Annotation of src/usr.bin/skeyinit/skeyinit.c, Revision 1.64
1.63 millert 1: /* $OpenBSD: skeyinit.c,v 1.62 2015/11/20 20:57:48 deraadt Exp $ */
1.1 deraadt 2:
1.28 millert 3: /* OpenBSD S/Key (skeyinit.c)
1.1 deraadt 4: *
5: * Authors:
6: * Neil M. Haller <nmh@thumper.bellcore.com>
7: * Philip R. Karn <karn@chicago.qualcomm.com>
8: * John S. Walden <jsw@thumper.bellcore.com>
9: * Scott Chasin <chasin@crimelab.com>
1.20 millert 10: * Todd C. Miller <Todd.Miller@courtesan.com>
11: *
1.28 millert 12: * S/Key initialization and seed update
1.1 deraadt 13: */
14:
1.20 millert 15: #include <sys/file.h>
1.32 millert 16: #include <sys/resource.h>
17: #include <sys/stat.h>
1.1 deraadt 18: #include <sys/time.h>
19:
1.32 millert 20: #include <ctype.h>
1.19 millert 21: #include <err.h>
1.20 millert 22: #include <errno.h>
1.19 millert 23: #include <pwd.h>
1.28 millert 24: #include <readpassphrase.h>
1.1 deraadt 25: #include <stdio.h>
26: #include <stdlib.h>
27: #include <string.h>
1.19 millert 28: #include <syslog.h>
29: #include <time.h>
1.1 deraadt 30: #include <unistd.h>
1.56 deraadt 31: #include <limits.h>
1.6 millert 32: #include <utmp.h>
1.19 millert 33:
1.4 millert 34: #include <skey.h>
1.32 millert 35: #include <bsd_auth.h>
1.1 deraadt 36:
1.4 millert 37: #ifndef SKEY_NAMELEN
1.17 millert 38: #define SKEY_NAMELEN 4
1.4 millert 39: #endif
1.1 deraadt 40:
1.36 millert 41: void usage(void);
1.44 deraadt 42: void secure_mode(int *, char *, char *, size_t, char *, size_t);
1.38 millert 43: void normal_mode(char *, int, char *, char *);
1.32 millert 44: void enable_db(int);
1.8 millert 45:
1.1 deraadt 46: int
1.36 millert 47: main(int argc, char **argv)
1.1 deraadt 48: {
1.60 tim 49: int rval, i, l, n, defaultsetup, rmkey, hexmode, enable;
1.56 deraadt 50: char hostname[HOST_NAME_MAX+1];
1.38 millert 51: char seed[SKEY_MAX_SEED_LEN + 1];
1.32 millert 52: char buf[256], key[SKEY_BINKEY_SIZE], filename[PATH_MAX], *ht;
53: char lastc, me[UT_NAMESIZE + 1], *p, *auth_type;
1.57 deraadt 54: const char *errstr;
1.1 deraadt 55: struct skey skey;
56: struct passwd *pp;
1.62 deraadt 57:
58: if (pledge("stdio rpath wpath cpath fattr flock tty", NULL) == -1)
59: err(1, "pledge");
1.1 deraadt 60:
1.60 tim 61: n = rmkey = hexmode = enable = 0;
1.32 millert 62: defaultsetup = 1;
63: ht = auth_type = NULL;
1.4 millert 64:
1.59 tim 65: /* Build up a default seed based on the hostname and some randomness */
1.1 deraadt 66: if (gethostname(hostname, sizeof(hostname)) < 0)
67: err(1, "gethostname");
1.38 millert 68: for (i = 0, p = seed; hostname[i] && i < SKEY_NAMELEN; i++) {
1.59 tim 69: if (isalnum((unsigned char)hostname[i]))
70: *p++ = tolower((unsigned char)hostname[i]);
1.25 millert 71: }
1.59 tim 72: for (i = 0; i < 5; i++)
73: *p++ = arc4random_uniform(10) + '0';
1.25 millert 74: *p = '\0';
1.1 deraadt 75:
76: if ((pp = getpwuid(getuid())) == NULL)
1.40 deraadt 77: err(1, "no user with uid %u", getuid());
1.42 deraadt 78: (void)strlcpy(me, pp->pw_name, sizeof me);
1.1 deraadt 79:
80: if ((pp = getpwnam(me)) == NULL)
81: err(1, "Who are you?");
82:
1.8 millert 83: for (i = 1; i < argc && argv[i][0] == '-' && strcmp(argv[i], "--");) {
84: if (argv[i][2] == '\0') {
85: /* Single character switch */
86: switch (argv[i][1]) {
1.32 millert 87: case 'a':
88: if (argv[++i] == NULL || argv[i][0] == '\0')
1.36 millert 89: usage();
1.48 otto 90: auth_type = argv[i];
1.32 millert 91: break;
1.4 millert 92: case 's':
93: defaultsetup = 0;
1.48 otto 94: if (auth_type == NULL)
95: auth_type = "skey";
1.4 millert 96: break;
97: case 'x':
98: hexmode = 1;
99: break;
1.35 millert 100: case 'r':
101: rmkey = 1;
1.4 millert 102: break;
1.17 millert 103: case 'n':
1.23 deraadt 104: if (argv[++i] == NULL || argv[i][0] == '\0')
1.36 millert 105: usage();
1.57 deraadt 106: n = strtonum(argv[i], 1, SKEY_MAX_SEQ - 1, &errstr);
107: if (errstr)
1.17 millert 108: errx(1, "count must be > 0 and < %d",
109: SKEY_MAX_SEQ);
110: break;
1.32 millert 111: case 'D':
112: enable = -1;
113: break;
114: case 'E':
115: enable = 1;
116: break;
1.8 millert 117: default:
1.36 millert 118: usage();
1.8 millert 119: }
120: } else {
121: /* Multi character switches are hash types */
122: if ((ht = skey_set_algorithm(&argv[i][1])) == NULL) {
123: warnx("Unknown hash algorithm %s", &argv[i][1]);
1.36 millert 124: usage();
1.8 millert 125: }
1.7 millert 126: }
1.8 millert 127: i++;
1.7 millert 128: }
1.32 millert 129: argv += i;
130: argc -= i;
1.7 millert 131:
1.60 tim 132: if (argc > 1 || (enable && argc))
1.36 millert 133: usage();
1.32 millert 134:
1.60 tim 135: /* Handle -D and -E */
136: if (enable) {
137: enable_db(enable);
1.34 millert 138: exit(0);
139: }
1.32 millert 140:
141: /* Check for optional user string. */
142: if (argc == 1) {
1.36 millert 143: if ((pp = getpwnam(argv[0])) == NULL) {
1.16 millert 144: if (getuid() == 0) {
145: static struct passwd _pp;
146:
1.36 millert 147: _pp.pw_name = argv[0];
1.16 millert 148: pp = &_pp;
1.36 millert 149: warnx("Warning, user unknown: %s", argv[0]);
1.16 millert 150: } else {
1.36 millert 151: errx(1, "User unknown: %s", argv[0]);
1.16 millert 152: }
1.32 millert 153: } else if (strcmp(pp->pw_name, me) != 0 && getuid() != 0) {
154: /* Only root can change other's S/Keys. */
155: errx(1, "Permission denied.");
1.1 deraadt 156: }
157: }
158:
1.41 millert 159: switch (skey_haskey(pp->pw_name)) {
160: case -1:
161: if (errno == ENOENT || errno == EPERM)
162: errx(1, "S/Key disabled");
163: else
164: err(1, "cannot open database");
165: break;
166: case 0:
167: /* existing user */
168: break;
169: case 1:
1.48 otto 170: if (!defaultsetup && strcmp(auth_type, "skey") == 0) {
1.41 millert 171: fprintf(stderr,
1.45 espie 172: "You must authenticate yourself before using S/Key for the first time. In\n"
173: "secure mode this is normally done via an existing S/Key key. However, since\n"
174: "you do not have an entry in the S/Key database you will have to specify an\n"
175: "alternate authentication type via the `-a' flag, e.g.\n"
1.54 ajacouto 176: " \"skeyinit -s -a passwd\"\n\n"
1.45 espie 177: "Note that entering a plaintext password over a non-secure link defeats the\n"
178: "purpose of using S/Key in the fist place.\n");
1.41 millert 179: exit(1);
180: }
181: break;
182: }
1.28 millert 183:
1.1 deraadt 184: if (getuid() != 0) {
1.32 millert 185: if ((pp = pw_dup(pp)) == NULL)
186: err(1, NULL);
187: if (!auth_userokay(pp->pw_name, auth_type, NULL, NULL))
188: errx(1, "Password incorrect");
1.10 millert 189: }
1.1 deraadt 190:
1.28 millert 191: /*
192: * Lookup and lock the record we are about to modify.
193: * If this is a new entry this will prevent other users
194: * from appending new entries (and clobbering ours).
195: */
1.1 deraadt 196: rval = skeylookup(&skey, pp->pw_name);
197: switch (rval) {
1.4 millert 198: case -1:
1.41 millert 199: err(1, "cannot open database");
1.21 millert 200: break;
1.4 millert 201: case 0:
1.35 millert 202: /* remove user if asked to do so */
203: if (rmkey) {
204: if (snprintf(filename, sizeof(filename),
205: "%s/%s", _PATH_SKEYDIR, pp->pw_name)
1.55 guenther 206: >= sizeof(filename))
207: errc(1, ENAMETOOLONG,
208: "Cannot remove S/Key entry");
1.35 millert 209: if (unlink(filename) != 0)
210: err(1, "Cannot remove S/Key entry");
211: printf("S/Key entry for %s removed.\n",
212: pp->pw_name);
213: exit(0);
214: }
1.4 millert 215:
1.28 millert 216: (void)printf("[Updating %s with %s]\n", pp->pw_name,
217: ht ? ht : skey_get_algorithm());
218: (void)printf("Old seed: [%s] %s\n",
219: skey_get_algorithm(), skey.seed);
1.4 millert 220:
221: /*
1.25 millert 222: * Sanity check old seed.
223: */
224: l = strlen(skey.seed);
225: for (p = skey.seed; *p; p++) {
1.52 deraadt 226: if (isalpha((unsigned char)*p)) {
227: if (isupper((unsigned char)*p))
228: *p = tolower((unsigned char)*p);
229: } else if (!isdigit((unsigned char)*p)) {
1.25 millert 230: memmove(p, p + 1, l - (p - skey.seed));
231: l--;
232: }
233: }
234:
1.28 millert 235: /* If the seed ends in 0-8 just add one. */
1.4 millert 236: if (l > 0) {
237: lastc = skey.seed[l - 1];
1.52 deraadt 238: if (isdigit((unsigned char)lastc) &&
239: lastc != '9') {
1.43 deraadt 240: (void)strlcpy(seed, skey.seed,
241: sizeof seed);
1.38 millert 242: seed[l - 1] = lastc + 1;
1.4 millert 243: }
1.52 deraadt 244: if (isdigit((unsigned char)lastc) &&
245: lastc == '9' && l < 16) {
1.43 deraadt 246: (void)strlcpy(seed, skey.seed,
247: sizeof seed);
1.38 millert 248: seed[l - 1] = '0';
249: seed[l] = '0';
250: seed[l + 1] = '\0';
1.4 millert 251: }
1.1 deraadt 252: }
1.4 millert 253: break;
254: case 1:
1.35 millert 255: if (rmkey)
256: errx(1, "You have no entry to remove.");
1.28 millert 257: (void)printf("[Adding %s with %s]\n", pp->pw_name,
258: ht ? ht : skey_get_algorithm());
1.32 millert 259: if (snprintf(filename, sizeof(filename), "%s/%s",
1.55 guenther 260: _PATH_SKEYDIR, pp->pw_name) >= sizeof(filename))
261: errc(1, ENAMETOOLONG,
262: "Cannot create S/Key entry");
1.36 millert 263: if ((l = open(filename,
264: O_RDWR | O_NONBLOCK | O_CREAT | O_TRUNC |O_NOFOLLOW,
1.32 millert 265: S_IRUSR | S_IWUSR)) == -1 ||
266: flock(l, LOCK_EX) != 0 ||
267: (skey.keyfile = fdopen(l, "r+")) == NULL)
268: err(1, "Cannot create S/Key entry");
1.4 millert 269: break;
1.1 deraadt 270: }
1.32 millert 271: if (fchown(fileno(skey.keyfile), pp->pw_uid, -1) != 0 ||
272: fchmod(fileno(skey.keyfile), S_IRUSR | S_IWUSR) != 0)
273: err(1, "can't set owner/mode for %s", pp->pw_name);
1.64 ! millert 274: if (defaultsetup && n == 0)
1.47 otto 275: n = 100;
1.1 deraadt 276:
1.8 millert 277: /* Set hash type if asked to */
1.28 millert 278: if (ht && strcmp(ht, skey_get_algorithm()) != 0)
279: skey_set_algorithm(ht);
280:
281: alarm(180);
282: if (!defaultsetup)
1.44 deraadt 283: secure_mode(&n, key, seed, sizeof seed, buf, sizeof(buf));
1.28 millert 284: else
1.38 millert 285: normal_mode(pp->pw_name, n, key, seed);
1.28 millert 286: alarm(0);
1.4 millert 287:
1.32 millert 288: /* XXX - why use malloc here? */
1.58 deraadt 289: if ((skey.val = malloc(16 + 1)) == NULL)
1.28 millert 290: err(1, "Can't allocate memory");
291: btoa8(skey.val, key);
1.1 deraadt 292:
1.32 millert 293: (void)fseek(skey.keyfile, 0L, SEEK_SET);
294: (void)fprintf(skey.keyfile, "%s\n%s\n%04d\n%s\n%s\n",
295: pp->pw_name, skey_get_algorithm(), n, seed, skey.val);
1.28 millert 296: (void)fclose(skey.keyfile);
1.4 millert 297:
1.28 millert 298: (void)printf("\nID %s skey is otp-%s %d %s\n", pp->pw_name,
1.38 millert 299: skey_get_algorithm(), n, seed);
1.28 millert 300: (void)printf("Next login password: %s\n\n",
301: hexmode ? put8(buf, key) : btoe(buf, key));
302: exit(0);
303: }
1.1 deraadt 304:
1.28 millert 305: void
1.44 deraadt 306: secure_mode(int *count, char *key, char *seed, size_t seedlen,
307: char *buf, size_t bufsiz)
1.28 millert 308: {
1.38 millert 309: char *p, newseed[SKEY_MAX_SEED_LEN + 2];
1.57 deraadt 310: const char *errstr;
1.64 ! millert 311: int i, n = *count;
1.4 millert 312:
1.28 millert 313: (void)puts("You need the 6 words generated from the \"skey\" command.");
1.64 ! millert 314: if (n == 0) {
! 315: for (i = 0; ; i++) {
! 316: if (i >= 2)
! 317: exit(1);
! 318:
! 319: (void)printf("Enter sequence count from 1 to %d: ",
! 320: SKEY_MAX_SEQ);
! 321: (void)fgets(buf, bufsiz, stdin);
! 322: clearerr(stdin);
! 323: rip(buf);
! 324: n = strtonum(buf, 1, SKEY_MAX_SEQ-1, &errstr);
! 325: if (!errstr)
! 326: break; /* Valid range */
! 327: fprintf(stderr,
! 328: "ERROR: Count must be between 1 and %d\n",
! 329: SKEY_MAX_SEQ - 1);
! 330: }
! 331: *count= n;
1.28 millert 332: }
1.1 deraadt 333:
1.28 millert 334: for (i = 0; ; i++) {
335: if (i >= 2)
336: exit(1);
337:
1.38 millert 338: (void)printf("Enter new seed [default %s]: ", seed);
339: (void)fgets(newseed, sizeof(newseed), stdin); /* XXX */
1.28 millert 340: clearerr(stdin);
1.38 millert 341: rip(newseed);
342: if (strlen(newseed) > SKEY_MAX_SEED_LEN) {
1.28 millert 343: (void)fprintf(stderr, "ERROR: Seed must be between 1 "
344: "and %d characters in length\n", SKEY_MAX_SEED_LEN);
345: continue;
346: }
1.38 millert 347: for (p = newseed; *p; p++) {
1.52 deraadt 348: if (isspace((unsigned char)*p)) {
1.28 millert 349: (void)fputs("ERROR: Seed must not contain "
350: "any spaces\n", stderr);
1.1 deraadt 351: break;
1.52 deraadt 352: } else if (isalpha((unsigned char)*p)) {
353: if (isupper((unsigned char)*p))
354: *p = tolower((unsigned char)*p);
355: } else if (!isdigit((unsigned char)*p)) {
1.28 millert 356: (void)fputs("ERROR: Seed must be purely "
357: "alphanumeric\n", stderr);
358: break;
359: }
1.1 deraadt 360: }
1.28 millert 361: if (*p == '\0')
362: break; /* Valid seed */
363: }
1.38 millert 364: if (newseed[0] != '\0')
1.44 deraadt 365: (void)strlcpy(seed, newseed, seedlen);
1.1 deraadt 366:
1.28 millert 367: for (i = 0; ; i++) {
368: if (i >= 2)
369: exit(1);
370:
371: (void)printf("otp-%s %d %s\nS/Key access password: ",
372: skey_get_algorithm(), n, seed);
373: (void)fgets(buf, bufsiz, stdin);
374: clearerr(stdin);
375: rip(buf);
376: backspace(buf);
377:
378: if (buf[0] == '?') {
379: (void)puts("Enter 6 words from secure S/Key calculation.");
380: continue;
381: } else if (buf[0] == '\0')
382: exit(1);
383:
384: if (etob(key, buf) == 1 || atob8(key, buf) == 0)
385: break; /* Valid format */
386: (void)fputs("ERROR: Invalid format - try again with the 6 words.\n",
387: stderr);
1.1 deraadt 388: }
1.28 millert 389: }
1.1 deraadt 390:
1.28 millert 391: void
1.38 millert 392: normal_mode(char *username, int n, char *key, char *seed)
1.28 millert 393: {
394: int i, nn;
1.38 millert 395: char passwd[SKEY_MAX_PW_LEN+2], key2[SKEY_BINKEY_SIZE];
1.1 deraadt 396:
1.28 millert 397: /* Get user's secret passphrase */
398: for (i = 0; ; i++) {
399: if (i > 2)
1.38 millert 400: errx(1, "S/Key entry not updated");
1.28 millert 401:
1.46 otto 402: if (readpassphrase("Enter new secret passphrase: ", passwd,
1.28 millert 403: sizeof(passwd), 0) == NULL || passwd[0] == '\0')
404: exit(1);
405:
406: if (strlen(passwd) < SKEY_MIN_PW_LEN) {
407: (void)fprintf(stderr,
408: "ERROR: Your passphrase must be at least %d "
409: "characters long.\n", SKEY_MIN_PW_LEN);
410: continue;
411: } else if (strcmp(passwd, username) == 0) {
412: (void)fputs("ERROR: Your passphrase may not be the "
413: "same as your user name.\n", stderr);
414: continue;
1.50 deraadt 415: } else if (strspn(passwd, "abcdefghijklmnopqrstuvwxyz") ==
1.28 millert 416: strlen(passwd)) {
417: (void)fputs("ERROR: Your passphrase must contain more "
418: "than just lower case letters.\nWhitespace, "
1.37 aaron 419: "numbers, and punctuation are suggested.\n",
420: stderr);
1.28 millert 421: continue;
422: } else if (strlen(passwd) > 63) {
423: (void)fprintf(stderr, "WARNING: Your passphrase is "
424: "longer than the recommended maximum length of 63\n");
425: }
426: /* XXX - should check for passphrase that is really too long */
1.13 millert 427:
1.38 millert 428: /* Crunch seed and passphrase into starting key */
429: nn = keycrunch(key, seed, passwd);
1.59 tim 430: explicit_bzero(passwd, sizeof(passwd));
1.38 millert 431: if (nn != 0)
432: err(2, "key crunch failed");
433:
434: if (readpassphrase("Again secret passphrase: ", passwd,
435: sizeof(passwd), 0) == NULL || passwd[0] == '\0')
436: exit(1);
437:
438: /* Crunch seed and passphrase into starting key */
439: nn = keycrunch(key2, seed, passwd);
1.59 tim 440: explicit_bzero(passwd, sizeof(passwd));
1.38 millert 441: if (nn != 0)
442: err(2, "key crunch failed");
443:
444: if (memcmp(key, key2, sizeof(key2)) == 0)
1.28 millert 445: break;
1.1 deraadt 446:
1.28 millert 447: (void)fputs("Passphrases do not match.\n", stderr);
1.20 millert 448: }
1.28 millert 449:
450: nn = n;
451: while (nn-- != 0)
452: f(key);
453: }
454:
1.32 millert 455: void
1.36 millert 456: enable_db(int op)
1.32 millert 457: {
458: if (op == 1) {
459: /* enable */
460: if (mkdir(_PATH_SKEYDIR, 01730) != 0 && errno != EEXIST)
461: err(1, "can't mkdir %s", _PATH_SKEYDIR);
1.33 millert 462: if (chown(_PATH_SKEYDIR, geteuid(), getegid()) != 0)
463: err(1, "can't chown %s", _PATH_SKEYDIR);
1.32 millert 464: if (chmod(_PATH_SKEYDIR, 01730) != 0)
465: err(1, "can't chmod %s", _PATH_SKEYDIR);
466: } else {
467: /* disable */
468: if (chmod(_PATH_SKEYDIR, 0) != 0 && errno != ENOENT)
469: err(1, "can't chmod %s", _PATH_SKEYDIR);
470: }
471: }
472:
1.8 millert 473: void
1.36 millert 474: usage(void)
1.8 millert 475: {
1.36 millert 476: extern char *__progname;
477:
1.60 tim 478: (void)fprintf(stderr, "usage: %s [-DErsx] [-a auth-type] [-n count]"
1.53 naddy 479: "\n\t[-md5 | -rmd160 | -sha1] [user]\n", __progname);
1.8 millert 480: exit(1);
1.1 deraadt 481: }
![[BACK]](/icons/back.gif){kind=icon}
Return to skeyinit.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / skeyinit