svr-authpam.c

   1 /*
   2  * Dropbear SSH
   3  *
   4  * Copyright (c) 2004 Martin Carlsson
   5  * Portions (c) 2004 Matt Johnston
   6  * All rights reserved.
   7  *
   8  * Permission is hereby granted, free of charge, to any person obtaining a copy
   9  * of this software and associated documentation files (the "Software"), to deal
  10  * in the Software without restriction, including without limitation the rights
  11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  12  * copies of the Software, and to permit persons to whom the Software is
  13  * furnished to do so, subject to the following conditions:
  14  *
  15  * The above copyright notice and this permission notice shall be included in
  16  * all copies or substantial portions of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  21  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  24  * SOFTWARE. */
  25
  26 /* Validates a user password using PAM */
  27
  28 #include "includes.h"
  29 #include "session.h"
  30 #include "buffer.h"
  31 #include "dbutil.h"
  32 #include "auth.h"
  33
  34 #ifdef ENABLE_SVR_PAM_AUTH
  35
  36 #if defined(HAVE_SECURITY_PAM_APPL_H)
  37 #include <security/pam_appl.h>
  38 #elif defined (HAVE_PAM_PAM_APPL_H)
  39 #include <pam/pam_appl.h>
  40 #endif
  41
  42 struct UserDataS {
  43         char* user;
  44         char* passwd;
  45 };
  46
  47 /* PAM conversation function - for now we only handle one message */
  48 int
  49 pamConvFunc(int num_msg,
  50                 const struct pam_message **msg,
  51                 struct pam_response **respp,
  52                 void *appdata_ptr) {
  53
  54         int rc = PAM_SUCCESS;
  55         struct pam_response* resp = NULL;
  56         struct UserDataS* userDatap = (struct UserDataS*) appdata_ptr;
  57         unsigned int msg_len = 0;
  58         unsigned int i = 0;
  59
  60         const char* message = (*msg)->msg;
  61
  62         /* make a copy we can strip */
  63         char * compare_message = m_strdup(message);
  64
  65         TRACE(("enter pamConvFunc"))
  66
  67         if (num_msg != 1) {
  68                 /* If you're getting here - Dropbear probably can't support your pam
  69                  * modules. This whole file is a bit of a hack around lack of
  70                  * asynchronocity in PAM anyway. */
  71                 dropbear_log(LOG_INFO, "pamConvFunc() called with >1 messages: not supported.");
  72                 return PAM_CONV_ERR;
  73         }
  74
  75         TRACE(("msg_style is %d", (*msg)->msg_style))
  76         if (compare_message) {
  77                 TRACE(("message is '%s'", compare_message))
  78         } else {
  79                 TRACE(("null message"))
  80         }
  81
  82
  83         /* Make the string lowercase. */
  84         msg_len = strlen(compare_message);
  85         for (i = 0; i < msg_len; i++) {
  86                 compare_message[i] = tolower(compare_message[i]);
  87         }
  88
  89         /* If the string ends with ": ", remove the space.
  90            ie "login: " vs "login:" */
  91         if (msg_len > 2
  92                         && compare_message[msg_len-2] == ':'
  93                         && compare_message[msg_len-1] == ' ') {
  94                 compare_message[msg_len-1] = '\0';
  95         }
  96
  97         switch((*msg)->msg_style) {
  98
  99                 case PAM_PROMPT_ECHO_OFF:
 100
 101                         if (!(strcmp(compare_message, "password:") == 0)) {
 102                                 /* We don't recognise the prompt as asking for a password,
 103                                    so can't handle it. Add more above as required for
 104                                    different pam modules/implementations */
 105                                 dropbear_log(LOG_NOTICE, "PAM unknown prompt '%s' (no echo)",
 106                                                 compare_message);
 107                                 rc = PAM_CONV_ERR;
 108                                 break;
 109                         }
 110
 111                         /* You have to read the PAM module-writers' docs (do we look like
 112                          * module writers? no.) to find out that the module will
 113                          * free the pam_response and its resp element - ie we _must_ malloc
 114                          * it here */
 115                         resp = (struct pam_response*) m_malloc(sizeof(struct pam_response));
 116                         memset(resp, 0, sizeof(struct pam_response));
 117
 118                         resp->resp = m_strdup(userDatap->passwd);
 119                         m_burn(userDatap->passwd, strlen(userDatap->passwd));
 120                         (*respp) = resp;
 121                         break;
 122
 123
 124                 case PAM_PROMPT_ECHO_ON:
 125
 126                         if (!(
 127                                 (strcmp(compare_message, "login:" ) == 0)
 128                                 || (strcmp(compare_message, "please enter username:") == 0)
 129                                 || (strcmp(compare_message, "username:") == 0)
 130                                 )) {
 131                                 /* We don't recognise the prompt as asking for a username,
 132                                    so can't handle it. Add more above as required for
 133                                    different pam modules/implementations */
 134                                 dropbear_log(LOG_NOTICE, "PAM unknown prompt '%s' (with echo)",
 135                                                 compare_message);
 136                                 rc = PAM_CONV_ERR;
 137                                 break;
 138                         }
 139
 140                         /* You have to read the PAM module-writers' docs (do we look like
 141                          * module writers? no.) to find out that the module will
 142                          * free the pam_response and its resp element - ie we _must_ malloc
 143                          * it here */
 144                         resp = (struct pam_response*) m_malloc(sizeof(struct pam_response));
 145                         memset(resp, 0, sizeof(struct pam_response));
 146
 147                         resp->resp = m_strdup(userDatap->user);
 148                         TRACE(("userDatap->user='%s'", userDatap->user))
 149                         (*respp) = resp;
 150                         break;
 151
 152                 default:
 153                         TRACE(("Unknown message type"))
 154                         rc = PAM_CONV_ERR;
 155                         break;
 156         }
 157
 158         m_free(compare_message);
 159         TRACE(("leave pamConvFunc, rc %d", rc))
 160
 161         return rc;
 162 }
 163
 164 /* Process a password auth request, sending success or failure messages as
 165  * appropriate. To the client it looks like it's doing normal password auth (as
 166  * opposed to keyboard-interactive or something), so the pam module has to be
 167  * fairly standard (ie just "what's your username, what's your password, OK").
 168  *
 169  * Keyboard interactive would be a lot nicer, but since PAM is synchronous, it
 170  * gets very messy trying to send the interactive challenges, and read the
 171  * interactive responses, over the network. */
 172 void svr_auth_pam() {
 173
 174         struct UserDataS userData = {NULL, NULL};
 175         struct pam_conv pamConv = {
 176                 pamConvFunc,
 177                 &userData /* submitted to pamvConvFunc as appdata_ptr */
 178         };
 179
 180         pam_handle_t* pamHandlep = NULL;
 181
 182         unsigned char * password = NULL;
 183         unsigned int passwordlen;
 184
 185         int rc = PAM_SUCCESS;
 186         unsigned char changepw;
 187
 188         /* check if client wants to change password */
 189         changepw = buf_getbool(ses.payload);
 190         if (changepw) {
 191                 /* not implemented by this server */
 192                 send_msg_userauth_failure(0, 1);
 193                 goto cleanup;
 194         }
 195
 196         password = buf_getstring(ses.payload, &passwordlen);
 197
 198         /* used to pass data to the PAM conversation function - don't bother with
 199          * strdup() etc since these are touched only by our own conversation
 200          * function (above) which takes care of it */
 201         userData.user = ses.authstate.pw_name;
 202         userData.passwd = password;
 203
 204         /* Init pam */
 205         if ((rc = pam_start("sshd", NULL, &pamConv, &pamHandlep)) != PAM_SUCCESS) {
 206                 dropbear_log(LOG_WARNING, "pam_start() failed, rc=%d, %s\n",
 207                                 rc, pam_strerror(pamHandlep, rc));
 208                 goto cleanup;
 209         }
 210
 211         /* just to set it to something */
 212         if ((rc = pam_set_item(pamHandlep, PAM_TTY, "ssh") != PAM_SUCCESS)) {
 213                 dropbear_log(LOG_WARNING, "pam_set_item() failed, rc=%d, %s\n",
 214                                 rc, pam_strerror(pamHandlep, rc));
 215                 goto cleanup;
 216         }
 217
 218 #ifdef HAVE_PAM_FAIL_DELAY
 219         /* We have our own random delay code already, disable PAM's */
 220         (void) pam_fail_delay(pamHandlep, 0 /* musec_delay */);
 221 #endif
 222
 223         /* (void) pam_set_item(pamHandlep, PAM_FAIL_DELAY, (void*) pamDelayFunc); */
 224
 225         if ((rc = pam_authenticate(pamHandlep, 0)) != PAM_SUCCESS) {
 226                 dropbear_log(LOG_WARNING, "pam_authenticate() failed, rc=%d, %s\n",
 227                                 rc, pam_strerror(pamHandlep, rc));
 228                 dropbear_log(LOG_WARNING,
 229                                 "bad PAM password attempt for '%s' from %s",
 230                                 ses.authstate.pw_name,
 231                                 svr_ses.addrstring);
 232                 send_msg_userauth_failure(0, 1);
 233                 goto cleanup;
 234         }
 235
 236         if ((rc = pam_acct_mgmt(pamHandlep, 0)) != PAM_SUCCESS) {
 237                 dropbear_log(LOG_WARNING, "pam_acct_mgmt() failed, rc=%d, %s\n",
 238                                 rc, pam_strerror(pamHandlep, rc));
 239                 dropbear_log(LOG_WARNING,
 240                                 "bad PAM password attempt for '%s' from %s",
 241                                 ses.authstate.pw_name,
 242                                 svr_ses.addrstring);
 243                 send_msg_userauth_failure(0, 1);
 244                 goto cleanup;
 245         }
 246
 247         /* successful authentication */
 248         dropbear_log(LOG_NOTICE, "PAM password auth succeeded for '%s' from %s",
 249                         ses.authstate.pw_name,
 250                         svr_ses.addrstring);
 251         send_msg_userauth_success();
 252
 253 cleanup:
 254         if (password != NULL) {
 255                 m_burn(password, passwordlen);
 256                 m_free(password);
 257         }
 258         if (pamHandlep != NULL) {
 259                 TRACE(("pam_end"))
 260                 (void) pam_end(pamHandlep, 0 /* pam_status */);
 261         }
 262 }
 263
 264 #endif /* ENABLE_SVR_PAM_AUTH */