blob: 61fd0a738e8afc24dd9d3a05aef820a79b0a0956 [file] [log] [blame]
Damien Millereba71ba2000-04-29 23:57:08 +10001/*
2 * Copyright (c) 2000 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
Damien Millereba71ba2000-04-29 23:57:08 +100012 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
Damien Millere4340be2000-09-16 13:29:08 +110024
Damien Millereba71ba2000-04-29 23:57:08 +100025#include "includes.h"
Ben Lindstrom7ebb6352002-03-22 03:04:08 +000026RCSID("$OpenBSD: auth2.c,v 1.89 2002/03/19 14:27:39 markus Exp $");
Damien Miller874d77b2000-10-14 16:23:11 +110027
Damien Millereba71ba2000-04-29 23:57:08 +100028#include <openssl/evp.h>
29
Ben Lindstrom226cfa02001-01-22 05:34:40 +000030#include "ssh2.h"
Damien Millereba71ba2000-04-29 23:57:08 +100031#include "xmalloc.h"
32#include "rsa.h"
Ben Lindstromd95c09c2001-02-18 19:13:33 +000033#include "sshpty.h"
Damien Millereba71ba2000-04-29 23:57:08 +100034#include "packet.h"
35#include "buffer.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000036#include "log.h"
Damien Millereba71ba2000-04-29 23:57:08 +100037#include "servconf.h"
38#include "compat.h"
Ben Lindstromc7637672001-06-09 00:36:26 +000039#include "channels.h"
Damien Millereba71ba2000-04-29 23:57:08 +100040#include "bufaux.h"
Damien Millereba71ba2000-04-29 23:57:08 +100041#include "auth.h"
42#include "session.h"
43#include "dispatch.h"
Damien Millereba71ba2000-04-29 23:57:08 +100044#include "key.h"
Ben Lindstrom6d40c0f2001-01-29 09:02:24 +000045#include "cipher.h"
Damien Millereba71ba2000-04-29 23:57:08 +100046#include "kex.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000047#include "pathnames.h"
Damien Millereba71ba2000-04-29 23:57:08 +100048#include "uidswap.h"
Damien Millerf6d9e222000-06-18 14:50:44 +100049#include "auth-options.h"
Ben Lindstrom5eabda32001-04-12 23:34:34 +000050#include "hostfile.h"
51#include "canohost.h"
Ben Lindstrom551ea372001-06-05 18:56:16 +000052#include "match.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000053#include "monitor_wrap.h"
Damien Millereba71ba2000-04-29 23:57:08 +100054
55/* import */
56extern ServerOptions options;
Ben Lindstrom46c16222000-12-22 01:43:59 +000057extern u_char *session_id2;
Damien Millereba71ba2000-04-29 23:57:08 +100058extern int session_id2_len;
59
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000060Authctxt *x_authctxt = NULL;
Damien Miller874d77b2000-10-14 16:23:11 +110061static int one = 1;
62
63typedef struct Authmethod Authmethod;
64struct Authmethod {
65 char *name;
66 int (*userauth)(Authctxt *authctxt);
67 int *enabled;
68};
69
Damien Millereba71ba2000-04-29 23:57:08 +100070/* protocol */
71
Damien Miller630d6f42002-01-22 23:17:30 +110072static void input_service_request(int, u_int32_t, void *);
73static void input_userauth_request(int, u_int32_t, void *);
Damien Millereba71ba2000-04-29 23:57:08 +100074
Damien Millereba71ba2000-04-29 23:57:08 +100075/* helper */
Ben Lindstrombba81212001-06-25 05:01:22 +000076static Authmethod *authmethod_lookup(const char *);
Ben Lindstrom79073822001-07-04 03:42:30 +000077static char *authmethods_get(void);
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000078int user_key_allowed(struct passwd *, Key *);
79int hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
Damien Millereba71ba2000-04-29 23:57:08 +100080
Damien Miller874d77b2000-10-14 16:23:11 +110081/* auth */
Ben Lindstrombba81212001-06-25 05:01:22 +000082static void userauth_banner(void);
83static int userauth_none(Authctxt *);
84static int userauth_passwd(Authctxt *);
85static int userauth_pubkey(Authctxt *);
86static int userauth_hostbased(Authctxt *);
87static int userauth_kbdint(Authctxt *);
Damien Miller874d77b2000-10-14 16:23:11 +110088
89Authmethod authmethods[] = {
90 {"none",
91 userauth_none,
92 &one},
93 {"publickey",
94 userauth_pubkey,
Damien Miller0bc1bd82000-11-13 22:57:25 +110095 &options.pubkey_authentication},
Damien Miller874d77b2000-10-14 16:23:11 +110096 {"password",
97 userauth_passwd,
98 &options.password_authentication},
Ben Lindstromd1f20ec2001-02-10 21:31:53 +000099 {"keyboard-interactive",
100 userauth_kbdint,
101 &options.kbd_interactive_authentication},
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000102 {"hostbased",
103 userauth_hostbased,
104 &options.hostbased_authentication},
Damien Miller874d77b2000-10-14 16:23:11 +1100105 {NULL, NULL, NULL}
Damien Millereba71ba2000-04-29 23:57:08 +1000106};
Damien Millereba71ba2000-04-29 23:57:08 +1000107
108/*
Damien Miller874d77b2000-10-14 16:23:11 +1100109 * loop until authctxt->success == TRUE
Damien Millereba71ba2000-04-29 23:57:08 +1000110 */
111
Ben Lindstrom73ab9ba2002-03-22 01:27:35 +0000112Authctxt *
Ben Lindstrom3c36bb22001-12-06 17:55:26 +0000113do_authentication2(void)
Damien Millereba71ba2000-04-29 23:57:08 +1000114{
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000115 Authctxt *authctxt = authctxt_new();
116
Damien Miller874d77b2000-10-14 16:23:11 +1100117 x_authctxt = authctxt; /*XXX*/
118
Ben Lindstrombdfb4df2001-10-03 17:12:43 +0000119 /* challenge-response is implemented via keyboard interactive */
Ben Lindstrom551ea372001-06-05 18:56:16 +0000120 if (options.challenge_response_authentication)
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000121 options.kbd_interactive_authentication = 1;
Damien Millerf8154422001-04-25 22:44:14 +1000122 if (options.pam_authentication_via_kbd_int)
123 options.kbd_interactive_authentication = 1;
Damien Millerffc868f2002-05-09 15:59:13 +1000124 if (use_privsep)
125 options.pam_authentication_via_kbd_int = 0;
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000126
Damien Miller7d053392002-01-22 23:24:13 +1100127 dispatch_init(&dispatch_protocol_error);
Damien Millereba71ba2000-04-29 23:57:08 +1000128 dispatch_set(SSH2_MSG_SERVICE_REQUEST, &input_service_request);
Damien Miller874d77b2000-10-14 16:23:11 +1100129 dispatch_run(DISPATCH_BLOCK, &authctxt->success, authctxt);
Ben Lindstrom73ab9ba2002-03-22 01:27:35 +0000130
131 return (authctxt);
Damien Millereba71ba2000-04-29 23:57:08 +1000132}
133
Ben Lindstrombba81212001-06-25 05:01:22 +0000134static void
Damien Miller630d6f42002-01-22 23:17:30 +1100135input_service_request(int type, u_int32_t seq, void *ctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000136{
Damien Miller874d77b2000-10-14 16:23:11 +1100137 Authctxt *authctxt = ctxt;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000138 u_int len;
Damien Millereba71ba2000-04-29 23:57:08 +1000139 int accept = 0;
140 char *service = packet_get_string(&len);
Damien Miller48b03fc2002-01-22 23:11:40 +1100141 packet_check_eom();
Damien Millereba71ba2000-04-29 23:57:08 +1000142
Damien Miller874d77b2000-10-14 16:23:11 +1100143 if (authctxt == NULL)
144 fatal("input_service_request: no authctxt");
145
Damien Millereba71ba2000-04-29 23:57:08 +1000146 if (strcmp(service, "ssh-userauth") == 0) {
Damien Miller874d77b2000-10-14 16:23:11 +1100147 if (!authctxt->success) {
Damien Millereba71ba2000-04-29 23:57:08 +1000148 accept = 1;
149 /* now we can handle user-auth requests */
150 dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &input_userauth_request);
151 }
152 }
153 /* XXX all other service requests are denied */
154
155 if (accept) {
156 packet_start(SSH2_MSG_SERVICE_ACCEPT);
157 packet_put_cstring(service);
158 packet_send();
159 packet_write_wait();
160 } else {
161 debug("bad service request %s", service);
162 packet_disconnect("bad service request %s", service);
163 }
164 xfree(service);
165}
166
Ben Lindstrombba81212001-06-25 05:01:22 +0000167static void
Damien Miller630d6f42002-01-22 23:17:30 +1100168input_userauth_request(int type, u_int32_t seq, void *ctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000169{
Damien Miller874d77b2000-10-14 16:23:11 +1100170 Authctxt *authctxt = ctxt;
171 Authmethod *m = NULL;
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000172 char *user, *service, *method, *style = NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000173 int authenticated = 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000174
Damien Miller874d77b2000-10-14 16:23:11 +1100175 if (authctxt == NULL)
176 fatal("input_userauth_request: no authctxt");
Damien Millereba71ba2000-04-29 23:57:08 +1000177
Damien Miller874d77b2000-10-14 16:23:11 +1100178 user = packet_get_string(NULL);
179 service = packet_get_string(NULL);
180 method = packet_get_string(NULL);
181 debug("userauth-request for user %s service %s method %s", user, service, method);
Ben Lindstrom4dccfa52000-12-28 16:40:05 +0000182 debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
Damien Miller874d77b2000-10-14 16:23:11 +1100183
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000184 if ((style = strchr(user, ':')) != NULL)
185 *style++ = 0;
186
Kevin Stevesef4eea92001-02-05 12:42:17 +0000187 if (authctxt->attempt++ == 0) {
Damien Miller3a5b0232002-03-13 13:19:42 +1100188 /* setup auth context */
Kevin Steves205cc1e2002-03-22 20:43:05 +0000189 authctxt->pw = PRIVSEP(getpwnamallow(user));
190 if (authctxt->pw && strcmp(service, "ssh-connection")==0) {
Damien Miller874d77b2000-10-14 16:23:11 +1100191 authctxt->valid = 1;
192 debug2("input_userauth_request: setting up authctxt for %s", user);
193#ifdef USE_PAM
Damien Miller79418552002-04-23 20:28:48 +1000194 PRIVSEP(start_pam(authctxt->pw->pw_name));
Damien Miller874d77b2000-10-14 16:23:11 +1100195#endif
196 } else {
197 log("input_userauth_request: illegal user %s", user);
Damien Miller22e22bf2001-01-19 15:46:38 +1100198#ifdef USE_PAM
Damien Miller79418552002-04-23 20:28:48 +1000199 PRIVSEP(start_pam("NOUSER"));
Damien Miller22e22bf2001-01-19 15:46:38 +1100200#endif
Damien Miller874d77b2000-10-14 16:23:11 +1100201 }
Ben Lindstrom7ebb6352002-03-22 03:04:08 +0000202 setproctitle("%s%s", authctxt->pw ? user : "unknown",
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000203 use_privsep ? " [net]" : "");
Damien Miller874d77b2000-10-14 16:23:11 +1100204 authctxt->user = xstrdup(user);
205 authctxt->service = xstrdup(service);
Ben Lindstrom9d0c0662001-06-09 01:40:00 +0000206 authctxt->style = style ? xstrdup(style) : NULL;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000207 if (use_privsep)
208 mm_inform_authserv(service, style);
Ben Lindstrom9d0c0662001-06-09 01:40:00 +0000209 } else if (strcmp(user, authctxt->user) != 0 ||
210 strcmp(service, authctxt->service) != 0) {
211 packet_disconnect("Change of username or service not allowed: "
212 "(%s,%s) -> (%s,%s)",
213 authctxt->user, authctxt->service, user, service);
Damien Millereba71ba2000-04-29 23:57:08 +1000214 }
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000215 /* reset state */
Damien Milleree116252001-12-21 12:42:34 +1100216 auth2_challenge_stop(authctxt);
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000217 authctxt->postponed = 0;
Damien Millerb70b61f2000-09-16 16:25:12 +1100218
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000219 /* try to authenticate user */
Damien Miller874d77b2000-10-14 16:23:11 +1100220 m = authmethod_lookup(method);
221 if (m != NULL) {
222 debug2("input_userauth_request: try method %s", method);
223 authenticated = m->userauth(authctxt);
Damien Miller874d77b2000-10-14 16:23:11 +1100224 }
Damien Miller5d57e502001-03-30 10:48:31 +1000225 userauth_finish(authctxt, authenticated, method);
226
227 xfree(service);
228 xfree(user);
229 xfree(method);
230}
231
232void
233userauth_finish(Authctxt *authctxt, int authenticated, char *method)
234{
Ben Lindstromcd4349f2001-06-09 00:23:17 +0000235 char *methods;
236
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000237 if (!authctxt->valid && authenticated)
238 fatal("INTERNAL ERROR: authenticated invalid user %s",
239 authctxt->user);
Damien Millerb70b61f2000-09-16 16:25:12 +1100240
Damien Miller874d77b2000-10-14 16:23:11 +1100241 /* Special handling for root */
Ben Lindstromd8a90212001-02-15 03:08:27 +0000242 if (authenticated && authctxt->pw->pw_uid == 0 &&
243 !auth_root_allowed(method))
Damien Millereba71ba2000-04-29 23:57:08 +1000244 authenticated = 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000245
246#ifdef USE_PAM
Damien Miller79418552002-04-23 20:28:48 +1000247 if (!use_privsep && authenticated && authctxt->user &&
248 !do_pam_account(authctxt->user, NULL))
Damien Millerb70b61f2000-09-16 16:25:12 +1100249 authenticated = 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000250#endif /* USE_PAM */
251
Damien Miller874d77b2000-10-14 16:23:11 +1100252 /* Log before sending the reply */
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000253 auth_log(authctxt, authenticated, method, " ssh2");
254
Ben Lindstromcd4349f2001-06-09 00:23:17 +0000255 if (authctxt->postponed)
256 return;
257
258 /* XXX todo: check if multiple auth methods are needed */
259 if (authenticated == 1) {
260 /* turn off userauth */
Damien Miller7d053392002-01-22 23:24:13 +1100261 dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &dispatch_protocol_ignore);
Ben Lindstromcd4349f2001-06-09 00:23:17 +0000262 packet_start(SSH2_MSG_USERAUTH_SUCCESS);
263 packet_send();
264 packet_write_wait();
265 /* now we can break out */
266 authctxt->success = 1;
267 } else {
Damien Millere49d0962001-11-13 23:46:18 +1100268 if (authctxt->failures++ > AUTH_FAIL_MAX) {
269#ifdef WITH_AIXAUTHENTICATE
270 loginfailed(authctxt->user,
Damien Millerf3451a22002-02-05 12:40:46 +1100271 get_canonical_hostname(options.verify_reverse_mapping),
Damien Millere49d0962001-11-13 23:46:18 +1100272 "ssh");
273#endif /* WITH_AIXAUTHENTICATE */
Ben Lindstromcd4349f2001-06-09 00:23:17 +0000274 packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
Damien Millere49d0962001-11-13 23:46:18 +1100275 }
Ben Lindstromcd4349f2001-06-09 00:23:17 +0000276 methods = authmethods_get();
277 packet_start(SSH2_MSG_USERAUTH_FAILURE);
278 packet_put_cstring(methods);
279 packet_put_char(0); /* XXX partial success, unused */
280 packet_send();
281 packet_write_wait();
282 xfree(methods);
283 }
Damien Miller874d77b2000-10-14 16:23:11 +1100284}
285
Ben Lindstrombba81212001-06-25 05:01:22 +0000286static void
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000287userauth_banner(void)
288{
289 struct stat st;
290 char *banner = NULL;
291 off_t len, n;
292 int fd;
293
294 if (options.banner == NULL || (datafellows & SSH_BUG_BANNER))
295 return;
Ben Lindstrom0cae0402001-04-04 23:47:52 +0000296 if ((fd = open(options.banner, O_RDONLY)) < 0)
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000297 return;
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000298 if (fstat(fd, &st) < 0)
299 goto done;
300 len = st.st_size;
301 banner = xmalloc(len + 1);
302 if ((n = read(fd, banner, len)) < 0)
303 goto done;
304 banner[n] = '\0';
305 packet_start(SSH2_MSG_USERAUTH_BANNER);
306 packet_put_cstring(banner);
307 packet_put_cstring(""); /* language, unused */
308 packet_send();
309 debug("userauth_banner: sent");
310done:
311 if (banner)
312 xfree(banner);
313 close(fd);
314 return;
315}
Damien Miller874d77b2000-10-14 16:23:11 +1100316
Ben Lindstrombba81212001-06-25 05:01:22 +0000317static int
Damien Miller874d77b2000-10-14 16:23:11 +1100318userauth_none(Authctxt *authctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000319{
Damien Miller874d77b2000-10-14 16:23:11 +1100320 /* disable method "none", only allowed one time */
321 Authmethod *m = authmethod_lookup("none");
322 if (m != NULL)
323 m->enabled = NULL;
Damien Miller48b03fc2002-01-22 23:11:40 +1100324 packet_check_eom();
Kevin Stevesef4eea92001-02-05 12:42:17 +0000325 userauth_banner();
Damien Millerb8c656e2000-06-28 15:22:41 +1000326
Damien Miller874d77b2000-10-14 16:23:11 +1100327 if (authctxt->valid == 0)
328 return(0);
Damien Miller3a5b0232002-03-13 13:19:42 +1100329
330#ifdef HAVE_CYGWIN
331 if (check_nt_auth(1, authctxt->pw) == 0)
332 return(0);
Damien Miller874d77b2000-10-14 16:23:11 +1100333#endif
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000334 return PRIVSEP(auth_password(authctxt, ""));
Damien Millereba71ba2000-04-29 23:57:08 +1000335}
Damien Miller874d77b2000-10-14 16:23:11 +1100336
Ben Lindstrombba81212001-06-25 05:01:22 +0000337static int
Damien Miller874d77b2000-10-14 16:23:11 +1100338userauth_passwd(Authctxt *authctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000339{
340 char *password;
341 int authenticated = 0;
342 int change;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000343 u_int len;
Damien Millereba71ba2000-04-29 23:57:08 +1000344 change = packet_get_char();
345 if (change)
346 log("password change not supported");
347 password = packet_get_string(&len);
Damien Miller48b03fc2002-01-22 23:11:40 +1100348 packet_check_eom();
Damien Miller3a5b0232002-03-13 13:19:42 +1100349 if (authctxt->valid &&
350#ifdef HAVE_CYGWIN
351 check_nt_auth(1, authctxt->pw) &&
Damien Miller874d77b2000-10-14 16:23:11 +1100352#endif
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000353 PRIVSEP(auth_password(authctxt, password)) == 1)
Damien Miller3a5b0232002-03-13 13:19:42 +1100354 authenticated = 1;
Damien Millereba71ba2000-04-29 23:57:08 +1000355 memset(password, 0, len);
356 xfree(password);
357 return authenticated;
358}
Damien Miller874d77b2000-10-14 16:23:11 +1100359
Ben Lindstrombba81212001-06-25 05:01:22 +0000360static int
Damien Miller874d77b2000-10-14 16:23:11 +1100361userauth_kbdint(Authctxt *authctxt)
362{
363 int authenticated = 0;
Ben Lindstrom551ea372001-06-05 18:56:16 +0000364 char *lang, *devs;
Damien Miller874d77b2000-10-14 16:23:11 +1100365
366 lang = packet_get_string(NULL);
367 devs = packet_get_string(NULL);
Damien Miller48b03fc2002-01-22 23:11:40 +1100368 packet_check_eom();
Damien Miller874d77b2000-10-14 16:23:11 +1100369
Ben Lindstrom551ea372001-06-05 18:56:16 +0000370 debug("keyboard-interactive devs %s", devs);
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000371
Ben Lindstrom551ea372001-06-05 18:56:16 +0000372 if (options.challenge_response_authentication)
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000373 authenticated = auth2_challenge(authctxt, devs);
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000374
Damien Millerb8481582000-12-03 11:51:51 +1100375#ifdef USE_PAM
Damien Millerf8154422001-04-25 22:44:14 +1000376 if (authenticated == 0 && options.pam_authentication_via_kbd_int)
Damien Millerb8481582000-12-03 11:51:51 +1100377 authenticated = auth2_pam(authctxt);
378#endif
Damien Miller874d77b2000-10-14 16:23:11 +1100379 xfree(devs);
Ben Lindstrom551ea372001-06-05 18:56:16 +0000380 xfree(lang);
Damien Miller874d77b2000-10-14 16:23:11 +1100381#ifdef HAVE_CYGWIN
Damien Miller0dea79d2001-12-29 14:08:28 +1100382 if (check_nt_auth(0, authctxt->pw) == 0)
Damien Miller874d77b2000-10-14 16:23:11 +1100383 return(0);
384#endif
385 return authenticated;
386}
387
Ben Lindstrombba81212001-06-25 05:01:22 +0000388static int
Damien Miller874d77b2000-10-14 16:23:11 +1100389userauth_pubkey(Authctxt *authctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000390{
391 Buffer b;
Damien Miller9b74bfc2002-02-05 12:26:03 +1100392 Key *key = NULL;
Ben Lindstrom90fd8142002-02-26 18:09:42 +0000393 char *pkalg;
394 u_char *pkblob, *sig;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000395 u_int alen, blen, slen;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100396 int have_sig, pktype;
Damien Millereba71ba2000-04-29 23:57:08 +1000397 int authenticated = 0;
398
Damien Miller874d77b2000-10-14 16:23:11 +1100399 if (!authctxt->valid) {
400 debug2("userauth_pubkey: disabled because of invalid user");
Damien Millereba71ba2000-04-29 23:57:08 +1000401 return 0;
402 }
403 have_sig = packet_get_char();
Ben Lindstromd121f612000-12-03 17:00:47 +0000404 if (datafellows & SSH_BUG_PKAUTH) {
405 debug2("userauth_pubkey: SSH_BUG_PKAUTH");
406 /* no explicit pkalg given */
407 pkblob = packet_get_string(&blen);
408 buffer_init(&b);
409 buffer_append(&b, pkblob, blen);
410 /* so we have to extract the pkalg from the pkblob */
411 pkalg = buffer_get_string(&b, &alen);
412 buffer_free(&b);
413 } else {
414 pkalg = packet_get_string(&alen);
415 pkblob = packet_get_string(&blen);
416 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100417 pktype = key_type_from_name(pkalg);
418 if (pktype == KEY_UNSPEC) {
Ben Lindstromd121f612000-12-03 17:00:47 +0000419 /* this is perfectly legal */
Damien Miller9b74bfc2002-02-05 12:26:03 +1100420 log("userauth_pubkey: unsupported public key algorithm: %s",
421 pkalg);
422 goto done;
Damien Millereba71ba2000-04-29 23:57:08 +1000423 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100424 key = key_from_blob(pkblob, blen);
Damien Miller9b74bfc2002-02-05 12:26:03 +1100425 if (key == NULL) {
426 error("userauth_pubkey: cannot decode key: %s", pkalg);
427 goto done;
Damien Millereba71ba2000-04-29 23:57:08 +1000428 }
Damien Miller9b74bfc2002-02-05 12:26:03 +1100429 if (key->type != pktype) {
430 error("userauth_pubkey: type mismatch for decoded key "
431 "(received %d, expected %d)", key->type, pktype);
432 goto done;
433 }
434 if (have_sig) {
435 sig = packet_get_string(&slen);
436 packet_check_eom();
437 buffer_init(&b);
438 if (datafellows & SSH_OLD_SESSIONID) {
439 buffer_append(&b, session_id2, session_id2_len);
440 } else {
441 buffer_put_string(&b, session_id2, session_id2_len);
442 }
443 /* reconstruct packet */
444 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
445 buffer_put_cstring(&b, authctxt->user);
446 buffer_put_cstring(&b,
447 datafellows & SSH_BUG_PKSERVICE ?
448 "ssh-userauth" :
449 authctxt->service);
450 if (datafellows & SSH_BUG_PKAUTH) {
451 buffer_put_char(&b, have_sig);
452 } else {
453 buffer_put_cstring(&b, "publickey");
454 buffer_put_char(&b, have_sig);
455 buffer_put_cstring(&b, pkalg);
456 }
457 buffer_put_string(&b, pkblob, blen);
458#ifdef DEBUG_PK
459 buffer_dump(&b);
460#endif
461 /* test for correct signature */
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000462 authenticated = 0;
463 if (PRIVSEP(user_key_allowed(authctxt->pw, key)) &&
464 PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
465 buffer_len(&b))) == 1)
Damien Miller3a5b0232002-03-13 13:19:42 +1100466 authenticated = 1;
Damien Miller9b74bfc2002-02-05 12:26:03 +1100467 buffer_clear(&b);
468 xfree(sig);
469 } else {
470 debug("test whether pkalg/pkblob are acceptable");
471 packet_check_eom();
472
473 /* XXX fake reply and always send PK_OK ? */
474 /*
475 * XXX this allows testing whether a user is allowed
476 * to login: if you happen to have a valid pubkey this
477 * message is sent. the message is NEVER sent at all
478 * if a user is not allowed to login. is this an
479 * issue? -markus
480 */
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000481 if (PRIVSEP(user_key_allowed(authctxt->pw, key))) {
Damien Miller9b74bfc2002-02-05 12:26:03 +1100482 packet_start(SSH2_MSG_USERAUTH_PK_OK);
483 packet_put_string(pkalg, alen);
484 packet_put_string(pkblob, blen);
485 packet_send();
486 packet_write_wait();
487 authctxt->postponed = 1;
488 }
489 }
490 if (authenticated != 1)
491 auth_clear_options();
492done:
Damien Miller0bc1bd82000-11-13 22:57:25 +1100493 debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg);
Damien Miller9b74bfc2002-02-05 12:26:03 +1100494 if (key != NULL)
495 key_free(key);
Damien Millereba71ba2000-04-29 23:57:08 +1000496 xfree(pkalg);
497 xfree(pkblob);
Damien Miller874d77b2000-10-14 16:23:11 +1100498#ifdef HAVE_CYGWIN
Damien Miller0dea79d2001-12-29 14:08:28 +1100499 if (check_nt_auth(0, authctxt->pw) == 0)
Damien Miller874d77b2000-10-14 16:23:11 +1100500 return(0);
501#endif
Damien Millereba71ba2000-04-29 23:57:08 +1000502 return authenticated;
503}
504
Ben Lindstrombba81212001-06-25 05:01:22 +0000505static int
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000506userauth_hostbased(Authctxt *authctxt)
507{
508 Buffer b;
Damien Miller9b74bfc2002-02-05 12:26:03 +1100509 Key *key = NULL;
Ben Lindstrom90fd8142002-02-26 18:09:42 +0000510 char *pkalg, *cuser, *chost, *service;
511 u_char *pkblob, *sig;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000512 u_int alen, blen, slen;
513 int pktype;
514 int authenticated = 0;
515
516 if (!authctxt->valid) {
517 debug2("userauth_hostbased: disabled because of invalid user");
518 return 0;
519 }
520 pkalg = packet_get_string(&alen);
521 pkblob = packet_get_string(&blen);
522 chost = packet_get_string(NULL);
523 cuser = packet_get_string(NULL);
524 sig = packet_get_string(&slen);
525
526 debug("userauth_hostbased: cuser %s chost %s pkalg %s slen %d",
527 cuser, chost, pkalg, slen);
528#ifdef DEBUG_PK
529 debug("signature:");
530 buffer_init(&b);
531 buffer_append(&b, sig, slen);
532 buffer_dump(&b);
533 buffer_free(&b);
534#endif
535 pktype = key_type_from_name(pkalg);
536 if (pktype == KEY_UNSPEC) {
537 /* this is perfectly legal */
538 log("userauth_hostbased: unsupported "
539 "public key algorithm: %s", pkalg);
540 goto done;
541 }
542 key = key_from_blob(pkblob, blen);
543 if (key == NULL) {
Damien Miller9b74bfc2002-02-05 12:26:03 +1100544 error("userauth_hostbased: cannot decode key: %s", pkalg);
545 goto done;
546 }
547 if (key->type != pktype) {
548 error("userauth_hostbased: type mismatch for decoded key "
549 "(received %d, expected %d)", key->type, pktype);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000550 goto done;
551 }
Ben Lindstrom671388f2001-04-19 20:40:45 +0000552 service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
553 authctxt->service;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000554 buffer_init(&b);
Ben Lindstrom671388f2001-04-19 20:40:45 +0000555 buffer_put_string(&b, session_id2, session_id2_len);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000556 /* reconstruct packet */
557 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
558 buffer_put_cstring(&b, authctxt->user);
Ben Lindstrom671388f2001-04-19 20:40:45 +0000559 buffer_put_cstring(&b, service);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000560 buffer_put_cstring(&b, "hostbased");
561 buffer_put_string(&b, pkalg, alen);
562 buffer_put_string(&b, pkblob, blen);
563 buffer_put_cstring(&b, chost);
564 buffer_put_cstring(&b, cuser);
565#ifdef DEBUG_PK
566 buffer_dump(&b);
567#endif
568 /* test for allowed key and correct signature */
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000569 authenticated = 0;
570 if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) &&
571 PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
572 buffer_len(&b))) == 1)
Damien Miller3a5b0232002-03-13 13:19:42 +1100573 authenticated = 1;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000574
575 buffer_clear(&b);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000576done:
577 debug2("userauth_hostbased: authenticated %d", authenticated);
Damien Miller9b74bfc2002-02-05 12:26:03 +1100578 if (key != NULL)
579 key_free(key);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000580 xfree(pkalg);
581 xfree(pkblob);
582 xfree(cuser);
583 xfree(chost);
584 xfree(sig);
585 return authenticated;
586}
587
Damien Miller874d77b2000-10-14 16:23:11 +1100588/* get current user */
Damien Millereba71ba2000-04-29 23:57:08 +1000589
590struct passwd*
591auth_get_user(void)
592{
Damien Miller874d77b2000-10-14 16:23:11 +1100593 return (x_authctxt != NULL && x_authctxt->valid) ? x_authctxt->pw : NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000594}
595
Damien Miller874d77b2000-10-14 16:23:11 +1100596#define DELIM ","
Damien Millereba71ba2000-04-29 23:57:08 +1000597
Ben Lindstrom79073822001-07-04 03:42:30 +0000598static char *
Damien Miller874d77b2000-10-14 16:23:11 +1100599authmethods_get(void)
600{
601 Authmethod *method = NULL;
Damien Miller0e3b8722002-01-22 23:26:38 +1100602 Buffer b;
Damien Miller874d77b2000-10-14 16:23:11 +1100603 char *list;
604
Damien Miller0e3b8722002-01-22 23:26:38 +1100605 buffer_init(&b);
Damien Miller874d77b2000-10-14 16:23:11 +1100606 for (method = authmethods; method->name != NULL; method++) {
607 if (strcmp(method->name, "none") == 0)
608 continue;
609 if (method->enabled != NULL && *(method->enabled) != 0) {
Damien Miller0e3b8722002-01-22 23:26:38 +1100610 if (buffer_len(&b) > 0)
611 buffer_append(&b, ",", 1);
612 buffer_append(&b, method->name, strlen(method->name));
Damien Millereba71ba2000-04-29 23:57:08 +1000613 }
614 }
Damien Miller0e3b8722002-01-22 23:26:38 +1100615 buffer_append(&b, "\0", 1);
616 list = xstrdup(buffer_ptr(&b));
617 buffer_free(&b);
Damien Miller874d77b2000-10-14 16:23:11 +1100618 return list;
619}
620
Ben Lindstrombba81212001-06-25 05:01:22 +0000621static Authmethod *
Damien Miller874d77b2000-10-14 16:23:11 +1100622authmethod_lookup(const char *name)
623{
624 Authmethod *method = NULL;
625 if (name != NULL)
626 for (method = authmethods; method->name != NULL; method++)
627 if (method->enabled != NULL &&
628 *(method->enabled) != 0 &&
629 strcmp(name, method->name) == 0)
630 return method;
631 debug2("Unrecognized authentication method name: %s", name ? name : "NULL");
632 return NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000633}
634
635/* return 1 if user allows given key */
Ben Lindstrombba81212001-06-25 05:01:22 +0000636static int
Ben Lindstromf96704d2001-06-25 04:17:12 +0000637user_key_allowed2(struct passwd *pw, Key *key, char *file)
Damien Millereba71ba2000-04-29 23:57:08 +1000638{
Ben Lindstromf96704d2001-06-25 04:17:12 +0000639 char line[8192];
Damien Millereba71ba2000-04-29 23:57:08 +1000640 int found_key = 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000641 FILE *f;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000642 u_long linenum = 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000643 struct stat st;
644 Key *found;
Damien Millerda9edca2001-12-21 12:48:54 +1100645 char *fp;
Damien Millereba71ba2000-04-29 23:57:08 +1000646
Damien Miller874d77b2000-10-14 16:23:11 +1100647 if (pw == NULL)
648 return 0;
649
Damien Millereba71ba2000-04-29 23:57:08 +1000650 /* Temporarily use the user's uid. */
Ben Lindstrom3fcf1a22001-04-08 18:26:59 +0000651 temporarily_use_uid(pw);
Damien Millereba71ba2000-04-29 23:57:08 +1000652
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000653 debug("trying public key file %s", file);
Damien Millereba71ba2000-04-29 23:57:08 +1000654
655 /* Fail quietly if file does not exist */
656 if (stat(file, &st) < 0) {
657 /* Restore the privileged uid. */
658 restore_uid();
659 return 0;
660 }
661 /* Open the file containing the authorized keys. */
662 f = fopen(file, "r");
663 if (!f) {
664 /* Restore the privileged uid. */
665 restore_uid();
666 return 0;
667 }
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000668 if (options.strict_modes &&
Ben Lindstrom90279d82001-07-04 03:56:56 +0000669 secure_filename(f, file, pw, line, sizeof(line)) != 0) {
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000670 fclose(f);
671 log("Authentication refused: %s", line);
672 restore_uid();
673 return 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000674 }
Ben Lindstrombfb3a0e2001-06-05 20:25:05 +0000675
Damien Millereba71ba2000-04-29 23:57:08 +1000676 found_key = 0;
Damien Millerd3444942000-09-30 14:20:03 +1100677 found = key_new(key->type);
Damien Millereba71ba2000-04-29 23:57:08 +1000678
679 while (fgets(line, sizeof(line), f)) {
Damien Millerf6d9e222000-06-18 14:50:44 +1000680 char *cp, *options = NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000681 linenum++;
682 /* Skip leading whitespace, empty and comment lines. */
683 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
684 ;
685 if (!*cp || *cp == '\n' || *cp == '#')
686 continue;
Damien Millerf6d9e222000-06-18 14:50:44 +1000687
Ben Lindstrom1bc3bdb2001-09-20 23:11:26 +0000688 if (key_read(found, &cp) != 1) {
Damien Millerf6d9e222000-06-18 14:50:44 +1000689 /* no key? check if there are options for this key */
690 int quoted = 0;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100691 debug2("user_key_allowed: check options: '%s'", cp);
Damien Millerf6d9e222000-06-18 14:50:44 +1000692 options = cp;
693 for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
694 if (*cp == '\\' && cp[1] == '"')
695 cp++; /* Skip both */
696 else if (*cp == '"')
697 quoted = !quoted;
698 }
699 /* Skip remaining whitespace. */
700 for (; *cp == ' ' || *cp == '\t'; cp++)
701 ;
Ben Lindstrom1bc3bdb2001-09-20 23:11:26 +0000702 if (key_read(found, &cp) != 1) {
Damien Miller0bc1bd82000-11-13 22:57:25 +1100703 debug2("user_key_allowed: advance: '%s'", cp);
Damien Millerf6d9e222000-06-18 14:50:44 +1000704 /* still no key? advance to next line*/
705 continue;
706 }
707 }
708 if (key_equal(found, key) &&
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000709 auth_parse_options(pw, options, file, linenum) == 1) {
Damien Millereba71ba2000-04-29 23:57:08 +1000710 found_key = 1;
Ben Lindstrom940fb862001-08-06 21:01:49 +0000711 debug("matching key found: file %s, line %lu",
Damien Millereba71ba2000-04-29 23:57:08 +1000712 file, linenum);
Damien Millerda9edca2001-12-21 12:48:54 +1100713 fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
714 verbose("Found matching %s key: %s",
Damien Miller9f0f5c62001-12-21 14:45:46 +1100715 key_type(found), fp);
Damien Millerda9edca2001-12-21 12:48:54 +1100716 xfree(fp);
Damien Millereba71ba2000-04-29 23:57:08 +1000717 break;
718 }
719 }
720 restore_uid();
721 fclose(f);
722 key_free(found);
Ben Lindstromb54873a2001-03-11 20:01:55 +0000723 if (!found_key)
724 debug2("key not found");
Damien Millereba71ba2000-04-29 23:57:08 +1000725 return found_key;
726}
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000727
Ben Lindstromf96704d2001-06-25 04:17:12 +0000728/* check whether given key is in .ssh/authorized_keys* */
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000729int
Ben Lindstromf96704d2001-06-25 04:17:12 +0000730user_key_allowed(struct passwd *pw, Key *key)
731{
732 int success;
733 char *file;
734
735 file = authorized_keys_file(pw);
736 success = user_key_allowed2(pw, key, file);
737 xfree(file);
738 if (success)
739 return success;
740
741 /* try suffix "2" for backward compat, too */
742 file = authorized_keys_file2(pw);
743 success = user_key_allowed2(pw, key, file);
744 xfree(file);
745 return success;
746}
747
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000748/* return 1 if given hostkey is allowed */
Ben Lindstrom7a2073c2002-03-22 02:30:41 +0000749int
Ben Lindstrom4aa603c2001-04-19 20:38:06 +0000750hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000751 Key *key)
752{
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000753 const char *resolvedname, *ipaddr, *lookup;
Ben Lindstrom65366a82001-12-06 16:32:47 +0000754 HostStatus host_status;
755 int len;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000756
Damien Millerc5d86352002-02-05 12:13:41 +1100757 resolvedname = get_canonical_hostname(options.verify_reverse_mapping);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000758 ipaddr = get_remote_ipaddr();
759
Ben Lindstrom2bffd6f2001-04-19 20:35:40 +0000760 debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s",
761 chost, resolvedname, ipaddr);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000762
763 if (options.hostbased_uses_name_from_packet_only) {
764 if (auth_rhosts2(pw, cuser, chost, chost) == 0)
765 return 0;
766 lookup = chost;
767 } else {
Ben Lindstrom2bffd6f2001-04-19 20:35:40 +0000768 if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') {
769 debug2("stripping trailing dot from chost %s", chost);
770 chost[len - 1] = '\0';
771 }
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000772 if (strcasecmp(resolvedname, chost) != 0)
773 log("userauth_hostbased mismatch: "
774 "client sends %s, but we resolve %s to %s",
775 chost, ipaddr, resolvedname);
776 if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0)
777 return 0;
778 lookup = resolvedname;
779 }
780 debug2("userauth_hostbased: access allowed by auth_rhosts2");
781
Ben Lindstrom83647ce2001-06-25 04:30:16 +0000782 host_status = check_key_in_hostfiles(pw, key, lookup,
783 _PATH_SSH_SYSTEM_HOSTFILE,
Ben Lindstroma4789ef2001-06-25 04:40:49 +0000784 options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000785
Ben Lindstrom83647ce2001-06-25 04:30:16 +0000786 /* backward compat if no key has been found. */
787 if (host_status == HOST_NEW)
788 host_status = check_key_in_hostfiles(pw, key, lookup,
789 _PATH_SSH_SYSTEM_HOSTFILE2,
Ben Lindstroma4789ef2001-06-25 04:40:49 +0000790 options.ignore_user_known_hosts ? NULL :
791 _PATH_SSH_USER_HOSTFILE2);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000792
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000793 return (host_status == HOST_OK);
794}