1 /* $OpenBSD: auth2-pubkey.c,v 1.55 2016/01/27 00:53:12 djm Exp $ */
3 * Copyright (c) 2000 Markus Friedl. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 #include <sys/types.h>
58 #include "pathnames.h"
60 #include "auth-options.h"
65 #include "monitor_wrap.h"
69 #include "channels.h" /* XXX for session.h */
70 #include "session.h" /* XXX for child_set_env(); refactor? */
73 extern ServerOptions options
;
74 extern u_char
*session_id2
;
75 extern u_int session_id2_len
;
78 userauth_pubkey(Authctxt
*authctxt
)
82 char *pkalg
, *userstyle
, *fp
= NULL
;
84 u_int alen
, blen
, slen
;
86 int authenticated
= 0;
88 if (!authctxt
->valid
) {
89 debug2("%s: disabled because of invalid user", __func__
);
92 have_sig
= packet_get_char();
93 if (datafellows
& SSH_BUG_PKAUTH
) {
94 debug2("%s: SSH_BUG_PKAUTH", __func__
);
95 /* no explicit pkalg given */
96 pkblob
= packet_get_string(&blen
);
98 buffer_append(&b
, pkblob
, blen
);
99 /* so we have to extract the pkalg from the pkblob */
100 pkalg
= buffer_get_string(&b
, &alen
);
103 pkalg
= packet_get_string(&alen
);
104 pkblob
= packet_get_string(&blen
);
106 pktype
= key_type_from_name(pkalg
);
107 if (pktype
== KEY_UNSPEC
) {
108 /* this is perfectly legal */
109 logit("%s: unsupported public key algorithm: %s",
113 key
= key_from_blob(pkblob
, blen
);
115 error("%s: cannot decode key: %s", __func__
, pkalg
);
118 if (key
->type
!= pktype
) {
119 error("%s: type mismatch for decoded key "
120 "(received %d, expected %d)", __func__
, key
->type
, pktype
);
123 if (key_type_plain(key
->type
) == KEY_RSA
&&
124 (datafellows
& SSH_BUG_RSASIGMD5
) != 0) {
125 logit("Refusing RSA key because client uses unsafe "
129 fp
= sshkey_fingerprint(key
, options
.fingerprint_hash
, SSH_FP_DEFAULT
);
130 if (auth2_userkey_already_used(authctxt
, key
)) {
131 logit("refusing previously-used %s key", key_type(key
));
134 if (match_pattern_list(sshkey_ssh_name(key
),
135 options
.pubkey_key_types
, 0) != 1) {
136 logit("%s: key type %s not in PubkeyAcceptedKeyTypes",
137 __func__
, sshkey_ssh_name(key
));
142 debug3("%s: have signature for %s %s",
143 __func__
, sshkey_type(key
), fp
);
144 sig
= packet_get_string(&slen
);
147 if (datafellows
& SSH_OLD_SESSIONID
) {
148 buffer_append(&b
, session_id2
, session_id2_len
);
150 buffer_put_string(&b
, session_id2
, session_id2_len
);
152 /* reconstruct packet */
153 buffer_put_char(&b
, SSH2_MSG_USERAUTH_REQUEST
);
154 xasprintf(&userstyle
, "%s%s%s", authctxt
->user
,
155 authctxt
->style
? ":" : "",
156 authctxt
->style
? authctxt
->style
: "");
157 buffer_put_cstring(&b
, userstyle
);
159 buffer_put_cstring(&b
,
160 datafellows
& SSH_BUG_PKSERVICE
?
163 if (datafellows
& SSH_BUG_PKAUTH
) {
164 buffer_put_char(&b
, have_sig
);
166 buffer_put_cstring(&b
, "publickey");
167 buffer_put_char(&b
, have_sig
);
168 buffer_put_cstring(&b
, pkalg
);
170 buffer_put_string(&b
, pkblob
, blen
);
174 pubkey_auth_info(authctxt
, key
, NULL
);
176 /* test for correct signature */
178 if (PRIVSEP(user_key_allowed(authctxt
->pw
, key
, 1)) &&
179 PRIVSEP(key_verify(key
, sig
, slen
, buffer_ptr(&b
),
180 buffer_len(&b
))) == 1) {
182 /* Record the successful key to prevent reuse */
183 auth2_record_userkey(authctxt
, key
);
184 key
= NULL
; /* Don't free below */
189 debug("%s: test whether pkalg/pkblob are acceptable for %s %s",
190 __func__
, sshkey_type(key
), fp
);
193 /* XXX fake reply and always send PK_OK ? */
195 * XXX this allows testing whether a user is allowed
196 * to login: if you happen to have a valid pubkey this
197 * message is sent. the message is NEVER sent at all
198 * if a user is not allowed to login. is this an
201 if (PRIVSEP(user_key_allowed(authctxt
->pw
, key
, 0))) {
202 packet_start(SSH2_MSG_USERAUTH_PK_OK
);
203 packet_put_string(pkalg
, alen
);
204 packet_put_string(pkblob
, blen
);
207 authctxt
->postponed
= 1;
210 if (authenticated
!= 1)
211 auth_clear_options();
213 debug2("%s: authenticated %d pkalg %s", __func__
, authenticated
, pkalg
);
219 return authenticated
;
223 pubkey_auth_info(Authctxt
*authctxt
, const Key
*key
, const char *fmt
, ...)
232 i
= vasprintf(&extra
, fmt
, ap
);
234 if (i
< 0 || extra
== NULL
)
235 fatal("%s: vasprintf failed", __func__
);
238 if (key_is_cert(key
)) {
239 fp
= sshkey_fingerprint(key
->cert
->signature_key
,
240 options
.fingerprint_hash
, SSH_FP_DEFAULT
);
241 auth_info(authctxt
, "%s ID %s (serial %llu) CA %s %s%s%s",
242 key_type(key
), key
->cert
->key_id
,
243 (unsigned long long)key
->cert
->serial
,
244 key_type(key
->cert
->signature_key
),
245 fp
== NULL
? "(null)" : fp
,
246 extra
== NULL
? "" : ", ", extra
== NULL
? "" : extra
);
249 fp
= sshkey_fingerprint(key
, options
.fingerprint_hash
,
251 auth_info(authctxt
, "%s %s%s%s", key_type(key
),
252 fp
== NULL
? "(null)" : fp
,
253 extra
== NULL
? "" : ", ", extra
== NULL
? "" : extra
);
260 * Splits 's' into an argument vector. Handles quoted string and basic
261 * escape characters (\\, \", \'). Caller must free the argument vector
265 split_argv(const char *s
, int *argcp
, char ***argvp
)
267 int r
= SSH_ERR_INTERNAL_ERROR
;
268 int argc
= 0, quote
, i
, j
;
269 char *arg
, **argv
= xcalloc(1, sizeof(*argv
));
274 for (i
= 0; s
[i
] != '\0'; i
++) {
275 /* Skip leading whitespace */
276 if (s
[i
] == ' ' || s
[i
] == '\t')
279 /* Start of a token */
282 (s
[i
+ 1] == '\'' || s
[i
+ 1] == '\"' || s
[i
+ 1] == '\\'))
284 else if (s
[i
] == '\'' || s
[i
] == '"')
287 argv
= xreallocarray(argv
, (argc
+ 2), sizeof(*argv
));
288 arg
= argv
[argc
++] = xcalloc(1, strlen(s
+ i
) + 1);
291 /* Copy the token in, removing escapes */
292 for (j
= 0; s
[i
] != '\0'; i
++) {
294 if (s
[i
+ 1] == '\'' ||
300 /* Unrecognised escape */
303 } else if (quote
== 0 && (s
[i
] == ' ' || s
[i
] == '\t'))
305 else if (quote
!= 0 && s
[i
] == quote
)
312 /* Ran out of string looking for close quote */
313 r
= SSH_ERR_INVALID_FORMAT
;
326 if (argc
!= 0 && argv
!= NULL
) {
327 for (i
= 0; i
< argc
; i
++)
335 * Reassemble an argument vector into a string, quoting and escaping as
336 * necessary. Caller must free returned string.
339 assemble_argv(int argc
, char **argv
)
343 struct sshbuf
*buf
, *arg
;
345 if ((buf
= sshbuf_new()) == NULL
|| (arg
= sshbuf_new()) == NULL
)
346 fatal("%s: sshbuf_new failed", __func__
);
348 for (i
= 0; i
< argc
; i
++) {
351 for (j
= 0; argv
[i
][j
] != '\0'; j
++) {
358 r
= sshbuf_put_u8(arg
, c
);
363 if ((r
= sshbuf_put_u8(arg
, '\\')) != 0)
367 r
= sshbuf_put_u8(arg
, c
);
371 fatal("%s: sshbuf_put_u8: %s",
372 __func__
, ssh_err(r
));
374 if ((i
!= 0 && (r
= sshbuf_put_u8(buf
, ' ')) != 0) ||
375 (ws
!= 0 && (r
= sshbuf_put_u8(buf
, '"')) != 0) ||
376 (r
= sshbuf_putb(buf
, arg
)) != 0 ||
377 (ws
!= 0 && (r
= sshbuf_put_u8(buf
, '"')) != 0))
378 fatal("%s: buffer error: %s", __func__
, ssh_err(r
));
380 if ((ret
= malloc(sshbuf_len(buf
) + 1)) == NULL
)
381 fatal("%s: malloc failed", __func__
);
382 memcpy(ret
, sshbuf_ptr(buf
), sshbuf_len(buf
));
383 ret
[sshbuf_len(buf
)] = '\0';
390 * Runs command in a subprocess. Returns pid on success and a FILE* to the
391 * subprocess' stdout or 0 on failure.
392 * NB. "command" is only used for logging.
395 subprocess(const char *tag
, struct passwd
*pw
, const char *command
,
396 int ac
, char **av
, FILE **child
)
400 int devnull
, p
[2], i
;
402 char *cp
, errmsg
[512];
408 debug3("%s: %s command \"%s\" running as %s", __func__
,
409 tag
, command
, pw
->pw_name
);
411 /* Verify the path exists and is safe-ish to execute */
413 error("%s path is not absolute", tag
);
416 temporarily_use_uid(pw
);
417 if (stat(av
[0], &st
) < 0) {
418 error("Could not stat %s \"%s\": %s", tag
,
419 av
[0], strerror(errno
));
423 if (auth_secure_path(av
[0], &st
, NULL
, 0,
424 errmsg
, sizeof(errmsg
)) != 0) {
425 error("Unsafe %s \"%s\": %s", tag
, av
[0], errmsg
);
431 * Run the command; stderr is left in place, stdout is the
432 * authorized_keys output.
435 error("%s: pipe: %s", tag
, strerror(errno
));
441 * Don't want to call this in the child, where it can fatal() and
442 * run cleanup_exit() code.
446 switch ((pid
= fork())) {
448 error("%s: fork: %s", tag
, strerror(errno
));
453 /* Prepare a minimal environment for the child. */
455 child_env
= xcalloc(sizeof(*child_env
), envsize
);
456 child_set_env(&child_env
, &envsize
, "PATH", _PATH_STDPATH
);
457 child_set_env(&child_env
, &envsize
, "USER", pw
->pw_name
);
458 child_set_env(&child_env
, &envsize
, "LOGNAME", pw
->pw_name
);
459 child_set_env(&child_env
, &envsize
, "HOME", pw
->pw_dir
);
460 if ((cp
= getenv("LANG")) != NULL
)
461 child_set_env(&child_env
, &envsize
, "LANG", cp
);
463 for (i
= 0; i
< NSIG
; i
++)
466 if ((devnull
= open(_PATH_DEVNULL
, O_RDWR
)) == -1) {
467 error("%s: open %s: %s", tag
, _PATH_DEVNULL
,
471 /* Keep stderr around a while longer to catch errors */
472 if (dup2(devnull
, STDIN_FILENO
) == -1 ||
473 dup2(p
[1], STDOUT_FILENO
) == -1) {
474 error("%s: dup2: %s", tag
, strerror(errno
));
477 closefrom(STDERR_FILENO
+ 1);
479 /* Don't use permanently_set_uid() here to avoid fatal() */
480 if (setresgid(pw
->pw_gid
, pw
->pw_gid
, pw
->pw_gid
) != 0) {
481 error("%s: setresgid %u: %s", tag
, (u_int
)pw
->pw_gid
,
485 if (setresuid(pw
->pw_uid
, pw
->pw_uid
, pw
->pw_uid
) != 0) {
486 error("%s: setresuid %u: %s", tag
, (u_int
)pw
->pw_uid
,
490 /* stdin is pointed to /dev/null at this point */
491 if (dup2(STDIN_FILENO
, STDERR_FILENO
) == -1) {
492 error("%s: dup2: %s", tag
, strerror(errno
));
496 execve(av
[0], av
, child_env
);
497 error("%s exec \"%s\": %s", tag
, command
, strerror(errno
));
499 default: /* parent */
504 if ((f
= fdopen(p
[0], "r")) == NULL
) {
505 error("%s: fdopen: %s", tag
, strerror(errno
));
507 /* Don't leave zombie child */
509 while (waitpid(pid
, NULL
, 0) == -1 && errno
== EINTR
)
514 debug3("%s: %s pid %ld", __func__
, tag
, (long)pid
);
519 /* Returns 0 if pid exited cleanly, non-zero otherwise */
521 exited_cleanly(pid_t pid
, const char *tag
, const char *cmd
)
525 while (waitpid(pid
, &status
, 0) == -1) {
526 if (errno
!= EINTR
) {
527 error("%s: waitpid: %s", tag
, strerror(errno
));
531 if (WIFSIGNALED(status
)) {
532 error("%s %s exited on signal %d", tag
, cmd
, WTERMSIG(status
));
534 } else if (WEXITSTATUS(status
) != 0) {
535 error("%s %s failed, status %d", tag
, cmd
, WEXITSTATUS(status
));
542 match_principals_option(const char *principal_list
, struct sshkey_cert
*cert
)
547 /* XXX percent_expand() sequences for authorized_principals? */
549 for (i
= 0; i
< cert
->nprincipals
; i
++) {
550 if ((result
= match_list(cert
->principals
[i
],
551 principal_list
, NULL
)) != NULL
) {
552 debug3("matched principal from key options \"%.100s\"",
562 process_principals(FILE *f
, char *file
, struct passwd
*pw
,
563 struct sshkey_cert
*cert
)
565 char line
[SSH_MAX_PUBKEY_BYTES
], *cp
, *ep
, *line_opts
;
569 while (read_keyfile_line(f
, file
, line
, sizeof(line
), &linenum
) != -1) {
570 /* Skip leading whitespace. */
571 for (cp
= line
; *cp
== ' ' || *cp
== '\t'; cp
++)
573 /* Skip blank and comment lines. */
574 if ((ep
= strchr(cp
, '#')) != NULL
)
576 if (!*cp
|| *cp
== '\n')
578 /* Trim trailing whitespace. */
579 ep
= cp
+ strlen(cp
) - 1;
580 while (ep
> cp
&& (*ep
== '\n' || *ep
== ' ' || *ep
== '\t'))
583 * If the line has internal whitespace then assume it has
587 if ((ep
= strrchr(cp
, ' ')) != NULL
||
588 (ep
= strrchr(cp
, '\t')) != NULL
) {
589 for (; *ep
== ' ' || *ep
== '\t'; ep
++)
594 for (i
= 0; i
< cert
->nprincipals
; i
++) {
595 if (strcmp(cp
, cert
->principals
[i
]) == 0) {
596 debug3("%s:%lu: matched principal \"%.100s\"",
597 file
== NULL
? "(command)" : file
,
598 linenum
, cert
->principals
[i
]);
599 if (auth_parse_options(pw
, line_opts
,
610 match_principals_file(char *file
, struct passwd
*pw
, struct sshkey_cert
*cert
)
615 temporarily_use_uid(pw
);
616 debug("trying authorized principals file %s", file
);
617 if ((f
= auth_openprincipals(file
, pw
, options
.strict_modes
)) == NULL
) {
621 success
= process_principals(f
, file
, pw
, cert
);
628 * Checks whether principal is allowed in output of command.
629 * returns 1 if the principal is allowed or 0 otherwise.
632 match_principals_command(struct passwd
*user_pw
, struct sshkey_cert
*cert
)
635 int ok
, found_principal
= 0;
637 int i
, ac
= 0, uid_swapped
= 0;
639 char *tmp
, *username
= NULL
, *command
= NULL
, **av
= NULL
;
640 void (*osigchld
)(int);
642 if (options
.authorized_principals_command
== NULL
)
644 if (options
.authorized_principals_command_user
== NULL
) {
645 error("No user for AuthorizedPrincipalsCommand specified, "
651 * NB. all returns later this function should go via "out" to
652 * ensure the original SIGCHLD handler is restored properly.
654 osigchld
= signal(SIGCHLD
, SIG_DFL
);
656 /* Prepare and verify the user for the command */
657 username
= percent_expand(options
.authorized_principals_command_user
,
658 "u", user_pw
->pw_name
, (char *)NULL
);
659 pw
= getpwnam(username
);
661 error("AuthorizedPrincipalsCommandUser \"%s\" not found: %s",
662 username
, strerror(errno
));
666 /* Turn the command into an argument vector */
667 if (split_argv(options
.authorized_principals_command
, &ac
, &av
) != 0) {
668 error("AuthorizedPrincipalsCommand \"%s\" contains "
669 "invalid quotes", command
);
673 error("AuthorizedPrincipalsCommand \"%s\" yielded no arguments",
677 for (i
= 1; i
< ac
; i
++) {
678 tmp
= percent_expand(av
[i
],
679 "u", user_pw
->pw_name
,
680 "h", user_pw
->pw_dir
,
683 fatal("%s: percent_expand failed", __func__
);
687 /* Prepare a printable command for logs, etc. */
688 command
= assemble_argv(ac
, av
);
690 if ((pid
= subprocess("AuthorizedPrincipalsCommand", pw
, command
,
695 temporarily_use_uid(pw
);
697 ok
= process_principals(f
, NULL
, pw
, cert
);
699 if (exited_cleanly(pid
, "AuthorizedPrincipalsCommand", command
) != 0)
702 /* Read completed successfully */
703 found_principal
= ok
;
707 signal(SIGCHLD
, osigchld
);
708 for (i
= 0; i
< ac
; i
++)
715 return found_principal
;
718 * Checks whether key is allowed in authorized_keys-format file,
719 * returns 1 if the key is allowed or 0 otherwise.
722 check_authkeys_file(FILE *f
, char *file
, Key
* key
, struct passwd
*pw
)
724 char line
[SSH_MAX_PUBKEY_BYTES
];
734 while (read_keyfile_line(f
, file
, line
, sizeof(line
), &linenum
) != -1) {
735 char *cp
, *key_options
= NULL
;
738 found
= key_new(key_is_cert(key
) ? KEY_UNSPEC
: key
->type
);
739 auth_clear_options();
741 /* Skip leading whitespace, empty and comment lines. */
742 for (cp
= line
; *cp
== ' ' || *cp
== '\t'; cp
++)
744 if (!*cp
|| *cp
== '\n' || *cp
== '#')
747 if (key_read(found
, &cp
) != 1) {
748 /* no key? check if there are options for this key */
750 debug2("user_key_allowed: check options: '%s'", cp
);
752 for (; *cp
&& (quoted
|| (*cp
!= ' ' && *cp
!= '\t')); cp
++) {
753 if (*cp
== '\\' && cp
[1] == '"')
754 cp
++; /* Skip both */
758 /* Skip remaining whitespace. */
759 for (; *cp
== ' ' || *cp
== '\t'; cp
++)
761 if (key_read(found
, &cp
) != 1) {
762 debug2("user_key_allowed: advance: '%s'", cp
);
763 /* still no key? advance to next line*/
767 if (key_is_cert(key
)) {
768 if (!key_equal(found
, key
->cert
->signature_key
))
770 if (auth_parse_options(pw
, key_options
, file
,
773 if (!key_is_cert_authority
)
775 if ((fp
= sshkey_fingerprint(found
,
776 options
.fingerprint_hash
, SSH_FP_DEFAULT
)) == NULL
)
778 debug("matching CA found: file %s, line %lu, %s %s",
779 file
, linenum
, key_type(found
), fp
);
781 * If the user has specified a list of principals as
782 * a key option, then prefer that list to matching
783 * their username in the certificate principals list.
785 if (authorized_principals
!= NULL
&&
786 !match_principals_option(authorized_principals
,
788 reason
= "Certificate does not contain an "
789 "authorized principal";
793 auth_debug_add("%s", reason
);
796 if (key_cert_check_authority(key
, 0, 0,
797 authorized_principals
== NULL
? pw
->pw_name
: NULL
,
800 if (auth_cert_options(key
, pw
) != 0) {
804 verbose("Accepted certificate ID \"%s\" (serial %llu) "
805 "signed by %s CA %s via %s", key
->cert
->key_id
,
806 (unsigned long long)key
->cert
->serial
,
807 key_type(found
), fp
, file
);
811 } else if (key_equal(found
, key
)) {
812 if (auth_parse_options(pw
, key_options
, file
,
815 if (key_is_cert_authority
)
817 if ((fp
= sshkey_fingerprint(found
,
818 options
.fingerprint_hash
, SSH_FP_DEFAULT
)) == NULL
)
820 debug("matching key found: file %s, line %lu %s %s",
821 file
, linenum
, key_type(found
), fp
);
830 debug2("key not found");
834 /* Authenticate a certificate key against TrustedUserCAKeys */
836 user_cert_trusted_ca(struct passwd
*pw
, Key
*key
)
838 char *ca_fp
, *principals_file
= NULL
;
840 int ret
= 0, found_principal
= 0, use_authorized_principals
;
842 if (!key_is_cert(key
) || options
.trusted_user_ca_keys
== NULL
)
845 if ((ca_fp
= sshkey_fingerprint(key
->cert
->signature_key
,
846 options
.fingerprint_hash
, SSH_FP_DEFAULT
)) == NULL
)
849 if (sshkey_in_file(key
->cert
->signature_key
,
850 options
.trusted_user_ca_keys
, 1, 0) != 0) {
851 debug2("%s: CA %s %s is not listed in %s", __func__
,
852 key_type(key
->cert
->signature_key
), ca_fp
,
853 options
.trusted_user_ca_keys
);
857 * If AuthorizedPrincipals is in use, then compare the certificate
858 * principals against the names in that file rather than matching
859 * against the username.
861 if ((principals_file
= authorized_principals_file(pw
)) != NULL
) {
862 if (match_principals_file(principals_file
, pw
, key
->cert
))
865 /* Try querying command if specified */
866 if (!found_principal
&& match_principals_command(pw
, key
->cert
))
868 /* If principals file or command is specified, then require a match */
869 use_authorized_principals
= principals_file
!= NULL
||
870 options
.authorized_principals_command
!= NULL
;
871 if (!found_principal
&& use_authorized_principals
) {
872 reason
= "Certificate does not contain an authorized principal";
875 auth_debug_add("%s", reason
);
878 if (key_cert_check_authority(key
, 0, 1,
879 use_authorized_principals
? NULL
: pw
->pw_name
, &reason
) != 0)
881 if (auth_cert_options(key
, pw
) != 0)
884 verbose("Accepted certificate ID \"%s\" (serial %llu) signed by "
885 "%s CA %s via %s", key
->cert
->key_id
,
886 (unsigned long long)key
->cert
->serial
,
887 key_type(key
->cert
->signature_key
), ca_fp
,
888 options
.trusted_user_ca_keys
);
892 free(principals_file
);
898 * Checks whether key is allowed in file.
899 * returns 1 if the key is allowed or 0 otherwise.
902 user_key_allowed2(struct passwd
*pw
, Key
*key
, char *file
)
907 /* Temporarily use the user's uid. */
908 temporarily_use_uid(pw
);
910 debug("trying public key file %s", file
);
911 if ((f
= auth_openkeyfile(file
, pw
, options
.strict_modes
)) != NULL
) {
912 found_key
= check_authkeys_file(f
, file
, key
, pw
);
921 * Checks whether key is allowed in output of command.
922 * returns 1 if the key is allowed or 0 otherwise.
925 user_key_command_allowed2(struct passwd
*user_pw
, Key
*key
)
928 int r
, ok
, found_key
= 0;
930 int i
, uid_swapped
= 0, ac
= 0;
932 char *username
= NULL
, *key_fp
= NULL
, *keytext
= NULL
;
933 char *tmp
, *command
= NULL
, **av
= NULL
;
934 void (*osigchld
)(int);
936 if (options
.authorized_keys_command
== NULL
)
938 if (options
.authorized_keys_command_user
== NULL
) {
939 error("No user for AuthorizedKeysCommand specified, skipping");
944 * NB. all returns later this function should go via "out" to
945 * ensure the original SIGCHLD handler is restored properly.
947 osigchld
= signal(SIGCHLD
, SIG_DFL
);
949 /* Prepare and verify the user for the command */
950 username
= percent_expand(options
.authorized_keys_command_user
,
951 "u", user_pw
->pw_name
, (char *)NULL
);
952 pw
= getpwnam(username
);
954 error("AuthorizedKeysCommandUser \"%s\" not found: %s",
955 username
, strerror(errno
));
959 /* Prepare AuthorizedKeysCommand */
960 if ((key_fp
= sshkey_fingerprint(key
, options
.fingerprint_hash
,
961 SSH_FP_DEFAULT
)) == NULL
) {
962 error("%s: sshkey_fingerprint failed", __func__
);
965 if ((r
= sshkey_to_base64(key
, &keytext
)) != 0) {
966 error("%s: sshkey_to_base64 failed: %s", __func__
, ssh_err(r
));
970 /* Turn the command into an argument vector */
971 if (split_argv(options
.authorized_keys_command
, &ac
, &av
) != 0) {
972 error("AuthorizedKeysCommand \"%s\" contains invalid quotes",
977 error("AuthorizedKeysCommand \"%s\" yielded no arguments",
981 for (i
= 1; i
< ac
; i
++) {
982 tmp
= percent_expand(av
[i
],
983 "u", user_pw
->pw_name
,
984 "h", user_pw
->pw_dir
,
985 "t", sshkey_ssh_name(key
),
990 fatal("%s: percent_expand failed", __func__
);
994 /* Prepare a printable command for logs, etc. */
995 command
= assemble_argv(ac
, av
);
998 * If AuthorizedKeysCommand was run without arguments
999 * then fall back to the old behaviour of passing the
1000 * target username as a single argument.
1003 av
= xreallocarray(av
, ac
+ 2, sizeof(*av
));
1004 av
[1] = xstrdup(user_pw
->pw_name
);
1006 /* Fix up command too, since it is used in log messages */
1008 xasprintf(&command
, "%s %s", av
[0], av
[1]);
1011 if ((pid
= subprocess("AuthorizedKeysCommand", pw
, command
,
1016 temporarily_use_uid(pw
);
1018 ok
= check_authkeys_file(f
, options
.authorized_keys_command
, key
, pw
);
1020 if (exited_cleanly(pid
, "AuthorizedKeysCommand", command
) != 0)
1023 /* Read completed successfully */
1028 signal(SIGCHLD
, osigchld
);
1029 for (i
= 0; i
< ac
; i
++)
1042 * Check whether key authenticates and authorises the user.
1045 user_key_allowed(struct passwd
*pw
, Key
*key
, int auth_attempt
)
1050 if (auth_key_is_revoked(key
))
1052 if (key_is_cert(key
) && auth_key_is_revoked(key
->cert
->signature_key
))
1055 success
= user_cert_trusted_ca(pw
, key
);
1059 success
= user_key_command_allowed2(pw
, key
);
1063 for (i
= 0; !success
&& i
< options
.num_authkeys_files
; i
++) {
1065 if (strcasecmp(options
.authorized_keys_files
[i
], "none") == 0)
1067 file
= expand_authorized_keys(
1068 options
.authorized_keys_files
[i
], pw
);
1070 success
= user_key_allowed2(pw
, key
, file
);
1077 /* Records a public key in the list of previously-successful keys */
1079 auth2_record_userkey(Authctxt
*authctxt
, struct sshkey
*key
)
1081 struct sshkey
**tmp
;
1083 if (authctxt
->nprev_userkeys
>= INT_MAX
||
1084 (tmp
= reallocarray(authctxt
->prev_userkeys
,
1085 authctxt
->nprev_userkeys
+ 1, sizeof(*tmp
))) == NULL
)
1086 fatal("%s: reallocarray failed", __func__
);
1087 authctxt
->prev_userkeys
= tmp
;
1088 authctxt
->prev_userkeys
[authctxt
->nprev_userkeys
] = key
;
1089 authctxt
->nprev_userkeys
++;
1092 /* Checks whether a key has already been used successfully for authentication */
1094 auth2_userkey_already_used(Authctxt
*authctxt
, struct sshkey
*key
)
1098 for (i
= 0; i
< authctxt
->nprev_userkeys
; i
++) {
1099 if (sshkey_equal_public(key
, authctxt
->prev_userkeys
[i
])) {
1106 Authmethod method_pubkey
= {
1109 &options
.pubkey_authentication