blob: bc42c96cb7607fb44d4e072852a7eeb8d90f9748 [file] [log] [blame]
Damien Millerb38eff82000-04-01 11:09:21 +10001/*
2 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
3 * All rights reserved
Damien Millere4340be2000-09-16 13:29:08 +11004 *
5 * As far as I am concerned, the code I have written for this software
6 * can be used freely for any purpose. Any derived versions of this
7 * software must be clearly marked as such, and if the derived work is
8 * incompatible with the protocol description in the RFC file, it must be
9 * called by a name other than "ssh" or "Secure Shell".
10 *
11 *
Damien Millerefb4afe2000-04-12 18:45:05 +100012 * Copyright (c) 2000 Markus Friedl. All rights reserved.
Damien Millere4340be2000-09-16 13:29:08 +110013 *
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
16 * are met:
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in the
21 * documentation and/or other materials provided with the distribution.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
24 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
27 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Damien Millerb38eff82000-04-01 11:09:21 +100033 */
34
35#include "includes.h"
Damien Miller874d77b2000-10-14 16:23:11 +110036RCSID("$OpenBSD: auth.c,v 1.11 2000/10/11 20:27:23 markus Exp $");
Damien Millerb38eff82000-04-01 11:09:21 +100037
38#include "xmalloc.h"
39#include "rsa.h"
40#include "ssh.h"
41#include "pty.h"
42#include "packet.h"
43#include "buffer.h"
Damien Millerb38eff82000-04-01 11:09:21 +100044#include "mpaux.h"
45#include "servconf.h"
Damien Millerefb4afe2000-04-12 18:45:05 +100046#include "compat.h"
Damien Millerb38eff82000-04-01 11:09:21 +100047#include "channels.h"
48#include "match.h"
Damien Millerd2c208a2000-05-17 22:00:02 +100049#ifdef HAVE_LOGIN_H
50#include <login.h>
51#endif
Damien Miller1f335fb2000-06-26 11:31:33 +100052#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
53#include <shadow.h>
54#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
Damien Millerb38eff82000-04-01 11:09:21 +100055
Damien Millerefb4afe2000-04-12 18:45:05 +100056#include "bufaux.h"
57#include "ssh2.h"
58#include "auth.h"
Damien Millerb38eff82000-04-01 11:09:21 +100059#include "session.h"
Damien Millerefb4afe2000-04-12 18:45:05 +100060
Damien Millerb38eff82000-04-01 11:09:21 +100061/* import */
62extern ServerOptions options;
Damien Millerb38eff82000-04-01 11:09:21 +100063
64/*
65 * Check if the user is allowed to log in via ssh. If user is listed in
66 * DenyUsers or user's primary group is listed in DenyGroups, false will
67 * be returned. If AllowUsers isn't empty and user isn't listed there, or
68 * if AllowGroups isn't empty and user isn't listed there, false will be
Damien Miller4af51302000-04-16 11:18:38 +100069 * returned.
Damien Millerb38eff82000-04-01 11:09:21 +100070 * If the user's shell is not executable, false will be returned.
Damien Miller4af51302000-04-16 11:18:38 +100071 * Otherwise true is returned.
Damien Millerb38eff82000-04-01 11:09:21 +100072 */
Damien Millereba71ba2000-04-29 23:57:08 +100073int
Damien Millerb38eff82000-04-01 11:09:21 +100074allowed_user(struct passwd * pw)
75{
76 struct stat st;
77 struct group *grp;
Damien Milleref7df542000-05-19 00:03:23 +100078 char *shell;
Damien Millerb38eff82000-04-01 11:09:21 +100079 int i;
80#ifdef WITH_AIXAUTHENTICATE
81 char *loginmsg;
82#endif /* WITH_AIXAUTHENTICATE */
Damien Miller62dd94b2000-09-23 14:26:32 +110083#if !defined(PAM) && defined(HAVE_SHADOW_H) && \
84 !defined(DISABLE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
Damien Miller1f335fb2000-06-26 11:31:33 +100085 struct spwd *spw;
Damien Millerb38eff82000-04-01 11:09:21 +100086
87 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
88 if (!pw)
89 return 0;
90
Damien Miller1f335fb2000-06-26 11:31:33 +100091 spw = getspnam(pw->pw_name);
Damien Millerc7088432000-07-02 18:44:54 +100092 if (spw != NULL) {
93 int days = time(NULL) / 86400;
Damien Miller1f335fb2000-06-26 11:31:33 +100094
Damien Millerc7088432000-07-02 18:44:54 +100095 /* Check account expiry */
Damien Miller62dd94b2000-09-23 14:26:32 +110096 if ((spw->sp_expire >= 0) && (days > spw->sp_expire))
Damien Millerc7088432000-07-02 18:44:54 +100097 return 0;
98
99 /* Check password expiry */
Damien Miller62dd94b2000-09-23 14:26:32 +1100100 if ((spw->sp_lstchg >= 0) && (spw->sp_max >= 0) &&
Damien Miller606f8802000-09-16 15:39:56 +1100101 (days > (spw->sp_lstchg + spw->sp_max)))
Damien Millerc7088432000-07-02 18:44:54 +1000102 return 0;
103 }
Damien Miller1f335fb2000-06-26 11:31:33 +1000104#else
105 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
106 if (!pw)
107 return 0;
108#endif
109
Damien Milleref7df542000-05-19 00:03:23 +1000110 /*
111 * Get the shell from the password data. An empty shell field is
112 * legal, and means /bin/sh.
113 */
114 shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
115
116 /* deny if shell does not exists or is not executable */
117 if (stat(shell, &st) != 0)
Damien Millerb38eff82000-04-01 11:09:21 +1000118 return 0;
119 if (!((st.st_mode & S_IFREG) && (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP))))
120 return 0;
121
122 /* Return false if user is listed in DenyUsers */
123 if (options.num_deny_users > 0) {
124 if (!pw->pw_name)
125 return 0;
126 for (i = 0; i < options.num_deny_users; i++)
127 if (match_pattern(pw->pw_name, options.deny_users[i]))
128 return 0;
129 }
130 /* Return false if AllowUsers isn't empty and user isn't listed there */
131 if (options.num_allow_users > 0) {
132 if (!pw->pw_name)
133 return 0;
134 for (i = 0; i < options.num_allow_users; i++)
135 if (match_pattern(pw->pw_name, options.allow_users[i]))
136 break;
137 /* i < options.num_allow_users iff we break for loop */
138 if (i >= options.num_allow_users)
139 return 0;
140 }
141 /* Get the primary group name if we need it. Return false if it fails */
142 if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
143 grp = getgrgid(pw->pw_gid);
144 if (!grp)
145 return 0;
146
147 /* Return false if user's group is listed in DenyGroups */
148 if (options.num_deny_groups > 0) {
149 if (!grp->gr_name)
150 return 0;
151 for (i = 0; i < options.num_deny_groups; i++)
152 if (match_pattern(grp->gr_name, options.deny_groups[i]))
153 return 0;
154 }
155 /*
156 * Return false if AllowGroups isn't empty and user's group
157 * isn't listed there
158 */
159 if (options.num_allow_groups > 0) {
160 if (!grp->gr_name)
161 return 0;
162 for (i = 0; i < options.num_allow_groups; i++)
163 if (match_pattern(grp->gr_name, options.allow_groups[i]))
164 break;
165 /* i < options.num_allow_groups iff we break for
166 loop */
167 if (i >= options.num_allow_groups)
168 return 0;
169 }
170 }
171
172#ifdef WITH_AIXAUTHENTICATE
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000173 if (loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) {
Damien Millerd2c208a2000-05-17 22:00:02 +1000174 if (loginmsg && *loginmsg) {
175 /* Remove embedded newlines (if any) */
176 char *p;
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000177 for (p = loginmsg; *p; p++) {
Damien Millerd2c208a2000-05-17 22:00:02 +1000178 if (*p == '\n')
179 *p = ' ';
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000180 }
Damien Millerd2c208a2000-05-17 22:00:02 +1000181 /* Remove trailing newline */
182 *--p = '\0';
Damien Miller2f6a0ad2000-05-31 11:20:11 +1000183 log("Login restricted for %s: %.100s", pw->pw_name, loginmsg);
Damien Millerd2c208a2000-05-17 22:00:02 +1000184 }
Damien Millerb38eff82000-04-01 11:09:21 +1000185 return 0;
Damien Millerd2c208a2000-05-17 22:00:02 +1000186 }
Damien Millerb38eff82000-04-01 11:09:21 +1000187#endif /* WITH_AIXAUTHENTICATE */
188
189 /* We found no reason not to let this user try to log on... */
190 return 1;
191}