Ben Lindstrom | 51b2488 | 2002-07-04 03:08:40 +0000 | [diff] [blame] | 1 | /* |
Ben Lindstrom | 024f08f | 2002-07-07 02:17:36 +0000 | [diff] [blame] | 2 | * |
| 3 | * Copyright (c) 2001 Gert Doering. All rights reserved. |
| 4 | * |
Ben Lindstrom | 51b2488 | 2002-07-04 03:08:40 +0000 | [diff] [blame] | 5 | * Redistribution and use in source and binary forms, with or without |
| 6 | * modification, are permitted provided that the following conditions |
| 7 | * are met: |
| 8 | * 1. Redistributions of source code must retain the above copyright |
| 9 | * notice, this list of conditions and the following disclaimer. |
| 10 | * 2. Redistributions in binary form must reproduce the above copyright |
| 11 | * notice, this list of conditions and the following disclaimer in the |
| 12 | * documentation and/or other materials provided with the distribution. |
| 13 | * |
| 14 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
| 15 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
| 16 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
| 17 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
| 18 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| 19 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| 20 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| 21 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 22 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 23 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 24 | * |
| 25 | */ |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 26 | #include "includes.h" |
Darren Tucker | 97363a8 | 2003-05-02 23:42:25 +1000 | [diff] [blame] | 27 | #include "ssh.h" |
| 28 | #include "log.h" |
| 29 | #include "servconf.h" |
Darren Tucker | 051c270 | 2003-09-22 13:05:26 +1000 | [diff] [blame] | 30 | #include "canohost.h" |
| 31 | #include "xmalloc.h" |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 32 | #include "buffer.h" |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 33 | |
| 34 | #ifdef _AIX |
| 35 | |
| 36 | #include <uinfo.h> |
Darren Tucker | fc3454e | 2003-07-14 16:41:55 +1000 | [diff] [blame] | 37 | #include "port-aix.h" |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 38 | |
Darren Tucker | 97363a8 | 2003-05-02 23:42:25 +1000 | [diff] [blame] | 39 | extern ServerOptions options; |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 40 | extern Buffer loginmsg; |
Darren Tucker | 97363a8 | 2003-05-02 23:42:25 +1000 | [diff] [blame] | 41 | |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 42 | /* |
Ben Lindstrom | 51b2488 | 2002-07-04 03:08:40 +0000 | [diff] [blame] | 43 | * AIX has a "usrinfo" area where logname and other stuff is stored - |
| 44 | * a few applications actually use this and die if it's not set |
| 45 | * |
| 46 | * NOTE: TTY= should be set, but since no one uses it and it's hard to |
| 47 | * acquire due to privsep code. We will just drop support. |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 48 | */ |
| 49 | void |
Ben Lindstrom | 51b2488 | 2002-07-04 03:08:40 +0000 | [diff] [blame] | 50 | aix_usrinfo(struct passwd *pw) |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 51 | { |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 52 | u_int i; |
Damien Miller | 3174125 | 2003-05-19 00:13:38 +1000 | [diff] [blame] | 53 | size_t len; |
Ben Lindstrom | 51b2488 | 2002-07-04 03:08:40 +0000 | [diff] [blame] | 54 | char *cp; |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 55 | |
Damien Miller | 3174125 | 2003-05-19 00:13:38 +1000 | [diff] [blame] | 56 | len = sizeof("LOGNAME= NAME= ") + (2 * strlen(pw->pw_name)); |
| 57 | cp = xmalloc(len); |
| 58 | |
Damien Miller | 3867bf3 | 2003-05-19 09:33:15 +1000 | [diff] [blame] | 59 | i = snprintf(cp, len, "LOGNAME=%s%cNAME=%s%c", pw->pw_name, '\0', |
| 60 | pw->pw_name, '\0'); |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 61 | if (usrinfo(SETUINFO, cp, i) == -1) |
| 62 | fatal("Couldn't set usrinfo: %s", strerror(errno)); |
| 63 | debug3("AIX/UsrInfo: set len %d", i); |
Damien Miller | 3174125 | 2003-05-19 00:13:38 +1000 | [diff] [blame] | 64 | |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 65 | xfree(cp); |
| 66 | } |
| 67 | |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 68 | # ifdef WITH_AIXAUTHENTICATE |
Darren Tucker | b9aa0a0 | 2003-07-08 22:59:59 +1000 | [diff] [blame] | 69 | /* |
| 70 | * Remove embedded newlines in string (if any). |
| 71 | * Used before logging messages returned by AIX authentication functions |
| 72 | * so the message is logged on one line. |
| 73 | */ |
| 74 | void |
| 75 | aix_remove_embedded_newlines(char *p) |
| 76 | { |
| 77 | if (p == NULL) |
| 78 | return; |
| 79 | |
| 80 | for (; *p; p++) { |
| 81 | if (*p == '\n') |
| 82 | *p = ' '; |
| 83 | } |
| 84 | /* Remove trailing whitespace */ |
| 85 | if (*--p == ' ') |
| 86 | *p = '\0'; |
| 87 | } |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 88 | |
| 89 | /* |
| 90 | * Do authentication via AIX's authenticate routine. We loop until the |
| 91 | * reenter parameter is 0, but normally authenticate is called only once. |
| 92 | * |
| 93 | * Note: this function returns 1 on success, whereas AIX's authenticate() |
| 94 | * returns 0. |
| 95 | */ |
| 96 | int |
| 97 | aix_authenticate(const char *name, const char *password, const char *host) |
| 98 | { |
| 99 | char *authmsg = NULL, *msg; |
| 100 | int authsuccess = 0, reenter, result; |
| 101 | |
| 102 | do { |
| 103 | result = authenticate((char *)name, (char *)password, &reenter, |
| 104 | &authmsg); |
| 105 | aix_remove_embedded_newlines(authmsg); |
| 106 | debug3("AIX/authenticate result %d, msg %.100s", result, |
| 107 | authmsg); |
| 108 | } while (reenter); |
| 109 | |
| 110 | if (result == 0) { |
| 111 | authsuccess = 1; |
| 112 | |
| 113 | /* No pty yet, so just label the line as "ssh" */ |
| 114 | aix_setauthdb(name); |
| 115 | if (loginsuccess((char *)name, (char *)host, "ssh", &msg) == 0) { |
| 116 | if (msg != NULL) { |
| 117 | debug("%s: msg %s", __func__, msg); |
| 118 | buffer_append(&loginmsg, msg, strlen(msg)); |
| 119 | xfree(msg); |
| 120 | } |
| 121 | } |
| 122 | } |
| 123 | |
| 124 | if (authmsg != NULL) |
| 125 | xfree(authmsg); |
| 126 | |
| 127 | return authsuccess; |
| 128 | } |
Darren Tucker | b9aa0a0 | 2003-07-08 22:59:59 +1000 | [diff] [blame] | 129 | |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 130 | # ifdef CUSTOM_FAILED_LOGIN |
Darren Tucker | 97363a8 | 2003-05-02 23:42:25 +1000 | [diff] [blame] | 131 | /* |
| 132 | * record_failed_login: generic "login failed" interface function |
| 133 | */ |
| 134 | void |
| 135 | record_failed_login(const char *user, const char *ttyname) |
| 136 | { |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 137 | char *hostname = (char *)get_canonical_hostname(options.use_dns); |
Damien Miller | 3174125 | 2003-05-19 00:13:38 +1000 | [diff] [blame] | 138 | |
Darren Tucker | fc3454e | 2003-07-14 16:41:55 +1000 | [diff] [blame] | 139 | if (geteuid() != 0) |
| 140 | return; |
| 141 | |
| 142 | aix_setauthdb(user); |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 143 | # ifdef AIX_LOGINFAILED_4ARG |
Darren Tucker | a0c0b63 | 2003-07-08 20:52:12 +1000 | [diff] [blame] | 144 | loginfailed((char *)user, hostname, (char *)ttyname, AUDIT_FAIL_AUTH); |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 145 | # else |
Darren Tucker | 5c6a91a | 2003-07-14 16:21:44 +1000 | [diff] [blame] | 146 | loginfailed((char *)user, hostname, (char *)ttyname); |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 147 | # endif |
Darren Tucker | 97363a8 | 2003-05-02 23:42:25 +1000 | [diff] [blame] | 148 | } |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 149 | # endif /* CUSTOM_FAILED_LOGIN */ |
Darren Tucker | fc3454e | 2003-07-14 16:41:55 +1000 | [diff] [blame] | 150 | |
| 151 | /* |
| 152 | * If we have setauthdb, retrieve the password registry for the user's |
| 153 | * account then feed it to setauthdb. This may load registry-specific method |
| 154 | * code. If we don't have setauthdb or have already called it this is a no-op. |
| 155 | */ |
| 156 | void |
| 157 | aix_setauthdb(const char *user) |
| 158 | { |
| 159 | # ifdef HAVE_SETAUTHDB |
| 160 | static char *registry = NULL; |
| 161 | |
| 162 | if (registry != NULL) /* have already done setauthdb */ |
| 163 | return; |
| 164 | |
| 165 | if (setuserdb(S_READ) == -1) { |
| 166 | debug3("%s: Could not open userdb to read", __func__); |
| 167 | return; |
| 168 | } |
| 169 | |
| 170 | if (getuserattr((char *)user, S_REGISTRY, ®istry, SEC_CHAR) == 0) { |
| 171 | if (setauthdb(registry, NULL) == 0) |
| 172 | debug3("%s: AIX/setauthdb set registry %s", __func__, |
| 173 | registry); |
| 174 | else |
| 175 | debug3("%s: AIX/setauthdb set registry %s failed: %s", |
| 176 | __func__, registry, strerror(errno)); |
| 177 | } else |
| 178 | debug3("%s: Could not read S_REGISTRY for user: %s", __func__, |
| 179 | strerror(errno)); |
| 180 | enduserdb(); |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 181 | # endif /* HAVE_SETAUTHDB */ |
Darren Tucker | fc3454e | 2003-07-14 16:41:55 +1000 | [diff] [blame] | 182 | } |
Ben Lindstrom | a9c039c | 2002-02-19 20:27:55 +0000 | [diff] [blame] | 183 | |
Darren Tucker | d763416 | 2003-11-22 14:16:56 +1100 | [diff] [blame] | 184 | # endif /* WITH_AIXAUTHENTICATE */ |
| 185 | |
| 186 | #endif /* _AIX */ |