4 * Copyright (c) 2004 Martin Carlsson
5 * Portions (c) 2004 Matt Johnston
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
26 /* Validates a user password using PAM */
34 #ifdef ENABLE_SVR_PAM_AUTH
36 #if defined(HAVE_SECURITY_PAM_APPL_H)
37 #include <security/pam_appl.h>
38 #elif defined (HAVE_PAM_PAM_APPL_H)
39 #include <pam/pam_appl.h>
47 /* PAM conversation function - for now we only handle one message */
49 pamConvFunc(int num_msg
,
50 const struct pam_message
**msg
,
51 struct pam_response
**respp
,
55 struct pam_response
* resp
= NULL
;
56 struct UserDataS
* userDatap
= (struct UserDataS
*) appdata_ptr
;
57 unsigned int msg_len
= 0;
59 char * compare_message
= NULL
;
61 TRACE(("enter pamConvFunc"))
64 /* If you're getting here - Dropbear probably can't support your pam
65 * modules. This whole file is a bit of a hack around lack of
66 * asynchronocity in PAM anyway. */
67 dropbear_log(LOG_INFO
, "pamConvFunc() called with >1 messages: not supported.");
71 /* make a copy we can strip */
72 compare_message
= m_strdup((*msg
)->msg
);
74 /* Make the string lowercase. */
75 msg_len
= strlen(compare_message
);
76 for (i
= 0; i
< msg_len
; i
++) {
77 compare_message
[i
] = tolower(compare_message
[i
]);
80 /* If the string ends with ": ", remove the space.
81 ie "login: " vs "login:" */
83 && compare_message
[msg_len
-2] == ':'
84 && compare_message
[msg_len
-1] == ' ') {
85 compare_message
[msg_len
-1] = '\0';
88 switch((*msg
)->msg_style
) {
90 case PAM_PROMPT_ECHO_OFF
:
92 if (!(strcmp(compare_message
, "password:") == 0)) {
93 /* We don't recognise the prompt as asking for a password,
94 so can't handle it. Add more above as required for
95 different pam modules/implementations. If you need
96 to add an entry here please mail the Dropbear developer */
97 dropbear_log(LOG_NOTICE
, "PAM unknown prompt '%s' (no echo)",
103 /* You have to read the PAM module-writers' docs (do we look like
104 * module writers? no.) to find out that the module will
105 * free the pam_response and its resp element - ie we _must_ malloc
107 resp
= (struct pam_response
*) m_malloc(sizeof(struct pam_response
));
108 memset(resp
, 0, sizeof(struct pam_response
));
110 resp
->resp
= m_strdup(userDatap
->passwd
);
111 m_burn(userDatap
->passwd
, strlen(userDatap
->passwd
));
116 case PAM_PROMPT_ECHO_ON
:
119 (strcmp(compare_message
, "login:" ) == 0)
120 || (strcmp(compare_message
, "please enter username:") == 0)
121 || (strcmp(compare_message
, "username:") == 0)
123 /* We don't recognise the prompt as asking for a username,
124 so can't handle it. Add more above as required for
125 different pam modules/implementations. If you need
126 to add an entry here please mail the Dropbear developer */
127 dropbear_log(LOG_NOTICE
, "PAM unknown prompt '%s' (with echo)",
133 /* You have to read the PAM module-writers' docs (do we look like
134 * module writers? no.) to find out that the module will
135 * free the pam_response and its resp element - ie we _must_ malloc
137 resp
= (struct pam_response
*) m_malloc(sizeof(struct pam_response
));
138 memset(resp
, 0, sizeof(struct pam_response
));
140 resp
->resp
= m_strdup(userDatap
->user
);
141 TRACE(("userDatap->user='%s'", userDatap
->user
))
149 buffer
* pam_err
= buf_new(msg_len
+ 4);
150 buf_setpos(pam_err
, 0);
151 buf_putbytes(pam_err
, "\r\n", 2);
152 buf_putbytes(pam_err
, (*msg
)->msg
, msg_len
);
153 buf_putbytes(pam_err
, "\r\n", 2);
154 buf_setpos(pam_err
, 0);
156 send_msg_userauth_banner(pam_err
);
162 TRACE(("Unknown message type"))
167 m_free(compare_message
);
168 TRACE(("leave pamConvFunc, rc %d", rc
))
173 /* Process a password auth request, sending success or failure messages as
174 * appropriate. To the client it looks like it's doing normal password auth (as
175 * opposed to keyboard-interactive or something), so the pam module has to be
176 * fairly standard (ie just "what's your username, what's your password, OK").
178 * Keyboard interactive would be a lot nicer, but since PAM is synchronous, it
179 * gets very messy trying to send the interactive challenges, and read the
180 * interactive responses, over the network. */
181 void svr_auth_pam() {
183 struct UserDataS userData
= {NULL
, NULL
};
184 struct pam_conv pamConv
= {
186 &userData
/* submitted to pamvConvFunc as appdata_ptr */
189 pam_handle_t
* pamHandlep
= NULL
;
191 char * password
= NULL
;
192 unsigned int passwordlen
;
194 int rc
= PAM_SUCCESS
;
195 unsigned char changepw
;
197 /* check if client wants to change password */
198 changepw
= buf_getbool(ses
.payload
);
200 /* not implemented by this server */
201 send_msg_userauth_failure(0, 1);
205 password
= buf_getstring(ses
.payload
, &passwordlen
);
207 /* used to pass data to the PAM conversation function - don't bother with
208 * strdup() etc since these are touched only by our own conversation
209 * function (above) which takes care of it */
210 userData
.user
= ses
.authstate
.pw_name
;
211 userData
.passwd
= password
;
214 if ((rc
= pam_start("sshd", NULL
, &pamConv
, &pamHandlep
)) != PAM_SUCCESS
) {
215 dropbear_log(LOG_WARNING
, "pam_start() failed, rc=%d, %s",
216 rc
, pam_strerror(pamHandlep
, rc
));
220 /* just to set it to something */
221 if ((rc
= pam_set_item(pamHandlep
, PAM_TTY
, "ssh") != PAM_SUCCESS
)) {
222 dropbear_log(LOG_WARNING
, "pam_set_item() failed, rc=%d, %s",
223 rc
, pam_strerror(pamHandlep
, rc
));
227 #ifdef HAVE_PAM_FAIL_DELAY
228 /* We have our own random delay code already, disable PAM's */
229 (void) pam_fail_delay(pamHandlep
, 0 /* musec_delay */);
232 /* (void) pam_set_item(pamHandlep, PAM_FAIL_DELAY, (void*) pamDelayFunc); */
234 if ((rc
= pam_authenticate(pamHandlep
, 0)) != PAM_SUCCESS
) {
235 dropbear_log(LOG_WARNING
, "pam_authenticate() failed, rc=%d, %s",
236 rc
, pam_strerror(pamHandlep
, rc
));
237 dropbear_log(LOG_WARNING
,
238 "Bad PAM password attempt for '%s' from %s",
239 ses
.authstate
.pw_name
,
241 send_msg_userauth_failure(0, 1);
245 if ((rc
= pam_acct_mgmt(pamHandlep
, 0)) != PAM_SUCCESS
) {
246 dropbear_log(LOG_WARNING
, "pam_acct_mgmt() failed, rc=%d, %s",
247 rc
, pam_strerror(pamHandlep
, rc
));
248 dropbear_log(LOG_WARNING
,
249 "Bad PAM password attempt for '%s' from %s",
250 ses
.authstate
.pw_name
,
252 send_msg_userauth_failure(0, 1);
256 /* successful authentication */
257 dropbear_log(LOG_NOTICE
, "PAM password auth succeeded for '%s' from %s",
258 ses
.authstate
.pw_name
,
260 send_msg_userauth_success();
263 if (password
!= NULL
) {
264 m_burn(password
, passwordlen
);
267 if (pamHandlep
!= NULL
) {
269 (void) pam_end(pamHandlep
, 0 /* pam_status */);
273 #endif /* ENABLE_SVR_PAM_AUTH */