src/usr.bin/ssh/auth1.c - diff

Return to auth1.c CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/Attic/auth1.c between version 1.2.2.5 and 1.3

version 1.2.2.5, 2001/03/21 18:52:34

version 1.3, 2000/08/20 18:42:40

Line 1

* As far as I am concerned, the code I have written for this software

* can be used freely for any purpose. Any derived versions of this

* software must be clearly marked as such, and if the derived work is

* incompatible with the protocol description in the RFC file, it must be

* called by a name other than "ssh" or "Secure Shell".

#include "includes.h"

Line 14

Line 8

#include "xmalloc.h"

#include "rsa.h"

#include "ssh1.h"

#include "ssh.h"

#include "packet.h"

#include "buffer.h"

#include "cipher.h"

#include "mpaux.h"

#include "log.h"

#include "servconf.h"

#include "compat.h"

#include "auth.h"

#include "session.h"

#include "misc.h"

/* import */

extern ServerOptions options;

extern char *forced_command;

* convert ssh auth msg type into description

Line 44

Line 38

return "rhosts-rsa";

case SSH_CMSG_AUTH_RHOSTS:

return "rhosts";

case SSH_CMSG_AUTH_TIS:

case SSH_CMSG_AUTH_TIS_RESPONSE:

return "challenge-response";

#ifdef KRB4

case SSH_CMSG_AUTH_KERBEROS:

return "kerberos";

#endif

#ifdef SKEY

case SSH_CMSG_AUTH_TIS_RESPONSE:

return "s/key";

#endif

}

snprintf(buf, sizeof buf, "bad-auth-msg-%d", type);

return buf;

}

* read packets, try to authenticate the user and

* The user does not exist or access is denied,

* return only if authentication is successful

* but fake indication that authentication is needed.

void

do_authloop(Authctxt *authctxt)

do_fake_authloop1(char *user)

{

int authenticated = 0;

int attempt = 0;

u_int bits;

log("Faking authloop for illegal user %.200s from %.200s port %d",

user,

get_remote_ipaddr(),

get_remote_port());

/* Indicate that authentication is needed. */

packet_start(SSH_SMSG_FAILURE);

packet_send();

packet_write_wait();

* Keep reading packets, and always respond with a failure. This is

* to avoid disclosing whether such a user really exists.

for (attempt = 1;; attempt++) {

/* Read a packet. This will not return if the client disconnects. */

int plen;

int type = packet_read(&plen);

#ifdef SKEY

unsigned int dlen;

char *password, *skeyinfo;

password = NULL;

/* Try to send a fake s/key challenge. */

if (options.skey_authentication == 1 &&

(skeyinfo = skey_fake_keyinfo(user)) != NULL) {

if (type == SSH_CMSG_AUTH_TIS) {

packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE);

packet_put_string(skeyinfo, strlen(skeyinfo));

packet_send();

packet_write_wait();

continue;

} else if (type == SSH_CMSG_AUTH_PASSWORD &&

options.password_authentication &&

(password = packet_get_string(&dlen)) != NULL &&

dlen == 5 &&

strncasecmp(password, "s/key", 5) == 0 ) {

packet_send_debug(skeyinfo);

}

if (password != NULL)

xfree(password);

#endif

if (attempt > AUTH_FAIL_MAX)

packet_disconnect(AUTH_FAIL_MSG, user);

* Send failure. This should be indistinguishable from a

* failed authentication.

packet_start(SSH_SMSG_FAILURE);

packet_send();

packet_write_wait();

}

/* NOTREACHED */

abort();

}

* read packets and try to authenticate local user *pw.

* return if authentication is successfull

void

do_authloop(struct passwd * pw)

{

int attempt = 0;

unsigned int bits;

RSA *client_host_key;

BIGNUM *n;

char *client_user, *password;

char info[1024];

char user[1024];

u_int dlen;

unsigned int dlen;

int plen, nlen, elen;

u_int ulen;

unsigned int ulen;

int type = 0;

struct passwd *pw = authctxt->pw;

void (*authlog) (const char *fmt,...) = verbose;

debug("Attempting authentication for %s%.100s.",

authctxt->valid ? "" : "illegal user ", authctxt->user);

/* If the user has no password, accept authentication immediately. */

if (options.password_authentication &&

#ifdef KRB4

(!options.kerberos_authentication || options.kerberos_or_local_passwd) &&

#endif

auth_password(pw, "")) {

auth_log(authctxt, 1, "without authentication", "");

return;

}

/* Indicate that authentication is needed. */

packet_start(SSH_SMSG_FAILURE);

packet_send();

packet_write_wait();

for (;;) {

for (attempt = 1;; attempt++) {

/* default to fail */

int authenticated = 0;

authenticated = 0;

strlcpy(user, "", sizeof user);

info[0] = '\0';

/* Get a packet from the client. */

type = packet_read(&plen);

Line 107

Line 153

#ifdef AFS

case SSH_CMSG_HAVE_KERBEROS_TGT:

if (!options.kerberos_tgt_passing) {

/* packet_get_all(); */

verbose("Kerberos tgt passing disabled.");

break;

} else {

Line 114

Line 161

char *tgt = packet_get_string(&dlen);

packet_integrity_check(plen, 4 + dlen, type);

if (!auth_kerberos_tgt(pw, tgt))

verbose("Kerberos tgt REFUSED for %.100s", authctxt->user);

verbose("Kerberos tgt REFUSED for %s", pw->pw_name);

xfree(tgt);

}

continue;

case SSH_CMSG_HAVE_AFS_TOKEN:

if (!options.afs_token_passing || !k_hasafs()) {

/* packet_get_all(); */

verbose("AFS token passing disabled.");

break;

} else {

Line 128

Line 176

char *token_string = packet_get_string(&dlen);

packet_integrity_check(plen, 4 + dlen, type);

if (!auth_afs_token(pw, token_string))

verbose("AFS token REFUSED for %.100s", authctxt->user);

verbose("AFS token REFUSED for %s", pw->pw_name);

xfree(token_string);

}

continue;

Line 136

Line 184

#ifdef KRB4

case SSH_CMSG_AUTH_KERBEROS:

if (!options.kerberos_authentication) {

/* packet_get_all(); */

verbose("Kerberos authentication disabled.");

break;

} else {

/* Try Kerberos v4 authentication. */

KTEXT_ST auth;

char *tkt_user = NULL;

char *kdata = packet_get_string((u_int *) &auth.length);

char *kdata = packet_get_string((unsigned int *) &auth.length);

packet_integrity_check(plen, 4 + auth.length, type);

if (authctxt->valid) {

if (auth.length < MAX_KTXT_LEN)

memcpy(auth.dat, kdata, auth.length);

authenticated = auth_krb4(pw->pw_name, &auth, &tkt_user);

if (authenticated) {

snprintf(info, sizeof info,

" tktuser %.100s", tkt_user);

xfree(tkt_user);

}

xfree(kdata);

authenticated = auth_krb4(pw->pw_name, &auth, &tkt_user);

if (authenticated) {

snprintf(user, sizeof user, " tktuser %s", tkt_user);

xfree(tkt_user);

}

break;

#endif /* KRB4 */

Line 174

Line 222

client_user = packet_get_string(&ulen);

packet_integrity_check(plen, 4 + ulen, type);

/* Try to authenticate using /etc/hosts.equiv and .rhosts. */

/* Try to authenticate using /etc/hosts.equiv and

.rhosts. */

authenticated = auth_rhosts(pw, client_user);

snprintf(info, sizeof info, " ruser %.100s", client_user);

snprintf(user, sizeof user, " ruser %s", client_user);

xfree(client_user);

break;

Line 206

Line 255

packet_get_bignum(client_host_key->n, &nlen);

if (bits != BN_num_bits(client_host_key->n))

verbose("Warning: keysize mismatch for client_host_key: "

log("Warning: keysize mismatch for client_host_key: "

"actual %d, announced %d", BN_num_bits(client_host_key->n), bits);

packet_integrity_check(plen, (4 + ulen) + 4 + elen + nlen, type);

authenticated = auth_rhosts_rsa(pw, client_user, client_host_key);

RSA_free(client_host_key);

snprintf(info, sizeof info, " ruser %.100s", client_user);

snprintf(user, sizeof user, " ruser %s", client_user);

xfree(client_user);

break;

Line 250

Line 299

xfree(password);

break;

#ifdef SKEY

case SSH_CMSG_AUTH_TIS:

debug("rcvd SSH_CMSG_AUTH_TIS");

if (options.challenge_reponse_authentication == 1) {

if (options.skey_authentication == 1) {

char *challenge = get_challenge(authctxt, authctxt->style);

char *skeyinfo = skey_keyinfo(pw->pw_name);

if (challenge != NULL) {

if (skeyinfo == NULL) {

debug("sending challenge '%s'", challenge);

debug("generating fake skeyinfo for %.100s.", pw->pw_name);

skeyinfo = skey_fake_keyinfo(pw->pw_name);

}

if (skeyinfo != NULL) {

/* we send our s/key- in tis-challenge messages */

debug("sending challenge '%s'", skeyinfo);

packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE);

packet_put_cstring(challenge);

packet_put_string(skeyinfo, strlen(skeyinfo));

packet_send();

packet_write_wait();

continue;

Line 266

Line 321

break;

case SSH_CMSG_AUTH_TIS_RESPONSE:

debug("rcvd SSH_CMSG_AUTH_TIS_RESPONSE");

if (options.challenge_reponse_authentication == 1) {

if (options.skey_authentication == 1) {

char *response = packet_get_string(&dlen);

debug("got response '%s'", response);

debug("skey response == '%s'", response);

packet_integrity_check(plen, 4 + dlen, type);

authenticated = verify_response(authctxt, response);

authenticated = (skey_haskey(pw->pw_name) == 0 &&

memset(response, 'r', dlen);

skey_passcheck(pw->pw_name, response) != -1);

xfree(response);

}

break;

#else

case SSH_CMSG_AUTH_TIS:

/* TIS Authentication is unsupported */

log("TIS authentication unsupported.");

break;

#endif

default:

Line 284

Line 345

log("Unknown message during authentication: type %d", type);

break;

}

if (!authctxt->valid && authenticated)

fatal("INTERNAL ERROR: authenticated invalid user %s",

authctxt->user);

/* Special handling for root */

if (authenticated && authctxt->pw->pw_uid == 0 &&

* Check if the user is logging in as root and root logins

!auth_root_allowed(get_authname(type)))

* are disallowed.

authenticated = 0;

* Note that root login is allowed for forced commands.

if (authenticated && pw->pw_uid == 0 && !options.permit_root_login) {

if (forced_command) {

log("Root login accepted for forced command.");

} else {

authenticated = 0;

log("ROOT LOGIN REFUSED FROM %.200s",

get_canonical_hostname());

}

/* Log before sending the reply */

/* Raise logging level */

auth_log(authctxt, authenticated, get_authname(type), info);

if (authenticated ||

attempt == AUTH_FAIL_LOG ||

type == SSH_CMSG_AUTH_PASSWORD)

authlog = log;

authlog("%s %s for %.200s from %.200s port %d%s",

authenticated ? "Accepted" : "Failed",

get_authname(type),

pw->pw_uid == 0 ? "ROOT" : pw->pw_name,

get_remote_ipaddr(),

get_remote_port(),

user);

if (authenticated)

return;

if (authctxt->failures++ > AUTH_FAIL_MAX)

if (attempt > AUTH_FAIL_MAX)

packet_disconnect(AUTH_FAIL_MSG, authctxt->user);

packet_disconnect(AUTH_FAIL_MSG, pw->pw_name);

/* Send a message indicating that the authentication attempt failed. */

packet_start(SSH_SMSG_FAILURE);

packet_send();

packet_write_wait();

Line 315

Line 395

void

do_authentication()

{

Authctxt *authctxt;

struct passwd *pw, pwcopy;

struct passwd *pw;

int plen;

u_int ulen;

unsigned int ulen;

char *user, *style = NULL;

char *user;

/* Get the name of the user that we wish to log in as. */

packet_read_expect(&plen, SSH_CMSG_USER);

Line 328

Line 407

user = packet_get_string(&ulen);

packet_integrity_check(plen, (4 + ulen), SSH_CMSG_USER);

if ((style = strchr(user, ':')) != NULL)

setproctitle("%s", user);

*style++ = 0;

authctxt = authctxt_new();

#ifdef AFS

authctxt->user = user;

/* If machine has AFS, set process authentication group. */

authctxt->style = style;

if (k_hasafs()) {

k_setpag();

k_unlog();

}

#endif /* AFS */

/* Verify that the user is a valid user. */

pw = getpwnam(user);

if (pw && allowed_user(pw)) {

if (!pw || !allowed_user(pw))

authctxt->valid = 1;

do_fake_authloop1(user);

pw = pwcopy(pw);

xfree(user);

} else {

debug("do_authentication: illegal user %s", user);

pw = NULL;

}

authctxt->pw = pw;

setproctitle("%s", pw ? user : "unknown");

/* Take a copy of the returned structure. */

memset(&pwcopy, 0, sizeof(pwcopy));

pwcopy.pw_name = xstrdup(pw->pw_name);

pwcopy.pw_passwd = xstrdup(pw->pw_passwd);

pwcopy.pw_uid = pw->pw_uid;

pwcopy.pw_gid = pw->pw_gid;

pwcopy.pw_class = xstrdup(pw->pw_class);

pwcopy.pw_dir = xstrdup(pw->pw_dir);

pwcopy.pw_shell = xstrdup(pw->pw_shell);

pw = &pwcopy;

* If we are not running as root, the user must have the same uid as

* the server.

if (getuid() != 0 && pw && pw->pw_uid != getuid())

if (getuid() != 0 && pw->pw_uid != getuid())

packet_disconnect("Cannot change user when server not running as root.");

debug("Attempting authentication for %.100s.", pw->pw_name);

* Loop until the user has been authenticated or the connection is

* closed, do_authloop() returns only if authentication is successful

do_authloop(authctxt);

/* If the user has no password, accept authentication immediately. */

if (options.password_authentication &&

#ifdef KRB4

(!options.kerberos_authentication || options.kerberos_or_local_passwd) &&

#endif /* KRB4 */

auth_password(pw, "")) {

/* Authentication with empty password succeeded. */

log("Login for user %s from %.100s, accepted without authentication.",

pw->pw_name, get_remote_ipaddr());

} else {

/* Loop until the user has been authenticated or the

connection is closed, do_authloop() returns only if

authentication is successfull */

do_authloop(pw);

}

/* The user has been authenticated and accepted. */

packet_start(SSH_SMSG_SUCCESS);

packet_send();

packet_write_wait();

xfree(authctxt->user);

xfree(authctxt);

/* Perform session preparation. */

do_authenticated(pw);