1 /* $OpenBSD: auth2.c,v 1.116 2007/09/29 00:25:51 dtucker Exp $ */
3 * Copyright (c) 2000 Markus Friedl. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 #include <sys/types.h>
46 #include "pathnames.h"
52 #include "monitor_wrap.h"
55 extern ServerOptions options
;
56 extern u_char
*session_id2
;
57 extern u_int session_id2_len
;
58 extern Buffer loginmsg
;
62 extern Authmethod method_none
;
63 extern Authmethod method_pubkey
;
64 extern Authmethod method_passwd
;
65 extern Authmethod method_kbdint
;
66 extern Authmethod method_hostbased
;
68 extern Authmethod method_gssapi
;
71 Authmethod
*authmethods
[] = {
85 static void input_service_request(int, u_int32_t
, void *);
86 static void input_userauth_request(int, u_int32_t
, void *);
89 static Authmethod
*authmethod_lookup(const char *);
90 static char *authmethods_get(void);
93 * loop until authctxt->success == TRUE
97 do_authentication2(Authctxt
*authctxt
)
99 dispatch_init(&dispatch_protocol_error
);
100 dispatch_set(SSH2_MSG_SERVICE_REQUEST
, &input_service_request
);
101 dispatch_run(DISPATCH_BLOCK
, &authctxt
->success
, authctxt
);
106 input_service_request(int type
, u_int32_t seq
, void *ctxt
)
108 Authctxt
*authctxt
= ctxt
;
111 char *service
= packet_get_string(&len
);
114 if (authctxt
== NULL
)
115 fatal("input_service_request: no authctxt");
117 if (strcmp(service
, "ssh-userauth") == 0) {
118 if (!authctxt
->success
) {
120 /* now we can handle user-auth requests */
121 dispatch_set(SSH2_MSG_USERAUTH_REQUEST
, &input_userauth_request
);
124 /* XXX all other service requests are denied */
127 packet_start(SSH2_MSG_SERVICE_ACCEPT
);
128 packet_put_cstring(service
);
132 debug("bad service request %s", service
);
133 packet_disconnect("bad service request %s", service
);
140 input_userauth_request(int type
, u_int32_t seq
, void *ctxt
)
142 Authctxt
*authctxt
= ctxt
;
143 Authmethod
*m
= NULL
;
144 char *user
, *service
, *method
, *style
= NULL
;
145 int authenticated
= 0;
146 #ifdef HAVE_LOGIN_CAP
148 const char *from_host
, *from_ip
;
150 from_host
= get_canonical_hostname(options
.use_dns
);
151 from_ip
= get_remote_ipaddr();
154 if (authctxt
== NULL
)
155 fatal("input_userauth_request: no authctxt");
157 user
= packet_get_string(NULL
);
158 service
= packet_get_string(NULL
);
159 method
= packet_get_string(NULL
);
160 debug("userauth-request for user %s service %s method %s", user
, service
, method
);
161 debug("attempt %d failures %d", authctxt
->attempt
, authctxt
->failures
);
163 if ((style
= strchr(user
, ':')) != NULL
)
166 if (authctxt
->attempt
++ == 0) {
167 /* setup auth context */
168 authctxt
->pw
= PRIVSEP(getpwnamallow(user
));
169 authctxt
->user
= xstrdup(user
);
170 if (authctxt
->pw
&& strcmp(service
, "ssh-connection")==0) {
172 debug2("input_userauth_request: setting up authctxt for %s", user
);
174 logit("input_userauth_request: invalid user %s", user
);
175 authctxt
->pw
= fakepw();
176 #ifdef SSH_AUDIT_EVENTS
177 PRIVSEP(audit_event(SSH_INVALID_USER
));
182 PRIVSEP(start_pam(authctxt
));
184 setproctitle("%s%s", authctxt
->valid
? user
: "unknown",
185 use_privsep
? " [net]" : "");
186 authctxt
->service
= xstrdup(service
);
187 authctxt
->style
= style
? xstrdup(style
) : NULL
;
189 mm_inform_authserv(service
, style
);
190 } else if (strcmp(user
, authctxt
->user
) != 0 ||
191 strcmp(service
, authctxt
->service
) != 0) {
192 packet_disconnect("Change of username or service not allowed: "
193 "(%s,%s) -> (%s,%s)",
194 authctxt
->user
, authctxt
->service
, user
, service
);
197 #ifdef HAVE_LOGIN_CAP
198 if (authctxt
->pw
!= NULL
) {
199 lc
= login_getpwclass(authctxt
->pw
);
201 lc
= login_getclassbyname(NULL
, authctxt
->pw
);
202 if (!auth_hostok(lc
, from_host
, from_ip
)) {
203 logit("Denied connection for %.200s from %.200s [%.200s].",
204 authctxt
->pw
->pw_name
, from_host
, from_ip
);
205 packet_disconnect("Sorry, you are not allowed to connect.");
207 if (!auth_timeok(lc
, time(NULL
))) {
208 logit("LOGIN %.200s REFUSED (TIME) FROM %.200s",
209 authctxt
->pw
->pw_name
, from_host
);
210 packet_disconnect("Logins not available right now.");
215 #endif /* HAVE_LOGIN_CAP */
218 auth2_challenge_stop(authctxt
);
221 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN
, NULL
);
222 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE
, NULL
);
225 authctxt
->postponed
= 0;
227 /* try to authenticate user */
228 m
= authmethod_lookup(method
);
230 debug2("input_userauth_request: try method %s", method
);
231 authenticated
= m
->userauth(authctxt
);
233 userauth_finish(authctxt
, authenticated
, method
);
241 userauth_finish(Authctxt
*authctxt
, int authenticated
, char *method
)
245 if (!authctxt
->valid
&& authenticated
)
246 fatal("INTERNAL ERROR: authenticated invalid user %s",
249 /* Special handling for root */
250 if (authenticated
&& authctxt
->pw
->pw_uid
== 0 &&
251 !auth_root_allowed(method
)) {
253 #ifdef SSH_AUDIT_EVENTS
254 PRIVSEP(audit_event(SSH_LOGIN_ROOT_DENIED
));
259 if (options
.use_pam
&& authenticated
) {
260 if (!PRIVSEP(do_pam_account())) {
261 /* if PAM returned a message, send it to the user */
262 if (buffer_len(&loginmsg
) > 0) {
263 buffer_append(&loginmsg
, "\0", 1);
264 userauth_send_banner(buffer_ptr(&loginmsg
));
267 fatal("Access denied for user %s by PAM account "
268 "configuration", authctxt
->user
);
274 if (authenticated
&& cray_access_denied(authctxt
->user
)) {
276 fatal("Access denied for user %s.",authctxt
->user
);
280 /* Log before sending the reply */
281 auth_log(authctxt
, authenticated
, method
, " ssh2");
283 if (authctxt
->postponed
)
286 /* XXX todo: check if multiple auth methods are needed */
287 if (authenticated
== 1) {
288 /* turn off userauth */
289 dispatch_set(SSH2_MSG_USERAUTH_REQUEST
, &dispatch_protocol_ignore
);
290 packet_start(SSH2_MSG_USERAUTH_SUCCESS
);
293 /* now we can break out */
294 authctxt
->success
= 1;
296 if (authctxt
->failures
++ > options
.max_authtries
) {
297 #ifdef SSH_AUDIT_EVENTS
298 PRIVSEP(audit_event(SSH_LOGIN_EXCEED_MAXTRIES
));
300 packet_disconnect(AUTH_FAIL_MSG
, authctxt
->user
);
302 methods
= authmethods_get();
303 packet_start(SSH2_MSG_USERAUTH_FAILURE
);
304 packet_put_cstring(methods
);
305 packet_put_char(0); /* XXX partial success, unused */
313 authmethods_get(void)
320 for (i
= 0; authmethods
[i
] != NULL
; i
++) {
321 if (strcmp(authmethods
[i
]->name
, "none") == 0)
323 if (authmethods
[i
]->enabled
!= NULL
&&
324 *(authmethods
[i
]->enabled
) != 0) {
325 if (buffer_len(&b
) > 0)
326 buffer_append(&b
, ",", 1);
327 buffer_append(&b
, authmethods
[i
]->name
,
328 strlen(authmethods
[i
]->name
));
331 buffer_append(&b
, "\0", 1);
332 list
= xstrdup(buffer_ptr(&b
));
338 authmethod_lookup(const char *name
)
343 for (i
= 0; authmethods
[i
] != NULL
; i
++)
344 if (authmethods
[i
]->enabled
!= NULL
&&
345 *(authmethods
[i
]->enabled
) != 0 &&
346 strcmp(name
, authmethods
[i
]->name
) == 0)
347 return authmethods
[i
];
348 debug2("Unrecognized authentication method name: %s",
349 name
? name
: "NULL");