2 * Copyright (c) 2000-2003,2005 by Solar Designer. See LICENSE.
7 #define _XOPEN_SOURCE 600
9 #define _XOPEN_SOURCE 500
10 #define _XOPEN_SOURCE_EXTENDED
11 #define _XOPEN_VERSION 500
24 #define PAM_SM_PASSWORD
26 #include <security/pam_appl.h>
28 #include <security/pam_modules.h>
30 #include "pam_macros.h"
32 #if !defined(PAM_EXTERN) && !defined(PAM_STATIC)
33 #define PAM_EXTERN extern
36 #if !defined(PAM_AUTHTOK_RECOVERY_ERR) && defined(PAM_AUTHTOK_RECOVER_ERR)
37 #define PAM_AUTHTOK_RECOVERY_ERR PAM_AUTHTOK_RECOVER_ERR
40 #if (defined(__sun) || defined(__hpux)) && \
41 !defined(LINUX_PAM) && !defined(_OPENPAM)
42 /* Sun's PAM doesn't use const here, while Linux-PAM and OpenPAM do */
45 #define lo_const const
48 /* OpenPAM doesn't use const here, while Linux-PAM does */
51 #define l_const lo_const
53 typedef lo_const
void *pam_item_t
;
57 #define F_ENFORCE_MASK 0x00000003
58 #define F_ENFORCE_USERS 0x00000001
59 #define F_ENFORCE_ROOT 0x00000002
60 #define F_ENFORCE_EVERYONE F_ENFORCE_MASK
61 #define F_NON_UNIX 0x00000004
62 #define F_ASK_OLDAUTHTOK_MASK 0x00000030
63 #define F_ASK_OLDAUTHTOK_PRELIM 0x00000010
64 #define F_ASK_OLDAUTHTOK_UPDATE 0x00000020
65 #define F_CHECK_OLDAUTHTOK 0x00000040
66 #define F_USE_FIRST_PASS 0x00000100
67 #define F_USE_AUTHTOK 0x00000200
75 static params_t defaults
= {
77 {INT_MAX
, 24, 11, 8, 7}, /* min */
79 3, /* passphrase_words */
84 F_ENFORCE_EVERYONE
, /* flags */
88 #define PROMPT_OLDPASS \
89 "Enter current password: "
90 #define PROMPT_NEWPASS1 \
91 "Enter new password: "
92 #define PROMPT_NEWPASS2 \
93 "Re-type new password: "
95 #define MESSAGE_MISCONFIGURED \
96 "System configuration error. Please contact your administrator."
97 #define MESSAGE_INVALID_OPTION \
98 "pam_passwdqc: Invalid option: \"%s\"."
99 #define MESSAGE_INTRO_PASSWORD \
100 "\nYou can now choose the new password.\n"
101 #define MESSAGE_INTRO_BOTH \
102 "\nYou can now choose the new password or passphrase.\n"
103 #define MESSAGE_EXPLAIN_PASSWORD_1CLASS \
104 "A good password should be a mix of upper and lower case letters,\n" \
105 "digits, and other characters. You can use a%s %d character long\n" \
107 #define MESSAGE_EXPLAIN_PASSWORD_CLASSES \
108 "A valid password should be a mix of upper and lower case letters,\n" \
109 "digits, and other characters. You can use a%s %d character long\n" \
110 "password with characters from at least %d of these 4 classes.\n" \
111 "An upper case letter that begins the password and a digit that\n" \
112 "ends it do not count towards the number of character classes used.\n"
113 #define MESSAGE_EXPLAIN_PASSWORD_ALL_CLASSES \
114 "A valid password should be a mix of upper and lower case letters,\n" \
115 "digits, and other characters. You can use a%s %d character long\n" \
116 "password with characters from all of these classes. An upper\n" \
117 "case letter that begins the password and a digit that ends it do\n" \
118 "not count towards the number of character classes used.\n"
119 #define MESSAGE_EXPLAIN_PASSWORD_ALT \
120 "A valid password should be a mix of upper and lower case letters,\n" \
121 "digits, and other characters. You can use a%s %d character long\n" \
122 "password with characters from at least 3 of these 4 classes, or\n" \
123 "a%s %d character long password containing characters from all the\n" \
124 "classes. An upper case letter that begins the password and a\n" \
125 "digit that ends it do not count towards the number of character\n" \
127 #define MESSAGE_EXPLAIN_PASSPHRASE \
128 "A passphrase should be of at least %d words, %d to %d characters\n" \
129 "long, and contain enough different characters.\n"
130 #define MESSAGE_RANDOM \
131 "Alternatively, if noone else can see your terminal now, you can\n" \
132 "pick this as your password: \"%s\".\n"
133 #define MESSAGE_RANDOMONLY \
134 "This system is configured to permit randomly generated passwords\n" \
135 "only. If noone else can see your terminal now, you can pick this\n" \
136 "as your password: \"%s\". Otherwise, come back later.\n"
137 #define MESSAGE_RANDOMFAILED \
138 "This system is configured to use randomly generated passwords\n" \
139 "only, but the attempt to generate a password has failed. This\n" \
140 "could happen for a number of reasons: you could have requested\n" \
141 "an impossible password length, or the access to kernel random\n" \
142 "number pool could have failed."
143 #define MESSAGE_TOOLONG \
144 "This password may be too long for some services. Choose another."
145 #define MESSAGE_TRUNCATED \
146 "Warning: your longer password will be truncated to 8 characters."
147 #define MESSAGE_WEAKPASS \
149 #define MESSAGE_NOTRANDOM \
150 "Sorry, you've mistyped the password that was generated for you."
151 #define MESSAGE_MISTYPED \
152 "Sorry, passwords do not match."
153 #define MESSAGE_RETRY \
156 static int converse(pam_handle_t
*pamh
, int style
, l_const
char *text
,
157 struct pam_response
**resp
)
160 const struct pam_conv
*conv
;
161 struct pam_message msg
, *pmsg
;
165 status
= pam_get_item(pamh
, PAM_CONV
, &item
);
166 if (status
!= PAM_SUCCESS
)
171 msg
.msg_style
= style
;
174 return conv
->conv(1, (lo_const
struct pam_message
**)&pmsg
, resp
,
179 __attribute__ ((format (printf
, 3, 4)))
181 static int say(pam_handle_t
*pamh
, int style
, const char *format
, ...)
186 struct pam_response
*resp
;
189 va_start(args
, format
);
190 needed
= vsnprintf(buffer
, sizeof(buffer
), format
, args
);
193 if ((unsigned int)needed
< sizeof(buffer
)) {
194 status
= converse(pamh
, style
, buffer
, &resp
);
195 pwqc_overwrite_string(buffer
);
196 pwqc_drop_pam_reply(resp
, 1);
199 memset(buffer
, 0, sizeof(buffer
));
205 static int check_max(params_t
*params
, pam_handle_t
*pamh
, const char *newpass
)
207 if ((int)strlen(newpass
) > params
->qc
.max
) {
208 if (params
->qc
.max
!= 8) {
209 say(pamh
, PAM_ERROR_MSG
, MESSAGE_TOOLONG
);
212 say(pamh
, PAM_TEXT_INFO
, MESSAGE_TRUNCATED
);
218 static int check_pass(struct passwd
*pw
, const char *pass
)
228 if (!strcmp(pw
->pw_passwd
, "x")) {
230 spw
= getspnam(pw
->pw_name
);
235 hash
= bigcrypt(pass
, spw
->sp_pwdp
);
237 hash
= crypt(pass
, spw
->sp_pwdp
);
239 retval
= strcmp(hash
, spw
->sp_pwdp
) ? -1 : 0;
240 memset(spw
->sp_pwdp
, 0, strlen(spw
->sp_pwdp
));
245 return strcmp(crypt(pass
, pw
->pw_passwd
), pw
->pw_passwd
) ? -1 : 0;
248 static int am_root(pam_handle_t
*pamh
)
256 if (pam_get_item(pamh
, PAM_SERVICE
, &item
) != PAM_SUCCESS
)
260 return !strcmp(service
, "passwd");
263 static int parse(params_t
*params
, pam_handle_t
*pamh
,
264 int argc
, const char **argv
)
272 if (!strncmp(*argv
, "min=", 4)) {
274 for (i
= 0; i
< 5; i
++) {
275 if (!strncmp(p
, "disabled", 8)) {
279 v
= strtoul(p
, &e
, 10);
282 if (i
< 4 && *p
++ != ',') break;
283 if (v
> INT_MAX
) break;
284 if (i
&& (int)v
> params
->qc
.min
[i
- 1]) break;
285 params
->qc
.min
[i
] = v
;
289 if (!strncmp(*argv
, "max=", 4)) {
290 v
= strtoul(*argv
+ 4, &e
, 10);
291 if (*e
|| v
< 8 || v
> INT_MAX
) break;
294 if (!strncmp(*argv
, "passphrase=", 11)) {
295 v
= strtoul(*argv
+ 11, &e
, 10);
296 if (*e
|| v
> INT_MAX
) break;
297 params
->qc
.passphrase_words
= v
;
299 if (!strncmp(*argv
, "match=", 6)) {
300 v
= strtoul(*argv
+ 6, &e
, 10);
301 if (*e
|| v
> INT_MAX
) break;
302 params
->qc
.match_length
= v
;
304 if (!strncmp(*argv
, "similar=", 8)) {
305 if (!strcmp(*argv
+ 8, "permit"))
306 params
->qc
.similar_deny
= 0;
308 if (!strcmp(*argv
+ 8, "deny"))
309 params
->qc
.similar_deny
= 1;
313 if (!strncmp(*argv
, "random=", 7)) {
314 v
= strtoul(*argv
+ 7, &e
, 10);
315 if (!strcmp(e
, ",only")) {
317 params
->qc
.min
[4] = INT_MAX
;
319 if (*e
|| (v
&& v
< 24) || v
> 72) break;
320 params
->qc
.random_bits
= v
;
322 if (!strncmp(*argv
, "enforce=", 8)) {
323 params
->flags
&= ~F_ENFORCE_MASK
;
324 if (!strcmp(*argv
+ 8, "users"))
325 params
->flags
|= F_ENFORCE_USERS
;
327 if (!strcmp(*argv
+ 8, "everyone"))
328 params
->flags
|= F_ENFORCE_EVERYONE
;
330 if (strcmp(*argv
+ 8, "none"))
333 if (!strcmp(*argv
, "non-unix")) {
334 if (params
->flags
& F_CHECK_OLDAUTHTOK
) break;
335 params
->flags
|= F_NON_UNIX
;
337 if (!strncmp(*argv
, "retry=", 6)) {
338 v
= strtoul(*argv
+ 6, &e
, 10);
339 if (*e
|| v
> INT_MAX
) break;
342 if (!strncmp(*argv
, "ask_oldauthtok", 14)) {
343 params
->flags
&= ~F_ASK_OLDAUTHTOK_MASK
;
344 if (params
->flags
& F_USE_FIRST_PASS
) break;
345 if (!strcmp(*argv
+ 14, "=update"))
346 params
->flags
|= F_ASK_OLDAUTHTOK_UPDATE
;
349 params
->flags
|= F_ASK_OLDAUTHTOK_PRELIM
;
353 if (!strcmp(*argv
, "check_oldauthtok")) {
354 if (params
->flags
& F_NON_UNIX
) break;
355 params
->flags
|= F_CHECK_OLDAUTHTOK
;
357 if (!strcmp(*argv
, "use_first_pass")) {
358 if (params
->flags
& F_ASK_OLDAUTHTOK_MASK
) break;
359 params
->flags
|= F_USE_FIRST_PASS
| F_USE_AUTHTOK
;
361 if (!strcmp(*argv
, "use_authtok")) {
362 params
->flags
|= F_USE_AUTHTOK
;
369 say(pamh
, PAM_ERROR_MSG
, am_root(pamh
) ?
370 MESSAGE_INVALID_OPTION
: MESSAGE_MISCONFIGURED
, *argv
);
377 PAM_EXTERN
int pam_sm_chauthtok(pam_handle_t
*pamh
, int flags
,
378 int argc
, const char **argv
)
381 struct pam_response
*resp
;
382 struct passwd
*pw
, fake_pw
;
384 const char *user
, *oldpass
, *newpass
;
385 char *trypass
, *randompass
;
388 int randomonly
, enforce
, retries_left
, retry_wanted
;
392 status
= parse(¶ms
, pamh
, argc
, argv
);
393 if (status
!= PAM_SUCCESS
)
397 if (flags
& PAM_PRELIM_CHECK
) {
398 if (params
.flags
& F_ASK_OLDAUTHTOK_PRELIM
)
401 if (flags
& PAM_UPDATE_AUTHTOK
) {
402 if (params
.flags
& F_ASK_OLDAUTHTOK_UPDATE
)
405 return PAM_SERVICE_ERR
;
407 if (ask_oldauthtok
&& !am_root(pamh
)) {
408 status
= converse(pamh
, PAM_PROMPT_ECHO_OFF
,
409 PROMPT_OLDPASS
, &resp
);
411 if (status
== PAM_SUCCESS
) {
412 if (resp
&& resp
->resp
) {
413 status
= pam_set_item(pamh
,
414 PAM_OLDAUTHTOK
, resp
->resp
);
415 pwqc_drop_pam_reply(resp
, 1);
417 status
= PAM_AUTHTOK_RECOVERY_ERR
;
420 if (status
!= PAM_SUCCESS
)
424 if (flags
& PAM_PRELIM_CHECK
)
427 status
= pam_get_item(pamh
, PAM_USER
, &item
);
428 if (status
!= PAM_SUCCESS
)
432 status
= pam_get_item(pamh
, PAM_OLDAUTHTOK
, &item
);
433 if (status
!= PAM_SUCCESS
)
437 if (params
.flags
& F_NON_UNIX
) {
439 pw
->pw_name
= (char *)user
;
445 return PAM_USER_UNKNOWN
;
446 if ((params
.flags
& F_CHECK_OLDAUTHTOK
) && !am_root(pamh
) &&
447 (!oldpass
|| check_pass(pw
, oldpass
)))
448 status
= PAM_AUTH_ERR
;
449 memset(pw
->pw_passwd
, 0, strlen(pw
->pw_passwd
));
450 if (status
!= PAM_SUCCESS
)
454 randomonly
= params
.qc
.min
[4] > params
.qc
.max
;
457 enforce
= params
.flags
& F_ENFORCE_ROOT
;
459 enforce
= params
.flags
& F_ENFORCE_USERS
;
461 if (params
.flags
& F_USE_AUTHTOK
) {
462 status
= pam_get_item(pamh
, PAM_AUTHTOK
, &item
);
463 if (status
!= PAM_SUCCESS
)
466 if (!newpass
|| (check_max(¶ms
, pamh
, newpass
) && enforce
))
467 return PAM_AUTHTOK_ERR
;
468 reason
= _passwdqc_check(¶ms
.qc
, newpass
, oldpass
, pw
);
470 say(pamh
, PAM_ERROR_MSG
, MESSAGE_WEAKPASS
, reason
);
472 status
= PAM_AUTHTOK_ERR
;
477 retries_left
= params
.retry
;
483 params
.qc
.passphrase_words
&& params
.qc
.min
[2] <= params
.qc
.max
)
484 status
= say(pamh
, PAM_TEXT_INFO
, MESSAGE_INTRO_BOTH
);
486 status
= say(pamh
, PAM_TEXT_INFO
, MESSAGE_INTRO_PASSWORD
);
487 if (status
!= PAM_SUCCESS
)
490 if (!randomonly
&& params
.qc
.min
[0] == params
.qc
.min
[4])
491 status
= say(pamh
, PAM_TEXT_INFO
,
492 MESSAGE_EXPLAIN_PASSWORD_1CLASS
,
493 params
.qc
.min
[4] == 8 || params
.qc
.min
[4] == 11 ? "n" : "",
496 if (!randomonly
&& params
.qc
.min
[3] == params
.qc
.min
[4])
497 status
= say(pamh
, PAM_TEXT_INFO
,
498 MESSAGE_EXPLAIN_PASSWORD_CLASSES
,
499 params
.qc
.min
[4] == 8 || params
.qc
.min
[4] == 11 ? "n" : "",
501 params
.qc
.min
[1] != params
.qc
.min
[3] ? 3 : 2);
503 if (!randomonly
&& params
.qc
.min
[3] == INT_MAX
)
504 status
= say(pamh
, PAM_TEXT_INFO
,
505 MESSAGE_EXPLAIN_PASSWORD_ALL_CLASSES
,
506 params
.qc
.min
[4] == 8 || params
.qc
.min
[4] == 11 ? "n" : "",
510 status
= say(pamh
, PAM_TEXT_INFO
,
511 MESSAGE_EXPLAIN_PASSWORD_ALT
,
512 params
.qc
.min
[3] == 8 || params
.qc
.min
[3] == 11 ? "n" : "",
514 params
.qc
.min
[4] == 8 || params
.qc
.min
[4] == 11 ? "n" : "",
516 if (status
!= PAM_SUCCESS
)
520 params
.qc
.passphrase_words
&&
521 params
.qc
.min
[2] <= params
.qc
.max
) {
522 status
= say(pamh
, PAM_TEXT_INFO
, MESSAGE_EXPLAIN_PASSPHRASE
,
523 params
.qc
.passphrase_words
,
524 params
.qc
.min
[2], params
.qc
.max
);
525 if (status
!= PAM_SUCCESS
)
529 randompass
= _passwdqc_random(¶ms
.qc
);
531 status
= say(pamh
, PAM_TEXT_INFO
, randomonly
?
532 MESSAGE_RANDOMONLY
: MESSAGE_RANDOM
, randompass
);
533 if (status
!= PAM_SUCCESS
) {
534 pwqc_overwrite_string(randompass
);
539 say(pamh
, PAM_ERROR_MSG
, am_root(pamh
) ?
540 MESSAGE_RANDOMFAILED
: MESSAGE_MISCONFIGURED
);
541 return PAM_AUTHTOK_ERR
;
544 status
= converse(pamh
, PAM_PROMPT_ECHO_OFF
, PROMPT_NEWPASS1
, &resp
);
545 if (status
== PAM_SUCCESS
&& (!resp
|| !resp
->resp
))
546 status
= PAM_AUTHTOK_ERR
;
548 if (status
!= PAM_SUCCESS
) {
549 pwqc_overwrite_string(randompass
);
553 trypass
= strdup(resp
->resp
);
555 pwqc_drop_pam_reply(resp
, 1);
558 pwqc_overwrite_string(randompass
);
559 return PAM_AUTHTOK_ERR
;
562 if (check_max(¶ms
, pamh
, trypass
) && enforce
) {
563 status
= PAM_AUTHTOK_ERR
;
568 if (status
== PAM_SUCCESS
&&
569 (!randompass
|| !strstr(trypass
, randompass
)) &&
571 (reason
= _passwdqc_check(¶ms
.qc
, trypass
, oldpass
, pw
)))) {
573 say(pamh
, PAM_ERROR_MSG
, MESSAGE_NOTRANDOM
);
575 say(pamh
, PAM_ERROR_MSG
, MESSAGE_WEAKPASS
, reason
);
577 status
= PAM_AUTHTOK_ERR
;
582 if (status
== PAM_SUCCESS
)
583 status
= converse(pamh
, PAM_PROMPT_ECHO_OFF
,
584 PROMPT_NEWPASS2
, &resp
);
585 if (status
== PAM_SUCCESS
) {
586 if (resp
&& resp
->resp
) {
587 if (strcmp(trypass
, resp
->resp
)) {
589 PAM_ERROR_MSG
, MESSAGE_MISTYPED
);
590 if (status
== PAM_SUCCESS
) {
591 status
= PAM_AUTHTOK_ERR
;
595 pwqc_drop_pam_reply(resp
, 1);
597 status
= PAM_AUTHTOK_ERR
;
600 if (status
== PAM_SUCCESS
)
601 status
= pam_set_item(pamh
, PAM_AUTHTOK
, trypass
);
603 pwqc_overwrite_string(randompass
);
604 pwqc_overwrite_string(trypass
);
605 pwqc_drop_mem(trypass
);
607 if (retry_wanted
&& --retries_left
> 0) {
608 status
= say(pamh
, PAM_TEXT_INFO
, MESSAGE_RETRY
);
609 if (status
== PAM_SUCCESS
)
616 #ifdef PAM_MODULE_ENTRY
617 PAM_MODULE_ENTRY("pam_passwdqc");
618 #elif defined(PAM_STATIC)
619 struct pam_module _pam_passwdqc_modstruct
= {