Annotation of src/usr.bin/ssh/auth-rh-rsa.c, Revision 1.15
1.1 provos 1: /*
1.9 deraadt 2: * Author: Tatu Ylonen <ylo@cs.hut.fi>
3: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: * All rights reserved
5: * Rhosts or /etc/hosts.equiv authentication combined with RSA host
6: * authentication.
7: *
1.15 ! deraadt 8: * As far as I am concerned, the code I have written for this software
! 9: * can be used freely for any purpose. Any derived versions of this
! 10: * software must be clearly marked as such, and if the derived work is
! 11: * incompatible with the protocol description in the RFC file, it must be
! 12: * called by a name other than "ssh" or "Secure Shell".
! 13: *
! 14: *
! 15: * Copyright (c) 2000 Markus Friedl. All rights reserved.
! 16: *
! 17: * Redistribution and use in source and binary forms, with or without
! 18: * modification, are permitted provided that the following conditions
! 19: * are met:
! 20: * 1. Redistributions of source code must retain the above copyright
! 21: * notice, this list of conditions and the following disclaimer.
! 22: * 2. Redistributions in binary form must reproduce the above copyright
! 23: * notice, this list of conditions and the following disclaimer in the
! 24: * documentation and/or other materials provided with the distribution.
! 25: *
! 26: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
! 27: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
! 28: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
! 29: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
! 30: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
! 31: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
! 32: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
! 33: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
! 34: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
! 35: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.9 deraadt 36: */
1.1 provos 37:
38: #include "includes.h"
1.15 ! deraadt 39: RCSID("$OpenBSD: auth-rh-rsa.c,v 1.14 2000/06/20 01:39:38 markus Exp $");
1.1 provos 40:
41: #include "packet.h"
42: #include "ssh.h"
43: #include "xmalloc.h"
44: #include "uidswap.h"
1.4 markus 45: #include "servconf.h"
1.1 provos 46:
1.12 markus 47: #include <openssl/rsa.h>
48: #include <openssl/dsa.h>
1.11 markus 49: #include "key.h"
50: #include "hostfile.h"
51:
1.10 markus 52: /*
53: * Tries to authenticate the user using the .rhosts file and the host using
54: * its host key. Returns true if authentication succeeds.
55: */
1.1 provos 56:
1.13 markus 57: int
1.11 markus 58: auth_rhosts_rsa(struct passwd *pw, const char *client_user, RSA *client_host_key)
1.1 provos 59: {
1.8 markus 60: extern ServerOptions options;
61: const char *canonical_hostname;
62: HostStatus host_status;
1.11 markus 63: Key *client_key, *found;
1.8 markus 64:
65: debug("Trying rhosts with RSA host authentication for %.100s", client_user);
66:
1.11 markus 67: if (client_host_key == NULL)
68: return 0;
69:
1.8 markus 70: /* Check if we would accept it using rhosts authentication. */
71: if (!auth_rhosts(pw, client_user))
72: return 0;
73:
74: canonical_hostname = get_canonical_hostname();
75:
1.11 markus 76: debug("Rhosts RSA authentication: canonical host %.900s", canonical_hostname);
77:
78: /* wrap the RSA key into a 'generic' key */
79: client_key = key_new(KEY_RSA);
80: BN_copy(client_key->rsa->e, client_host_key->e);
81: BN_copy(client_key->rsa->n, client_host_key->n);
82: found = key_new(KEY_RSA);
1.8 markus 83:
84: /* Check if we know the host and its host key. */
85: host_status = check_host_in_hostfile(SSH_SYSTEM_HOSTFILE, canonical_hostname,
1.11 markus 86: client_key, found);
1.8 markus 87:
88: /* Check user host file unless ignored. */
89: if (host_status != HOST_OK && !options.ignore_user_known_hosts) {
90: struct stat st;
91: char *user_hostfile = tilde_expand_filename(SSH_USER_HOSTFILE, pw->pw_uid);
1.10 markus 92: /*
93: * Check file permissions of SSH_USER_HOSTFILE, auth_rsa()
94: * did already check pw->pw_dir, but there is a race XXX
95: */
1.8 markus 96: if (options.strict_modes &&
97: (stat(user_hostfile, &st) == 0) &&
98: ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
99: (st.st_mode & 022) != 0)) {
100: log("Rhosts RSA authentication refused for %.100s: bad owner or modes for %.200s",
101: pw->pw_name, user_hostfile);
102: } else {
103: /* XXX race between stat and the following open() */
104: temporarily_use_uid(pw->pw_uid);
105: host_status = check_host_in_hostfile(user_hostfile, canonical_hostname,
1.11 markus 106: client_key, found);
1.8 markus 107: restore_uid();
108: }
109: xfree(user_hostfile);
110: }
1.11 markus 111: key_free(client_key);
112: key_free(found);
1.8 markus 113:
114: if (host_status != HOST_OK) {
115: debug("Rhosts with RSA host authentication denied: unknown or invalid host key");
116: packet_send_debug("Your host key cannot be verified: unknown or invalid host key.");
117: return 0;
118: }
119: /* A matching host key was found and is known. */
120:
121: /* Perform the challenge-response dialog with the client for the host key. */
1.11 markus 122: if (!auth_rsa_challenge_dialog(client_host_key)) {
1.8 markus 123: log("Client on %.800s failed to respond correctly to host authentication.",
124: canonical_hostname);
125: return 0;
126: }
1.10 markus 127: /*
128: * We have authenticated the user using .rhosts or /etc/hosts.equiv,
129: * and the host using RSA. We accept the authentication.
130: */
1.8 markus 131:
132: verbose("Rhosts with RSA host authentication accepted for %.100s, %.100s on %.700s.",
1.11 markus 133: pw->pw_name, client_user, canonical_hostname);
1.8 markus 134: packet_send_debug("Rhosts with RSA host authentication accepted.");
135: return 1;
1.1 provos 136: }
![[BACK]](/icons/back.gif){kind=icon}
Return to auth-rh-rsa.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh