release/src/router/dropbear/svr-authpam.c

   1 /*
   2  * Dropbear SSH
   3  *
   4  * Copyright (c) 2004 Martin Carlsson
   5  * Portions (c) 2004 Matt Johnston
   6  * All rights reserved.
   7  *
   8  * Permission is hereby granted, free of charge, to any person obtaining a copy
   9  * of this software and associated documentation files (the "Software"), to deal
  10  * in the Software without restriction, including without limitation the rights
  11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  12  * copies of the Software, and to permit persons to whom the Software is
  13  * furnished to do so, subject to the following conditions:
  14  *
  15  * The above copyright notice and this permission notice shall be included in
  16  * all copies or substantial portions of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  21  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  24  * SOFTWARE. */
  25
  26 /* Validates a user password using PAM */
  27
  28 #include "includes.h"
  29 #include "session.h"
  30 #include "buffer.h"
  31 #include "dbutil.h"
  32 #include "auth.h"
  33
  34 #ifdef ENABLE_SVR_PAM_AUTH
  35
  36 #if defined(HAVE_SECURITY_PAM_APPL_H)
  37 #include <security/pam_appl.h>
  38 #elif defined (HAVE_PAM_PAM_APPL_H)
  39 #include <pam/pam_appl.h>
  40 #endif
  41
  42 struct UserDataS {
  43         char* user;
  44         char* passwd;
  45 };
  46
  47 /* PAM conversation function - for now we only handle one message */
  48 int
  49 pamConvFunc(int num_msg,
  50                 const struct pam_message **msg,
  51                 struct pam_response **respp,
  52                 void *appdata_ptr) {
  53
  54         int rc = PAM_SUCCESS;
  55         struct pam_response* resp = NULL;
  56         struct UserDataS* userDatap = (struct UserDataS*) appdata_ptr;
  57         unsigned int msg_len = 0;
  58         unsigned int i = 0;
  59         char * compare_message = NULL;
  60
  61         TRACE(("enter pamConvFunc"))
  62
  63         if (num_msg != 1) {
  64                 /* If you're getting here - Dropbear probably can't support your pam
  65                  * modules. This whole file is a bit of a hack around lack of
  66                  * asynchronocity in PAM anyway. */
  67                 dropbear_log(LOG_INFO, "pamConvFunc() called with >1 messages: not supported.");
  68                 return PAM_CONV_ERR;
  69         }
  70
  71         /* make a copy we can strip */
  72         compare_message = m_strdup((*msg)->msg);
  73
  74         /* Make the string lowercase. */
  75         msg_len = strlen(compare_message);
  76         for (i = 0; i < msg_len; i++) {
  77                 compare_message[i] = tolower(compare_message[i]);
  78         }
  79
  80         /* If the string ends with ": ", remove the space.
  81            ie "login: " vs "login:" */
  82         if (msg_len > 2
  83                         && compare_message[msg_len-2] == ':'
  84                         && compare_message[msg_len-1] == ' ') {
  85                 compare_message[msg_len-1] = '\0';
  86         }
  87
  88         switch((*msg)->msg_style) {
  89
  90                 case PAM_PROMPT_ECHO_OFF:
  91
  92                         if (!(strcmp(compare_message, "password:") == 0)) {
  93                                 /* We don't recognise the prompt as asking for a password,
  94                                    so can't handle it. Add more above as required for
  95                                    different pam modules/implementations. If you need
  96                                    to add an entry here please mail the Dropbear developer */
  97                                 dropbear_log(LOG_NOTICE, "PAM unknown prompt '%s' (no echo)",
  98                                                 compare_message);
  99                                 rc = PAM_CONV_ERR;
 100                                 break;
 101                         }
 102
 103                         /* You have to read the PAM module-writers' docs (do we look like
 104                          * module writers? no.) to find out that the module will
 105                          * free the pam_response and its resp element - ie we _must_ malloc
 106                          * it here */
 107                         resp = (struct pam_response*) m_malloc(sizeof(struct pam_response));
 108                         memset(resp, 0, sizeof(struct pam_response));
 109
 110                         resp->resp = m_strdup(userDatap->passwd);
 111                         m_burn(userDatap->passwd, strlen(userDatap->passwd));
 112                         (*respp) = resp;
 113                         break;
 114
 115
 116                 case PAM_PROMPT_ECHO_ON:
 117
 118                         if (!(
 119                                 (strcmp(compare_message, "login:" ) == 0)
 120                                 || (strcmp(compare_message, "please enter username:") == 0)
 121                                 || (strcmp(compare_message, "username:") == 0)
 122                                 )) {
 123                                 /* We don't recognise the prompt as asking for a username,
 124                                    so can't handle it. Add more above as required for
 125                                    different pam modules/implementations. If you need
 126                                    to add an entry here please mail the Dropbear developer */
 127                                 dropbear_log(LOG_NOTICE, "PAM unknown prompt '%s' (with echo)",
 128                                                 compare_message);
 129                                 rc = PAM_CONV_ERR;
 130                                 break;
 131                         }
 132
 133                         /* You have to read the PAM module-writers' docs (do we look like
 134                          * module writers? no.) to find out that the module will
 135                          * free the pam_response and its resp element - ie we _must_ malloc
 136                          * it here */
 137                         resp = (struct pam_response*) m_malloc(sizeof(struct pam_response));
 138                         memset(resp, 0, sizeof(struct pam_response));
 139
 140                         resp->resp = m_strdup(userDatap->user);
 141                         TRACE(("userDatap->user='%s'", userDatap->user))
 142                         (*respp) = resp;
 143                         break;
 144
 145                 case PAM_ERROR_MSG:
 146                 case PAM_TEXT_INFO:
 147
 148                         if (msg_len > 0) {
 149                                 buffer * pam_err = buf_new(msg_len + 4);
 150                                 buf_setpos(pam_err, 0);
 151                                 buf_putbytes(pam_err, "\r\n", 2);
 152                                 buf_putbytes(pam_err, (*msg)->msg, msg_len);
 153                                 buf_putbytes(pam_err, "\r\n", 2);
 154                                 buf_setpos(pam_err, 0);
 155
 156                                 send_msg_userauth_banner(pam_err);
 157                                 buf_free(pam_err);
 158                         }
 159                         break;
 160
 161                 default:
 162                         TRACE(("Unknown message type"))
 163                         rc = PAM_CONV_ERR;
 164                         break;
 165         }
 166
 167         m_free(compare_message);
 168         TRACE(("leave pamConvFunc, rc %d", rc))
 169
 170         return rc;
 171 }
 172
 173 /* Process a password auth request, sending success or failure messages as
 174  * appropriate. To the client it looks like it's doing normal password auth (as
 175  * opposed to keyboard-interactive or something), so the pam module has to be
 176  * fairly standard (ie just "what's your username, what's your password, OK").
 177  *
 178  * Keyboard interactive would be a lot nicer, but since PAM is synchronous, it
 179  * gets very messy trying to send the interactive challenges, and read the
 180  * interactive responses, over the network. */
 181 void svr_auth_pam() {
 182
 183         struct UserDataS userData = {NULL, NULL};
 184         struct pam_conv pamConv = {
 185                 pamConvFunc,
 186                 &userData /* submitted to pamvConvFunc as appdata_ptr */
 187         };
 188
 189         pam_handle_t* pamHandlep = NULL;
 190
 191         char * password = NULL;
 192         unsigned int passwordlen;
 193
 194         int rc = PAM_SUCCESS;
 195         unsigned char changepw;
 196
 197         /* check if client wants to change password */
 198         changepw = buf_getbool(ses.payload);
 199         if (changepw) {
 200                 /* not implemented by this server */
 201                 send_msg_userauth_failure(0, 1);
 202                 goto cleanup;
 203         }
 204
 205         password = buf_getstring(ses.payload, &passwordlen);
 206
 207         /* used to pass data to the PAM conversation function - don't bother with
 208          * strdup() etc since these are touched only by our own conversation
 209          * function (above) which takes care of it */
 210         userData.user = ses.authstate.pw_name;
 211         userData.passwd = password;
 212
 213         /* Init pam */
 214         if ((rc = pam_start("sshd", NULL, &pamConv, &pamHandlep)) != PAM_SUCCESS) {
 215                 dropbear_log(LOG_WARNING, "pam_start() failed, rc=%d, %s",
 216                                 rc, pam_strerror(pamHandlep, rc));
 217                 goto cleanup;
 218         }
 219
 220         /* just to set it to something */
 221         if ((rc = pam_set_item(pamHandlep, PAM_TTY, "ssh") != PAM_SUCCESS)) {
 222                 dropbear_log(LOG_WARNING, "pam_set_item() failed, rc=%d, %s",
 223                                 rc, pam_strerror(pamHandlep, rc));
 224                 goto cleanup;
 225         }
 226
 227 #ifdef HAVE_PAM_FAIL_DELAY
 228         /* We have our own random delay code already, disable PAM's */
 229         (void) pam_fail_delay(pamHandlep, 0 /* musec_delay */);
 230 #endif
 231
 232         /* (void) pam_set_item(pamHandlep, PAM_FAIL_DELAY, (void*) pamDelayFunc); */
 233
 234         if ((rc = pam_authenticate(pamHandlep, 0)) != PAM_SUCCESS) {
 235                 dropbear_log(LOG_WARNING, "pam_authenticate() failed, rc=%d, %s",
 236                                 rc, pam_strerror(pamHandlep, rc));
 237                 dropbear_log(LOG_WARNING,
 238                                 "Bad PAM password attempt for '%s' from %s",
 239                                 ses.authstate.pw_name,
 240                                 svr_ses.addrstring);
 241                 send_msg_userauth_failure(0, 1);
 242                 goto cleanup;
 243         }
 244
 245         if ((rc = pam_acct_mgmt(pamHandlep, 0)) != PAM_SUCCESS) {
 246                 dropbear_log(LOG_WARNING, "pam_acct_mgmt() failed, rc=%d, %s",
 247                                 rc, pam_strerror(pamHandlep, rc));
 248                 dropbear_log(LOG_WARNING,
 249                                 "Bad PAM password attempt for '%s' from %s",
 250                                 ses.authstate.pw_name,
 251                                 svr_ses.addrstring);
 252                 send_msg_userauth_failure(0, 1);
 253                 goto cleanup;
 254         }
 255
 256         /* successful authentication */
 257         dropbear_log(LOG_NOTICE, "PAM password auth succeeded for '%s' from %s",
 258                         ses.authstate.pw_name,
 259                         svr_ses.addrstring);
 260         send_msg_userauth_success();
 261
 262 cleanup:
 263         if (password != NULL) {
 264                 m_burn(password, passwordlen);
 265                 m_free(password);
 266         }
 267         if (pamHandlep != NULL) {
 268                 TRACE(("pam_end"))
 269                 (void) pam_end(pamHandlep, 0 /* pam_status */);
 270         }
 271 }
 272
 273 #endif /* ENABLE_SVR_PAM_AUTH */