svr-auth.c

   1 /*
   2  * Dropbear - a SSH2 server
   3  *
   4  * Copyright (c) 2002,2003 Matt Johnston
   5  * All rights reserved.
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  20  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  23  * SOFTWARE. */
  24
  25 /* This file (auth.c) handles authentication requests, passing it to the
  26  * particular type (auth-passwd, auth-pubkey). */
  27
  28 #include "includes.h"
  29 #include "dbutil.h"
  30 #include "session.h"
  31 #include "buffer.h"
  32 #include "ssh.h"
  33 #include "packet.h"
  34 #include "auth.h"
  35 #include "runopts.h"
  36 #include "random.h"
  37
  38 static void authclear();
  39 static int checkusername(unsigned char *username, unsigned int userlen);
  40 static void send_msg_userauth_banner();
  41
  42 /* initialise the first time for a session, resetting all parameters */
  43 void svr_authinitialise() {
  44
  45         ses.authstate.failcount = 0;
  46         ses.authstate.pw_name = NULL;
  47         ses.authstate.pw_dir = NULL;
  48         ses.authstate.pw_shell = NULL;
  49         ses.authstate.pw_passwd = NULL;
  50         authclear();
  51
  52 }
  53
  54 /* Reset the auth state, but don't reset the failcount. This is for if the
  55  * user decides to try with a different username etc, and is also invoked
  56  * on initialisation */
  57 static void authclear() {
  58
  59         memset(&ses.authstate, 0, sizeof(ses.authstate));
  60 #ifdef ENABLE_SVR_PUBKEY_AUTH
  61         ses.authstate.authtypes |= AUTH_TYPE_PUBKEY;
  62 #endif
  63 #if defined(ENABLE_SVR_PASSWORD_AUTH) || defined(ENABLE_SVR_PAM_AUTH)
  64         if (!svr_opts.noauthpass) {
  65                 ses.authstate.authtypes |= AUTH_TYPE_PASSWORD;
  66         }
  67 #endif
  68         if (ses.authstate.pw_name) {
  69                 m_free(ses.authstate.pw_name);
  70         }
  71         if (ses.authstate.pw_shell) {
  72                 m_free(ses.authstate.pw_shell);
  73         }
  74         if (ses.authstate.pw_dir) {
  75                 m_free(ses.authstate.pw_dir);
  76         }
  77         if (ses.authstate.pw_passwd) {
  78                 m_free(ses.authstate.pw_passwd);
  79         }
  80
  81 }
  82
  83 /* Send a banner message if specified to the client. The client might
  84  * ignore this, but possibly serves as a legal "no trespassing" sign */
  85 static void send_msg_userauth_banner() {
  86
  87         TRACE(("enter send_msg_userauth_banner"))
  88         if (svr_opts.banner == NULL) {
  89                 TRACE(("leave send_msg_userauth_banner: banner is NULL"))
  90                 return;
  91         }
  92
  93         CHECKCLEARTOWRITE();
  94
  95         buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_BANNER);
  96         buf_putstring(ses.writepayload, buf_getptr(svr_opts.banner,
  97                                 svr_opts.banner->len), svr_opts.banner->len);
  98         buf_putstring(ses.writepayload, "en", 2);
  99
 100         encrypt_packet();
 101         buf_free(svr_opts.banner);
 102         svr_opts.banner = NULL;
 103
 104         TRACE(("leave send_msg_userauth_banner"))
 105 }
 106
 107 /* handle a userauth request, check validity, pass to password or pubkey
 108  * checking, and handle success or failure */
 109 void recv_msg_userauth_request() {
 110
 111         unsigned char *username = NULL, *servicename = NULL, *methodname = NULL;
 112         unsigned int userlen, servicelen, methodlen;
 113
 114         TRACE(("enter recv_msg_userauth_request"))
 115
 116         /* ignore packets if auth is already done */
 117         if (ses.authstate.authdone == 1) {
 118                 TRACE(("leave recv_msg_userauth_request: authdone already"))
 119                 return;
 120         }
 121
 122         /* send the banner if it exists, it will only exist once */
 123         if (svr_opts.banner) {
 124                 send_msg_userauth_banner();
 125         }
 126
 127
 128         username = buf_getstring(ses.payload, &userlen);
 129         servicename = buf_getstring(ses.payload, &servicelen);
 130         methodname = buf_getstring(ses.payload, &methodlen);
 131
 132         /* only handle 'ssh-connection' currently */
 133         if (servicelen != SSH_SERVICE_CONNECTION_LEN
 134                         && (strncmp(servicename, SSH_SERVICE_CONNECTION,
 135                                         SSH_SERVICE_CONNECTION_LEN) != 0)) {
 136
 137                 /* TODO - disconnect here */
 138                 m_free(username);
 139                 m_free(servicename);
 140                 m_free(methodname);
 141                 dropbear_exit("unknown service in auth");
 142         }
 143
 144         /* user wants to know what methods are supported */
 145         if (methodlen == AUTH_METHOD_NONE_LEN &&
 146                         strncmp(methodname, AUTH_METHOD_NONE,
 147                                 AUTH_METHOD_NONE_LEN) == 0) {
 148                 TRACE(("recv_msg_userauth_request: 'none' request"))
 149                 send_msg_userauth_failure(0, 0);
 150                 goto out;
 151         }
 152
 153         /* check username is good before continuing */
 154         if (checkusername(username, userlen) == DROPBEAR_FAILURE) {
 155                 /* username is invalid/no shell/etc - send failure */
 156                 TRACE(("sending checkusername failure"))
 157                 send_msg_userauth_failure(0, 1);
 158                 goto out;
 159         }
 160
 161 #ifdef ENABLE_SVR_PASSWORD_AUTH
 162         if (!svr_opts.noauthpass &&
 163                         !(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
 164                 /* user wants to try password auth */
 165                 if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
 166                                 strncmp(methodname, AUTH_METHOD_PASSWORD,
 167                                         AUTH_METHOD_PASSWORD_LEN) == 0) {
 168                         svr_auth_password();
 169                         goto out;
 170                 }
 171         }
 172 #endif
 173
 174 #ifdef ENABLE_SVR_PAM_AUTH
 175         if (!svr_opts.noauthpass &&
 176                         !(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) {
 177                 /* user wants to try password auth */
 178                 if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
 179                                 strncmp(methodname, AUTH_METHOD_PASSWORD,
 180                                         AUTH_METHOD_PASSWORD_LEN) == 0) {
 181                         svr_auth_pam();
 182                         goto out;
 183                 }
 184         }
 185 #endif
 186
 187 #ifdef ENABLE_SVR_PUBKEY_AUTH
 188         /* user wants to try pubkey auth */
 189         if (methodlen == AUTH_METHOD_PUBKEY_LEN &&
 190                         strncmp(methodname, AUTH_METHOD_PUBKEY,
 191                                 AUTH_METHOD_PUBKEY_LEN) == 0) {
 192                 svr_auth_pubkey();
 193                 goto out;
 194         }
 195 #endif
 196
 197         /* nothing matched, we just fail */
 198         send_msg_userauth_failure(0, 1);
 199
 200 out:
 201
 202         m_free(username);
 203         m_free(servicename);
 204         m_free(methodname);
 205 }
 206
 207
 208 /* Check that the username exists, has a non-empty password, and has a valid
 209  * shell.
 210  * returns DROPBEAR_SUCCESS on valid username, DROPBEAR_FAILURE on failure */
 211 static int checkusername(unsigned char *username, unsigned int userlen) {
 212
 213         char* listshell = NULL;
 214         char* usershell = NULL;
 215         TRACE(("enter checkusername"))
 216         if (userlen > MAX_USERNAME_LEN) {
 217                 return DROPBEAR_FAILURE;
 218         }
 219
 220         /* new user or username has changed */
 221         if (ses.authstate.username == NULL ||
 222                 strcmp(username, ses.authstate.username) != 0) {
 223                         /* the username needs resetting */
 224                         if (ses.authstate.username != NULL) {
 225                                 dropbear_log(LOG_WARNING, "client trying multiple usernames from %s",
 226                                                         svr_ses.addrstring);
 227                                 m_free(ses.authstate.username);
 228                         }
 229                         authclear();
 230                         fill_passwd(username);
 231                         ses.authstate.username = m_strdup(username);
 232         }
 233
 234         /* check that user exists */
 235         if (!ses.authstate.pw_name) {
 236                 TRACE(("leave checkusername: user '%s' doesn't exist", username))
 237                 dropbear_log(LOG_WARNING,
 238                                 "login attempt for nonexistent user from %s",
 239                                 svr_ses.addrstring);
 240                 send_msg_userauth_failure(0, 1);
 241                 return DROPBEAR_FAILURE;
 242         }
 243
 244         /* check for non-root if desired */
 245         if (svr_opts.norootlogin && ses.authstate.pw_uid == 0) {
 246                 TRACE(("leave checkusername: root login disabled"))
 247                 dropbear_log(LOG_WARNING, "root login rejected");
 248                 send_msg_userauth_failure(0, 1);
 249                 return DROPBEAR_FAILURE;
 250         }
 251
 252         /* check for an empty password */
 253         if (ses.authstate.pw_passwd[0] == '\0') {
 254                 TRACE(("leave checkusername: empty pword"))
 255                 dropbear_log(LOG_WARNING, "user '%s' has blank password, rejected",
 256                                 ses.authstate.pw_name);
 257                 send_msg_userauth_failure(0, 1);
 258                 return DROPBEAR_FAILURE;
 259         }
 260
 261         TRACE(("shell is %s", ses.authstate.pw_shell))
 262
 263         /* check that the shell is set */
 264         usershell = ses.authstate.pw_shell;
 265         if (usershell[0] == '\0') {
 266                 /* empty shell in /etc/passwd means /bin/sh according to passwd(5) */
 267                 usershell = "/bin/sh";
 268         }
 269
 270         /* check the shell is valid. If /etc/shells doesn't exist, getusershell()
 271          * should return some standard shells like "/bin/sh" and "/bin/csh" (this
 272          * is platform-specific) */
 273         setusershell();
 274         while ((listshell = getusershell()) != NULL) {
 275                 TRACE(("test shell is '%s'", listshell))
 276                 if (strcmp(listshell, usershell) == 0) {
 277                         /* have a match */
 278                         goto goodshell;
 279                 }
 280         }
 281         /* no matching shell */
 282         endusershell();
 283         TRACE(("no matching shell"))
 284         dropbear_log(LOG_WARNING, "user '%s' has invalid shell, rejected",
 285                                 ses.authstate.pw_name);
 286         send_msg_userauth_failure(0, 1);
 287         return DROPBEAR_FAILURE;
 288
 289 goodshell:
 290         endusershell();
 291         TRACE(("matching shell"))
 292
 293         TRACE(("uid = %d", ses.authstate.pw_uid))
 294         TRACE(("leave checkusername"))
 295         return DROPBEAR_SUCCESS;
 296
 297 }
 298
 299 /* Send a failure message to the client, in responds to a userauth_request.
 300  * Partial indicates whether to set the "partial success" flag,
 301  * incrfail is whether to count this failure in the failure count (which
 302  * is limited. This function also handles disconnection after too many
 303  * failures */
 304 void send_msg_userauth_failure(int partial, int incrfail) {
 305
 306         buffer *typebuf = NULL;
 307
 308         TRACE(("enter send_msg_userauth_failure"))
 309
 310         CHECKCLEARTOWRITE();
 311
 312         buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_FAILURE);
 313
 314         /* put a list of allowed types */
 315         typebuf = buf_new(30); /* long enough for PUBKEY and PASSWORD */
 316
 317         if (ses.authstate.authtypes & AUTH_TYPE_PUBKEY) {
 318                 buf_putbytes(typebuf, AUTH_METHOD_PUBKEY, AUTH_METHOD_PUBKEY_LEN);
 319                 if (ses.authstate.authtypes & AUTH_TYPE_PASSWORD) {
 320                         buf_putbyte(typebuf, ',');
 321                 }
 322         }
 323
 324         if (ses.authstate.authtypes & AUTH_TYPE_PASSWORD) {
 325                 buf_putbytes(typebuf, AUTH_METHOD_PASSWORD, AUTH_METHOD_PASSWORD_LEN);
 326         }
 327
 328         buf_setpos(typebuf, 0);
 329         buf_putstring(ses.writepayload, buf_getptr(typebuf, typebuf->len),
 330                         typebuf->len);
 331
 332         TRACE(("auth fail: methods %d, '%s'", ses.authstate.authtypes,
 333                                 buf_getptr(typebuf, typebuf->len)));
 334
 335         buf_free(typebuf);
 336
 337         buf_putbyte(ses.writepayload, partial ? 1 : 0);
 338         encrypt_packet();
 339
 340         if (incrfail) {
 341                 unsigned int delay;
 342                 genrandom((unsigned char*)&delay, sizeof(delay));
 343                 /* We delay for 300ms +- 50ms, 0.1ms granularity */
 344                 delay = 250000 + (delay % 1000)*100;
 345                 usleep(delay);
 346                 dropbear_log(LOG_INFO, "delay is %d", delay);
 347                 ses.authstate.failcount++;
 348         }
 349
 350         if (ses.authstate.failcount >= MAX_AUTH_TRIES) {
 351                 char * userstr;
 352                 /* XXX - send disconnect ? */
 353                 TRACE(("Max auth tries reached, exiting"))
 354
 355                 if (ses.authstate.pw_name == NULL) {
 356                         userstr = "is invalid";
 357                 } else {
 358                         userstr = ses.authstate.pw_name;
 359                 }
 360                 dropbear_exit("Max auth tries reached - user '%s' from %s",
 361                                 userstr, svr_ses.addrstring);
 362         }
 363
 364         TRACE(("leave send_msg_userauth_failure"))
 365 }
 366
 367 /* Send a success message to the user, and set the "authdone" flag */
 368 void send_msg_userauth_success() {
 369
 370         TRACE(("enter send_msg_userauth_success"))
 371
 372         CHECKCLEARTOWRITE();
 373
 374         buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_SUCCESS);
 375         encrypt_packet();
 376
 377         /* authdone must be set after encrypt_packet() for
 378          * delayed-zlib mode */
 379         ses.authstate.authdone = 1;
 380         ses.connect_time = 0;
 381
 382
 383         if (ses.authstate.pw_uid == 0) {
 384                 ses.allowprivport = 1;
 385         }
 386
 387         /* Remove from the list of pre-auth sockets. Should be m_close(), since if
 388          * we fail, we might end up leaking connection slots, and disallow new
 389          * logins - a nasty situation. */
 390         m_close(svr_ses.childpipe);
 391
 392         TRACE(("leave send_msg_userauth_success"))
 393
 394 }