[BACK]Return to auth-rh-rsa.c CVS log [TXT][DIR] Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/Attic/auth-rh-rsa.c between version 1.7 and 1.8

version 1.7, 1999/11/22 21:02:38 version 1.8, 1999/11/23 22:25:52
Line 26 
Line 26 
 /* Tries to authenticate the user using the .rhosts file and the host using  /* Tries to authenticate the user using the .rhosts file and the host using
    its host key.  Returns true if authentication succeeds. */     its host key.  Returns true if authentication succeeds. */
   
 int auth_rhosts_rsa(struct passwd *pw, const char *client_user,  int
                     BIGNUM *client_host_key_e, BIGNUM *client_host_key_n)  auth_rhosts_rsa(struct passwd *pw, const char *client_user,
                   BIGNUM *client_host_key_e, BIGNUM *client_host_key_n)
 {  {
   extern ServerOptions options;          extern ServerOptions options;
   const char *canonical_hostname;          const char *canonical_hostname;
   HostStatus host_status;          HostStatus host_status;
   BIGNUM *ke, *kn;          BIGNUM *ke, *kn;
   
   debug("Trying rhosts with RSA host authentication for %.100s", client_user);          debug("Trying rhosts with RSA host authentication for %.100s", client_user);
   
   /* Check if we would accept it using rhosts authentication. */          /* Check if we would accept it using rhosts authentication. */
   if (!auth_rhosts(pw, client_user))          if (!auth_rhosts(pw, client_user))
     return 0;                  return 0;
   
   canonical_hostname = get_canonical_hostname();          canonical_hostname = get_canonical_hostname();
   
   debug("Rhosts RSA authentication: canonical host %.900s",          debug("Rhosts RSA authentication: canonical host %.900s",
         canonical_hostname);                canonical_hostname);
   
   /* Check if we know the host and its host key. */  
   /* Check system-wide host file. */  
   ke = BN_new();  
   kn = BN_new();  
   host_status = check_host_in_hostfile(SSH_SYSTEM_HOSTFILE, canonical_hostname,  
                                        client_host_key_e, client_host_key_n, ke, kn);  
   
   /* Check user host file unless ignored. */          /* Check if we know the host and its host key. */
   if (host_status != HOST_OK && !options.ignore_user_known_hosts) {          ke = BN_new();
     struct stat st;          kn = BN_new();
     char *user_hostfile = tilde_expand_filename(SSH_USER_HOSTFILE, pw->pw_uid);          host_status = check_host_in_hostfile(SSH_SYSTEM_HOSTFILE, canonical_hostname,
     /* Check file permissions of SSH_USER_HOSTFILE,                                               client_host_key_e, client_host_key_n,
        auth_rsa() did already check pw->pw_dir, but there is a race XXX */                                               ke, kn);
     if (options.strict_modes &&  
         (stat(user_hostfile, &st) == 0) &&  
         ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||  
         (st.st_mode & 022) != 0)) {  
        log("Rhosts RSA authentication refused for %.100s: bad owner or modes for %.200s",  
            pw->pw_name, user_hostfile);  
     } else {  
       /* XXX race between stat and the following open() */  
       temporarily_use_uid(pw->pw_uid);  
       host_status = check_host_in_hostfile(user_hostfile, canonical_hostname,  
                                            client_host_key_e, client_host_key_n, ke, kn);  
       restore_uid();  
     }  
     xfree(user_hostfile);  
   }  
   BN_free(ke);  
   BN_free(kn);  
   
   if (host_status != HOST_OK) {          /* Check user host file unless ignored. */
     /* The host key was not found. */          if (host_status != HOST_OK && !options.ignore_user_known_hosts) {
     debug("Rhosts with RSA host authentication denied: unknown or invalid host key");                  struct stat st;
     packet_send_debug("Your host key cannot be verified: unknown or invalid host key.");                  char *user_hostfile = tilde_expand_filename(SSH_USER_HOSTFILE, pw->pw_uid);
     return 0;                  /* Check file permissions of SSH_USER_HOSTFILE, auth_rsa()
   }                     did already check pw->pw_dir, but there is a race XXX */
                   if (options.strict_modes &&
                       (stat(user_hostfile, &st) == 0) &&
                       ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
                        (st.st_mode & 022) != 0)) {
                           log("Rhosts RSA authentication refused for %.100s: bad owner or modes for %.200s",
                               pw->pw_name, user_hostfile);
                   } else {
                           /* XXX race between stat and the following open() */
                           temporarily_use_uid(pw->pw_uid);
                           host_status = check_host_in_hostfile(user_hostfile, canonical_hostname,
                                                                client_host_key_e, client_host_key_n,
                                                                ke, kn);
                           restore_uid();
                   }
                   xfree(user_hostfile);
           }
           BN_free(ke);
           BN_free(kn);
   
   /* A matching host key was found and is known. */          if (host_status != HOST_OK) {
                   debug("Rhosts with RSA host authentication denied: unknown or invalid host key");
   /* Perform the challenge-response dialog with the client for the host key. */                  packet_send_debug("Your host key cannot be verified: unknown or invalid host key.");
   if (!auth_rsa_challenge_dialog(client_host_key_e, client_host_key_n))                  return 0;
     {          }
       log("Client on %.800s failed to respond correctly to host authentication.",          /* A matching host key was found and is known. */
           canonical_hostname);  
       return 0;  
     }  
   
   /* We have authenticated the user using .rhosts or /etc/hosts.equiv, and          /* Perform the challenge-response dialog with the client for the host key. */
      the host using RSA.  We accept the authentication. */          if (!auth_rsa_challenge_dialog(client_host_key_e, client_host_key_n)) {
                   log("Client on %.800s failed to respond correctly to host authentication.",
   verbose("Rhosts with RSA host authentication accepted for %.100s, %.100s on %.700s.",                      canonical_hostname);
       pw->pw_name, client_user, canonical_hostname);                  return 0;
   packet_send_debug("Rhosts with RSA host authentication accepted.");          }
   return 1;          /* We have authenticated the user using .rhosts or /etc/hosts.equiv, and the host using RSA.
              We accept the authentication. */
   
           verbose("Rhosts with RSA host authentication accepted for %.100s, %.100s on %.700s.",
                   pw->pw_name, client_user, canonical_hostname);
           packet_send_debug("Rhosts with RSA host authentication accepted.");
           return 1;
 }  }
Legend:
Removed from v.1.7  
changed lines
  Added in v.1.8