blob: 7b60d6276ef116516b981428b54b97ad7e969889 [file] [log] [blame]
Damien Millereba71ba2000-04-29 23:57:08 +10001/*
2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
5 * Created: Sat Mar 18 22:15:47 1995 ylo
6 * Code to connect to a remote host, and to perform the client side of the
7 * login (authentication) dialog.
8 *
9 */
10
11#include "includes.h"
Damien Millerad833b32000-08-23 10:46:23 +100012RCSID("$OpenBSD: sshconnect1.c,v 1.5 2000/08/19 21:34:44 markus Exp $");
Damien Millereba71ba2000-04-29 23:57:08 +100013
14#include <openssl/bn.h>
15#include <openssl/dsa.h>
16#include <openssl/rsa.h>
17#include <openssl/evp.h>
18
19#include "xmalloc.h"
20#include "rsa.h"
21#include "ssh.h"
22#include "buffer.h"
23#include "packet.h"
Damien Millereba71ba2000-04-29 23:57:08 +100024#include "cipher.h"
25#include "mpaux.h"
26#include "uidswap.h"
27#include "readconf.h"
28#include "key.h"
Damien Miller994cf142000-07-21 10:19:44 +100029#include "authfd.h"
Damien Millereba71ba2000-04-29 23:57:08 +100030#include "sshconnect.h"
31#include "authfile.h"
32
33/* Session id for the current session. */
34unsigned char session_id[16];
35unsigned int supported_authentications = 0;
36
37extern Options options;
38extern char *__progname;
39
40/*
41 * Checks if the user has an authentication agent, and if so, tries to
42 * authenticate using the agent.
43 */
44int
45try_agent_authentication()
46{
Damien Millerad833b32000-08-23 10:46:23 +100047 int type;
Damien Millereba71ba2000-04-29 23:57:08 +100048 char *comment;
49 AuthenticationConnection *auth;
50 unsigned char response[16];
51 unsigned int i;
Damien Millerad833b32000-08-23 10:46:23 +100052 int plen, clen;
53 Key *key;
54 BIGNUM *challenge;
Damien Millereba71ba2000-04-29 23:57:08 +100055
56 /* Get connection to the agent. */
57 auth = ssh_get_authentication_connection();
58 if (!auth)
59 return 0;
60
Damien Millereba71ba2000-04-29 23:57:08 +100061 challenge = BN_new();
Damien Millerad833b32000-08-23 10:46:23 +100062 key = key_new(KEY_RSA);
Damien Millereba71ba2000-04-29 23:57:08 +100063
64 /* Loop through identities served by the agent. */
Damien Millerad833b32000-08-23 10:46:23 +100065 for (key = ssh_get_first_identity(auth, &comment, 1);
66 key != NULL;
67 key = ssh_get_next_identity(auth, &comment, 1)) {
Damien Millereba71ba2000-04-29 23:57:08 +100068
69 /* Try this identity. */
70 debug("Trying RSA authentication via agent with '%.100s'", comment);
71 xfree(comment);
72
73 /* Tell the server that we are willing to authenticate using this key. */
74 packet_start(SSH_CMSG_AUTH_RSA);
Damien Millerad833b32000-08-23 10:46:23 +100075 packet_put_bignum(key->rsa->n);
Damien Millereba71ba2000-04-29 23:57:08 +100076 packet_send();
77 packet_write_wait();
78
79 /* Wait for server's response. */
80 type = packet_read(&plen);
81
82 /* The server sends failure if it doesn\'t like our key or
83 does not support RSA authentication. */
84 if (type == SSH_SMSG_FAILURE) {
85 debug("Server refused our key.");
Damien Millerad833b32000-08-23 10:46:23 +100086 key_free(key);
Damien Millereba71ba2000-04-29 23:57:08 +100087 continue;
88 }
89 /* Otherwise it should have sent a challenge. */
90 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
91 packet_disconnect("Protocol error during RSA authentication: %d",
92 type);
93
94 packet_get_bignum(challenge, &clen);
95
96 packet_integrity_check(plen, clen, type);
97
98 debug("Received RSA challenge from server.");
99
100 /* Ask the agent to decrypt the challenge. */
Damien Millerad833b32000-08-23 10:46:23 +1000101 if (!ssh_decrypt_challenge(auth, key, challenge, session_id, 1, response)) {
102 /*
103 * The agent failed to authenticate this identifier
104 * although it advertised it supports this. Just
105 * return a wrong value.
106 */
Damien Millereba71ba2000-04-29 23:57:08 +1000107 log("Authentication agent failed to decrypt challenge.");
108 memset(response, 0, sizeof(response));
109 }
Damien Millerad833b32000-08-23 10:46:23 +1000110 key_free(key);
Damien Millereba71ba2000-04-29 23:57:08 +1000111 debug("Sending response to RSA challenge.");
112
113 /* Send the decrypted challenge back to the server. */
114 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
115 for (i = 0; i < 16; i++)
116 packet_put_char(response[i]);
117 packet_send();
118 packet_write_wait();
119
120 /* Wait for response from the server. */
121 type = packet_read(&plen);
122
123 /* The server returns success if it accepted the authentication. */
124 if (type == SSH_SMSG_SUCCESS) {
Damien Millereba71ba2000-04-29 23:57:08 +1000125 BN_clear_free(challenge);
Damien Millerad833b32000-08-23 10:46:23 +1000126 debug("RSA authentication accepted by server.");
Damien Millereba71ba2000-04-29 23:57:08 +1000127 return 1;
128 }
129 /* Otherwise it should return failure. */
130 if (type != SSH_SMSG_FAILURE)
131 packet_disconnect("Protocol error waiting RSA auth response: %d",
132 type);
133 }
Damien Millereba71ba2000-04-29 23:57:08 +1000134 BN_clear_free(challenge);
Damien Millereba71ba2000-04-29 23:57:08 +1000135 debug("RSA authentication using agent refused.");
136 return 0;
137}
138
139/*
140 * Computes the proper response to a RSA challenge, and sends the response to
141 * the server.
142 */
143void
144respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
145{
146 unsigned char buf[32], response[16];
147 MD5_CTX md;
148 int i, len;
149
150 /* Decrypt the challenge using the private key. */
151 rsa_private_decrypt(challenge, challenge, prv);
152
153 /* Compute the response. */
154 /* The response is MD5 of decrypted challenge plus session id. */
155 len = BN_num_bytes(challenge);
156 if (len <= 0 || len > sizeof(buf))
157 packet_disconnect("respond_to_rsa_challenge: bad challenge length %d",
158 len);
159
160 memset(buf, 0, sizeof(buf));
161 BN_bn2bin(challenge, buf + sizeof(buf) - len);
162 MD5_Init(&md);
163 MD5_Update(&md, buf, 32);
164 MD5_Update(&md, session_id, 16);
165 MD5_Final(response, &md);
166
167 debug("Sending response to host key RSA challenge.");
168
169 /* Send the response back to the server. */
170 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
171 for (i = 0; i < 16; i++)
172 packet_put_char(response[i]);
173 packet_send();
174 packet_write_wait();
175
176 memset(buf, 0, sizeof(buf));
177 memset(response, 0, sizeof(response));
178 memset(&md, 0, sizeof(md));
179}
180
181/*
182 * Checks if the user has authentication file, and if so, tries to authenticate
183 * the user using it.
184 */
185int
186try_rsa_authentication(const char *authfile)
187{
188 BIGNUM *challenge;
189 Key *public;
190 Key *private;
191 char *passphrase, *comment;
192 int type, i;
193 int plen, clen;
194
195 /* Try to load identification for the authentication key. */
196 public = key_new(KEY_RSA);
197 if (!load_public_key(authfile, public, &comment)) {
198 key_free(public);
199 /* Could not load it. Fail. */
200 return 0;
201 }
202 debug("Trying RSA authentication with key '%.100s'", comment);
203
204 /* Tell the server that we are willing to authenticate using this key. */
205 packet_start(SSH_CMSG_AUTH_RSA);
206 packet_put_bignum(public->rsa->n);
207 packet_send();
208 packet_write_wait();
209
210 /* We no longer need the public key. */
211 key_free(public);
212
213 /* Wait for server's response. */
214 type = packet_read(&plen);
215
216 /*
217 * The server responds with failure if it doesn\'t like our key or
218 * doesn\'t support RSA authentication.
219 */
220 if (type == SSH_SMSG_FAILURE) {
221 debug("Server refused our key.");
222 xfree(comment);
223 return 0;
224 }
225 /* Otherwise, the server should respond with a challenge. */
226 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
227 packet_disconnect("Protocol error during RSA authentication: %d", type);
228
229 /* Get the challenge from the packet. */
230 challenge = BN_new();
231 packet_get_bignum(challenge, &clen);
232
233 packet_integrity_check(plen, clen, type);
234
235 debug("Received RSA challenge from server.");
236
237 private = key_new(KEY_RSA);
238 /*
239 * Load the private key. Try first with empty passphrase; if it
240 * fails, ask for a passphrase.
241 */
242 if (!load_private_key(authfile, "", private, NULL)) {
243 char buf[300];
244 snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
245 comment);
246 if (!options.batch_mode)
247 passphrase = read_passphrase(buf, 0);
248 else {
249 debug("Will not query passphrase for %.100s in batch mode.",
250 comment);
251 passphrase = xstrdup("");
252 }
253
254 /* Load the authentication file using the pasphrase. */
255 if (!load_private_key(authfile, passphrase, private, NULL)) {
256 memset(passphrase, 0, strlen(passphrase));
257 xfree(passphrase);
258 error("Bad passphrase.");
259
260 /* Send a dummy response packet to avoid protocol error. */
261 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
262 for (i = 0; i < 16; i++)
263 packet_put_char(0);
264 packet_send();
265 packet_write_wait();
266
267 /* Expect the server to reject it... */
268 packet_read_expect(&plen, SSH_SMSG_FAILURE);
269 xfree(comment);
270 return 0;
271 }
272 /* Destroy the passphrase. */
273 memset(passphrase, 0, strlen(passphrase));
274 xfree(passphrase);
275 }
276 /* We no longer need the comment. */
277 xfree(comment);
278
279 /* Compute and send a response to the challenge. */
280 respond_to_rsa_challenge(challenge, private->rsa);
281
282 /* Destroy the private key. */
283 key_free(private);
284
285 /* We no longer need the challenge. */
286 BN_clear_free(challenge);
287
288 /* Wait for response from the server. */
289 type = packet_read(&plen);
290 if (type == SSH_SMSG_SUCCESS) {
291 debug("RSA authentication accepted by server.");
292 return 1;
293 }
294 if (type != SSH_SMSG_FAILURE)
295 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
296 debug("RSA authentication refused.");
297 return 0;
298}
299
300/*
301 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
302 * authentication and RSA host authentication.
303 */
304int
305try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
306{
307 int type;
308 BIGNUM *challenge;
309 int plen, clen;
310
311 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
312
313 /* Tell the server that we are willing to authenticate using this key. */
314 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
315 packet_put_string(local_user, strlen(local_user));
316 packet_put_int(BN_num_bits(host_key->n));
317 packet_put_bignum(host_key->e);
318 packet_put_bignum(host_key->n);
319 packet_send();
320 packet_write_wait();
321
322 /* Wait for server's response. */
323 type = packet_read(&plen);
324
325 /* The server responds with failure if it doesn't admit our
326 .rhosts authentication or doesn't know our host key. */
327 if (type == SSH_SMSG_FAILURE) {
328 debug("Server refused our rhosts authentication or host key.");
329 return 0;
330 }
331 /* Otherwise, the server should respond with a challenge. */
332 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
333 packet_disconnect("Protocol error during RSA authentication: %d", type);
334
335 /* Get the challenge from the packet. */
336 challenge = BN_new();
337 packet_get_bignum(challenge, &clen);
338
339 packet_integrity_check(plen, clen, type);
340
341 debug("Received RSA challenge for host key from server.");
342
343 /* Compute a response to the challenge. */
344 respond_to_rsa_challenge(challenge, host_key);
345
346 /* We no longer need the challenge. */
347 BN_clear_free(challenge);
348
349 /* Wait for response from the server. */
350 type = packet_read(&plen);
351 if (type == SSH_SMSG_SUCCESS) {
352 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
353 return 1;
354 }
355 if (type != SSH_SMSG_FAILURE)
356 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
357 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
358 return 0;
359}
360
361#ifdef KRB4
362int
363try_kerberos_authentication()
364{
365 KTEXT_ST auth; /* Kerberos data */
366 char *reply;
367 char inst[INST_SZ];
368 char *realm;
369 CREDENTIALS cred;
370 int r, type, plen;
371 socklen_t slen;
372 Key_schedule schedule;
373 u_long checksum, cksum;
374 MSG_DAT msg_data;
375 struct sockaddr_in local, foreign;
376 struct stat st;
377
378 /* Don't do anything if we don't have any tickets. */
379 if (stat(tkt_string(), &st) < 0)
380 return 0;
381
382 strncpy(inst, (char *) krb_get_phost(get_canonical_hostname()), INST_SZ);
383
384 realm = (char *) krb_realmofhost(get_canonical_hostname());
385 if (!realm) {
386 debug("Kerberos V4: no realm for %s", get_canonical_hostname());
387 return 0;
388 }
389 /* This can really be anything. */
390 checksum = (u_long) getpid();
391
392 r = krb_mk_req(&auth, KRB4_SERVICE_NAME, inst, realm, checksum);
393 if (r != KSUCCESS) {
394 debug("Kerberos V4 krb_mk_req failed: %s", krb_err_txt[r]);
395 return 0;
396 }
397 /* Get session key to decrypt the server's reply with. */
398 r = krb_get_cred(KRB4_SERVICE_NAME, inst, realm, &cred);
399 if (r != KSUCCESS) {
400 debug("get_cred failed: %s", krb_err_txt[r]);
401 return 0;
402 }
403 des_key_sched((des_cblock *) cred.session, schedule);
404
405 /* Send authentication info to server. */
406 packet_start(SSH_CMSG_AUTH_KERBEROS);
407 packet_put_string((char *) auth.dat, auth.length);
408 packet_send();
409 packet_write_wait();
410
411 /* Zero the buffer. */
412 (void) memset(auth.dat, 0, MAX_KTXT_LEN);
413
414 slen = sizeof(local);
415 memset(&local, 0, sizeof(local));
416 if (getsockname(packet_get_connection_in(),
417 (struct sockaddr *) & local, &slen) < 0)
418 debug("getsockname failed: %s", strerror(errno));
419
420 slen = sizeof(foreign);
421 memset(&foreign, 0, sizeof(foreign));
422 if (getpeername(packet_get_connection_in(),
423 (struct sockaddr *) & foreign, &slen) < 0) {
424 debug("getpeername failed: %s", strerror(errno));
425 fatal_cleanup();
426 }
427 /* Get server reply. */
428 type = packet_read(&plen);
429 switch (type) {
430 case SSH_SMSG_FAILURE:
431 /* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
432 debug("Kerberos V4 authentication failed.");
433 return 0;
434 break;
435
436 case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
437 /* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
438 debug("Kerberos V4 authentication accepted.");
439
440 /* Get server's response. */
441 reply = packet_get_string((unsigned int *) &auth.length);
442 memcpy(auth.dat, reply, auth.length);
443 xfree(reply);
444
445 packet_integrity_check(plen, 4 + auth.length, type);
446
447 /*
448 * If his response isn't properly encrypted with the session
449 * key, and the decrypted checksum fails to match, he's
450 * bogus. Bail out.
451 */
452 r = krb_rd_priv(auth.dat, auth.length, schedule, &cred.session,
453 &foreign, &local, &msg_data);
454 if (r != KSUCCESS) {
455 debug("Kerberos V4 krb_rd_priv failed: %s", krb_err_txt[r]);
456 packet_disconnect("Kerberos V4 challenge failed!");
457 }
458 /* Fetch the (incremented) checksum that we supplied in the request. */
459 (void) memcpy((char *) &cksum, (char *) msg_data.app_data, sizeof(cksum));
460 cksum = ntohl(cksum);
461
462 /* If it matches, we're golden. */
463 if (cksum == checksum + 1) {
464 debug("Kerberos V4 challenge successful.");
465 return 1;
466 } else
467 packet_disconnect("Kerberos V4 challenge failed!");
468 break;
469
470 default:
471 packet_disconnect("Protocol error on Kerberos V4 response: %d", type);
472 }
473 return 0;
474}
475
476#endif /* KRB4 */
477
478#ifdef AFS
479int
480send_kerberos_tgt()
481{
482 CREDENTIALS *creds;
483 char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
484 int r, type, plen;
485 char buffer[8192];
486 struct stat st;
487
488 /* Don't do anything if we don't have any tickets. */
489 if (stat(tkt_string(), &st) < 0)
490 return 0;
491
492 creds = xmalloc(sizeof(*creds));
493
494 if ((r = krb_get_tf_fullname(TKT_FILE, pname, pinst, prealm)) != KSUCCESS) {
495 debug("Kerberos V4 tf_fullname failed: %s", krb_err_txt[r]);
496 return 0;
497 }
498 if ((r = krb_get_cred("krbtgt", prealm, prealm, creds)) != GC_OK) {
499 debug("Kerberos V4 get_cred failed: %s", krb_err_txt[r]);
500 return 0;
501 }
502 if (time(0) > krb_life_to_time(creds->issue_date, creds->lifetime)) {
503 debug("Kerberos V4 ticket expired: %s", TKT_FILE);
504 return 0;
505 }
Damien Millere247cc42000-05-07 12:03:14 +1000506 creds_to_radix(creds, (unsigned char *)buffer, sizeof buffer);
Damien Millereba71ba2000-04-29 23:57:08 +1000507 xfree(creds);
508
509 packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
510 packet_put_string(buffer, strlen(buffer));
511 packet_send();
512 packet_write_wait();
513
514 type = packet_read(&plen);
515
516 if (type == SSH_SMSG_FAILURE)
517 debug("Kerberos TGT for realm %s rejected.", prealm);
518 else if (type != SSH_SMSG_SUCCESS)
519 packet_disconnect("Protocol error on Kerberos TGT response: %d", type);
520
521 return 1;
522}
523
524void
525send_afs_tokens(void)
526{
527 CREDENTIALS creds;
528 struct ViceIoctl parms;
529 struct ClearToken ct;
530 int i, type, len, plen;
531 char buf[2048], *p, *server_cell;
532 char buffer[8192];
533
534 /* Move over ktc_GetToken, here's something leaner. */
535 for (i = 0; i < 100; i++) { /* just in case */
536 parms.in = (char *) &i;
537 parms.in_size = sizeof(i);
538 parms.out = buf;
539 parms.out_size = sizeof(buf);
540 if (k_pioctl(0, VIOCGETTOK, &parms, 0) != 0)
541 break;
542 p = buf;
543
544 /* Get secret token. */
545 memcpy(&creds.ticket_st.length, p, sizeof(unsigned int));
546 if (creds.ticket_st.length > MAX_KTXT_LEN)
547 break;
548 p += sizeof(unsigned int);
549 memcpy(creds.ticket_st.dat, p, creds.ticket_st.length);
550 p += creds.ticket_st.length;
551
552 /* Get clear token. */
553 memcpy(&len, p, sizeof(len));
554 if (len != sizeof(struct ClearToken))
555 break;
556 p += sizeof(len);
557 memcpy(&ct, p, len);
558 p += len;
559 p += sizeof(len); /* primary flag */
560 server_cell = p;
561
562 /* Flesh out our credentials. */
563 strlcpy(creds.service, "afs", sizeof creds.service);
564 creds.instance[0] = '\0';
565 strlcpy(creds.realm, server_cell, REALM_SZ);
566 memcpy(creds.session, ct.HandShakeKey, DES_KEY_SZ);
567 creds.issue_date = ct.BeginTimestamp;
568 creds.lifetime = krb_time_to_life(creds.issue_date, ct.EndTimestamp);
569 creds.kvno = ct.AuthHandle;
570 snprintf(creds.pname, sizeof(creds.pname), "AFS ID %d", ct.ViceId);
571 creds.pinst[0] = '\0';
572
573 /* Encode token, ship it off. */
Damien Millere247cc42000-05-07 12:03:14 +1000574 if (creds_to_radix(&creds, (unsigned char*) buffer, sizeof buffer) <= 0)
Damien Millereba71ba2000-04-29 23:57:08 +1000575 break;
576 packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
577 packet_put_string(buffer, strlen(buffer));
578 packet_send();
579 packet_write_wait();
580
581 /* Roger, Roger. Clearance, Clarence. What's your vector,
582 Victor? */
583 type = packet_read(&plen);
584
585 if (type == SSH_SMSG_FAILURE)
586 debug("AFS token for cell %s rejected.", server_cell);
587 else if (type != SSH_SMSG_SUCCESS)
588 packet_disconnect("Protocol error on AFS token response: %d", type);
589 }
590}
591
592#endif /* AFS */
593
594/*
595 * Tries to authenticate with any string-based challenge/response system.
596 * Note that the client code is not tied to s/key or TIS.
597 */
598int
599try_skey_authentication()
600{
601 int type, i;
602 int payload_len;
603 unsigned int clen;
604 char *challenge, *response;
605
606 debug("Doing skey authentication.");
607
608 /* request a challenge */
609 packet_start(SSH_CMSG_AUTH_TIS);
610 packet_send();
611 packet_write_wait();
612
613 type = packet_read(&payload_len);
614 if (type != SSH_SMSG_FAILURE &&
615 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
616 packet_disconnect("Protocol error: got %d in response "
617 "to skey-auth", type);
618 }
619 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
620 debug("No challenge for skey authentication.");
621 return 0;
622 }
623 challenge = packet_get_string(&clen);
624 packet_integrity_check(payload_len, (4 + clen), type);
625 if (options.cipher == SSH_CIPHER_NONE)
626 log("WARNING: Encryption is disabled! "
627 "Reponse will be transmitted in clear text.");
628 fprintf(stderr, "%s\n", challenge);
629 xfree(challenge);
630 fflush(stderr);
631 for (i = 0; i < options.number_of_password_prompts; i++) {
632 if (i != 0)
633 error("Permission denied, please try again.");
634 response = read_passphrase("Response: ", 0);
635 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
636 packet_put_string(response, strlen(response));
637 memset(response, 0, strlen(response));
638 xfree(response);
639 packet_send();
640 packet_write_wait();
641 type = packet_read(&payload_len);
642 if (type == SSH_SMSG_SUCCESS)
643 return 1;
644 if (type != SSH_SMSG_FAILURE)
645 packet_disconnect("Protocol error: got %d in response "
646 "to skey-auth-reponse", type);
647 }
648 /* failure */
649 return 0;
650}
651
652/*
653 * Tries to authenticate with plain passwd authentication.
654 */
655int
656try_password_authentication(char *prompt)
657{
658 int type, i, payload_len;
659 char *password;
660
661 debug("Doing password authentication.");
662 if (options.cipher == SSH_CIPHER_NONE)
663 log("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
664 for (i = 0; i < options.number_of_password_prompts; i++) {
665 if (i != 0)
666 error("Permission denied, please try again.");
667 password = read_passphrase(prompt, 0);
668 packet_start(SSH_CMSG_AUTH_PASSWORD);
669 packet_put_string(password, strlen(password));
670 memset(password, 0, strlen(password));
671 xfree(password);
672 packet_send();
673 packet_write_wait();
674
675 type = packet_read(&payload_len);
676 if (type == SSH_SMSG_SUCCESS)
677 return 1;
678 if (type != SSH_SMSG_FAILURE)
679 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
680 }
681 /* failure */
682 return 0;
683}
684
685/*
686 * SSH1 key exchange
687 */
688void
689ssh_kex(char *host, struct sockaddr *hostaddr)
690{
691 int i;
692 BIGNUM *key;
693 RSA *host_key;
694 RSA *public_key;
695 Key k;
696 int bits, rbits;
697 int ssh_cipher_default = SSH_CIPHER_3DES;
698 unsigned char session_key[SSH_SESSION_KEY_LENGTH];
699 unsigned char cookie[8];
700 unsigned int supported_ciphers;
701 unsigned int server_flags, client_flags;
702 int payload_len, clen, sum_len = 0;
703 u_int32_t rand = 0;
704
705 debug("Waiting for server public key.");
706
707 /* Wait for a public key packet from the server. */
708 packet_read_expect(&payload_len, SSH_SMSG_PUBLIC_KEY);
709
710 /* Get cookie from the packet. */
711 for (i = 0; i < 8; i++)
712 cookie[i] = packet_get_char();
713
714 /* Get the public key. */
715 public_key = RSA_new();
716 bits = packet_get_int();/* bits */
717 public_key->e = BN_new();
718 packet_get_bignum(public_key->e, &clen);
719 sum_len += clen;
720 public_key->n = BN_new();
721 packet_get_bignum(public_key->n, &clen);
722 sum_len += clen;
723
724 rbits = BN_num_bits(public_key->n);
725 if (bits != rbits) {
726 log("Warning: Server lies about size of server public key: "
727 "actual size is %d bits vs. announced %d.", rbits, bits);
728 log("Warning: This may be due to an old implementation of ssh.");
729 }
730 /* Get the host key. */
731 host_key = RSA_new();
732 bits = packet_get_int();/* bits */
733 host_key->e = BN_new();
734 packet_get_bignum(host_key->e, &clen);
735 sum_len += clen;
736 host_key->n = BN_new();
737 packet_get_bignum(host_key->n, &clen);
738 sum_len += clen;
739
740 rbits = BN_num_bits(host_key->n);
741 if (bits != rbits) {
742 log("Warning: Server lies about size of server host key: "
743 "actual size is %d bits vs. announced %d.", rbits, bits);
744 log("Warning: This may be due to an old implementation of ssh.");
745 }
746
747 /* Get protocol flags. */
748 server_flags = packet_get_int();
749 packet_set_protocol_flags(server_flags);
750
751 supported_ciphers = packet_get_int();
752 supported_authentications = packet_get_int();
753
754 debug("Received server public key (%d bits) and host key (%d bits).",
755 BN_num_bits(public_key->n), BN_num_bits(host_key->n));
756
757 packet_integrity_check(payload_len,
758 8 + 4 + sum_len + 0 + 4 + 0 + 0 + 4 + 4 + 4,
759 SSH_SMSG_PUBLIC_KEY);
760 k.type = KEY_RSA;
761 k.rsa = host_key;
762 check_host_key(host, hostaddr, &k,
763 options.user_hostfile, options.system_hostfile);
764
765 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
766
767 compute_session_id(session_id, cookie, host_key->n, public_key->n);
768
769 /* Generate a session key. */
770 arc4random_stir();
771
772 /*
773 * Generate an encryption key for the session. The key is a 256 bit
774 * random number, interpreted as a 32-byte key, with the least
775 * significant 8 bits being the first byte of the key.
776 */
777 for (i = 0; i < 32; i++) {
778 if (i % 4 == 0)
779 rand = arc4random();
780 session_key[i] = rand & 0xff;
781 rand >>= 8;
782 }
783
784 /*
785 * According to the protocol spec, the first byte of the session key
786 * is the highest byte of the integer. The session key is xored with
787 * the first 16 bytes of the session id.
788 */
789 key = BN_new();
790 BN_set_word(key, 0);
791 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
792 BN_lshift(key, key, 8);
793 if (i < 16)
794 BN_add_word(key, session_key[i] ^ session_id[i]);
795 else
796 BN_add_word(key, session_key[i]);
797 }
798
799 /*
800 * Encrypt the integer using the public key and host key of the
801 * server (key with smaller modulus first).
802 */
803 if (BN_cmp(public_key->n, host_key->n) < 0) {
804 /* Public key has smaller modulus. */
805 if (BN_num_bits(host_key->n) <
806 BN_num_bits(public_key->n) + SSH_KEY_BITS_RESERVED) {
807 fatal("respond_to_rsa_challenge: host_key %d < public_key %d + "
808 "SSH_KEY_BITS_RESERVED %d",
809 BN_num_bits(host_key->n),
810 BN_num_bits(public_key->n),
811 SSH_KEY_BITS_RESERVED);
812 }
813 rsa_public_encrypt(key, key, public_key);
814 rsa_public_encrypt(key, key, host_key);
815 } else {
816 /* Host key has smaller modulus (or they are equal). */
817 if (BN_num_bits(public_key->n) <
818 BN_num_bits(host_key->n) + SSH_KEY_BITS_RESERVED) {
819 fatal("respond_to_rsa_challenge: public_key %d < host_key %d + "
820 "SSH_KEY_BITS_RESERVED %d",
821 BN_num_bits(public_key->n),
822 BN_num_bits(host_key->n),
823 SSH_KEY_BITS_RESERVED);
824 }
825 rsa_public_encrypt(key, key, host_key);
826 rsa_public_encrypt(key, key, public_key);
827 }
828
829 /* Destroy the public keys since we no longer need them. */
830 RSA_free(public_key);
831 RSA_free(host_key);
832
Damien Miller30c3d422000-05-09 11:02:59 +1000833 if (options.cipher == SSH_CIPHER_ILLEGAL) {
834 log("No valid SSH1 cipher, using %.100s instead.",
835 cipher_name(SSH_FALLBACK_CIPHER));
836 options.cipher = SSH_FALLBACK_CIPHER;
837 } else if (options.cipher == SSH_CIPHER_NOT_SET) {
Damien Millereba71ba2000-04-29 23:57:08 +1000838 if (cipher_mask1() & supported_ciphers & (1 << ssh_cipher_default))
839 options.cipher = ssh_cipher_default;
840 else {
841 debug("Cipher %s not supported, using %.100s instead.",
Damien Miller30c3d422000-05-09 11:02:59 +1000842 cipher_name(ssh_cipher_default),
843 cipher_name(SSH_FALLBACK_CIPHER));
Damien Millereba71ba2000-04-29 23:57:08 +1000844 options.cipher = SSH_FALLBACK_CIPHER;
845 }
846 }
847 /* Check that the selected cipher is supported. */
848 if (!(supported_ciphers & (1 << options.cipher)))
849 fatal("Selected cipher type %.100s not supported by server.",
850 cipher_name(options.cipher));
851
852 debug("Encryption type: %.100s", cipher_name(options.cipher));
853
854 /* Send the encrypted session key to the server. */
855 packet_start(SSH_CMSG_SESSION_KEY);
856 packet_put_char(options.cipher);
857
858 /* Send the cookie back to the server. */
859 for (i = 0; i < 8; i++)
860 packet_put_char(cookie[i]);
861
862 /* Send and destroy the encrypted encryption key integer. */
863 packet_put_bignum(key);
864 BN_clear_free(key);
865
866 /* Send protocol flags. */
867 packet_put_int(client_flags);
868
869 /* Send the packet now. */
870 packet_send();
871 packet_write_wait();
872
873 debug("Sent encrypted session key.");
874
875 /* Set the encryption key. */
876 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
877
878 /* We will no longer need the session key here. Destroy any extra copies. */
879 memset(session_key, 0, sizeof(session_key));
880
881 /*
882 * Expect a success message from the server. Note that this message
883 * will be received in encrypted form.
884 */
885 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
886
887 debug("Received encrypted confirmation.");
888}
889
890/*
891 * Authenticate user
892 */
893void
894ssh_userauth(
895 const char* local_user,
896 const char* server_user,
897 char *host,
898 int host_key_valid, RSA *own_host_key)
899{
900 int i, type;
901 int payload_len;
902
903 if (supported_authentications == 0)
904 fatal("ssh_userauth: server supports no auth methods");
905
906 /* Send the name of the user to log in as on the server. */
907 packet_start(SSH_CMSG_USER);
908 packet_put_string(server_user, strlen(server_user));
909 packet_send();
910 packet_write_wait();
911
912 /*
913 * The server should respond with success if no authentication is
914 * needed (the user has no password). Otherwise the server responds
915 * with failure.
916 */
917 type = packet_read(&payload_len);
918
919 /* check whether the connection was accepted without authentication. */
920 if (type == SSH_SMSG_SUCCESS)
921 return;
922 if (type != SSH_SMSG_FAILURE)
923 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER",
924 type);
925
926#ifdef AFS
927 /* Try Kerberos tgt passing if the server supports it. */
928 if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
929 options.kerberos_tgt_passing) {
930 if (options.cipher == SSH_CIPHER_NONE)
931 log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
932 (void) send_kerberos_tgt();
933 }
934 /* Try AFS token passing if the server supports it. */
935 if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
936 options.afs_token_passing && k_hasafs()) {
937 if (options.cipher == SSH_CIPHER_NONE)
938 log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
939 send_afs_tokens();
940 }
941#endif /* AFS */
942
943#ifdef KRB4
944 if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
945 options.kerberos_authentication) {
946 debug("Trying Kerberos authentication.");
947 if (try_kerberos_authentication()) {
948 /* The server should respond with success or failure. */
949 type = packet_read(&payload_len);
950 if (type == SSH_SMSG_SUCCESS)
951 return;
952 if (type != SSH_SMSG_FAILURE)
953 packet_disconnect("Protocol error: got %d in response to Kerberos auth", type);
954 }
955 }
956#endif /* KRB4 */
957
958 /*
959 * Use rhosts authentication if running in privileged socket and we
960 * do not wish to remain anonymous.
961 */
962 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) &&
963 options.rhosts_authentication) {
964 debug("Trying rhosts authentication.");
965 packet_start(SSH_CMSG_AUTH_RHOSTS);
966 packet_put_string(local_user, strlen(local_user));
967 packet_send();
968 packet_write_wait();
969
970 /* The server should respond with success or failure. */
971 type = packet_read(&payload_len);
972 if (type == SSH_SMSG_SUCCESS)
973 return;
974 if (type != SSH_SMSG_FAILURE)
975 packet_disconnect("Protocol error: got %d in response to rhosts auth",
976 type);
977 }
978 /*
979 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
980 * authentication.
981 */
982 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
983 options.rhosts_rsa_authentication && host_key_valid) {
984 if (try_rhosts_rsa_authentication(local_user, own_host_key))
985 return;
986 }
987 /* Try RSA authentication if the server supports it. */
988 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
989 options.rsa_authentication) {
990 /*
991 * Try RSA authentication using the authentication agent. The
992 * agent is tried first because no passphrase is needed for
993 * it, whereas identity files may require passphrases.
994 */
995 if (try_agent_authentication())
996 return;
997
998 /* Try RSA authentication for each identity. */
999 for (i = 0; i < options.num_identity_files; i++)
1000 if (try_rsa_authentication(options.identity_files[i]))
1001 return;
1002 }
1003 /* Try skey authentication if the server supports it. */
1004 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
1005 options.skey_authentication && !options.batch_mode) {
1006 if (try_skey_authentication())
1007 return;
1008 }
1009 /* Try password authentication if the server supports it. */
1010 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
1011 options.password_authentication && !options.batch_mode) {
1012 char prompt[80];
1013
1014 snprintf(prompt, sizeof(prompt), "%.30s@%.40s's password: ",
1015 server_user, host);
1016 if (try_password_authentication(prompt))
1017 return;
1018 }
1019 /* All authentication methods have failed. Exit with an error message. */
1020 fatal("Permission denied.");
1021 /* NOTREACHED */
1022}