blob: a07f1fe77d86e7290209ffcbf8346bf97b9786a2 [file] [log] [blame]
Damien Miller4f9f42a2003-05-10 19:28:02 +10001/*-
2 * Copyright (c) 2002 Networks Associates Technology, Inc.
3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project by ThinkSec AS and
6 * NAI Labs, the Security Research Division of Network Associates, Inc.
7 * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
8 * DARPA CHATS research program.
Damien Millere69f18c2000-06-12 16:38:54 +10009 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
Damien Millere69f18c2000-06-12 16:38:54 +100018 *
Damien Miller4f9f42a2003-05-10 19:28:02 +100019 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
Damien Millere72b7af1999-12-30 15:08:44 +110030 */
Damien Miller26314f62004-06-01 11:28:20 +100031/*
32 * Copyright (c) 2003,2004 Damien Miller <djm@mindrot.org>
33 * Copyright (c) 2003,2004 Darren Tucker <dtucker@zip.com.au>
34 *
35 * Permission to use, copy, modify, and distribute this software for any
36 * purpose with or without fee is hereby granted, provided that the above
37 * copyright notice and this permission notice appear in all copies.
38 *
39 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
40 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
41 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
42 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
43 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
44 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
45 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
46 */
Damien Millere72b7af1999-12-30 15:08:44 +110047
Damien Miller25d93422003-05-18 20:45:47 +100048/* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
Damien Millere72b7af1999-12-30 15:08:44 +110049#include "includes.h"
Damien Miller6645e7a2006-03-15 14:42:54 +110050
51#include <sys/types.h>
52#include <sys/stat.h>
53#include <sys/wait.h>
Darren Tucker341dae52006-07-13 08:45:14 +100054
55#include <errno.h>
Damien Miller6645e7a2006-03-15 14:42:54 +110056#include <signal.h>
Damien Millerded319c2006-09-01 15:38:36 +100057#include <stdarg.h>
Damien Millerb8fe89c2006-07-24 14:51:00 +100058#include <string.h>
59#include <unistd.h>
Damien Millere72b7af1999-12-30 15:08:44 +110060
61#ifdef USE_PAM
Damien Miller0f47c532004-01-02 18:01:30 +110062#if defined(HAVE_SECURITY_PAM_APPL_H)
Damien Miller4f9f42a2003-05-10 19:28:02 +100063#include <security/pam_appl.h>
Damien Miller0f47c532004-01-02 18:01:30 +110064#elif defined (HAVE_PAM_PAM_APPL_H)
65#include <pam/pam_appl.h>
66#endif
Damien Miller4f9f42a2003-05-10 19:28:02 +100067
Darren Tuckerf08bdb52005-05-26 19:59:48 +100068/* OpenGroup RFC86.0 and XSSO specify no "const" on arguments */
69#ifdef PAM_SUN_CODEBASE
70# define sshpam_const /* Solaris, HP-UX, AIX */
71#else
72# define sshpam_const const /* LinuxPAM, OpenPAM */
73#endif
74
Damien Miller2ab323e2006-08-05 12:43:32 +100075/* Ambiguity in spec: is it an array of pointers or a pointer to an array? */
76#ifdef PAM_SUN_CODEBASE
77# define PAM_MSG_MEMBER(msg, n, member) ((*(msg))[(n)].member)
78#else
79# define PAM_MSG_MEMBER(msg, n, member) ((msg)[(n)]->member)
80#endif
81
Damien Miller75bb6642006-08-05 14:07:20 +100082#include "xmalloc.h"
83#include "buffer.h"
84#include "key.h"
85#include "hostfile.h"
Kevin Stevese683e762002-04-04 19:02:28 +000086#include "auth.h"
Damien Miller63dc3e92001-02-07 12:58:33 +110087#include "auth-pam.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000088#include "canohost.h"
Damien Miller4f9f42a2003-05-10 19:28:02 +100089#include "log.h"
Damien Miller4f9f42a2003-05-10 19:28:02 +100090#include "msg.h"
91#include "packet.h"
Darren Tuckerb6db1722004-05-13 17:29:35 +100092#include "misc.h"
Damien Miller4f9f42a2003-05-10 19:28:02 +100093#include "servconf.h"
94#include "ssh2.h"
Damien Miller1f499fd2003-08-25 13:08:49 +100095#include "auth-options.h"
Damien Miller75bb6642006-08-05 14:07:20 +100096#ifdef GSSAPI
97#include "ssh-gss.h"
98#endif
99#include "monitor_wrap.h"
Damien Millere72b7af1999-12-30 15:08:44 +1100100
Damien Miller4e448a32003-05-14 15:11:48 +1000101extern ServerOptions options;
Darren Tucker18df00c2003-11-18 12:42:07 +1100102extern Buffer loginmsg;
Darren Tucker07705c72003-12-18 15:34:31 +1100103extern int compat20;
Darren Tucker2a9bf4b2004-04-18 11:00:26 +1000104extern u_int utmp_len;
Damien Miller4e448a32003-05-14 15:11:48 +1000105
Darren Tucker328118a2005-05-25 16:18:09 +1000106/* so we don't silently change behaviour */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000107#ifdef USE_POSIX_THREADS
Darren Tucker328118a2005-05-25 16:18:09 +1000108# error "USE_POSIX_THREADS replaced by UNSUPPORTED_POSIX_THREADS_HACK"
109#endif
110
111/*
112 * Formerly known as USE_POSIX_THREADS, using this is completely unsupported
113 * and generally a bad idea. Use at own risk and do not expect support if
114 * this breaks.
115 */
116#ifdef UNSUPPORTED_POSIX_THREADS_HACK
Damien Miller4f9f42a2003-05-10 19:28:02 +1000117#include <pthread.h>
118/*
Damien Millera8e06ce2003-11-21 23:48:55 +1100119 * Avoid namespace clash when *not* using pthreads for systems *with*
120 * pthreads, which unconditionally define pthread_t via sys/types.h
Damien Miller4f9f42a2003-05-10 19:28:02 +1000121 * (e.g. Linux)
122 */
Damien Millera8e06ce2003-11-21 23:48:55 +1100123typedef pthread_t sp_pthread_t;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000124#else
Darren Tucker1b27c8f2004-01-13 22:35:58 +1100125typedef pid_t sp_pthread_t;
126#endif
127
128struct pam_ctxt {
129 sp_pthread_t pam_thread;
130 int pam_psock;
131 int pam_csock;
132 int pam_done;
133};
134
135static void sshpam_free_ctx(void *);
136static struct pam_ctxt *cleanup_ctxt;
137
Darren Tucker328118a2005-05-25 16:18:09 +1000138#ifndef UNSUPPORTED_POSIX_THREADS_HACK
Damien Miller4f9f42a2003-05-10 19:28:02 +1000139/*
140 * Simulate threads with processes.
141 */
Kevin Steves63007d42002-07-21 17:57:01 +0000142
Darren Tucker749bc952004-01-14 22:14:04 +1100143static int sshpam_thread_status = -1;
144static mysig_t sshpam_oldsig;
145
Damien Miller94cf4c82005-07-17 17:04:47 +1000146static void
Darren Tucker749bc952004-01-14 22:14:04 +1100147sshpam_sigchld_handler(int sig)
148{
Darren Tuckerb53355e2004-05-24 11:55:36 +1000149 signal(SIGCHLD, SIG_DFL);
Darren Tucker7ae09622004-01-14 23:07:56 +1100150 if (cleanup_ctxt == NULL)
151 return; /* handler called after PAM cleanup, shouldn't happen */
Darren Tuckerb53355e2004-05-24 11:55:36 +1000152 if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG)
Damien Miller37294fb2005-07-17 17:18:49 +1000153 <= 0) {
Darren Tuckerb53355e2004-05-24 11:55:36 +1000154 /* PAM thread has not exitted, privsep slave must have */
155 kill(cleanup_ctxt->pam_thread, SIGTERM);
156 if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0)
Darren Tucker5d423f42004-07-11 16:54:08 +1000157 <= 0)
Darren Tuckerb53355e2004-05-24 11:55:36 +1000158 return; /* could not wait */
159 }
Darren Tucker749bc952004-01-14 22:14:04 +1100160 if (WIFSIGNALED(sshpam_thread_status) &&
161 WTERMSIG(sshpam_thread_status) == SIGTERM)
162 return; /* terminated by pthread_cancel */
163 if (!WIFEXITED(sshpam_thread_status))
Darren Tucker57d4ca92007-08-10 14:32:34 +1000164 sigdie("PAM: authentication thread exited unexpectedly");
Darren Tucker749bc952004-01-14 22:14:04 +1100165 if (WEXITSTATUS(sshpam_thread_status) != 0)
Darren Tucker57d4ca92007-08-10 14:32:34 +1000166 sigdie("PAM: authentication thread exited uncleanly");
Darren Tucker749bc952004-01-14 22:14:04 +1100167}
168
Damien Millerb8fe89c2006-07-24 14:51:00 +1000169/* ARGSUSED */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000170static void
Damien Millerb8fe89c2006-07-24 14:51:00 +1000171pthread_exit(void *value)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000172{
173 _exit(0);
174}
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000175
Damien Millerb8fe89c2006-07-24 14:51:00 +1000176/* ARGSUSED */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000177static int
Damien Millerb8fe89c2006-07-24 14:51:00 +1000178pthread_create(sp_pthread_t *thread, const void *attr,
Damien Miller4f9f42a2003-05-10 19:28:02 +1000179 void *(*thread_start)(void *), void *arg)
180{
181 pid_t pid;
Darren Tucker4f1adad2005-07-16 11:33:06 +1000182 struct pam_ctxt *ctx = arg;
Damien Millere72b7af1999-12-30 15:08:44 +1100183
Darren Tuckerb9b60212004-03-04 20:03:54 +1100184 sshpam_thread_status = -1;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000185 switch ((pid = fork())) {
186 case -1:
187 error("fork(): %s", strerror(errno));
188 return (-1);
189 case 0:
Darren Tucker4f1adad2005-07-16 11:33:06 +1000190 close(ctx->pam_psock);
191 ctx->pam_psock = -1;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000192 thread_start(arg);
193 _exit(1);
194 default:
195 *thread = pid;
Darren Tucker4f1adad2005-07-16 11:33:06 +1000196 close(ctx->pam_csock);
197 ctx->pam_csock = -1;
Darren Tucker749bc952004-01-14 22:14:04 +1100198 sshpam_oldsig = signal(SIGCHLD, sshpam_sigchld_handler);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000199 return (0);
200 }
201}
Damien Millere72b7af1999-12-30 15:08:44 +1100202
Damien Miller4f9f42a2003-05-10 19:28:02 +1000203static int
204pthread_cancel(sp_pthread_t thread)
205{
Darren Tucker7ae09622004-01-14 23:07:56 +1100206 signal(SIGCHLD, sshpam_oldsig);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000207 return (kill(thread, SIGTERM));
208}
209
Damien Millerb8fe89c2006-07-24 14:51:00 +1000210/* ARGSUSED */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000211static int
Damien Millerb8fe89c2006-07-24 14:51:00 +1000212pthread_join(sp_pthread_t thread, void **value)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000213{
214 int status;
215
Darren Tucker749bc952004-01-14 22:14:04 +1100216 if (sshpam_thread_status != -1)
217 return (sshpam_thread_status);
218 signal(SIGCHLD, sshpam_oldsig);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000219 waitpid(thread, &status, 0);
220 return (status);
221}
222#endif
223
224
Damien Miller5c3a5582003-09-23 22:12:38 +1000225static pam_handle_t *sshpam_handle = NULL;
226static int sshpam_err = 0;
227static int sshpam_authenticated = 0;
Damien Miller5c3a5582003-09-23 22:12:38 +1000228static int sshpam_session_open = 0;
229static int sshpam_cred_established = 0;
Darren Tucker07705c72003-12-18 15:34:31 +1100230static int sshpam_account_status = -1;
Damien Millerc756e9b2003-11-17 21:41:42 +1100231static char **sshpam_env = NULL;
Darren Tucker17addf02004-03-30 20:57:57 +1000232static Authctxt *sshpam_authctxt = NULL;
Darren Tucker450a1582004-05-30 20:43:59 +1000233static const char *sshpam_password = NULL;
Darren Tucker36a3d602005-01-20 12:43:38 +1100234static char badpw[] = "\b\n\r\177INCORRECT";
Damien Miller4f9f42a2003-05-10 19:28:02 +1000235
Damien Millerc756e9b2003-11-17 21:41:42 +1100236/* Some PAM implementations don't implement this */
237#ifndef HAVE_PAM_GETENVLIST
238static char **
239pam_getenvlist(pam_handle_t *pamh)
240{
241 /*
Damien Millera8e06ce2003-11-21 23:48:55 +1100242 * XXX - If necessary, we can still support envrionment passing
Damien Millerc756e9b2003-11-17 21:41:42 +1100243 * for platforms without pam_getenvlist by searching for known
244 * env vars (e.g. KRB5CCNAME) from the PAM environment.
245 */
246 return NULL;
247}
248#endif
249
Darren Tucker21dd0892004-08-16 23:12:05 +1000250/*
251 * Some platforms, notably Solaris, do not enforce password complexity
252 * rules during pam_chauthtok() if the real uid of the calling process
253 * is 0, on the assumption that it's being called by "passwd" run by root.
254 * This wraps pam_chauthtok and sets/restore the real uid so PAM will do
255 * the right thing.
256 */
257#ifdef SSHPAM_CHAUTHTOK_NEEDS_RUID
258static int
259sshpam_chauthtok_ruid(pam_handle_t *pamh, int flags)
260{
261 int result;
262
263 if (sshpam_authctxt == NULL)
264 fatal("PAM: sshpam_authctxt not initialized");
265 if (setreuid(sshpam_authctxt->pw->pw_uid, -1) == -1)
266 fatal("%s: setreuid failed: %s", __func__, strerror(errno));
267 result = pam_chauthtok(pamh, flags);
268 if (setreuid(0, -1) == -1)
269 fatal("%s: setreuid failed: %s", __func__, strerror(errno));
270 return result;
271}
272# define pam_chauthtok(a,b) (sshpam_chauthtok_ruid((a), (b)))
273#endif
274
Darren Tucker07705c72003-12-18 15:34:31 +1100275void
Darren Tucker17db1c42004-06-19 12:54:38 +1000276sshpam_password_change_required(int reqd)
Darren Tucker07705c72003-12-18 15:34:31 +1100277{
Darren Tuckera8df9242004-01-15 00:15:07 +1100278 debug3("%s %d", __func__, reqd);
Darren Tucker17addf02004-03-30 20:57:57 +1000279 if (sshpam_authctxt == NULL)
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100280 fatal("%s: PAM authctxt not initialized", __func__);
Darren Tucker17addf02004-03-30 20:57:57 +1000281 sshpam_authctxt->force_pwchange = reqd;
Darren Tucker07705c72003-12-18 15:34:31 +1100282 if (reqd) {
283 no_port_forwarding_flag |= 2;
284 no_agent_forwarding_flag |= 2;
285 no_x11_forwarding_flag |= 2;
286 } else {
287 no_port_forwarding_flag &= ~2;
288 no_agent_forwarding_flag &= ~2;
289 no_x11_forwarding_flag &= ~2;
Darren Tucker07705c72003-12-18 15:34:31 +1100290 }
291}
Darren Tucker1921ed92004-02-10 13:23:28 +1100292
Damien Millerc756e9b2003-11-17 21:41:42 +1100293/* Import regular and PAM environment from subprocess */
294static void
295import_environments(Buffer *b)
296{
297 char *env;
298 u_int i, num_env;
299 int err;
300
Darren Tuckera8df9242004-01-15 00:15:07 +1100301 debug3("PAM: %s entering", __func__);
302
Darren Tucker328118a2005-05-25 16:18:09 +1000303#ifndef UNSUPPORTED_POSIX_THREADS_HACK
Darren Tucker07705c72003-12-18 15:34:31 +1100304 /* Import variables set by do_pam_account */
305 sshpam_account_status = buffer_get_int(b);
Darren Tucker17db1c42004-06-19 12:54:38 +1000306 sshpam_password_change_required(buffer_get_int(b));
Darren Tucker07705c72003-12-18 15:34:31 +1100307
Damien Millerc756e9b2003-11-17 21:41:42 +1100308 /* Import environment from subprocess */
309 num_env = buffer_get_int(b);
Darren Tuckerd8093e42006-05-04 16:24:34 +1000310 if (num_env > 1024)
311 fatal("%s: received %u environment variables, expected <= 1024",
312 __func__, num_env);
313 sshpam_env = xcalloc(num_env + 1, sizeof(*sshpam_env));
Damien Millerc756e9b2003-11-17 21:41:42 +1100314 debug3("PAM: num env strings %d", num_env);
315 for(i = 0; i < num_env; i++)
316 sshpam_env[i] = buffer_get_string(b, NULL);
317
318 sshpam_env[num_env] = NULL;
319
320 /* Import PAM environment from subprocess */
321 num_env = buffer_get_int(b);
322 debug("PAM: num PAM env strings %d", num_env);
323 for(i = 0; i < num_env; i++) {
324 env = buffer_get_string(b, NULL);
325
Darren Tucker8a1624c2003-11-18 12:45:35 +1100326#ifdef HAVE_PAM_PUTENV
Damien Millerc756e9b2003-11-17 21:41:42 +1100327 /* Errors are not fatal here */
328 if ((err = pam_putenv(sshpam_handle, env)) != PAM_SUCCESS) {
329 error("PAM: pam_putenv: %s",
330 pam_strerror(sshpam_handle, sshpam_err));
331 }
Darren Tucker8a1624c2003-11-18 12:45:35 +1100332#endif
Damien Millerc756e9b2003-11-17 21:41:42 +1100333 }
Darren Tucker4b385d42004-03-04 19:54:10 +1100334#endif
Damien Millerc756e9b2003-11-17 21:41:42 +1100335}
336
Damien Miller9d5705a2000-09-16 16:09:27 +1100337/*
Damien Miller4f9f42a2003-05-10 19:28:02 +1000338 * Conversation function for authentication thread.
Damien Miller9d5705a2000-09-16 16:09:27 +1100339 */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000340static int
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000341sshpam_thread_conv(int n, sshpam_const struct pam_message **msg,
Damien Miller1f499fd2003-08-25 13:08:49 +1000342 struct pam_response **resp, void *data)
Damien Millere72b7af1999-12-30 15:08:44 +1100343{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000344 Buffer buffer;
345 struct pam_ctxt *ctxt;
Damien Miller5c3a5582003-09-23 22:12:38 +1000346 struct pam_response *reply;
Kevin Steves38b050a2002-07-23 00:44:07 +0000347 int i;
348
Darren Tuckerba53b832004-02-17 20:46:59 +1100349 debug3("PAM: %s entering, %d messages", __func__, n);
Damien Miller5c3a5582003-09-23 22:12:38 +1000350 *resp = NULL;
351
Darren Tucker59e06022004-06-30 20:34:31 +1000352 if (data == NULL) {
353 error("PAM: conversation function passed a null context");
354 return (PAM_CONV_ERR);
355 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000356 ctxt = data;
357 if (n <= 0 || n > PAM_MAX_NUM_MSG)
358 return (PAM_CONV_ERR);
Damien Miller5c3a5582003-09-23 22:12:38 +1000359
Darren Tuckerd8093e42006-05-04 16:24:34 +1000360 if ((reply = calloc(n, sizeof(*reply))) == NULL)
Damien Miller5c3a5582003-09-23 22:12:38 +1000361 return (PAM_CONV_ERR);
Damien Miller5c3a5582003-09-23 22:12:38 +1000362
Damien Miller4f9f42a2003-05-10 19:28:02 +1000363 buffer_init(&buffer);
364 for (i = 0; i < n; ++i) {
Damien Miller4f9f42a2003-05-10 19:28:02 +1000365 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
366 case PAM_PROMPT_ECHO_OFF:
Damien Millera8e06ce2003-11-21 23:48:55 +1100367 buffer_put_cstring(&buffer,
Damien Miller5c3a5582003-09-23 22:12:38 +1000368 PAM_MSG_MEMBER(msg, i, msg));
Damien Millera8e06ce2003-11-21 23:48:55 +1100369 if (ssh_msg_send(ctxt->pam_csock,
Damien Miller9bdba702003-11-17 21:27:55 +1100370 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
371 goto fail;
Damien Millera8e06ce2003-11-21 23:48:55 +1100372 if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
Damien Miller9bdba702003-11-17 21:27:55 +1100373 goto fail;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000374 if (buffer_get_char(&buffer) != PAM_AUTHTOK)
375 goto fail;
Damien Miller5c3a5582003-09-23 22:12:38 +1000376 reply[i].resp = buffer_get_string(&buffer, NULL);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000377 break;
378 case PAM_PROMPT_ECHO_ON:
Damien Millera8e06ce2003-11-21 23:48:55 +1100379 buffer_put_cstring(&buffer,
Damien Miller5c3a5582003-09-23 22:12:38 +1000380 PAM_MSG_MEMBER(msg, i, msg));
Damien Millera8e06ce2003-11-21 23:48:55 +1100381 if (ssh_msg_send(ctxt->pam_csock,
Damien Miller9bdba702003-11-17 21:27:55 +1100382 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
383 goto fail;
384 if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1)
385 goto fail;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000386 if (buffer_get_char(&buffer) != PAM_AUTHTOK)
387 goto fail;
Damien Miller5c3a5582003-09-23 22:12:38 +1000388 reply[i].resp = buffer_get_string(&buffer, NULL);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000389 break;
390 case PAM_ERROR_MSG:
Damien Millera8e06ce2003-11-21 23:48:55 +1100391 buffer_put_cstring(&buffer,
Damien Miller5c3a5582003-09-23 22:12:38 +1000392 PAM_MSG_MEMBER(msg, i, msg));
Damien Millera8e06ce2003-11-21 23:48:55 +1100393 if (ssh_msg_send(ctxt->pam_csock,
Damien Miller9bdba702003-11-17 21:27:55 +1100394 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
395 goto fail;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000396 break;
397 case PAM_TEXT_INFO:
Damien Millera8e06ce2003-11-21 23:48:55 +1100398 buffer_put_cstring(&buffer,
Damien Miller5c3a5582003-09-23 22:12:38 +1000399 PAM_MSG_MEMBER(msg, i, msg));
Damien Millera8e06ce2003-11-21 23:48:55 +1100400 if (ssh_msg_send(ctxt->pam_csock,
Damien Miller9bdba702003-11-17 21:27:55 +1100401 PAM_MSG_MEMBER(msg, i, msg_style), &buffer) == -1)
402 goto fail;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000403 break;
404 default:
405 goto fail;
406 }
407 buffer_clear(&buffer);
Kevin Steves38b050a2002-07-23 00:44:07 +0000408 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000409 buffer_free(&buffer);
Damien Miller5c3a5582003-09-23 22:12:38 +1000410 *resp = reply;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000411 return (PAM_SUCCESS);
Damien Miller5c3a5582003-09-23 22:12:38 +1000412
Damien Miller4f9f42a2003-05-10 19:28:02 +1000413 fail:
Damien Miller5c3a5582003-09-23 22:12:38 +1000414 for(i = 0; i < n; i++) {
415 if (reply[i].resp != NULL)
416 xfree(reply[i].resp);
417 }
418 xfree(reply);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000419 buffer_free(&buffer);
420 return (PAM_CONV_ERR);
Kevin Steves38b050a2002-07-23 00:44:07 +0000421}
422
Damien Miller4f9f42a2003-05-10 19:28:02 +1000423/*
424 * Authentication thread.
425 */
426static void *
427sshpam_thread(void *ctxtp)
Damien Millere72b7af1999-12-30 15:08:44 +1100428{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000429 struct pam_ctxt *ctxt = ctxtp;
430 Buffer buffer;
Damien Millerf4b6f102003-09-02 23:12:06 +1000431 struct pam_conv sshpam_conv;
Darren Tucker1f7e4082004-07-01 14:00:14 +1000432 int flags = (options.permit_empty_passwd == 0 ?
433 PAM_DISALLOW_NULL_AUTHTOK : 0);
Darren Tucker328118a2005-05-25 16:18:09 +1000434#ifndef UNSUPPORTED_POSIX_THREADS_HACK
Damien Millerc756e9b2003-11-17 21:41:42 +1100435 extern char **environ;
436 char **env_from_pam;
437 u_int i;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000438 const char *pam_user;
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000439 const char **ptr_pam_user = &pam_user;
Darren Tucker54e1b222006-09-17 11:57:46 +1000440 char *tz = getenv("TZ");
Damien Miller4f9f42a2003-05-10 19:28:02 +1000441
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000442 pam_get_item(sshpam_handle, PAM_USER,
443 (sshpam_const void **)ptr_pam_user);
Darren Tucker54e1b222006-09-17 11:57:46 +1000444
Damien Millerc756e9b2003-11-17 21:41:42 +1100445 environ[0] = NULL;
Darren Tucker54e1b222006-09-17 11:57:46 +1000446 if (tz != NULL)
447 if (setenv("TZ", tz, 1) == -1)
448 error("PAM: could not set TZ environment: %s",
449 strerror(errno));
Damien Miller2d2ed3d2004-07-21 20:54:47 +1000450
451 if (sshpam_authctxt != NULL) {
452 setproctitle("%s [pam]",
453 sshpam_authctxt->valid ? pam_user : "unknown");
454 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000455#endif
456
Damien Millerf4b6f102003-09-02 23:12:06 +1000457 sshpam_conv.conv = sshpam_thread_conv;
458 sshpam_conv.appdata_ptr = ctxt;
459
Darren Tucker17addf02004-03-30 20:57:57 +1000460 if (sshpam_authctxt == NULL)
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100461 fatal("%s: PAM authctxt not initialized", __func__);
462
Damien Miller4f9f42a2003-05-10 19:28:02 +1000463 buffer_init(&buffer);
464 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
465 (const void *)&sshpam_conv);
466 if (sshpam_err != PAM_SUCCESS)
467 goto auth_fail;
Darren Tucker1f7e4082004-07-01 14:00:14 +1000468 sshpam_err = pam_authenticate(sshpam_handle, flags);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000469 if (sshpam_err != PAM_SUCCESS)
470 goto auth_fail;
Darren Tucker07705c72003-12-18 15:34:31 +1100471
Darren Tuckerc376c862003-12-18 16:08:59 +1100472 if (compat20) {
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000473 if (!do_pam_account()) {
474 sshpam_err = PAM_ACCT_EXPIRED;
Darren Tucker07705c72003-12-18 15:34:31 +1100475 goto auth_fail;
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000476 }
Darren Tucker17addf02004-03-30 20:57:57 +1000477 if (sshpam_authctxt->force_pwchange) {
Darren Tucker07705c72003-12-18 15:34:31 +1100478 sshpam_err = pam_chauthtok(sshpam_handle,
479 PAM_CHANGE_EXPIRED_AUTHTOK);
480 if (sshpam_err != PAM_SUCCESS)
481 goto auth_fail;
Darren Tucker17db1c42004-06-19 12:54:38 +1000482 sshpam_password_change_required(0);
Darren Tucker07705c72003-12-18 15:34:31 +1100483 }
Darren Tuckerc376c862003-12-18 16:08:59 +1100484 }
Darren Tucker07705c72003-12-18 15:34:31 +1100485
Damien Miller4f9f42a2003-05-10 19:28:02 +1000486 buffer_put_cstring(&buffer, "OK");
Damien Millerc756e9b2003-11-17 21:41:42 +1100487
Darren Tucker328118a2005-05-25 16:18:09 +1000488#ifndef UNSUPPORTED_POSIX_THREADS_HACK
Darren Tucker07705c72003-12-18 15:34:31 +1100489 /* Export variables set by do_pam_account */
490 buffer_put_int(&buffer, sshpam_account_status);
Darren Tucker17addf02004-03-30 20:57:57 +1000491 buffer_put_int(&buffer, sshpam_authctxt->force_pwchange);
Darren Tucker07705c72003-12-18 15:34:31 +1100492
Damien Millerc756e9b2003-11-17 21:41:42 +1100493 /* Export any environment strings set in child */
494 for(i = 0; environ[i] != NULL; i++)
495 ; /* Count */
496 buffer_put_int(&buffer, i);
497 for(i = 0; environ[i] != NULL; i++)
498 buffer_put_cstring(&buffer, environ[i]);
499
500 /* Export any environment strings set by PAM in child */
501 env_from_pam = pam_getenvlist(sshpam_handle);
502 for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
503 ; /* Count */
504 buffer_put_int(&buffer, i);
505 for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++)
506 buffer_put_cstring(&buffer, env_from_pam[i]);
Darren Tucker328118a2005-05-25 16:18:09 +1000507#endif /* UNSUPPORTED_POSIX_THREADS_HACK */
Damien Millerc756e9b2003-11-17 21:41:42 +1100508
Damien Miller9bdba702003-11-17 21:27:55 +1100509 /* XXX - can't do much about an error here */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000510 ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
511 buffer_free(&buffer);
512 pthread_exit(NULL);
513
514 auth_fail:
515 buffer_put_cstring(&buffer,
516 pam_strerror(sshpam_handle, sshpam_err));
Damien Miller9bdba702003-11-17 21:27:55 +1100517 /* XXX - can't do much about an error here */
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000518 if (sshpam_err == PAM_ACCT_EXPIRED)
519 ssh_msg_send(ctxt->pam_csock, PAM_ACCT_EXPIRED, &buffer);
520 else
521 ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000522 buffer_free(&buffer);
523 pthread_exit(NULL);
Damien Miller787b2ec2003-11-21 23:56:47 +1100524
Damien Miller4f9f42a2003-05-10 19:28:02 +1000525 return (NULL); /* Avoid warning for non-pthread case */
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000526}
527
Darren Tucker8846a072003-10-07 11:30:15 +1000528void
529sshpam_thread_cleanup(void)
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000530{
Darren Tucker8846a072003-10-07 11:30:15 +1000531 struct pam_ctxt *ctxt = cleanup_ctxt;
Kevin Stevesef4eea92001-02-05 12:42:17 +0000532
Darren Tuckera8df9242004-01-15 00:15:07 +1100533 debug3("PAM: %s entering", __func__);
Darren Tucker8846a072003-10-07 11:30:15 +1000534 if (ctxt != NULL && ctxt->pam_thread != 0) {
535 pthread_cancel(ctxt->pam_thread);
536 pthread_join(ctxt->pam_thread, NULL);
537 close(ctxt->pam_psock);
538 close(ctxt->pam_csock);
539 memset(ctxt, 0, sizeof(*ctxt));
540 cleanup_ctxt = NULL;
541 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000542}
Kevin Stevesef4eea92001-02-05 12:42:17 +0000543
Damien Miller4f9f42a2003-05-10 19:28:02 +1000544static int
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000545sshpam_null_conv(int n, sshpam_const struct pam_message **msg,
Damien Miller1f499fd2003-08-25 13:08:49 +1000546 struct pam_response **resp, void *data)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000547{
Darren Tuckerba53b832004-02-17 20:46:59 +1100548 debug3("PAM: %s entering, %d messages", __func__, n);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000549 return (PAM_CONV_ERR);
550}
Damien Miller63dc3e92001-02-07 12:58:33 +1100551
Damien Miller4f9f42a2003-05-10 19:28:02 +1000552static struct pam_conv null_conv = { sshpam_null_conv, NULL };
553
Darren Tucker0a7e3c62004-09-11 22:28:01 +1000554static int
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000555sshpam_store_conv(int n, sshpam_const struct pam_message **msg,
Darren Tucker0a7e3c62004-09-11 22:28:01 +1000556 struct pam_response **resp, void *data)
557{
558 struct pam_response *reply;
559 int i;
560 size_t len;
561
562 debug3("PAM: %s called with %d messages", __func__, n);
563 *resp = NULL;
564
565 if (n <= 0 || n > PAM_MAX_NUM_MSG)
566 return (PAM_CONV_ERR);
567
Darren Tuckerd8093e42006-05-04 16:24:34 +1000568 if ((reply = calloc(n, sizeof(*reply))) == NULL)
Darren Tucker0a7e3c62004-09-11 22:28:01 +1000569 return (PAM_CONV_ERR);
Darren Tucker0a7e3c62004-09-11 22:28:01 +1000570
571 for (i = 0; i < n; ++i) {
572 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
573 case PAM_ERROR_MSG:
574 case PAM_TEXT_INFO:
575 len = strlen(PAM_MSG_MEMBER(msg, i, msg));
576 buffer_append(&loginmsg, PAM_MSG_MEMBER(msg, i, msg), len);
577 buffer_append(&loginmsg, "\n", 1 );
578 reply[i].resp_retcode = PAM_SUCCESS;
579 break;
580 default:
581 goto fail;
582 }
583 }
584 *resp = reply;
585 return (PAM_SUCCESS);
586
587 fail:
588 for(i = 0; i < n; i++) {
589 if (reply[i].resp != NULL)
590 xfree(reply[i].resp);
591 }
592 xfree(reply);
593 return (PAM_CONV_ERR);
594}
595
596static struct pam_conv store_conv = { sshpam_store_conv, NULL };
597
Darren Tucker8846a072003-10-07 11:30:15 +1000598void
599sshpam_cleanup(void)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000600{
Damien Miller4f9f42a2003-05-10 19:28:02 +1000601 debug("PAM: cleanup");
Damien Miller5c3a5582003-09-23 22:12:38 +1000602 if (sshpam_handle == NULL)
603 return;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000604 pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
605 if (sshpam_cred_established) {
606 pam_setcred(sshpam_handle, PAM_DELETE_CRED);
607 sshpam_cred_established = 0;
608 }
609 if (sshpam_session_open) {
610 pam_close_session(sshpam_handle, PAM_SILENT);
611 sshpam_session_open = 0;
612 }
Darren Tucker1921ed92004-02-10 13:23:28 +1100613 sshpam_authenticated = 0;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000614 pam_end(sshpam_handle, sshpam_err);
615 sshpam_handle = NULL;
616}
617
618static int
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100619sshpam_init(Authctxt *authctxt)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000620{
Darren Tucker455813b2003-09-13 22:12:11 +1000621 extern char *__progname;
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100622 const char *pam_rhost, *pam_user, *user = authctxt->user;
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000623 const char **ptr_pam_user = &pam_user;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000624
625 if (sshpam_handle != NULL) {
626 /* We already have a PAM context; check if the user matches */
627 sshpam_err = pam_get_item(sshpam_handle,
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000628 PAM_USER, (sshpam_const void **)ptr_pam_user);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000629 if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0)
630 return (0);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000631 pam_end(sshpam_handle, sshpam_err);
632 sshpam_handle = NULL;
633 }
634 debug("PAM: initializing for \"%s\"", user);
Darren Tuckerc58c2ee2003-09-13 22:02:05 +1000635 sshpam_err =
Darren Tucker77fc29e2004-09-11 23:07:03 +1000636 pam_start(SSHD_PAM_SERVICE, user, &store_conv, &sshpam_handle);
Darren Tucker17addf02004-03-30 20:57:57 +1000637 sshpam_authctxt = authctxt;
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100638
Damien Miller4f9f42a2003-05-10 19:28:02 +1000639 if (sshpam_err != PAM_SUCCESS) {
640 pam_end(sshpam_handle, sshpam_err);
641 sshpam_handle = NULL;
642 return (-1);
643 }
Damien Miller3a961dc2003-06-03 10:25:48 +1000644 pam_rhost = get_remote_name_or_ip(utmp_len, options.use_dns);
Damien Miller46337202003-06-02 11:04:39 +1000645 debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
Damien Miller25d93422003-05-18 20:45:47 +1000646 sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
647 if (sshpam_err != PAM_SUCCESS) {
Damien Miller1f499fd2003-08-25 13:08:49 +1000648 pam_end(sshpam_handle, sshpam_err);
Damien Miller25d93422003-05-18 20:45:47 +1000649 sshpam_handle = NULL;
650 return (-1);
651 }
652#ifdef PAM_TTY_KLUDGE
Damien Millera8e06ce2003-11-21 23:48:55 +1100653 /*
654 * Some silly PAM modules (e.g. pam_time) require a TTY to operate.
655 * sshd doesn't set the tty until too late in the auth process and
Damien Miller25d93422003-05-18 20:45:47 +1000656 * may not even set one (for tty-less connections)
Damien Millera8e06ce2003-11-21 23:48:55 +1100657 */
Damien Miller25d93422003-05-18 20:45:47 +1000658 debug("PAM: setting PAM_TTY to \"ssh\"");
659 sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, "ssh");
660 if (sshpam_err != PAM_SUCCESS) {
661 pam_end(sshpam_handle, sshpam_err);
662 sshpam_handle = NULL;
663 return (-1);
664 }
665#endif
Damien Miller4f9f42a2003-05-10 19:28:02 +1000666 return (0);
667}
668
669static void *
670sshpam_init_ctx(Authctxt *authctxt)
671{
672 struct pam_ctxt *ctxt;
673 int socks[2];
674
Darren Tuckera8df9242004-01-15 00:15:07 +1100675 debug3("PAM: %s entering", __func__);
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000676 /*
677 * Refuse to start if we don't have PAM enabled or do_pam_account
678 * has previously failed.
679 */
680 if (!options.use_pam || sshpam_account_status == 0)
Damien Miller4e448a32003-05-14 15:11:48 +1000681 return NULL;
682
Damien Miller4f9f42a2003-05-10 19:28:02 +1000683 /* Initialize PAM */
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100684 if (sshpam_init(authctxt) == -1) {
Damien Miller4f9f42a2003-05-10 19:28:02 +1000685 error("PAM: initialization failed");
686 return (NULL);
687 }
688
Darren Tucker29171e92007-05-20 15:20:08 +1000689 ctxt = xcalloc(1, sizeof *ctxt);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000690
691 /* Start the authentication thread */
692 if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
693 error("PAM: failed create sockets: %s", strerror(errno));
694 xfree(ctxt);
695 return (NULL);
696 }
697 ctxt->pam_psock = socks[0];
698 ctxt->pam_csock = socks[1];
699 if (pthread_create(&ctxt->pam_thread, NULL, sshpam_thread, ctxt) == -1) {
700 error("PAM: failed to start authentication thread: %s",
701 strerror(errno));
702 close(socks[0]);
703 close(socks[1]);
704 xfree(ctxt);
705 return (NULL);
706 }
Darren Tucker8846a072003-10-07 11:30:15 +1000707 cleanup_ctxt = ctxt;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000708 return (ctxt);
709}
710
711static int
712sshpam_query(void *ctx, char **name, char **info,
713 u_int *num, char ***prompts, u_int **echo_on)
714{
715 Buffer buffer;
716 struct pam_ctxt *ctxt = ctx;
717 size_t plen;
718 u_char type;
719 char *msg;
Damien Millerdaffc6a2004-10-16 18:52:44 +1000720 size_t len, mlen;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000721
Darren Tuckera8df9242004-01-15 00:15:07 +1100722 debug3("PAM: %s entering", __func__);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000723 buffer_init(&buffer);
724 *name = xstrdup("");
725 *info = xstrdup("");
726 *prompts = xmalloc(sizeof(char *));
727 **prompts = NULL;
728 plen = 0;
729 *echo_on = xmalloc(sizeof(u_int));
730 while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) {
731 type = buffer_get_char(&buffer);
732 msg = buffer_get_string(&buffer, NULL);
Damien Millerdaffc6a2004-10-16 18:52:44 +1000733 mlen = strlen(msg);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000734 switch (type) {
735 case PAM_PROMPT_ECHO_ON:
736 case PAM_PROMPT_ECHO_OFF:
737 *num = 1;
Damien Millerdaffc6a2004-10-16 18:52:44 +1000738 len = plen + mlen + 1;
Damien Miller36812092006-03-26 14:22:47 +1100739 **prompts = xrealloc(**prompts, 1, len);
Damien Millerdaffc6a2004-10-16 18:52:44 +1000740 strlcpy(**prompts + plen, msg, len - plen);
741 plen += mlen;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000742 **echo_on = (type == PAM_PROMPT_ECHO_ON);
743 xfree(msg);
744 return (0);
745 case PAM_ERROR_MSG:
746 case PAM_TEXT_INFO:
747 /* accumulate messages */
Damien Millerdaffc6a2004-10-16 18:52:44 +1000748 len = plen + mlen + 2;
Damien Miller36812092006-03-26 14:22:47 +1100749 **prompts = xrealloc(**prompts, 1, len);
Damien Millerdaffc6a2004-10-16 18:52:44 +1000750 strlcpy(**prompts + plen, msg, len - plen);
751 plen += mlen;
752 strlcat(**prompts + plen, "\n", len - plen);
753 plen++;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000754 xfree(msg);
755 break;
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000756 case PAM_ACCT_EXPIRED:
757 sshpam_account_status = 0;
758 /* FALLTHROUGH */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000759 case PAM_AUTH_ERR:
Darren Tucker2c77b7f2006-05-15 17:22:33 +1000760 debug3("PAM: %s", pam_strerror(sshpam_handle, type));
Darren Tucker7b1e6952005-09-28 22:33:27 +1000761 if (**prompts != NULL && strlen(**prompts) != 0) {
762 *info = **prompts;
763 **prompts = NULL;
764 *num = 0;
765 **echo_on = 0;
766 ctxt->pam_done = -1;
Damien Miller66f9eb62006-03-18 23:04:49 +1100767 xfree(msg);
Darren Tucker7b1e6952005-09-28 22:33:27 +1000768 return 0;
769 }
770 /* FALLTHROUGH */
771 case PAM_SUCCESS:
Damien Miller4f9f42a2003-05-10 19:28:02 +1000772 if (**prompts != NULL) {
773 /* drain any accumulated messages */
Darren Tucker18df00c2003-11-18 12:42:07 +1100774 debug("PAM: %s", **prompts);
775 buffer_append(&loginmsg, **prompts,
776 strlen(**prompts));
Damien Miller4f9f42a2003-05-10 19:28:02 +1000777 xfree(**prompts);
778 **prompts = NULL;
779 }
780 if (type == PAM_SUCCESS) {
Darren Tuckerd5bfa8f2005-01-20 13:29:51 +1100781 if (!sshpam_authctxt->valid ||
782 (sshpam_authctxt->pw->pw_uid == 0 &&
783 options.permit_root_login != PERMIT_YES))
Darren Tucker36a3d602005-01-20 12:43:38 +1100784 fatal("Internal error: PAM auth "
785 "succeeded when it should have "
786 "failed");
Damien Millerc756e9b2003-11-17 21:41:42 +1100787 import_environments(&buffer);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000788 *num = 0;
789 **echo_on = 0;
790 ctxt->pam_done = 1;
791 xfree(msg);
792 return (0);
793 }
Darren Tucker2a9bf4b2004-04-18 11:00:26 +1000794 error("PAM: %s for %s%.100s from %.100s", msg,
795 sshpam_authctxt->valid ? "" : "illegal user ",
796 sshpam_authctxt->user,
797 get_remote_name_or_ip(utmp_len, options.use_dns));
Darren Tucker439ce0d2003-10-09 14:20:15 +1000798 /* FALLTHROUGH */
Damien Miller4f9f42a2003-05-10 19:28:02 +1000799 default:
800 *num = 0;
801 **echo_on = 0;
802 xfree(msg);
803 ctxt->pam_done = -1;
804 return (-1);
805 }
806 }
807 return (-1);
808}
809
810/* XXX - see also comment in auth-chall.c:verify_response */
811static int
812sshpam_respond(void *ctx, u_int num, char **resp)
813{
814 Buffer buffer;
815 struct pam_ctxt *ctxt = ctx;
816
Darren Tucker1d4ebbf2006-01-29 16:46:13 +1100817 debug2("PAM: %s entering, %u responses", __func__, num);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000818 switch (ctxt->pam_done) {
819 case 1:
820 sshpam_authenticated = 1;
821 return (0);
822 case 0:
823 break;
824 default:
825 return (-1);
826 }
827 if (num != 1) {
828 error("PAM: expected one response, got %u", num);
829 return (-1);
830 }
831 buffer_init(&buffer);
Darren Tuckerd5bfa8f2005-01-20 13:29:51 +1100832 if (sshpam_authctxt->valid &&
833 (sshpam_authctxt->pw->pw_uid != 0 ||
Damien Miller37294fb2005-07-17 17:18:49 +1000834 options.permit_root_login == PERMIT_YES))
Darren Tucker36a3d602005-01-20 12:43:38 +1100835 buffer_put_cstring(&buffer, *resp);
836 else
837 buffer_put_cstring(&buffer, badpw);
Damien Miller9bdba702003-11-17 21:27:55 +1100838 if (ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer) == -1) {
839 buffer_free(&buffer);
840 return (-1);
841 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000842 buffer_free(&buffer);
843 return (1);
844}
845
846static void
847sshpam_free_ctx(void *ctxtp)
848{
849 struct pam_ctxt *ctxt = ctxtp;
850
Darren Tuckera8df9242004-01-15 00:15:07 +1100851 debug3("PAM: %s entering", __func__);
Darren Tucker8846a072003-10-07 11:30:15 +1000852 sshpam_thread_cleanup();
Damien Miller4f9f42a2003-05-10 19:28:02 +1000853 xfree(ctxt);
854 /*
855 * We don't call sshpam_cleanup() here because we may need the PAM
856 * handle at a later stage, e.g. when setting up a session. It's
857 * still on the cleanup list, so pam_end() *will* be called before
858 * the server process terminates.
859 */
860}
861
862KbdintDevice sshpam_device = {
863 "pam",
864 sshpam_init_ctx,
865 sshpam_query,
866 sshpam_respond,
867 sshpam_free_ctx
868};
869
870KbdintDevice mm_sshpam_device = {
871 "pam",
872 mm_sshpam_init_ctx,
873 mm_sshpam_query,
874 mm_sshpam_respond,
875 mm_sshpam_free_ctx
876};
877
878/*
879 * This replaces auth-pam.c
880 */
881void
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100882start_pam(Authctxt *authctxt)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000883{
Damien Miller9d507da2003-05-14 15:31:12 +1000884 if (!options.use_pam)
885 fatal("PAM: initialisation requested when UsePAM=no");
886
Darren Tuckerdbf7a742004-03-08 23:04:06 +1100887 if (sshpam_init(authctxt) == -1)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000888 fatal("PAM: initialisation failed");
889}
890
891void
892finish_pam(void)
893{
Darren Tucker8846a072003-10-07 11:30:15 +1000894 sshpam_cleanup();
Damien Miller4f9f42a2003-05-10 19:28:02 +1000895}
896
Damien Miller1f499fd2003-08-25 13:08:49 +1000897u_int
898do_pam_account(void)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000899{
Darren Tucker77fc29e2004-09-11 23:07:03 +1000900 debug("%s: called", __func__);
Darren Tucker07705c72003-12-18 15:34:31 +1100901 if (sshpam_account_status != -1)
902 return (sshpam_account_status);
903
Damien Miller1f499fd2003-08-25 13:08:49 +1000904 sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
Darren Tucker77fc29e2004-09-11 23:07:03 +1000905 debug3("PAM: %s pam_acct_mgmt = %d (%s)", __func__, sshpam_err,
906 pam_strerror(sshpam_handle, sshpam_err));
Damien Miller94cf4c82005-07-17 17:04:47 +1000907
Darren Tucker07705c72003-12-18 15:34:31 +1100908 if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
909 sshpam_account_status = 0;
910 return (sshpam_account_status);
Damien Miller1f499fd2003-08-25 13:08:49 +1000911 }
912
Darren Tucker07705c72003-12-18 15:34:31 +1100913 if (sshpam_err == PAM_NEW_AUTHTOK_REQD)
Darren Tucker17db1c42004-06-19 12:54:38 +1000914 sshpam_password_change_required(1);
Darren Tucker07705c72003-12-18 15:34:31 +1100915
916 sshpam_account_status = 1;
917 return (sshpam_account_status);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000918}
919
920void
Damien Miller341c6e62003-09-02 23:18:52 +1000921do_pam_set_tty(const char *tty)
922{
Darren Tuckerf38db7f2003-08-08 13:43:37 +1000923 if (tty != NULL) {
924 debug("PAM: setting PAM_TTY to \"%s\"", tty);
925 sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, tty);
926 if (sshpam_err != PAM_SUCCESS)
927 fatal("PAM: failed to set PAM_TTY: %s",
928 pam_strerror(sshpam_handle, sshpam_err));
929 }
Damien Miller4f9f42a2003-05-10 19:28:02 +1000930}
931
932void
933do_pam_setcred(int init)
934{
935 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
Darren Tucker77fc29e2004-09-11 23:07:03 +1000936 (const void *)&store_conv);
Damien Miller4f9f42a2003-05-10 19:28:02 +1000937 if (sshpam_err != PAM_SUCCESS)
938 fatal("PAM: failed to set PAM_CONV: %s",
939 pam_strerror(sshpam_handle, sshpam_err));
940 if (init) {
941 debug("PAM: establishing credentials");
942 sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED);
943 } else {
944 debug("PAM: reinitializing credentials");
945 sshpam_err = pam_setcred(sshpam_handle, PAM_REINITIALIZE_CRED);
946 }
947 if (sshpam_err == PAM_SUCCESS) {
948 sshpam_cred_established = 1;
949 return;
950 }
951 if (sshpam_authenticated)
952 fatal("PAM: pam_setcred(): %s",
953 pam_strerror(sshpam_handle, sshpam_err));
954 else
955 debug("PAM: pam_setcred(): %s",
956 pam_strerror(sshpam_handle, sshpam_err));
957}
958
Damien Miller4f9f42a2003-05-10 19:28:02 +1000959static int
Darren Tuckerf08bdb52005-05-26 19:59:48 +1000960sshpam_tty_conv(int n, sshpam_const struct pam_message **msg,
Damien Miller1f499fd2003-08-25 13:08:49 +1000961 struct pam_response **resp, void *data)
Damien Miller4f9f42a2003-05-10 19:28:02 +1000962{
963 char input[PAM_MAX_MSG_SIZE];
Damien Miller5c3a5582003-09-23 22:12:38 +1000964 struct pam_response *reply;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000965 int i;
966
Darren Tuckerba53b832004-02-17 20:46:59 +1100967 debug3("PAM: %s called with %d messages", __func__, n);
968
Damien Miller5c3a5582003-09-23 22:12:38 +1000969 *resp = NULL;
970
Darren Tucker18df00c2003-11-18 12:42:07 +1100971 if (n <= 0 || n > PAM_MAX_NUM_MSG || !isatty(STDIN_FILENO))
Damien Miller4f9f42a2003-05-10 19:28:02 +1000972 return (PAM_CONV_ERR);
Damien Miller5c3a5582003-09-23 22:12:38 +1000973
Darren Tuckerd8093e42006-05-04 16:24:34 +1000974 if ((reply = calloc(n, sizeof(*reply))) == NULL)
Damien Miller5c3a5582003-09-23 22:12:38 +1000975 return (PAM_CONV_ERR);
Damien Miller5c3a5582003-09-23 22:12:38 +1000976
Damien Miller4f9f42a2003-05-10 19:28:02 +1000977 for (i = 0; i < n; ++i) {
978 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
979 case PAM_PROMPT_ECHO_OFF:
Damien Miller5c3a5582003-09-23 22:12:38 +1000980 reply[i].resp =
Damien Millera8e06ce2003-11-21 23:48:55 +1100981 read_passphrase(PAM_MSG_MEMBER(msg, i, msg),
Damien Miller4f9f42a2003-05-10 19:28:02 +1000982 RP_ALLOW_STDIN);
Damien Miller5c3a5582003-09-23 22:12:38 +1000983 reply[i].resp_retcode = PAM_SUCCESS;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000984 break;
985 case PAM_PROMPT_ECHO_ON:
Darren Tucker0947ddf2003-11-13 11:21:31 +1100986 fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
Darren Tucker22164712007-05-20 15:26:07 +1000987 if (fgets(input, sizeof input, stdin) == NULL)
988 input[0] = '\0';
Damien Millera6fb77f2004-07-19 09:39:11 +1000989 if ((reply[i].resp = strdup(input)) == NULL)
990 goto fail;
Damien Miller5c3a5582003-09-23 22:12:38 +1000991 reply[i].resp_retcode = PAM_SUCCESS;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000992 break;
993 case PAM_ERROR_MSG:
994 case PAM_TEXT_INFO:
Darren Tucker0947ddf2003-11-13 11:21:31 +1100995 fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
Damien Miller5c3a5582003-09-23 22:12:38 +1000996 reply[i].resp_retcode = PAM_SUCCESS;
Damien Miller4f9f42a2003-05-10 19:28:02 +1000997 break;
998 default:
999 goto fail;
1000 }
1001 }
Damien Miller5c3a5582003-09-23 22:12:38 +10001002 *resp = reply;
Damien Miller4f9f42a2003-05-10 19:28:02 +10001003 return (PAM_SUCCESS);
Damien Miller5c3a5582003-09-23 22:12:38 +10001004
Damien Miller4f9f42a2003-05-10 19:28:02 +10001005 fail:
Damien Miller5c3a5582003-09-23 22:12:38 +10001006 for(i = 0; i < n; i++) {
1007 if (reply[i].resp != NULL)
1008 xfree(reply[i].resp);
1009 }
1010 xfree(reply);
Damien Miller4f9f42a2003-05-10 19:28:02 +10001011 return (PAM_CONV_ERR);
1012}
1013
Darren Tucker94befab2004-06-03 14:53:12 +10001014static struct pam_conv tty_conv = { sshpam_tty_conv, NULL };
Darren Tucker18df00c2003-11-18 12:42:07 +11001015
Damien Miller4f9f42a2003-05-10 19:28:02 +10001016/*
1017 * XXX this should be done in the authentication phase, but ssh1 doesn't
1018 * support that
1019 */
1020void
1021do_pam_chauthtok(void)
1022{
Damien Miller4f9f42a2003-05-10 19:28:02 +10001023 if (use_privsep)
Damien Miller1f499fd2003-08-25 13:08:49 +10001024 fatal("Password expired (unable to change with privsep)");
Damien Miller4f9f42a2003-05-10 19:28:02 +10001025 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
Darren Tucker18df00c2003-11-18 12:42:07 +11001026 (const void *)&tty_conv);
Damien Miller4f9f42a2003-05-10 19:28:02 +10001027 if (sshpam_err != PAM_SUCCESS)
1028 fatal("PAM: failed to set PAM_CONV: %s",
1029 pam_strerror(sshpam_handle, sshpam_err));
1030 debug("PAM: changing password");
1031 sshpam_err = pam_chauthtok(sshpam_handle, PAM_CHANGE_EXPIRED_AUTHTOK);
1032 if (sshpam_err != PAM_SUCCESS)
1033 fatal("PAM: pam_chauthtok(): %s",
1034 pam_strerror(sshpam_handle, sshpam_err));
1035}
1036
Darren Tucker18df00c2003-11-18 12:42:07 +11001037void
1038do_pam_session(void)
1039{
Darren Tucker1921ed92004-02-10 13:23:28 +11001040 debug3("PAM: opening session");
Damien Millera8e06ce2003-11-21 23:48:55 +11001041 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
Darren Tucker5cf8ef72004-02-17 23:20:07 +11001042 (const void *)&store_conv);
Darren Tucker18df00c2003-11-18 12:42:07 +11001043 if (sshpam_err != PAM_SUCCESS)
1044 fatal("PAM: failed to set PAM_CONV: %s",
1045 pam_strerror(sshpam_handle, sshpam_err));
1046 sshpam_err = pam_open_session(sshpam_handle, 0);
Darren Tucker69687f42004-09-11 22:17:26 +10001047 if (sshpam_err == PAM_SUCCESS)
1048 sshpam_session_open = 1;
1049 else {
1050 sshpam_session_open = 0;
1051 disable_forwarding();
1052 error("PAM: pam_open_session(): %s",
Darren Tucker18df00c2003-11-18 12:42:07 +11001053 pam_strerror(sshpam_handle, sshpam_err));
Darren Tucker69687f42004-09-11 22:17:26 +10001054 }
1055
1056}
1057
1058int
1059is_pam_session_open(void)
1060{
1061 return sshpam_session_open;
Darren Tucker18df00c2003-11-18 12:42:07 +11001062}
1063
Damien Millera8e06ce2003-11-21 23:48:55 +11001064/*
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001065 * Set a PAM environment string. We need to do this so that the session
1066 * modules can handle things like Kerberos/GSI credentials that appear
1067 * during the ssh authentication process.
1068 */
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001069int
Damien Millera8e06ce2003-11-21 23:48:55 +11001070do_pam_putenv(char *name, char *value)
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001071{
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001072 int ret = 1;
Damien Miller787b2ec2003-11-21 23:56:47 +11001073#ifdef HAVE_PAM_PUTENV
Damien Millerf2728092003-09-17 07:24:25 +10001074 char *compound;
1075 size_t len;
1076
1077 len = strlen(name) + strlen(value) + 2;
1078 compound = xmalloc(len);
1079
1080 snprintf(compound, len, "%s=%s", name, value);
1081 ret = pam_putenv(sshpam_handle, compound);
1082 xfree(compound);
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001083#endif
Damien Millerf2728092003-09-17 07:24:25 +10001084
Darren Tucker49aaf4a2003-08-26 11:58:16 +10001085 return (ret);
1086}
1087
Damien Miller4f9f42a2003-05-10 19:28:02 +10001088char **
Damien Millerc756e9b2003-11-17 21:41:42 +11001089fetch_pam_child_environment(void)
1090{
1091 return sshpam_env;
1092}
1093
1094char **
Damien Miller4f9f42a2003-05-10 19:28:02 +10001095fetch_pam_environment(void)
1096{
Damien Miller4f9f42a2003-05-10 19:28:02 +10001097 return (pam_getenvlist(sshpam_handle));
Damien Miller4f9f42a2003-05-10 19:28:02 +10001098}
1099
1100void
1101free_pam_environment(char **env)
1102{
1103 char **envp;
1104
Damien Millere27c6cc2003-05-16 18:21:01 +10001105 if (env == NULL)
1106 return;
1107
Damien Miller4f9f42a2003-05-10 19:28:02 +10001108 for (envp = env; *envp; envp++)
1109 xfree(*envp);
1110 xfree(env);
Damien Millere72b7af1999-12-30 15:08:44 +11001111}
1112
Darren Tucker450a1582004-05-30 20:43:59 +10001113/*
1114 * "Blind" conversation function for password authentication. Assumes that
1115 * echo-off prompts are for the password and stores messages for later
1116 * display.
1117 */
1118static int
Darren Tuckerf08bdb52005-05-26 19:59:48 +10001119sshpam_passwd_conv(int n, sshpam_const struct pam_message **msg,
Darren Tucker450a1582004-05-30 20:43:59 +10001120 struct pam_response **resp, void *data)
1121{
1122 struct pam_response *reply;
1123 int i;
1124 size_t len;
1125
1126 debug3("PAM: %s called with %d messages", __func__, n);
1127
1128 *resp = NULL;
1129
1130 if (n <= 0 || n > PAM_MAX_NUM_MSG)
1131 return (PAM_CONV_ERR);
1132
Darren Tucker29171e92007-05-20 15:20:08 +10001133 if ((reply = calloc(n, sizeof(*reply))) == NULL)
Darren Tucker450a1582004-05-30 20:43:59 +10001134 return (PAM_CONV_ERR);
Darren Tucker450a1582004-05-30 20:43:59 +10001135
1136 for (i = 0; i < n; ++i) {
1137 switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
1138 case PAM_PROMPT_ECHO_OFF:
1139 if (sshpam_password == NULL)
1140 goto fail;
Damien Millera6fb77f2004-07-19 09:39:11 +10001141 if ((reply[i].resp = strdup(sshpam_password)) == NULL)
1142 goto fail;
Darren Tucker450a1582004-05-30 20:43:59 +10001143 reply[i].resp_retcode = PAM_SUCCESS;
1144 break;
1145 case PAM_ERROR_MSG:
1146 case PAM_TEXT_INFO:
1147 len = strlen(PAM_MSG_MEMBER(msg, i, msg));
1148 if (len > 0) {
1149 buffer_append(&loginmsg,
1150 PAM_MSG_MEMBER(msg, i, msg), len);
1151 buffer_append(&loginmsg, "\n", 1);
1152 }
Damien Millera6fb77f2004-07-19 09:39:11 +10001153 if ((reply[i].resp = strdup("")) == NULL)
1154 goto fail;
Darren Tucker450a1582004-05-30 20:43:59 +10001155 reply[i].resp_retcode = PAM_SUCCESS;
1156 break;
1157 default:
1158 goto fail;
1159 }
1160 }
1161 *resp = reply;
1162 return (PAM_SUCCESS);
1163
Damien Miller94cf4c82005-07-17 17:04:47 +10001164 fail:
Darren Tucker450a1582004-05-30 20:43:59 +10001165 for(i = 0; i < n; i++) {
1166 if (reply[i].resp != NULL)
1167 xfree(reply[i].resp);
1168 }
1169 xfree(reply);
1170 return (PAM_CONV_ERR);
1171}
1172
1173static struct pam_conv passwd_conv = { sshpam_passwd_conv, NULL };
1174
1175/*
1176 * Attempt password authentication via PAM
1177 */
1178int
1179sshpam_auth_passwd(Authctxt *authctxt, const char *password)
1180{
1181 int flags = (options.permit_empty_passwd == 0 ?
1182 PAM_DISALLOW_NULL_AUTHTOK : 0);
1183
1184 if (!options.use_pam || sshpam_handle == NULL)
1185 fatal("PAM: %s called when PAM disabled or failed to "
1186 "initialise.", __func__);
1187
1188 sshpam_password = password;
1189 sshpam_authctxt = authctxt;
1190
Darren Tuckere061b152004-05-30 22:04:56 +10001191 /*
1192 * If the user logging in is invalid, or is root but is not permitted
1193 * by PermitRootLogin, use an invalid password to prevent leaking
1194 * information via timing (eg if the PAM config has a delay on fail).
1195 */
Darren Tuckerd5bfa8f2005-01-20 13:29:51 +11001196 if (!authctxt->valid || (authctxt->pw->pw_uid == 0 &&
Damien Miller37294fb2005-07-17 17:18:49 +10001197 options.permit_root_login != PERMIT_YES))
Darren Tuckere061b152004-05-30 22:04:56 +10001198 sshpam_password = badpw;
1199
Darren Tucker450a1582004-05-30 20:43:59 +10001200 sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
1201 (const void *)&passwd_conv);
1202 if (sshpam_err != PAM_SUCCESS)
1203 fatal("PAM: %s: failed to set PAM_CONV: %s", __func__,
1204 pam_strerror(sshpam_handle, sshpam_err));
1205
1206 sshpam_err = pam_authenticate(sshpam_handle, flags);
1207 sshpam_password = NULL;
Darren Tuckerd5bfa8f2005-01-20 13:29:51 +11001208 if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
Darren Tucker450a1582004-05-30 20:43:59 +10001209 debug("PAM: password authentication accepted for %.100s",
1210 authctxt->user);
Damien Miller37294fb2005-07-17 17:18:49 +10001211 return 1;
Darren Tucker450a1582004-05-30 20:43:59 +10001212 } else {
1213 debug("PAM: password authentication failed for %.100s: %s",
1214 authctxt->valid ? authctxt->user : "an illegal user",
1215 pam_strerror(sshpam_handle, sshpam_err));
1216 return 0;
1217 }
1218}
Damien Millere72b7af1999-12-30 15:08:44 +11001219#endif /* USE_PAM */