blob: a8a52ce9a7f543a391f4e9a80d07630911c7633d [file] [log] [blame]
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001/*
Damien Miller95def091999-11-25 00:26:21 +11002 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
5 * Created: Sat Mar 18 05:11:38 1995 ylo
6 * Password authentication. This file contains the functions to check whether
7 * the password is valid for the user.
8 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10009
10#include "includes.h"
Damien Millerdd1c7ba1999-11-19 15:53:20 +110011
Damien Millerbeb4ba51999-12-28 15:09:35 +110012#ifndef USE_PAM
Damien Millerdd1c7ba1999-11-19 15:53:20 +110013
Damien Miller1808f382000-01-06 12:03:12 +110014RCSID("$Id: auth-passwd.c,v 1.15 2000/01/06 01:03:13 damien Exp $");
Damien Millerd4a8b7e1999-10-27 13:42:43 +100015
16#include "packet.h"
17#include "ssh.h"
18#include "servconf.h"
19#include "xmalloc.h"
Damien Miller2cb210f1999-11-13 15:40:10 +110020
21#ifdef HAVE_SHADOW_H
Damien Millerbeb4ba51999-12-28 15:09:35 +110022# include <shadow.h>
Damien Miller2cb210f1999-11-13 15:40:10 +110023#endif
Damien Millerbeb4ba51999-12-28 15:09:35 +110024#if defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT)
25# include "md5crypt.h"
26#endif /* defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT) */
Damien Millerdd1c7ba1999-11-19 15:53:20 +110027
Damien Miller95def091999-11-25 00:26:21 +110028/*
29 * Tries to authenticate the user using password. Returns true if
30 * authentication succeeds.
31 */
32int
33auth_password(struct passwd * pw, const char *password)
Damien Millerd4a8b7e1999-10-27 13:42:43 +100034{
Damien Miller95def091999-11-25 00:26:21 +110035 extern ServerOptions options;
36 char *encrypted_password;
Damien Miller2e1b0821999-12-25 10:11:29 +110037 char *pw_password;
38 char *salt;
Damien Miller2cb210f1999-11-13 15:40:10 +110039#ifdef HAVE_SHADOW_H
Damien Miller95def091999-11-25 00:26:21 +110040 struct spwd *spw;
Damien Miller2cb210f1999-11-13 15:40:10 +110041#endif
Damien Millerd4a8b7e1999-10-27 13:42:43 +100042
Damien Millerece22a81999-12-30 09:48:15 +110043 /* deny if no user. */
44 if (pw == NULL)
45 return 0;
Damien Miller5428f641999-11-25 11:54:57 +110046 if (pw->pw_uid == 0 && options.permit_root_login == 2)
Damien Miller95def091999-11-25 00:26:21 +110047 return 0;
Damien Miller5428f641999-11-25 11:54:57 +110048 if (*password == '\0' && options.permit_empty_passwd == 0)
Damien Miller95def091999-11-25 00:26:21 +110049 return 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100050
Damien Millerd4a8b7e1999-10-27 13:42:43 +100051#ifdef SKEY
Damien Miller95def091999-11-25 00:26:21 +110052 if (options.skey_authentication == 1) {
Damien Milleraae6c611999-12-06 11:47:28 +110053 int ret = auth_skey_password(pw, password);
54 if (ret == 1 || ret == 0)
55 return ret;
Damien Miller95def091999-11-25 00:26:21 +110056 /* Fall back to ordinary passwd authentication. */
57 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +100058#endif
Damien Milleraae6c611999-12-06 11:47:28 +110059#ifdef KRB4
60 if (options.kerberos_authentication == 1) {
61 int ret = auth_krb4_password(pw, password);
62 if (ret == 1 || ret == 0)
63 return ret;
Damien Miller95def091999-11-25 00:26:21 +110064 /* Fall back to ordinary passwd authentication. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100065 }
Damien Milleraae6c611999-12-06 11:47:28 +110066#endif
Damien Miller95def091999-11-25 00:26:21 +110067
68 /* Check for users with no password. */
Damien Miller5428f641999-11-25 11:54:57 +110069 if (strcmp(password, "") == 0 && strcmp(pw->pw_passwd, "") == 0)
Damien Miller95def091999-11-25 00:26:21 +110070 return 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100071
Damien Miller2e1b0821999-12-25 10:11:29 +110072 pw_password = pw->pw_passwd;
73
Damien Millercb7e5f91999-12-21 21:03:09 +110074#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
Damien Miller95def091999-11-25 00:26:21 +110075 spw = getspnam(pw->pw_name);
Damien Miller8eb0fd61999-12-31 08:49:13 +110076 if (spw != NULL)
77 {
78 /* Check for users with no password. */
79 if (strcmp(password, "") == 0 && strcmp(spw->sp_pwdp, "") == 0)
80 return 1;
Damien Miller2cb210f1999-11-13 15:40:10 +110081
Damien Miller8eb0fd61999-12-31 08:49:13 +110082 pw_password = spw->sp_pwdp;
83 }
Damien Millercb7e5f91999-12-21 21:03:09 +110084#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
Damien Miller2e1b0821999-12-25 10:11:29 +110085
86 if (pw_password[0] != '\0')
87 salt = pw_password;
88 else
89 salt = "xx";
90
91#ifdef HAVE_MD5_PASSWORDS
92 if (is_md5_salt(salt))
93 encrypted_password = md5_crypt(password, salt);
94 else
95 encrypted_password = crypt(password, salt);
96#else /* HAVE_MD5_PASSWORDS */
97 encrypted_password = crypt(password, salt);
98#endif /* HAVE_MD5_PASSWORDS */
99
100 /* Authentication is accepted if the encrypted passwords are identical. */
101 return (strcmp(encrypted_password, pw_password) == 0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000102}
Damien Millerbeb4ba51999-12-28 15:09:35 +1100103#endif /* !USE_PAM */