Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| 3 | * All rights reserved |
Damien Miller | efb4afe | 2000-04-12 18:45:05 +1000 | [diff] [blame] | 4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 5 | */ |
| 6 | |
| 7 | #include "includes.h" |
Damien Miller | 942da03 | 2000-08-18 13:59:06 +1000 | [diff] [blame] | 8 | RCSID("$OpenBSD: auth.c,v 1.8 2000/08/04 20:30:07 markus Exp $"); |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 9 | |
| 10 | #include "xmalloc.h" |
| 11 | #include "rsa.h" |
| 12 | #include "ssh.h" |
| 13 | #include "pty.h" |
| 14 | #include "packet.h" |
| 15 | #include "buffer.h" |
| 16 | #include "cipher.h" |
| 17 | #include "mpaux.h" |
| 18 | #include "servconf.h" |
Damien Miller | efb4afe | 2000-04-12 18:45:05 +1000 | [diff] [blame] | 19 | #include "compat.h" |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 20 | #include "channels.h" |
| 21 | #include "match.h" |
Damien Miller | d2c208a | 2000-05-17 22:00:02 +1000 | [diff] [blame] | 22 | #ifdef HAVE_LOGIN_H |
| 23 | #include <login.h> |
| 24 | #endif |
Damien Miller | 1f335fb | 2000-06-26 11:31:33 +1000 | [diff] [blame] | 25 | #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) |
| 26 | #include <shadow.h> |
| 27 | #endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */ |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 28 | |
Damien Miller | efb4afe | 2000-04-12 18:45:05 +1000 | [diff] [blame] | 29 | #include "bufaux.h" |
| 30 | #include "ssh2.h" |
| 31 | #include "auth.h" |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 32 | #include "session.h" |
Damien Miller | efb4afe | 2000-04-12 18:45:05 +1000 | [diff] [blame] | 33 | |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 34 | /* import */ |
| 35 | extern ServerOptions options; |
| 36 | extern char *forced_command; |
| 37 | |
| 38 | /* |
| 39 | * Check if the user is allowed to log in via ssh. If user is listed in |
| 40 | * DenyUsers or user's primary group is listed in DenyGroups, false will |
| 41 | * be returned. If AllowUsers isn't empty and user isn't listed there, or |
| 42 | * if AllowGroups isn't empty and user isn't listed there, false will be |
Damien Miller | 4af5130 | 2000-04-16 11:18:38 +1000 | [diff] [blame] | 43 | * returned. |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 44 | * If the user's shell is not executable, false will be returned. |
Damien Miller | 4af5130 | 2000-04-16 11:18:38 +1000 | [diff] [blame] | 45 | * Otherwise true is returned. |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 46 | */ |
Damien Miller | eba71ba | 2000-04-29 23:57:08 +1000 | [diff] [blame] | 47 | int |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 48 | allowed_user(struct passwd * pw) |
| 49 | { |
| 50 | struct stat st; |
| 51 | struct group *grp; |
Damien Miller | ef7df54 | 2000-05-19 00:03:23 +1000 | [diff] [blame] | 52 | char *shell; |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 53 | int i; |
| 54 | #ifdef WITH_AIXAUTHENTICATE |
| 55 | char *loginmsg; |
| 56 | #endif /* WITH_AIXAUTHENTICATE */ |
Damien Miller | 1f335fb | 2000-06-26 11:31:33 +1000 | [diff] [blame] | 57 | #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) && \ |
| 58 | defined(HAS_SHADOW_EXPIRE) |
| 59 | struct spwd *spw; |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 60 | |
| 61 | /* Shouldn't be called if pw is NULL, but better safe than sorry... */ |
| 62 | if (!pw) |
| 63 | return 0; |
| 64 | |
Damien Miller | 1f335fb | 2000-06-26 11:31:33 +1000 | [diff] [blame] | 65 | spw = getspnam(pw->pw_name); |
Damien Miller | c708843 | 2000-07-02 18:44:54 +1000 | [diff] [blame] | 66 | if (spw != NULL) { |
| 67 | int days = time(NULL) / 86400; |
Damien Miller | 1f335fb | 2000-06-26 11:31:33 +1000 | [diff] [blame] | 68 | |
Damien Miller | c708843 | 2000-07-02 18:44:54 +1000 | [diff] [blame] | 69 | /* Check account expiry */ |
| 70 | if ((spw->sp_expire > 0) && (days > spw->sp_expire)) |
| 71 | return 0; |
| 72 | |
| 73 | /* Check password expiry */ |
| 74 | if ((spw->sp_lstchg > 0) && (spw->sp_inact > 0) && |
| 75 | (days > (spw->sp_lstchg + spw->sp_inact))) |
| 76 | return 0; |
| 77 | } |
Damien Miller | 1f335fb | 2000-06-26 11:31:33 +1000 | [diff] [blame] | 78 | #else |
| 79 | /* Shouldn't be called if pw is NULL, but better safe than sorry... */ |
| 80 | if (!pw) |
| 81 | return 0; |
| 82 | #endif |
| 83 | |
Damien Miller | ef7df54 | 2000-05-19 00:03:23 +1000 | [diff] [blame] | 84 | /* |
| 85 | * Get the shell from the password data. An empty shell field is |
| 86 | * legal, and means /bin/sh. |
| 87 | */ |
| 88 | shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell; |
| 89 | |
| 90 | /* deny if shell does not exists or is not executable */ |
| 91 | if (stat(shell, &st) != 0) |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 92 | return 0; |
| 93 | if (!((st.st_mode & S_IFREG) && (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)))) |
| 94 | return 0; |
| 95 | |
| 96 | /* Return false if user is listed in DenyUsers */ |
| 97 | if (options.num_deny_users > 0) { |
| 98 | if (!pw->pw_name) |
| 99 | return 0; |
| 100 | for (i = 0; i < options.num_deny_users; i++) |
| 101 | if (match_pattern(pw->pw_name, options.deny_users[i])) |
| 102 | return 0; |
| 103 | } |
| 104 | /* Return false if AllowUsers isn't empty and user isn't listed there */ |
| 105 | if (options.num_allow_users > 0) { |
| 106 | if (!pw->pw_name) |
| 107 | return 0; |
| 108 | for (i = 0; i < options.num_allow_users; i++) |
| 109 | if (match_pattern(pw->pw_name, options.allow_users[i])) |
| 110 | break; |
| 111 | /* i < options.num_allow_users iff we break for loop */ |
| 112 | if (i >= options.num_allow_users) |
| 113 | return 0; |
| 114 | } |
| 115 | /* Get the primary group name if we need it. Return false if it fails */ |
| 116 | if (options.num_deny_groups > 0 || options.num_allow_groups > 0) { |
| 117 | grp = getgrgid(pw->pw_gid); |
| 118 | if (!grp) |
| 119 | return 0; |
| 120 | |
| 121 | /* Return false if user's group is listed in DenyGroups */ |
| 122 | if (options.num_deny_groups > 0) { |
| 123 | if (!grp->gr_name) |
| 124 | return 0; |
| 125 | for (i = 0; i < options.num_deny_groups; i++) |
| 126 | if (match_pattern(grp->gr_name, options.deny_groups[i])) |
| 127 | return 0; |
| 128 | } |
| 129 | /* |
| 130 | * Return false if AllowGroups isn't empty and user's group |
| 131 | * isn't listed there |
| 132 | */ |
| 133 | if (options.num_allow_groups > 0) { |
| 134 | if (!grp->gr_name) |
| 135 | return 0; |
| 136 | for (i = 0; i < options.num_allow_groups; i++) |
| 137 | if (match_pattern(grp->gr_name, options.allow_groups[i])) |
| 138 | break; |
| 139 | /* i < options.num_allow_groups iff we break for |
| 140 | loop */ |
| 141 | if (i >= options.num_allow_groups) |
| 142 | return 0; |
| 143 | } |
| 144 | } |
| 145 | |
| 146 | #ifdef WITH_AIXAUTHENTICATE |
Damien Miller | 2f6a0ad | 2000-05-31 11:20:11 +1000 | [diff] [blame] | 147 | if (loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) { |
Damien Miller | d2c208a | 2000-05-17 22:00:02 +1000 | [diff] [blame] | 148 | if (loginmsg && *loginmsg) { |
| 149 | /* Remove embedded newlines (if any) */ |
| 150 | char *p; |
Damien Miller | 2f6a0ad | 2000-05-31 11:20:11 +1000 | [diff] [blame] | 151 | for (p = loginmsg; *p; p++) { |
Damien Miller | d2c208a | 2000-05-17 22:00:02 +1000 | [diff] [blame] | 152 | if (*p == '\n') |
| 153 | *p = ' '; |
Damien Miller | 2f6a0ad | 2000-05-31 11:20:11 +1000 | [diff] [blame] | 154 | } |
Damien Miller | d2c208a | 2000-05-17 22:00:02 +1000 | [diff] [blame] | 155 | /* Remove trailing newline */ |
| 156 | *--p = '\0'; |
Damien Miller | 2f6a0ad | 2000-05-31 11:20:11 +1000 | [diff] [blame] | 157 | log("Login restricted for %s: %.100s", pw->pw_name, loginmsg); |
Damien Miller | d2c208a | 2000-05-17 22:00:02 +1000 | [diff] [blame] | 158 | } |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 159 | return 0; |
Damien Miller | d2c208a | 2000-05-17 22:00:02 +1000 | [diff] [blame] | 160 | } |
Damien Miller | b38eff8 | 2000-04-01 11:09:21 +1000 | [diff] [blame] | 161 | #endif /* WITH_AIXAUTHENTICATE */ |
| 162 | |
| 163 | /* We found no reason not to let this user try to log on... */ |
| 164 | return 1; |
| 165 | } |