blob: 057335ba4fe906cc925d53d4c5c51e92bb2f13cb [file] [log] [blame]
djm@openbsd.org95767262016-03-07 19:02:43 +00001/* $OpenBSD: auth-rh-rsa.c,v 1.45 2016/03/07 19:02:43 djm Exp $ */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002/*
Damien Miller95def091999-11-25 00:26:21 +11003 * Author: Tatu Ylonen <ylo@cs.hut.fi>
Damien Miller95def091999-11-25 00:26:21 +11004 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
Damien Miller95def091999-11-25 00:26:21 +11006 * Rhosts or /etc/hosts.equiv authentication combined with RSA host
7 * authentication.
8 *
Damien Millere4340be2000-09-16 13:29:08 +11009 * As far as I am concerned, the code I have written for this software
10 * can be used freely for any purpose. Any derived versions of this
11 * software must be clearly marked as such, and if the derived work is
12 * incompatible with the protocol description in the RFC file, it must be
13 * called by a name other than "ssh" or "Secure Shell".
Damien Miller95def091999-11-25 00:26:21 +110014 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100015
16#include "includes.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100017
Damien Miller76c04802015-01-13 19:38:18 +110018#ifdef WITH_SSH1
19
Damien Miller9f2abc42006-07-10 20:53:08 +100020#include <sys/types.h>
21
22#include <pwd.h>
Damien Millerd7834352006-08-05 12:39:39 +100023#include <stdarg.h>
Damien Miller9f2abc42006-07-10 20:53:08 +100024
Damien Millerd4a8b7e1999-10-27 13:42:43 +100025#include "packet.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100026#include "uidswap.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000027#include "log.h"
Damien Millerd7834352006-08-05 12:39:39 +100028#include "buffer.h"
Damien Miller7acefbb2014-07-18 14:11:24 +100029#include "misc.h"
Damien Miller32265091999-11-12 11:33:04 +110030#include "servconf.h"
Damien Miller450a7a12000-03-26 13:04:51 +100031#include "key.h"
32#include "hostfile.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000033#include "pathnames.h"
34#include "auth.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000035#include "canohost.h"
Damien Millerd7834352006-08-05 12:39:39 +100036#ifdef GSSAPI
37#include "ssh-gss.h"
38#endif
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000039#include "monitor_wrap.h"
40
Ben Lindstrom186b7da2002-03-22 01:20:32 +000041/* import */
42extern ServerOptions options;
43
Damien Miller4af51302000-04-16 11:18:38 +100044int
djm@openbsd.org95767262016-03-07 19:02:43 +000045auth_rhosts_rsa_key_allowed(struct passwd *pw, const char *cuser,
46 const char *chost, Key *client_host_key)
Damien Millerd4a8b7e1999-10-27 13:42:43 +100047{
Damien Miller95def091999-11-25 00:26:21 +110048 HostStatus host_status;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100049
Damien Miller1aed65e2010-03-04 21:53:35 +110050 if (auth_key_is_revoked(client_host_key))
51 return 0;
52
Damien Miller95def091999-11-25 00:26:21 +110053 /* Check if we would accept it using rhosts authentication. */
Ben Lindstrom186b7da2002-03-22 01:20:32 +000054 if (!auth_rhosts(pw, cuser))
Damien Miller95def091999-11-25 00:26:21 +110055 return 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100056
Damien Millerd221ca62002-01-22 23:11:00 +110057 host_status = check_key_in_hostfiles(pw, client_host_key,
Ben Lindstrom186b7da2002-03-22 01:20:32 +000058 chost, _PATH_SSH_SYSTEM_HOSTFILE,
Ben Lindstroma4789ef2001-06-25 04:40:49 +000059 options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);
Damien Miller33e511e1999-11-11 11:43:13 +110060
Ben Lindstrom6328ab32002-03-22 02:54:23 +000061 return (host_status == HOST_OK);
Ben Lindstrom186b7da2002-03-22 01:20:32 +000062}
63
64/*
65 * Tries to authenticate the user using the .rhosts file and the host using
66 * its host key. Returns true if authentication succeeds.
67 */
68int
Damien Miller3e3b5142003-11-17 21:13:40 +110069auth_rhosts_rsa(Authctxt *authctxt, char *cuser, Key *client_host_key)
Ben Lindstrom186b7da2002-03-22 01:20:32 +000070{
djm@openbsd.org95767262016-03-07 19:02:43 +000071 struct ssh *ssh = active_state; /* XXX */
72 const char *chost;
Damien Miller3e3b5142003-11-17 21:13:40 +110073 struct passwd *pw = authctxt->pw;
Ben Lindstrom186b7da2002-03-22 01:20:32 +000074
75 debug("Trying rhosts with RSA host authentication for client user %.100s",
76 cuser);
77
Damien Miller3e3b5142003-11-17 21:13:40 +110078 if (!authctxt->valid || client_host_key == NULL ||
Ben Lindstrom186b7da2002-03-22 01:20:32 +000079 client_host_key->rsa == NULL)
80 return 0;
81
djm@openbsd.org95767262016-03-07 19:02:43 +000082 chost = auth_get_canonical_hostname(ssh, options.use_dns);
Ben Lindstrom186b7da2002-03-22 01:20:32 +000083 debug("Rhosts RSA authentication: canonical host %.900s", chost);
84
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000085 if (!PRIVSEP(auth_rhosts_rsa_key_allowed(pw, cuser, chost, client_host_key))) {
Damien Miller95def091999-11-25 00:26:21 +110086 debug("Rhosts with RSA host authentication denied: unknown or invalid host key");
87 packet_send_debug("Your host key cannot be verified: unknown or invalid host key.");
88 return 0;
89 }
90 /* A matching host key was found and is known. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100091
Damien Miller95def091999-11-25 00:26:21 +110092 /* Perform the challenge-response dialog with the client for the host key. */
Ben Lindstrom9c8aefe2002-03-22 01:12:58 +000093 if (!auth_rsa_challenge_dialog(client_host_key)) {
Damien Miller996acd22003-04-09 20:59:48 +100094 logit("Client on %.800s failed to respond correctly to host authentication.",
Ben Lindstrom186b7da2002-03-22 01:20:32 +000095 chost);
Damien Miller95def091999-11-25 00:26:21 +110096 return 0;
97 }
Damien Miller5428f641999-11-25 11:54:57 +110098 /*
99 * We have authenticated the user using .rhosts or /etc/hosts.equiv,
100 * and the host using RSA. We accept the authentication.
101 */
Damien Miller95def091999-11-25 00:26:21 +1100102
103 verbose("Rhosts with RSA host authentication accepted for %.100s, %.100s on %.700s.",
Damien Miller0dc1bef2005-07-17 17:22:45 +1000104 pw->pw_name, cuser, chost);
Damien Miller95def091999-11-25 00:26:21 +1100105 packet_send_debug("Rhosts with RSA host authentication accepted.");
106 return 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000107}
Damien Miller76c04802015-01-13 19:38:18 +1100108
109#endif /* WITH_SSH1 */