt = data;
340 if (n <= 0 || n > PAM_MAX_NUM_MSG)
341 return (PAM_CONV_ERR);
Damien Miller5c3a5582003-09-23 22:12:38 +1000342
Darren Tuckerd8093e42006-05-04 16:24:34 +1000343 if ((reply = calloc(n, sizeof(*reply))) == NULL)
Damien Miller5c3a5582003-09-23 22:12:38 +1000344 return (PAM_CONV_ERR);
Damien Miller5c3a5582003-09-23 22:12:38 +1000345
Damien Miller4f9f42a2003-05-10 19:28:02 +1000346 buffer_init(&buffer);
347 for (i = 0; i < n; ++i) {
Damien Miller4f9f42a2003-05-10 19:28:02 +1000348 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
349 case PAM_PROMPT_ECHO_OFF:
Damien Millera8e06ce2003-11-21 23:48:55 +1100350 buffer_put_cstring(&buffer,
Damien Miller5c3a5582003-09-23 22:12:38 +1000351 PAM_MSG_MEMBER(msg, i, msg));
Damien Millera8e06ce2003-11-21 23:48:55 +1100352 if (ssh_msg_send(ctxt->pam_csock,
Damien Miller9bdba702003-11-17 21:27:55 +1100353 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
354 goto fail;
Damien Millera8e06ce2003-11-21 23:48:55 +1100355 if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
Damien Miller9bdba702003-11-17 21:27:55 +1100356 goto fail;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000357 if (buffer_get_char(&buffer) != PAM_AUTHTOK)
358 goto fail;
Damien Miller5c3a5582003-09-23 22:12:38 +1000359 reply[i].resp = buffer_get_string(&buffer, NULL);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000360 break;
361 case PAM_PROMPT_ECHO_ON:
Damien Millera8e06ce2003-11-21 23:48:55 +1100362 buffer_put_cstring(&buffer,
Damien Miller5c3a5582003-09-23 22:12:38 +1000363 PAM_MSG_MEMBER(msg, i, msg));
Damien Millera8e06ce2003-11-21 23:48:55 +1100364 if (ssh_msg_send(ctxt->pam_csock,
Damien Miller9bdba702003-11-17 21:27:55 +1100365 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
366 goto fail;
367 if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
368 goto fail;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000369 if (buffer_get_char(&buffer) != PAM_AUTHTOK)
370 goto fail;
Damien Miller5c3a5582003-09-23 22:12:38 +1000371 reply[i].resp = buffer_get_string(&buffer, NULL);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000372 break;
373 case PAM_ERROR_MSG:
Damien Millera8e06ce2003-11-21 23:48:55 +1100374 buffer_put_cstring(&buffer,
Damien Miller5c3a5582003-09-23 22:12:38 +1000375 PAM_MSG_MEMBER(msg, i, msg));
Damien Millera8e06ce2003-11-21 23:48:55 +1100376 if (ssh_msg_send(ctxt->pam_csock,
Damien Miller9bdba702003-11-17 21:27:55 +1100377 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
378 goto fail;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000379 break;
380 case PAM_TEXT_INFO:
Damien Millera8e06ce2003-11-21 23:48:55 +1100381 buffer_put_cstring(&buffer,
Damien Miller5c3a5582003-09-23 22:12:38 +1000382 PAM_MSG_MEMBER(msg, i, msg));
Damien Millera8e06ce2003-11-21 23:48:55 +1100383 if (ssh_msg_send(ctxt->pam_csock,
Damien Miller9bdba702003-11-17 21:27:55 +1100384 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
385 goto fail;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000386 break;
387 default:
388 goto fail;
389 }
390 buffer_clear(&buffer);
Kevin Steves38b050a2002-07-23 00:44:07 +0000391 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000392 buffer_free(&buffer);
Damien Miller5c3a5582003-09-23 22:12:38 +1000393 *resp = reply;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000394 return (PAM_SUCCESS);
Damien Miller5c3a5582003-09-23 22:12:38 +1000395
Damien Miller4f9f42a2003-05-10 19:28:02 +1000396 fail:
Damien Miller5c3a5582003-09-23 22:12:38 +1000397 for(i = 0; i < n; i++) {
398 if (reply[i].resp != NULL)
399 xfree(reply[i].resp);
400 }
401 xfree(reply);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000402 buffer_free(&buffer);
403 return (PAM_CONV_ERR);
Kevin Steves38b050a2002-07-23 00:44:07 +0000404}
405
Damien Miller4f9f42a2003-05-10 19:28:02 +1000406/*
407 * Authentication thread.
408 */
409static void *
410sshpam_thread(void *ctxtp)
Damien Millere72b7af1999-12-30 15:08:44 +1100411{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000412 struct pam_ctxt *ctxt = ctxtp;
413 Buffer buffer;
Damien Millerf4b6f102003-09-02 23:12:06 +1000414 struct pam_conv sshpam_conv;
Darren Tucker1f7e4082004-07-01 14:00:14 +1000415 int flags = (options.permit_empty_passwd == 0 ?
416 PAM_DISALLOW_NULL_AUTHTOK : 0);
Darren Tucker328118a2005-05-25 16:18:09 +1000417#ifndef UNSUPPORTED_POSIX_THREADS_HACK
Damien Millerc756e9b2003-11-17 21:41:42 +1100418 extern char **environ;
419 char **env_from_pam;
420 u_int i;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000421 const char *pam_user;
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000422 const char **ptr_pam_user = &pam_user;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000423
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000424 pam_get_item(sshpam_handle, PAM_USER,
425 (sshpam_const void **)ptr_pam_user);
Damien Millerc756e9b2003-11-17 21:41:42 +1100426 environ[0] = NULL;
Damien Miller2d2ed3d2004-07-21 20:54:47 +1000427
428 if (sshpam_authctxt != NULL) {
429 setproctitle("%s [pam]",
430 sshpam_authctxt->valid ? pam_user : "unknown");
431 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000432#endif
433
Damien Millerf4b6f102003-09-02 23:12:06 +1000434 sshpam_conv.conv = sshpam_thread_conv;
435 sshpam_conv.appdata_ptr = ctxt;
436
Darren Tucker17addf02004-03-30 20:57:57 +1000437 if (sshpam_authctxt == NULL)
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100438 fatal("%s: PAM authctxt not initialized", __func__);
439
Damien Miller4f9f42a2003-05-10 19:28:02 +1000440 buffer_init(&buffer);
441 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
442 (const void *)&sshpam_conv);
443 if (sshpam_err != PAM_SUCCESS)
444 goto auth_fail;
Darren Tucker1f7e4082004-07-01 14:00:14 +1000445 sshpam_err = pam_authenticate(sshpam_handle, flags);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000446 if (sshpam_err != PAM_SUCCESS)
447 goto auth_fail;
Darren Tucker07705c72003-12-18 15:34:31 +1100448
Darren Tuckerc376c862003-12-18 16:08:59 +1100449 if (compat20) {
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000450 if (!do_pam_account()) {
451 sshpam_err = PAM_ACCT_EXPIRED;
Darren Tucker07705c72003-12-18 15:34:31 +1100452 goto auth_fail;
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000453 }
Darren Tucker17addf02004-03-30 20:57:57 +1000454 if (sshpam_authctxt->force_pwchange) {
Darren Tucker07705c72003-12-18 15:34:31 +1100455 sshpam_err = pam_chauthtok(sshpam_handle,
456 PAM_CHANGE_EXPIRED_AUTHTOK);
457 if (sshpam_err != PAM_SUCCESS)
458 goto auth_fail;
Darren Tucker17db1c42004-06-19 12:54:38 +1000459 sshpam_password_change_required(0);
Darren Tucker07705c72003-12-18 15:34:31 +1100460 }
Darren Tuckerc376c862003-12-18 16:08:59 +1100461 }
Darren Tucker07705c72003-12-18 15:34:31 +1100462
Damien Miller4f9f42a2003-05-10 19:28:02 +1000463 buffer_put_cstring(&buffer, "OK");
Damien Millerc756e9b2003-11-17 21:41:42 +1100464
Darren Tucker328118a2005-05-25 16:18:09 +1000465#ifndef UNSUPPORTED_POSIX_THREADS_HACK
Darren Tucker07705c72003-12-18 15:34:31 +1100466 /* Export variables set by do_pam_account */
467 buffer_put_int(&buffer, sshpam_account_status);
Darren Tucker17addf02004-03-30 20:57:57 +1000468 buffer_put_int(&buffer, sshpam_authctxt->force_pwchange);
Darren Tucker07705c72003-12-18 15:34:31 +1100469
Damien Millerc756e9b2003-11-17 21:41:42 +1100470 /* Export any environment strings set in child */
471 for(i = 0; environ[i] != NULL; i++)
472 ; /* Count */
473 buffer_put_int(&buffer, i);
474 for(i = 0; environ[i] != NULL; i++)
475 buffer_put_cstring(&buffer, environ[i]);
476
477 /* Export any environment strings set by PAM in child */
478 env_from_pam = pam_getenvlist(sshpam_handle);
479 for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
480 ; /* Count */
481 buffer_put_int(&buffer, i);
482 for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
483 buffer_put_cstring(&buffer, env_from_pam[i]);
Darren Tucker328118a2005-05-25 16:18:09 +1000484#endif /* UNSUPPORTED_POSIX_THREADS_HACK */
Damien Millerc756e9b2003-11-17 21:41:42 +1100485
Damien Miller9bdba702003-11-17 21:27:55 +1100486 /* XXX - can't do much about an error here */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000487 ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
488 buffer_free(&buffer);
489 pthread_exit(NULL);
490
491 auth_fail:
492 buffer_put_cstring(&buffer,
493 pam_strerror(sshpam_handle, sshpam_err));
Damien Miller9bdba702003-11-17 21:27:55 +1100494 /* XXX - can't do much about an error here */
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000495 if (sshpam_err == PAM_ACCT_EXPIRED)
496 ssh_msg_send(ctxt->pam_csock, PAM_ACCT_EXPIRED, &buffer);
497 else
498 ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000499 buffer_free(&buffer);
500 pthread_exit(NULL);
Damien Miller787b2ec2003-11-21 23:56:47 +1100501
Damien Miller4f9f42a2003-05-10 19:28:02 +1000502 return (NULL); /* Avoid warning for non-pthread case */
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000503}
504
Darren Tucker8846a072003-10-07 11:30:15 +1000505void
506sshpam_thread_cleanup(void)
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000507{
Darren Tucker8846a072003-10-07 11:30:15 +1000508 struct pam_ctxt *ctxt = cleanup_ctxt;
Kevin Stevesef4eea92001-02-05 12:42:17 +0000509
Darren Tuckera8df9242004-01-15 00:15:07 +1100510 debug3("PAM: %s entering", __func__);
Darren Tucker8846a072003-10-07 11:30:15 +1000511 if (ctxt != NULL && ctxt->pam_thread != 0) {
512 pthread_cancel(ctxt->pam_thread);
513 pthread_join(ctxt->pam_thread, NULL);
514 close(ctxt->pam_psock);
515 close(ctxt->pam_csock);
516 memset(ctxt, 0, sizeof(*ctxt));
517 cleanup_ctxt = NULL;
518 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000519}
Kevin Stevesef4eea92001-02-05 12:42:17 +0000520
Damien Miller4f9f42a2003-05-10 19:28:02 +1000521static int
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000522sshpam_null_conv(int n, sshpam_const struct pam_message **msg,
Damien Miller1f499fd2003-08-25 13:08:49 +1000523 struct pam_response **resp, void *data)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000524{
Darren Tuckerba53b832004-02-17 20:46:59 +1100525 debug3("PAM: %s entering, %d messages", __func__, n);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000526 return (PAM_CONV_ERR);
527}
Damien Miller63dc3e92001-02-07 12:58:33 +1100528
Damien Miller4f9f42a2003-05-10 19:28:02 +1000529static struct pam_conv null_conv = { sshpam_null_conv, NULL };
530
Darren Tucker0a7e3c62004-09-11 22:28:01 +1000531static int
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000532sshpam_store_conv(int n, sshpam_const struct pam_message **msg,
Darren Tucker0a7e3c62004-09-11 22:28:01 +1000533 struct pam_response **resp, void *data)
534{
535 struct pam_response *reply;
536 int i;
537 size_t len;
538
539 debug3("PAM: %s called with %d messages", __func__, n);
540 *resp = NULL;
541
542 if (n <= 0 || n > PAM_MAX_NUM_MSG)
543 return (PAM_CONV_ERR);
544
Darren Tuckerd8093e42006-05-04 16:24:34 +1000545 if ((reply = calloc(n, sizeof(*reply))) == NULL)
Darren Tucker0a7e3c62004-09-11 22:28:01 +1000546 return (PAM_CONV_ERR);
Darren Tucker0a7e3c62004-09-11 22:28:01 +1000547
548 for (i = 0; i < n; ++i) {
549 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
550 case PAM_ERROR_MSG:
551 case PAM_TEXT_INFO:
552 len = strlen(PAM_MSG_MEMBER(msg, i, msg));
553 buffer_append(&loginmsg, PAM_MSG_MEMBER(msg, i, msg), len);
554 buffer_append(&loginmsg, "\n", 1 );
555 reply[i].resp_retcode = PAM_SUCCESS;
556 break;
557 default:
558 goto fail;
559 }
560 }
561 *resp = reply;
562 return (PAM_SUCCESS);
563
564 fail:
565 for(i = 0; i < n; i++) {
566 if (reply[i].resp != NULL)
567 xfree(reply[i].resp);
568 }
569 xfree(reply);
570 return (PAM_CONV_ERR);
571}
572
573static struct pam_conv store_conv = { sshpam_store_conv, NULL };
574
Darren Tucker8846a072003-10-07 11:30:15 +1000575void
576sshpam_cleanup(void)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000577{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000578 debug("PAM: cleanup");
Damien Miller5c3a5582003-09-23 22:12:38 +1000579 if (sshpam_handle == NULL)
580 return;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000581 pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
582 if (sshpam_cred_established) {
583 pam_setcred(sshpam_handle, PAM_DELETE_CRED);
584 sshpam_cred_established = 0;
585 }
586 if (sshpam_session_open) {
587 pam_close_session(sshpam_handle, PAM_SILENT);
588 sshpam_session_open = 0;
589 }
Darren Tucker1921ed92004-02-10 13:23:28 +1100590 sshpam_authenticated = 0;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000591 pam_end(sshpam_handle, sshpam_err);
592 sshpam_handle = NULL;
593}
594
595static int
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100596sshpam_init(Authctxt *authctxt)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000597{
Darren Tucker455813b2003-09-13 22:12:11 +1000598 extern char *__progname;
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100599 const char *pam_rhost, *pam_user, *user = authctxt->user;
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000600 const char **ptr_pam_user = &pam_user;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000601
602 if (sshpam_handle != NULL) {
603 /* We already have a PAM context; check if the user matches */
604 sshpam_err = pam_get_item(sshpam_handle,
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000605 PAM_USER, (sshpam_const void **)ptr_pam_user);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000606 if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0)
607 return (0);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000608 pam_end(sshpam_handle, sshpam_err);
609 sshpam_handle = NULL;
610 }
611 debug("PAM: initializing for \"%s\"", user);
Darren Tuckerc58c2ee2003-09-13 22:02:05 +1000612 sshpam_err =
Darren Tucker77fc29e2004-09-11 23:07:03 +1000613 pam_start(SSHD_PAM_SERVICE, user, &store_conv, &sshpam_handle);
Darren Tucker17addf02004-03-30 20:57:57 +1000614 sshpam_authctxt = authctxt;
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100615
Damien Miller4f9f42a2003-05-10 19:28:02 +1000616 if (sshpam_err != PAM_SUCCESS) {
617 pam_end(sshpam_handle, sshpam_err);
618 sshpam_handle = NULL;
619 return (-1);
620 }
Damien Miller3a961dc2003-06-03 10:25:48 +1000621 pam_rhost = get_remote_name_or_ip(utmp_len, options.use_dns);
Damien Miller46337202003-06-02 11:04:39 +1000622 debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
Damien Miller25d93422003-05-18 20:45:47 +1000623 sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
624 if (sshpam_err != PAM_SUCCESS) {
Damien Miller1f499fd2003-08-25 13:08:49 +1000625 pam_end(sshpam_handle, sshpam_err);
Damien Miller25d93422003-05-18 20:45:47 +1000626 sshpam_handle = NULL;
627 return (-1);
628 }
629#ifdef PAM_TTY_KLUDGE
Damien Millera8e06ce2003-11-21 23:48:55 +1100630 /*
631 * Some silly PAM modules (e.g. pam_time) require a TTY to operate.
632 * sshd doesn't set the tty until too late in the auth process and
Damien Miller25d93422003-05-18 20:45:47 +1000633 * may not even set one (for tty-less connections)
Damien Millera8e06ce2003-11-21 23:48:55 +1100634 */
Damien Miller25d93422003-05-18 20:45:47 +1000635 debug("PAM: setting PAM_TTY to \"ssh\"");
636 sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, "ssh");
637 if (sshpam_err != PAM_SUCCESS) {
638 pam_end(sshpam_handle, sshpam_err);
639 sshpam_handle = NULL;
640 return (-1);
641 }
642#endif
Damien Miller4f9f42a2003-05-10 19:28:02 +1000643 return (0);
644}
645
646static void *
647sshpam_init_ctx(Authctxt *authctxt)
648{
649 struct pam_ctxt *ctxt;
650 int socks[2];
651
Darren Tuckera8df9242004-01-15 00:15:07 +1100652 debug3("PAM: %s entering", __func__);
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000653 /*
654 * Refuse to start if we don't have PAM enabled or do_pam_account
655 * has previously failed.
656 */
657 if (!options.use_pam || sshpam_account_status == 0)
Damien Miller4e448a32003-05-14 15:11:48 +1000658 return NULL;
659
Damien Miller4f9f42a2003-05-10 19:28:02 +1000660 /* Initialize PAM */
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100661 if (sshpam_init(authctxt) == -1) {
Damien Miller4f9f42a2003-05-10 19:28:02 +1000662 error("PAM: initialization failed");
663 return (NULL);
664 }
665
666 ctxt = xmalloc(sizeof *ctxt);
Darren Tucker8846a072003-10-07 11:30:15 +1000667 memset(ctxt, 0, sizeof(*ctxt));
Damien Miller4f9f42a2003-05-10 19:28:02 +1000668
669 /* Start the authentication thread */
670 if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
671 error("PAM: failed create sockets: %s", strerror(errno));
672 xfree(ctxt);
673 return (NULL);
674 }
675 ctxt->pam_psock = socks[0];
676 ctxt->pam_csock = socks[1];
677 if (pthread_create(&ctxt->pam_thread, NULL, sshpam_thread, ctxt) == -1) {
678 error("PAM: failed to start authentication thread: %s",
679 strerror(errno));
680 close(socks[0]);
681 close(socks[1]);
682 xfree(ctxt);
683 return (NULL);
684 }
Darren Tucker8846a072003-10-07 11:30:15 +1000685 cleanup_ctxt = ctxt;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000686 return (ctxt);
687}
688
689static int
690sshpam_query(void *ctx, char **name, char **info,
691 u_int *num, char ***prompts, u_int **echo_on)
692{
693 Buffer buffer;
694 struct pam_ctxt *ctxt = ctx;
695 size_t plen;
696 u_char type;
697 char *msg;
Damien Millerdaffc6a2004-10-16 18:52:44 +1000698 size_t len, mlen;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000699
Darren Tuckera8df9242004-01-15 00:15:07 +1100700 debug3("PAM: %s entering", __func__);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000701 buffer_init(&buffer);
702 *name = xstrdup("");
703 *info = xstrdup("");
704 *prompts = xmalloc(sizeof(char *));
705 **prompts = NULL;
706 plen = 0;
707 *echo_on = xmalloc(sizeof(u_int));
708 while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) {
709 type = buffer_get_char(&buffer);
710 msg = buffer_get_string(&buffer, NULL);
Damien Millerdaffc6a2004-10-16 18:52:44 +1000711 mlen = strlen(msg);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000712 switch (type) {
713 case PAM_PROMPT_ECHO_ON:
714 case PAM_PROMPT_ECHO_OFF:
715 *num = 1;
Damien Millerdaffc6a2004-10-16 18:52:44 +1000716 len = plen + mlen + 1;
Damien Miller36812092006-03-26 14:22:47 +1100717 **prompts = xrealloc(**prompts, 1, len);
Damien Millerdaffc6a2004-10-16 18:52:44 +1000718 strlcpy(**prompts + plen, msg, len - plen);
719 plen += mlen;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000720 **echo_on = (type == PAM_PROMPT_ECHO_ON);
721 xfree(msg);
722 return (0);
723 case PAM_ERROR_MSG:
724 case PAM_TEXT_INFO:
725 /* accumulate messages */
Damien Millerdaffc6a2004-10-16 18:52:44 +1000726 len = plen + mlen + 2;
Damien Miller36812092006-03-26 14:22:47 +1100727 **prompts = xrealloc(**prompts, 1, len);
Damien Millerdaffc6a2004-10-16 18:52:44 +1000728 strlcpy(**prompts + plen, msg, len - plen);
729 plen += mlen;
730 strlcat(**prompts + plen, "\n", len - plen);
731 plen++;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000732 xfree(msg);
733 break;
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000734 case PAM_ACCT_EXPIRED:
735 sshpam_account_status = 0;
736 /* FALLTHROUGH */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000737 case PAM_AUTH_ERR:
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000738 debug3("PAM: %s", pam_strerror(sshpam_handle, type));
Darren Tucker7b1e6952005-09-28 22:33:27 +1000739 if (**prompts != NULL && strlen(**prompts) != 0) {
740 *info = **prompts;
741 **prompts = NULL;
742 *num = 0;
743 **echo_on = 0;
744 ctxt->pam_done = -1;
Damien Miller66f9eb62006-03-18 23:04:49 +1100745 xfree(msg);
Darren Tucker7b1e6952005-09-28 22:33:27 +1000746 return 0;
747 }
748 /* FALLTHROUGH */
749 case PAM_SUCCESS:
Damien Miller4f9f42a2003-05-10 19:28:02 +1000750 if (**prompts != NULL) {
751 /* drain any accumulated messages */
Darren Tucker18df00c2003-11-18 12:42:07 +1100752 debug("PAM: %s", **prompts);
753 buffer_append(&loginmsg, **prompts,
754 strlen(**prompts));
Damien Miller4f9f42a2003-05-10 19:28:02 +1000755 xfree(**prompts);
756 **prompts = NULL;
757 }
758 if (type == PAM_SUCCESS) {
Darren Tuckerd5bfa8f2005-01-20 13:29:51 +1100759 if (!sshpam_authctxt->valid ||
760 (sshpam_authctxt->pw->pw_uid == 0 &&
761 options.permit_root_login != PERMIT_YES))
Darren Tucker36a3d602005-01-20 12:43:38 +1100762 fatal("Internal error: PAM auth "
763 "succeeded when it should have "
764 "failed");
Damien Millerc756e9b2003-11-17 21:41:42 +1100765 import_environments(&buffer);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000766 *num = 0;
767 **echo_on = 0;
768 ctxt->pam_done = 1;
769 xfree(msg);
770 return (0);
771 }
Darren Tucker2a9bf4b2004-04-18 11:00:26 +1000772 error("PAM: %s for %s%.100s from %.100s", msg,
773 sshpam_authctxt->valid ? "" : "illegal user ",
774 sshpam_authctxt->user,
775 get_remote_name_or_ip(utmp_len, options.use_dns));
Darren Tucker439ce0d2003-10-09 14:20:15 +1000776 /* FALLTHROUGH */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000777 default:
778 *num = 0;
779 **echo_on = 0;
780 xfree(msg);
781 ctxt->pam_done = -1;
782 return (-1);
783 }
784 }
785 return (-1);
786}
787
788/* XXX - see also comment in auth-chall.c:verify_response */
789static int
790sshpam_respond(void *ctx, u_int num, char **resp)
791{
792 Buffer buffer;
793 struct pam_ctxt *ctxt = ctx;
794
Darren Tucker1d4ebbf2006-01-29 16:46:13 +1100795 debug2("PAM: %s entering, %u responses", __func__, num);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000796 switch (ctxt->pam_done) {
797 case 1:
798 sshpam_authenticated = 1;
799 return (0);
800 case 0:
801 break;
802 default:
803 return (-1);
804 }
805 if (num != 1) {
806 error("PAM: expected one response, got %u", num);
807 return (-1);
808 }
809 buffer_init(&buffer);
Darren Tuckerd5bfa8f2005-01-20 13:29:51 +1100810 if (sshpam_authctxt->valid &&
811 (sshpam_authctxt->pw->pw_uid != 0 ||
Damien Miller37294fb2005-07-17 17:18:49 +1000812 options.permit_root_login == PERMIT_YES))
Darren Tucker36a3d602005-01-20 12:43:38 +1100813 buffer_put_cstring(&buffer, *resp);
814 else
815 buffer_put_cstring(&buffer, badpw);
Damien Miller9bdba702003-11-17 21:27:55 +1100816 if (ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer) == -1) {
817 buffer_free(&buffer);
818 return (-1);
819 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000820 buffer_free(&buffer);
821 return (1);
822}
823
824static void
825sshpam_free_ctx(void *ctxtp)
826{
827 struct pam_ctxt *ctxt = ctxtp;
828
Darren Tuckera8df9242004-01-15 00:15:07 +1100829 debug3("PAM: %s entering", __func__);
Darren Tucker8846a072003-10-07 11:30:15 +1000830 sshpam_thread_cleanup();
Damien Miller4f9f42a2003-05-10 19:28:02 +1000831 xfree(ctxt);
832 /*
833 * We don't call sshpam_cleanup() here because we may need the PAM
834 * handle at a later stage, e.g. when setting up a session. It's
835 * still on the cleanup list, so pam_end() *will* be called before
836 * the server process terminates.
837 */
838}
839
840KbdintDevice sshpam_device = {
841 "pam",
842 sshpam_init_ctx,
843 sshpam_query,
844 sshpam_respond,
845 sshpam_free_ctx
846};
847
848KbdintDevice mm_sshpam_device = {
849 "pam",
850 mm_sshpam_init_ctx,
851 mm_sshpam_query,
852 mm_sshpam_respond,
853 mm_sshpam_free_ctx
854};
855
856/*
857 * This replaces auth-pam.c
858 */
859void
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100860start_pam(Authctxt *authctxt)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000861{
Damien Miller9d507da2003-05-14 15:31:12 +1000862 if (!options.use_pam)
863 fatal("PAM: initialisation requested when UsePAM=no");
864
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100865 if (sshpam_init(authctxt) == -1)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000866 fatal("PAM: initialisation failed");
867}
868
869void
870finish_pam(void)
871{
Darren Tucker8846a072003-10-07 11:30:15 +1000872 sshpam_cleanup();
Damien Miller4f9f42a2003-05-10 19:28:02 +1000873}
874
Damien Miller1f499fd2003-08-25 13:08:49 +1000875u_int
876do_pam_account(void)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000877{
Darren Tucker77fc29e2004-09-11 23:07:03 +1000878 debug("%s: called", __func__);
Darren Tucker07705c72003-12-18 15:34:31 +1100879 if (sshpam_account_status != -1)
880 return (sshpam_account_status);
881
Damien Miller1f499fd2003-08-25 13:08:49 +1000882 sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
Darren Tucker77fc29e2004-09-11 23:07:03 +1000883 debug3("PAM: %s pam_acct_mgmt = %d (%s)", __func__, sshpam_err,
884 pam_strerror(sshpam_handle, sshpam_err));
Damien Miller94cf4c82005-07-17 17:04:47 +1000885
Darren Tucker07705c72003-12-18 15:34:31 +1100886 if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
887 sshpam_account_status = 0;
888 return (sshpam_account_status);
Damien Miller1f499fd2003-08-25 13:08:49 +1000889 }
890
Darren Tucker07705c72003-12-18 15:34:31 +1100891 if (sshpam_err == PAM_NEW_AUTHTOK_REQD)
Darren Tucker17db1c42004-06-19 12:54:38 +1000892 sshpam_password_change_required(1);
Darren Tucker07705c72003-12-18 15:34:31 +1100893
894 sshpam_account_status = 1;
895 return (sshpam_account_status);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000896}
897
898void
Damien Miller341c6e62003-09-02 23:18:52 +1000899do_pam_set_tty(const char *tty)
900{
Darren Tuckerf38db7f2003-08-08 13:43:37 +1000901 if (tty != NULL) {
902 debug("PAM: setting PAM_TTY to \"%s\"", tty);
903 sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, tty);
904 if (sshpam_err != PAM_SUCCESS)
905 fatal("PAM: failed to set PAM_TTY: %s",
906 pam_strerror(sshpam_handle, sshpam_err));
907 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000908}
909
910void
911do_pam_setcred(int init)
912{
913 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
Darren Tucker77fc29e2004-09-11 23:07:03 +1000914 (const void *)&store_conv);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000915 if (sshpam_err != PAM_SUCCESS)
916 fatal("PAM: failed to set PAM_CONV: %s",
917 pam_strerror(sshpam_handle, sshpam_err));
918 if (init) {
919 debug("PAM: establishing credentials");
920 sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED);
921 } else {
922 debug("PAM: reinitializing credentials");
923 sshpam_err = pam_setcred(sshpam_handle, PAM_REINITIALIZE_CRED);
924 }
925 if (sshpam_err == PAM_SUCCESS) {
926 sshpam_cred_established = 1;
927 return;
928 }
929 if (sshpam_authenticated)
930 fatal("PAM: pam_setcred(): %s",
931 pam_strerror(sshpam_handle, sshpam_err));
932 else
933 debug("PAM: pam_setcred(): %s",
934 pam_strerror(sshpam_handle, sshpam_err));
935}
936
Damien Miller4f9f42a2003-05-10 19:28:02 +1000937static int
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000938sshpam_tty_conv(int n, sshpam_const struct pam_message **msg,
Damien Miller1f499fd2003-08-25 13:08:49 +1000939 struct pam_response **resp, void *data)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000940{
941 char input[PAM_MAX_MSG_SIZE];
Damien Miller5c3a5582003-09-23 22:12:38 +1000942 struct pam_response *reply;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000943 int i;
944
Darren Tuckerba53b832004-02-17 20:46:59 +1100945 debug3("PAM: %s called with %d messages", __func__, n);
946
Damien Miller5c3a5582003-09-23 22:12:38 +1000947 *resp = NULL;
948
Darren Tucker18df00c2003-11-18 12:42:07 +1100949 if (n <= 0 || n > PAM_MAX_NUM_MSG || !isatty(STDIN_FILENO))
Damien Miller4f9f42a2003-05-10 19:28:02 +1000950 return (PAM_CONV_ERR);
Damien Miller5c3a5582003-09-23 22:12:38 +1000951
Darren Tuckerd8093e42006-05-04 16:24:34 +1000952 if ((reply = calloc(n, sizeof(*reply))) == NULL)
Damien Miller5c3a5582003-09-23 22:12:38 +1000953 return (PAM_CONV_ERR);
Damien Miller5c3a5582003-09-23 22:12:38 +1000954
Damien Miller4f9f42a2003-05-10 19:28:02 +1000955 for (i = 0; i < n; ++i) {
956 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
957 case PAM_PROMPT_ECHO_OFF:
Damien Miller5c3a5582003-09-23 22:12:38 +1000958 reply[i].resp =
Damien Millera8e06ce2003-11-21 23:48:55 +1100959 read_passphrase(PAM_MSG_MEMBER(msg, i, msg),
Damien Miller4f9f42a2003-05-10 19:28:02 +1000960 RP_ALLOW_STDIN);
Damien Miller5c3a5582003-09-23 22:12:38 +1000961 reply[i].resp_retcode = PAM_SUCCESS;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000962 break;
963 case PAM_PROMPT_ECHO_ON:
Darren Tucker0947ddf2003-11-13 11:21:31 +1100964 fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
Damien Miller4f9f42a2003-05-10 19:28:02 +1000965 fgets(input, sizeof input, stdin);
Damien Millera6fb77f2004-07-19 09:39:11 +1000966 if ((reply[i].resp = strdup(input)) == NULL)
967 goto fail;
Damien Miller5c3a5582003-09-23 22:12:38 +1000968 reply[i].resp_retcode = PAM_SUCCESS;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000969 break;
970 case PAM_ERROR_MSG:
971 case PAM_TEXT_INFO:
Darren Tucker0947ddf2003-11-13 11:21:31 +1100972 fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
Damien Miller5c3a5582003-09-23 22:12:38 +1000973 reply[i].resp_retcode = PAM_SUCCESS;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000974 break;
975 default:
976 goto fail;
977 }
978 }
Damien Miller5c3a5582003-09-23 22:12:38 +1000979 *resp = reply;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000980 return (PAM_SUCCESS);
Damien Miller5c3a5582003-09-23 22:12:38 +1000981
Damien Miller4f9f42a2003-05-10 19:28:02 +1000982 fail:
Damien Miller5c3a5582003-09-23 22:12:38 +1000983 for(i = 0; i < n; i++) {
984 if (reply[i].resp != NULL)
985 xfree(reply[i].resp);
986 }
987 xfree(reply);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000988 return (PAM_CONV_ERR);
989}
990
Darren Tucker94befab2004-06-03 14:53:12 +1000991static struct pam_conv tty_conv = { sshpam_tty_conv, NULL };
Darren Tucker18df00c2003-11-18 12:42:07 +1100992
Damien Miller4f9f42a2003-05-10 19:28:02 +1000993/*
994 * XXX this should be done in the authentication phase, but ssh1 doesn't
995 * support that
996 */
997void
998do_pam_chauthtok(void)
999{
Damien Miller4f9f42a2003-05-10 19:28:02 +10001000 if (use_privsep)
Damien Miller1f499fd2003-08-25 13:08:49 +10001001 fatal("Password expired (unable to change with privsep)");
Damien Miller4f9f42a2003-05-10 19:28:02 +10001002 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
Darren Tucker18df00c2003-11-18 12:42:07 +11001003 (const void *)&tty_conv);
Damien Miller4f9f42a2003-05-10 19:28:02 +10001004 if (sshpam_err != PAM_SUCCESS)
1005 fatal("PAM: failed to set PAM_CONV: %s",
1006 pam_strerror(sshpam_handle, sshpam_err));
1007 debug("PAM: changing password");
1008 sshpam_err = pam_chauthtok(sshpam_handle, PAM_CHANGE_EXPIRED_AUTHTOK);
1009 if (sshpam_err != PAM_SUCCESS)
1010 fatal("PAM: pam_chauthtok(): %s",
1011 pam_strerror(sshpam_handle, sshpam_err));
1012}
1013
Darren Tucker18df00c2003-11-18 12:42:07 +11001014void
1015do_pam_session(void)
1016{
Darren Tucker1921ed92004-02-10 13:23:28 +11001017 debug3("PAM: opening session");
Damien Millera8e06ce2003-11-21 23:48:55 +11001018 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
Darren Tucker5cf8ef72004-02-17 23:20:07 +11001019 (const void *)&store_conv);
Darren Tucker18df00c2003-11-18 12:42:07 +11001020 if (sshpam_err != PAM_SUCCESS)
1021 fatal("PAM: failed to set PAM_CONV: %s",
1022 pam_strerror(sshpam_handle, sshpam_err));
1023 sshpam_err = pam_open_session(sshpam_handle, 0);
Darren Tucker69687f42004-09-11 22:17:26 +10001024 if (sshpam_err == PAM_SUCCESS)
1025 sshpam_session_open = 1;
1026 else {
1027 sshpam_session_open = 0;
1028 disable_forwarding();
1029 error("PAM: pam_open_session(): %s",
Darren Tucker18df00c2003-11-18 12:42:07 +11001030 pam_strerror(sshpam_handle, sshpam_err));
Darren Tucker69687f42004-09-11 22:17:26 +10001031 }
1032
1033}
1034
1035int
1036is_pam_session_open(void)
1037{
1038 return sshpam_session_open;
Darren Tucker18df00c2003-11-18 12:42:07 +11001039}
1040
Damien Millera8e06ce2003-11-21 23:48:55 +11001041/*
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001042 * Set a PAM environment string. We need to do this so that the session
1043 * modules can handle things like Kerberos/GSI credentials that appear
1044 * during the ssh authentication process.
1045 */
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001046int
Damien Millera8e06ce2003-11-21 23:48:55 +11001047do_pam_putenv(char *name, char *value)
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001048{
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001049 int ret = 1;
Damien Miller787b2ec2003-11-21 23:56:47 +11001050#ifdef HAVE_PAM_PUTENV
Damien Millerf2728092003-09-17 07:24:25 +10001051 char *compound;
1052 size_t len;
1053
1054 len = strlen(name) + strlen(value) + 2;
1055 compound = xmalloc(len);
1056
1057 snprintf(compound, len, "%s=%s", name, value);
1058 ret = pam_putenv(sshpam_handle, compound);
1059 xfree(compound);
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001060#endif
Damien Millerf2728092003-09-17 07:24:25 +10001061
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001062 return (ret);
1063}
1064
Damien Miller4f9f42a2003-05-10 19:28:02 +10001065char **
Damien Millerc756e9b2003-11-17 21:41:42 +11001066fetch_pam_child_environment(void)
1067{
1068 return sshpam_env;
1069}
1070
1071char **
Damien Miller4f9f42a2003-05-10 19:28:02 +10001072fetch_pam_environment(void)
1073{
Damien Miller4f9f42a2003-05-10 19:28:02 +10001074 return (pam_getenvlist(sshpam_handle));
Damien Miller4f9f42a2003-05-10 19:28:02 +10001075}
1076
1077void
1078free_pam_environment(char **env)
1079{
1080 char **envp;
1081
Damien Millere27c6cc2003-05-16 18:21:01 +10001082 if (env == NULL)
1083 return;
1084
Damien Miller4f9f42a2003-05-10 19:28:02 +10001085 for (envp = env; *envp; envp++)
1086 xfree(*envp);
1087 xfree(env);
Damien Millere72b7af1999-12-30 15:08:44 +11001088}
1089
Darren Tucker450a1582004-05-30 20:43:59 +10001090/*
1091 * "Blind" conversation function for password authentication. Assumes that
1092 * echo-off prompts are for the password and stores messages for later
1093 * display.
1094 */
1095static int
Darren Tuckerf08bdb52005-05-26 19:59:48 +10001096sshpam_passwd_conv(int n, sshpam_const struct pam_message **msg,
Darren Tucker450a1582004-05-30 20:43:59 +10001097 struct pam_response **resp, void *data)
1098{
1099 struct pam_response *reply;
1100 int i;
1101 size_t len;
1102
1103 debug3("PAM: %s called with %d messages", __func__, n);
1104
1105 *resp = NULL;
1106
1107 if (n <= 0 || n > PAM_MAX_NUM_MSG)
1108 return (PAM_CONV_ERR);
1109
1110 if ((reply = malloc(n * sizeof(*reply))) == NULL)
1111 return (PAM_CONV_ERR);
1112 memset(reply, 0, n * sizeof(*reply));
1113
1114 for (i = 0; i < n; ++i) {
1115 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
1116 case PAM_PROMPT_ECHO_OFF:
1117 if (sshpam_password == NULL)
1118 goto fail;
Damien Millera6fb77f2004-07-19 09:39:11 +10001119 if ((reply[i].resp = strdup(sshpam_password)) == NULL)
1120 goto fail;
Darren Tucker450a1582004-05-30 20:43:59 +10001121 reply[i].resp_retcode = PAM_SUCCESS;
1122 break;
1123 case PAM_ERROR_MSG:
1124 case PAM_TEXT_INFO:
1125 len = strlen(PAM_MSG_MEMBER(msg, i, msg));
1126 if (len > 0) {
1127 buffer_append(&loginmsg,
1128 PAM_MSG_MEMBER(msg, i, msg), len);
1129 buffer_append(&loginmsg, "\n", 1);
1130 }
Damien Millera6fb77f2004-07-19 09:39:11 +10001131 if ((reply[i].resp = strdup("")) == NULL)
1132 goto fail;
Darren Tucker450a1582004-05-30 20:43:59 +10001133 reply[i].resp_retcode = PAM_SUCCESS;
1134 break;
1135 default:
1136 goto fail;
1137 }
1138 }
1139 *resp = reply;
1140 return (PAM_SUCCESS);
1141
Damien Miller94cf4c82005-07-17 17:04:47 +10001142 fail:
Darren Tucker450a1582004-05-30 20:43:59 +10001143 for(i = 0; i < n; i++) {
1144 if (reply[i].resp != NULL)
1145 xfree(reply[i].resp);
1146 }
1147 xfree(reply);
1148 return (PAM_CONV_ERR);
1149}
1150
1151static struct pam_conv passwd_conv = { sshpam_passwd_conv, NULL };
1152
1153/*
1154 * Attempt password authentication via PAM
1155 */
1156int
1157sshpam_auth_passwd(Authctxt *authctxt, const char *password)
1158{
1159 int flags = (options.permit_empty_passwd == 0 ?
1160 PAM_DISALLOW_NULL_AUTHTOK : 0);
1161
1162 if (!options.use_pam || sshpam_handle == NULL)
1163 fatal("PAM: %s called when PAM disabled or failed to "
1164 "initialise.", __func__);
1165
1166 sshpam_password = password;
1167 sshpam_authctxt = authctxt;
1168
Darren Tuckere061b152004-05-30 22:04:56 +10001169 /*
1170 * If the user logging in is invalid, or is root but is not permitted
1171 * by PermitRootLogin, use an invalid password to prevent leaking
1172 * information via timing (eg if the PAM config has a delay on fail).
1173 */
Darren Tuckerd5bfa8f2005-01-20 13:29:51 +11001174 if (!authctxt->valid || (authctxt->pw->pw_uid == 0 &&
Damien Miller37294fb2005-07-17 17:18:49 +10001175 options.permit_root_login != PERMIT_YES))
Darren Tuckere061b152004-05-30 22:04:56 +10001176 sshpam_password = badpw;
1177
Darren Tucker450a1582004-05-30 20:43:59 +10001178 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
1179 (const void *)&passwd_conv);
1180 if (sshpam_err != PAM_SUCCESS)
1181 fatal("PAM: %s: failed to set PAM_CONV: %s", __func__,
1182 pam_strerror(sshpam_handle, sshpam_err));
1183
1184 sshpam_err = pam_authenticate(sshpam_handle, flags);
1185 sshpam_password = NULL;
Darren Tuckerd5bfa8f2005-01-20 13:29:51 +11001186 if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
Darren Tucker450a1582004-05-30 20:43:59 +10001187 debug("PAM: password authentication accepted for %.100s",
1188 authctxt->user);
Damien Miller37294fb2005-07-17 17:18:49 +10001189 return 1;
Darren Tucker450a1582004-05-30 20:43:59 +10001190 } else {
1191 debug("PAM: password authentication failed for %.100s: %s",
1192 authctxt->valid ? authctxt->user : "an illegal user",
1193 pam_strerror(sshpam_handle, sshpam_err));
1194 return 0;
1195 }
1196}
Damien Millere72b7af1999-12-30 15:08:44 +11001197#endif /* USE_PAM */