blob: f3ca96592b953273dc5a463fd3c0b4b3da9da663 [file] [log] [blame]
Damien Miller7acefbb2014-07-18 14:11:24 +10001/* $OpenBSD: auth2-pubkey.c,v 1.41 2014/07/15 15:54:14 millert Exp $ */
Ben Lindstrom855bf3a2002-06-06 20:27:55 +00002/*
3 * Copyright (c) 2000 Markus Friedl. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "includes.h"
Damien Millerf17883e2006-03-15 11:45:54 +110027
28#include <sys/types.h>
29#include <sys/stat.h>
Damien Miller09d3e122012-10-31 08:58:58 +110030#include <sys/wait.h>
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000031
Damien Miller09d3e122012-10-31 08:58:58 +110032#include <errno.h>
Darren Tucker06db5842008-06-13 14:51:28 +100033#include <fcntl.h>
Darren Tucker737f7af2012-11-05 17:07:43 +110034#ifdef HAVE_PATHS_H
35# include <paths.h>
36#endif
Damien Miller9f2abc42006-07-10 20:53:08 +100037#include <pwd.h>
Damien Miller09d3e122012-10-31 08:58:58 +110038#include <signal.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100039#include <stdio.h>
Damien Millerd7834352006-08-05 12:39:39 +100040#include <stdarg.h>
Damien Miller0a80ca12010-02-27 07:55:05 +110041#include <string.h>
42#include <time.h>
Darren Tuckerd9526a52008-06-14 09:01:24 +100043#include <unistd.h>
Damien Miller9f2abc42006-07-10 20:53:08 +100044
Damien Millerd7834352006-08-05 12:39:39 +100045#include "xmalloc.h"
Darren Tucker22cc7412004-12-06 22:47:41 +110046#include "ssh.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000047#include "ssh2.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000048#include "packet.h"
49#include "buffer.h"
50#include "log.h"
Damien Miller7acefbb2014-07-18 14:11:24 +100051#include "misc.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000052#include "servconf.h"
53#include "compat.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000054#include "key.h"
Damien Millerd7834352006-08-05 12:39:39 +100055#include "hostfile.h"
56#include "auth.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000057#include "pathnames.h"
58#include "uidswap.h"
59#include "auth-options.h"
60#include "canohost.h"
Damien Millerd7834352006-08-05 12:39:39 +100061#ifdef GSSAPI
62#include "ssh-gss.h"
63#endif
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000064#include "monitor_wrap.h"
Damien Miller1aed65e2010-03-04 21:53:35 +110065#include "authfile.h"
Damien Miller30da3442010-05-10 11:58:03 +100066#include "match.h"
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000067
68/* import */
69extern ServerOptions options;
70extern u_char *session_id2;
Darren Tucker502d3842003-06-28 12:38:01 +100071extern u_int session_id2_len;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000072
73static int
74userauth_pubkey(Authctxt *authctxt)
75{
76 Buffer b;
77 Key *key = NULL;
Damien Miller4ce189d2013-04-23 15:17:52 +100078 char *pkalg, *userstyle;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +000079 u_char *pkblob, *sig;
80 u_int alen, blen, slen;
81 int have_sig, pktype;
82 int authenticated = 0;
83
84 if (!authctxt->valid) {
85 debug2("userauth_pubkey: disabled because of invalid user");
86 return 0;
87 }
88 have_sig = packet_get_char();
89 if (datafellows & SSH_BUG_PKAUTH) {
90 debug2("userauth_pubkey: SSH_BUG_PKAUTH");
91 /* no explicit pkalg given */
92 pkblob = packet_get_string(&blen);
93 buffer_init(&b);
94 buffer_append(&b, pkblob, blen);
95 /* so we have to extract the pkalg from the pkblob */
96 pkalg = buffer_get_string(&b, &alen);
97 buffer_free(&b);
98 } else {
99 pkalg = packet_get_string(&alen);
100 pkblob = packet_get_string(&blen);
101 }
102 pktype = key_type_from_name(pkalg);
103 if (pktype == KEY_UNSPEC) {
104 /* this is perfectly legal */
Damien Miller996acd22003-04-09 20:59:48 +1000105 logit("userauth_pubkey: unsupported public key algorithm: %s",
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000106 pkalg);
107 goto done;
108 }
109 key = key_from_blob(pkblob, blen);
110 if (key == NULL) {
111 error("userauth_pubkey: cannot decode key: %s", pkalg);
112 goto done;
113 }
114 if (key->type != pktype) {
115 error("userauth_pubkey: type mismatch for decoded key "
116 "(received %d, expected %d)", key->type, pktype);
117 goto done;
118 }
Damien Miller324541e2013-12-31 12:25:40 +1100119 if (key_type_plain(key->type) == KEY_RSA &&
120 (datafellows & SSH_BUG_RSASIGMD5) != 0) {
121 logit("Refusing RSA key because client uses unsafe "
122 "signature scheme");
123 goto done;
124 }
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000125 if (have_sig) {
126 sig = packet_get_string(&slen);
127 packet_check_eom();
128 buffer_init(&b);
129 if (datafellows & SSH_OLD_SESSIONID) {
130 buffer_append(&b, session_id2, session_id2_len);
131 } else {
132 buffer_put_string(&b, session_id2, session_id2_len);
133 }
134 /* reconstruct packet */
135 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
Damien Miller4ce189d2013-04-23 15:17:52 +1000136 xasprintf(&userstyle, "%s%s%s", authctxt->user,
137 authctxt->style ? ":" : "",
138 authctxt->style ? authctxt->style : "");
139 buffer_put_cstring(&b, userstyle);
140 free(userstyle);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000141 buffer_put_cstring(&b,
142 datafellows & SSH_BUG_PKSERVICE ?
143 "ssh-userauth" :
144 authctxt->service);
145 if (datafellows & SSH_BUG_PKAUTH) {
146 buffer_put_char(&b, have_sig);
147 } else {
148 buffer_put_cstring(&b, "publickey");
149 buffer_put_char(&b, have_sig);
150 buffer_put_cstring(&b, pkalg);
151 }
152 buffer_put_string(&b, pkblob, blen);
153#ifdef DEBUG_PK
154 buffer_dump(&b);
155#endif
Damien Miller20bdcd72013-07-18 16:10:09 +1000156 pubkey_auth_info(authctxt, key, NULL);
Darren Tucker74836ae2013-06-02 07:32:00 +1000157
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000158 /* test for correct signature */
159 authenticated = 0;
160 if (PRIVSEP(user_key_allowed(authctxt->pw, key)) &&
161 PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
Damien Millerfb1310e2004-01-21 11:02:50 +1100162 buffer_len(&b))) == 1)
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000163 authenticated = 1;
Damien Millerfb1310e2004-01-21 11:02:50 +1100164 buffer_free(&b);
Darren Tuckera627d422013-06-02 07:31:17 +1000165 free(sig);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000166 } else {
167 debug("test whether pkalg/pkblob are acceptable");
168 packet_check_eom();
169
170 /* XXX fake reply and always send PK_OK ? */
171 /*
172 * XXX this allows testing whether a user is allowed
173 * to login: if you happen to have a valid pubkey this
174 * message is sent. the message is NEVER sent at all
175 * if a user is not allowed to login. is this an
176 * issue? -markus
177 */
178 if (PRIVSEP(user_key_allowed(authctxt->pw, key))) {
179 packet_start(SSH2_MSG_USERAUTH_PK_OK);
180 packet_put_string(pkalg, alen);
181 packet_put_string(pkblob, blen);
182 packet_send();
183 packet_write_wait();
184 authctxt->postponed = 1;
185 }
186 }
187 if (authenticated != 1)
188 auth_clear_options();
189done:
190 debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg);
191 if (key != NULL)
192 key_free(key);
Darren Tuckera627d422013-06-02 07:31:17 +1000193 free(pkalg);
194 free(pkblob);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000195 return authenticated;
196}
197
Darren Tucker74836ae2013-06-02 07:32:00 +1000198void
Damien Miller20bdcd72013-07-18 16:10:09 +1000199pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...)
Darren Tucker74836ae2013-06-02 07:32:00 +1000200{
Damien Miller20bdcd72013-07-18 16:10:09 +1000201 char *fp, *extra;
202 va_list ap;
203 int i;
204
205 extra = NULL;
206 if (fmt != NULL) {
207 va_start(ap, fmt);
208 i = vasprintf(&extra, fmt, ap);
209 va_end(ap);
210 if (i < 0 || extra == NULL)
211 fatal("%s: vasprintf failed", __func__);
212 }
Darren Tucker74836ae2013-06-02 07:32:00 +1000213
214 if (key_is_cert(key)) {
215 fp = key_fingerprint(key->cert->signature_key,
216 SSH_FP_MD5, SSH_FP_HEX);
Damien Miller20bdcd72013-07-18 16:10:09 +1000217 auth_info(authctxt, "%s ID %s (serial %llu) CA %s %s%s%s",
Darren Tucker74836ae2013-06-02 07:32:00 +1000218 key_type(key), key->cert->key_id,
219 (unsigned long long)key->cert->serial,
Damien Miller20bdcd72013-07-18 16:10:09 +1000220 key_type(key->cert->signature_key), fp,
221 extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
Darren Tucker74836ae2013-06-02 07:32:00 +1000222 free(fp);
223 } else {
224 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
Damien Miller20bdcd72013-07-18 16:10:09 +1000225 auth_info(authctxt, "%s %s%s%s", key_type(key), fp,
226 extra == NULL ? "" : ", ", extra == NULL ? "" : extra);
Darren Tucker74836ae2013-06-02 07:32:00 +1000227 free(fp);
228 }
Damien Miller20bdcd72013-07-18 16:10:09 +1000229 free(extra);
Darren Tucker74836ae2013-06-02 07:32:00 +1000230}
231
Damien Miller30da3442010-05-10 11:58:03 +1000232static int
Damien Miller86687062014-07-02 15:28:02 +1000233match_principals_option(const char *principal_list, struct sshkey_cert *cert)
Damien Miller30da3442010-05-10 11:58:03 +1000234{
235 char *result;
236 u_int i;
237
238 /* XXX percent_expand() sequences for authorized_principals? */
239
240 for (i = 0; i < cert->nprincipals; i++) {
241 if ((result = match_list(cert->principals[i],
242 principal_list, NULL)) != NULL) {
243 debug3("matched principal from key options \"%.100s\"",
244 result);
Darren Tuckera627d422013-06-02 07:31:17 +1000245 free(result);
Damien Miller30da3442010-05-10 11:58:03 +1000246 return 1;
247 }
248 }
249 return 0;
250}
251
252static int
Damien Miller86687062014-07-02 15:28:02 +1000253match_principals_file(char *file, struct passwd *pw, struct sshkey_cert *cert)
Damien Miller30da3442010-05-10 11:58:03 +1000254{
255 FILE *f;
Damien Miller6018a362010-07-02 13:35:19 +1000256 char line[SSH_MAX_PUBKEY_BYTES], *cp, *ep, *line_opts;
Damien Miller30da3442010-05-10 11:58:03 +1000257 u_long linenum = 0;
258 u_int i;
259
260 temporarily_use_uid(pw);
261 debug("trying authorized principals file %s", file);
262 if ((f = auth_openprincipals(file, pw, options.strict_modes)) == NULL) {
263 restore_uid();
264 return 0;
265 }
266 while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
Damien Miller6018a362010-07-02 13:35:19 +1000267 /* Skip leading whitespace. */
Damien Miller30da3442010-05-10 11:58:03 +1000268 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
269 ;
Damien Miller6018a362010-07-02 13:35:19 +1000270 /* Skip blank and comment lines. */
271 if ((ep = strchr(cp, '#')) != NULL)
272 *ep = '\0';
273 if (!*cp || *cp == '\n')
Damien Miller30da3442010-05-10 11:58:03 +1000274 continue;
Damien Miller6018a362010-07-02 13:35:19 +1000275 /* Trim trailing whitespace. */
276 ep = cp + strlen(cp) - 1;
277 while (ep > cp && (*ep == '\n' || *ep == ' ' || *ep == '\t'))
278 *ep-- = '\0';
279 /*
280 * If the line has internal whitespace then assume it has
281 * key options.
282 */
283 line_opts = NULL;
284 if ((ep = strrchr(cp, ' ')) != NULL ||
285 (ep = strrchr(cp, '\t')) != NULL) {
286 for (; *ep == ' ' || *ep == '\t'; ep++)
Damien Miller188ea812010-12-01 11:50:14 +1100287 ;
Damien Miller6018a362010-07-02 13:35:19 +1000288 line_opts = cp;
289 cp = ep;
290 }
Damien Miller30da3442010-05-10 11:58:03 +1000291 for (i = 0; i < cert->nprincipals; i++) {
292 if (strcmp(cp, cert->principals[i]) == 0) {
Darren Tuckeraf1a60e2011-10-02 18:59:59 +1100293 debug3("matched principal \"%.100s\" "
294 "from file \"%s\" on line %lu",
Damien Miller09d3e122012-10-31 08:58:58 +1100295 cert->principals[i], file, linenum);
Damien Miller6018a362010-07-02 13:35:19 +1000296 if (auth_parse_options(pw, line_opts,
297 file, linenum) != 1)
298 continue;
Damien Miller30da3442010-05-10 11:58:03 +1000299 fclose(f);
300 restore_uid();
301 return 1;
302 }
303 }
304 }
305 fclose(f);
306 restore_uid();
307 return 0;
Damien Miller09d3e122012-10-31 08:58:58 +1100308}
Damien Miller30da3442010-05-10 11:58:03 +1000309
Damien Miller09d3e122012-10-31 08:58:58 +1100310/*
311 * Checks whether key is allowed in authorized_keys-format file,
312 * returns 1 if the key is allowed or 0 otherwise.
313 */
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000314static int
Damien Miller09d3e122012-10-31 08:58:58 +1100315check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000316{
Darren Tucker22cc7412004-12-06 22:47:41 +1100317 char line[SSH_MAX_PUBKEY_BYTES];
Damien Miller0a80ca12010-02-27 07:55:05 +1100318 const char *reason;
Darren Tucker33c787f2008-07-02 22:37:30 +1000319 int found_key = 0;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000320 u_long linenum = 0;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000321 Key *found;
322 char *fp;
323
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000324 found_key = 0;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000325
Darren Tucker74836ae2013-06-02 07:32:00 +1000326 found = NULL;
Darren Tucker22cc7412004-12-06 22:47:41 +1100327 while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000328 char *cp, *key_options = NULL;
Darren Tucker74836ae2013-06-02 07:32:00 +1000329 if (found != NULL)
330 key_free(found);
331 found = key_new(key_is_cert(key) ? KEY_UNSPEC : key->type);
Damien Miller0a80ca12010-02-27 07:55:05 +1100332 auth_clear_options();
333
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000334 /* Skip leading whitespace, empty and comment lines. */
335 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
336 ;
337 if (!*cp || *cp == '\n' || *cp == '#')
338 continue;
339
340 if (key_read(found, &cp) != 1) {
341 /* no key? check if there are options for this key */
342 int quoted = 0;
343 debug2("user_key_allowed: check options: '%s'", cp);
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000344 key_options = cp;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000345 for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
346 if (*cp == '\\' && cp[1] == '"')
347 cp++; /* Skip both */
348 else if (*cp == '"')
349 quoted = !quoted;
350 }
351 /* Skip remaining whitespace. */
352 for (; *cp == ' ' || *cp == '\t'; cp++)
353 ;
354 if (key_read(found, &cp) != 1) {
355 debug2("user_key_allowed: advance: '%s'", cp);
356 /* still no key? advance to next line*/
357 continue;
358 }
359 }
Damien Miller4e270b02010-04-16 15:56:21 +1000360 if (key_is_cert(key)) {
Damien Miller0a80ca12010-02-27 07:55:05 +1100361 if (!key_equal(found, key->cert->signature_key))
362 continue;
Damien Miller84399552010-05-21 14:58:12 +1000363 if (auth_parse_options(pw, key_options, file,
364 linenum) != 1)
365 continue;
366 if (!key_is_cert_authority)
367 continue;
Damien Miller0a80ca12010-02-27 07:55:05 +1100368 fp = key_fingerprint(found, SSH_FP_MD5,
369 SSH_FP_HEX);
Damien Millere513a912010-03-22 05:51:21 +1100370 debug("matching CA found: file %s, line %lu, %s %s",
371 file, linenum, key_type(found), fp);
Damien Miller30da3442010-05-10 11:58:03 +1000372 /*
373 * If the user has specified a list of principals as
374 * a key option, then prefer that list to matching
375 * their username in the certificate principals list.
376 */
377 if (authorized_principals != NULL &&
378 !match_principals_option(authorized_principals,
379 key->cert)) {
380 reason = "Certificate does not contain an "
381 "authorized principal";
382 fail_reason:
Darren Tuckera627d422013-06-02 07:31:17 +1000383 free(fp);
Damien Miller0a80ca12010-02-27 07:55:05 +1100384 error("%s", reason);
385 auth_debug_add("%s", reason);
386 continue;
387 }
Damien Miller30da3442010-05-10 11:58:03 +1000388 if (key_cert_check_authority(key, 0, 0,
389 authorized_principals == NULL ? pw->pw_name : NULL,
390 &reason) != 0)
391 goto fail_reason;
Damien Miller4e270b02010-04-16 15:56:21 +1000392 if (auth_cert_options(key, pw) != 0) {
Darren Tuckera627d422013-06-02 07:31:17 +1000393 free(fp);
Damien Miller0a80ca12010-02-27 07:55:05 +1100394 continue;
Damien Millere513a912010-03-22 05:51:21 +1100395 }
396 verbose("Accepted certificate ID \"%s\" "
397 "signed by %s CA %s via %s", key->cert->key_id,
398 key_type(found), fp, file);
Darren Tuckera627d422013-06-02 07:31:17 +1000399 free(fp);
Damien Miller0a80ca12010-02-27 07:55:05 +1100400 found_key = 1;
401 break;
Damien Miller84399552010-05-21 14:58:12 +1000402 } else if (key_equal(found, key)) {
403 if (auth_parse_options(pw, key_options, file,
404 linenum) != 1)
405 continue;
406 if (key_is_cert_authority)
407 continue;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000408 found_key = 1;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000409 fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
Darren Tucker74836ae2013-06-02 07:32:00 +1000410 debug("matching key found: file %s, line %lu %s %s",
411 file, linenum, key_type(found), fp);
Darren Tuckera627d422013-06-02 07:31:17 +1000412 free(fp);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000413 break;
414 }
415 }
Darren Tucker74836ae2013-06-02 07:32:00 +1000416 if (found != NULL)
417 key_free(found);
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000418 if (!found_key)
419 debug2("key not found");
420 return found_key;
421}
422
Damien Miller1aed65e2010-03-04 21:53:35 +1100423/* Authenticate a certificate key against TrustedUserCAKeys */
424static int
425user_cert_trusted_ca(struct passwd *pw, Key *key)
426{
Damien Miller30da3442010-05-10 11:58:03 +1000427 char *ca_fp, *principals_file = NULL;
Damien Miller1aed65e2010-03-04 21:53:35 +1100428 const char *reason;
429 int ret = 0;
430
431 if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL)
432 return 0;
433
Damien Millere513a912010-03-22 05:51:21 +1100434 ca_fp = key_fingerprint(key->cert->signature_key,
435 SSH_FP_MD5, SSH_FP_HEX);
Damien Miller1aed65e2010-03-04 21:53:35 +1100436
437 if (key_in_file(key->cert->signature_key,
438 options.trusted_user_ca_keys, 1) != 1) {
439 debug2("%s: CA %s %s is not listed in %s", __func__,
440 key_type(key->cert->signature_key), ca_fp,
441 options.trusted_user_ca_keys);
442 goto out;
443 }
Damien Miller30da3442010-05-10 11:58:03 +1000444 /*
445 * If AuthorizedPrincipals is in use, then compare the certificate
446 * principals against the names in that file rather than matching
447 * against the username.
448 */
449 if ((principals_file = authorized_principals_file(pw)) != NULL) {
450 if (!match_principals_file(principals_file, pw, key->cert)) {
451 reason = "Certificate does not contain an "
452 "authorized principal";
453 fail_reason:
454 error("%s", reason);
455 auth_debug_add("%s", reason);
456 goto out;
457 }
Damien Miller1aed65e2010-03-04 21:53:35 +1100458 }
Damien Miller30da3442010-05-10 11:58:03 +1000459 if (key_cert_check_authority(key, 0, 1,
460 principals_file == NULL ? pw->pw_name : NULL, &reason) != 0)
461 goto fail_reason;
Damien Miller4e270b02010-04-16 15:56:21 +1000462 if (auth_cert_options(key, pw) != 0)
Damien Miller1aed65e2010-03-04 21:53:35 +1100463 goto out;
464
Damien Millere513a912010-03-22 05:51:21 +1100465 verbose("Accepted certificate ID \"%s\" signed by %s CA %s via %s",
466 key->cert->key_id, key_type(key->cert->signature_key), ca_fp,
467 options.trusted_user_ca_keys);
Damien Miller1aed65e2010-03-04 21:53:35 +1100468 ret = 1;
469
470 out:
Darren Tuckera627d422013-06-02 07:31:17 +1000471 free(principals_file);
472 free(ca_fp);
Damien Miller1aed65e2010-03-04 21:53:35 +1100473 return ret;
474}
475
Damien Miller09d3e122012-10-31 08:58:58 +1100476/*
477 * Checks whether key is allowed in file.
478 * returns 1 if the key is allowed or 0 otherwise.
479 */
480static int
481user_key_allowed2(struct passwd *pw, Key *key, char *file)
482{
483 FILE *f;
484 int found_key = 0;
485
486 /* Temporarily use the user's uid. */
487 temporarily_use_uid(pw);
488
489 debug("trying public key file %s", file);
490 if ((f = auth_openkeyfile(file, pw, options.strict_modes)) != NULL) {
491 found_key = check_authkeys_file(f, file, key, pw);
492 fclose(f);
493 }
494
495 restore_uid();
496 return found_key;
497}
498
499/*
500 * Checks whether key is allowed in output of command.
501 * returns 1 if the key is allowed or 0 otherwise.
502 */
503static int
504user_key_command_allowed2(struct passwd *user_pw, Key *key)
505{
506 FILE *f;
507 int ok, found_key = 0;
508 struct passwd *pw;
509 struct stat st;
510 int status, devnull, p[2], i;
511 pid_t pid;
Damien Millerd0d10992012-11-04 22:23:14 +1100512 char *username, errmsg[512];
Damien Miller09d3e122012-10-31 08:58:58 +1100513
514 if (options.authorized_keys_command == NULL ||
515 options.authorized_keys_command[0] != '/')
516 return 0;
517
Damien Millerd0d10992012-11-04 22:23:14 +1100518 if (options.authorized_keys_command_user == NULL) {
519 error("No user for AuthorizedKeysCommand specified, skipping");
520 return 0;
Damien Miller09d3e122012-10-31 08:58:58 +1100521 }
522
Damien Millerd0d10992012-11-04 22:23:14 +1100523 username = percent_expand(options.authorized_keys_command_user,
524 "u", user_pw->pw_name, (char *)NULL);
525 pw = getpwnam(username);
526 if (pw == NULL) {
Damien Miller4018dc02013-02-15 10:28:55 +1100527 error("AuthorizedKeysCommandUser \"%s\" not found: %s",
528 username, strerror(errno));
Damien Millerd0d10992012-11-04 22:23:14 +1100529 free(username);
530 return 0;
531 }
532 free(username);
533
Damien Miller09d3e122012-10-31 08:58:58 +1100534 temporarily_use_uid(pw);
535
536 if (stat(options.authorized_keys_command, &st) < 0) {
537 error("Could not stat AuthorizedKeysCommand \"%s\": %s",
538 options.authorized_keys_command, strerror(errno));
539 goto out;
540 }
541 if (auth_secure_path(options.authorized_keys_command, &st, NULL, 0,
542 errmsg, sizeof(errmsg)) != 0) {
543 error("Unsafe AuthorizedKeysCommand: %s", errmsg);
544 goto out;
545 }
546
547 if (pipe(p) != 0) {
548 error("%s: pipe: %s", __func__, strerror(errno));
549 goto out;
550 }
551
Damien Miller1e854692012-11-14 19:04:02 +1100552 debug3("Running AuthorizedKeysCommand: \"%s %s\" as \"%s\"",
553 options.authorized_keys_command, user_pw->pw_name, pw->pw_name);
Damien Miller09d3e122012-10-31 08:58:58 +1100554
555 /*
556 * Don't want to call this in the child, where it can fatal() and
557 * run cleanup_exit() code.
558 */
559 restore_uid();
560
561 switch ((pid = fork())) {
562 case -1: /* error */
563 error("%s: fork: %s", __func__, strerror(errno));
564 close(p[0]);
565 close(p[1]);
566 return 0;
567 case 0: /* child */
568 for (i = 0; i < NSIG; i++)
569 signal(i, SIG_DFL);
570
Damien Miller1e854692012-11-14 19:04:02 +1100571 if ((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) {
572 error("%s: open %s: %s", __func__, _PATH_DEVNULL,
573 strerror(errno));
574 _exit(1);
575 }
576 /* Keep stderr around a while longer to catch errors */
577 if (dup2(devnull, STDIN_FILENO) == -1 ||
578 dup2(p[1], STDOUT_FILENO) == -1) {
579 error("%s: dup2: %s", __func__, strerror(errno));
580 _exit(1);
581 }
Damien Millerd0d10992012-11-04 22:23:14 +1100582 closefrom(STDERR_FILENO + 1);
Damien Miller1e854692012-11-14 19:04:02 +1100583
Damien Miller09d3e122012-10-31 08:58:58 +1100584 /* Don't use permanently_set_uid() here to avoid fatal() */
585 if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) != 0) {
586 error("setresgid %u: %s", (u_int)pw->pw_gid,
587 strerror(errno));
588 _exit(1);
589 }
590 if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) != 0) {
591 error("setresuid %u: %s", (u_int)pw->pw_uid,
592 strerror(errno));
593 _exit(1);
594 }
Damien Miller1e854692012-11-14 19:04:02 +1100595 /* stdin is pointed to /dev/null at this point */
596 if (dup2(STDIN_FILENO, STDERR_FILENO) == -1) {
Damien Miller09d3e122012-10-31 08:58:58 +1100597 error("%s: dup2: %s", __func__, strerror(errno));
598 _exit(1);
599 }
Damien Miller09d3e122012-10-31 08:58:58 +1100600
601 execl(options.authorized_keys_command,
Damien Miller1e854692012-11-14 19:04:02 +1100602 options.authorized_keys_command, user_pw->pw_name, NULL);
Damien Miller09d3e122012-10-31 08:58:58 +1100603
604 error("AuthorizedKeysCommand %s exec failed: %s",
605 options.authorized_keys_command, strerror(errno));
606 _exit(127);
607 default: /* parent */
608 break;
609 }
610
611 temporarily_use_uid(pw);
612
613 close(p[1]);
614 if ((f = fdopen(p[0], "r")) == NULL) {
615 error("%s: fdopen: %s", __func__, strerror(errno));
616 close(p[0]);
617 /* Don't leave zombie child */
618 kill(pid, SIGTERM);
619 while (waitpid(pid, NULL, 0) == -1 && errno == EINTR)
620 ;
621 goto out;
622 }
623 ok = check_authkeys_file(f, options.authorized_keys_command, key, pw);
624 fclose(f);
625
626 while (waitpid(pid, &status, 0) == -1) {
627 if (errno != EINTR) {
628 error("%s: waitpid: %s", __func__, strerror(errno));
629 goto out;
630 }
631 }
632 if (WIFSIGNALED(status)) {
633 error("AuthorizedKeysCommand %s exited on signal %d",
634 options.authorized_keys_command, WTERMSIG(status));
635 goto out;
636 } else if (WEXITSTATUS(status) != 0) {
637 error("AuthorizedKeysCommand %s returned status %d",
638 options.authorized_keys_command, WEXITSTATUS(status));
639 goto out;
640 }
641 found_key = ok;
642 out:
643 restore_uid();
644 return found_key;
645}
646
647/*
648 * Check whether key authenticates and authorises the user.
649 */
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000650int
651user_key_allowed(struct passwd *pw, Key *key)
652{
Damien Millerd8478b62011-05-29 21:39:36 +1000653 u_int success, i;
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000654 char *file;
655
Damien Miller1aed65e2010-03-04 21:53:35 +1100656 if (auth_key_is_revoked(key))
657 return 0;
658 if (key_is_cert(key) && auth_key_is_revoked(key->cert->signature_key))
659 return 0;
660
661 success = user_cert_trusted_ca(pw, key);
662 if (success)
663 return success;
664
Damien Miller09d3e122012-10-31 08:58:58 +1100665 success = user_key_command_allowed2(pw, key);
666 if (success > 0)
667 return success;
668
Damien Millerd8478b62011-05-29 21:39:36 +1000669 for (i = 0; !success && i < options.num_authkeys_files; i++) {
Damien Miller09d3e122012-10-31 08:58:58 +1100670
671 if (strcasecmp(options.authorized_keys_files[i], "none") == 0)
672 continue;
Damien Millerd8478b62011-05-29 21:39:36 +1000673 file = expand_authorized_keys(
674 options.authorized_keys_files[i], pw);
Damien Miller09d3e122012-10-31 08:58:58 +1100675
Damien Millerd8478b62011-05-29 21:39:36 +1000676 success = user_key_allowed2(pw, key, file);
Darren Tuckera627d422013-06-02 07:31:17 +1000677 free(file);
Damien Millerd8478b62011-05-29 21:39:36 +1000678 }
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000679
Ben Lindstrom855bf3a2002-06-06 20:27:55 +0000680 return success;
681}
682
683Authmethod method_pubkey = {
684 "publickey",
685 userauth_pubkey,
686 &options.pubkey_authentication
687};