=================================================================== RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/Attic/auth1.c,v retrieving revision 1.2.2.5 retrieving revision 1.3 diff -u -r1.2.2.5 -r1.3 --- src/usr.bin/ssh/Attic/auth1.c 2001/03/21 18:52:34 1.2.2.5 +++ src/usr.bin/ssh/Attic/auth1.c 2000/08/20 18:42:40 1.3 @@ -1,32 +1,26 @@ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved - * - * As far as I am concerned, the code I have written for this software - * can be used freely for any purpose. Any derived versions of this - * software must be clearly marked as such, and if the derived work is - * incompatible with the protocol description in the RFC file, it must be - * called by a name other than "ssh" or "Secure Shell". */ #include "includes.h" -RCSID("$OpenBSD: auth1.c,v 1.2.2.5 2001/03/21 18:52:34 jason Exp $"); +RCSID("$OpenBSD: auth1.c,v 1.3 2000/08/20 18:42:40 millert Exp $"); #include "xmalloc.h" #include "rsa.h" -#include "ssh1.h" +#include "ssh.h" #include "packet.h" #include "buffer.h" +#include "cipher.h" #include "mpaux.h" -#include "log.h" #include "servconf.h" #include "compat.h" #include "auth.h" #include "session.h" -#include "misc.h" /* import */ extern ServerOptions options; +extern char *forced_command; /* * convert ssh auth msg type into description @@ -44,61 +38,113 @@ return "rhosts-rsa"; case SSH_CMSG_AUTH_RHOSTS: return "rhosts"; - case SSH_CMSG_AUTH_TIS: - case SSH_CMSG_AUTH_TIS_RESPONSE: - return "challenge-response"; #ifdef KRB4 case SSH_CMSG_AUTH_KERBEROS: return "kerberos"; #endif +#ifdef SKEY + case SSH_CMSG_AUTH_TIS_RESPONSE: + return "s/key"; +#endif } snprintf(buf, sizeof buf, "bad-auth-msg-%d", type); return buf; } /* - * read packets, try to authenticate the user and - * return only if authentication is successful + * The user does not exist or access is denied, + * but fake indication that authentication is needed. */ void -do_authloop(Authctxt *authctxt) +do_fake_authloop1(char *user) { - int authenticated = 0; - u_int bits; + int attempt = 0; + + log("Faking authloop for illegal user %.200s from %.200s port %d", + user, + get_remote_ipaddr(), + get_remote_port()); + + /* Indicate that authentication is needed. */ + packet_start(SSH_SMSG_FAILURE); + packet_send(); + packet_write_wait(); + + /* + * Keep reading packets, and always respond with a failure. This is + * to avoid disclosing whether such a user really exists. + */ + for (attempt = 1;; attempt++) { + /* Read a packet. This will not return if the client disconnects. */ + int plen; + int type = packet_read(&plen); +#ifdef SKEY + unsigned int dlen; + char *password, *skeyinfo; + password = NULL; + /* Try to send a fake s/key challenge. */ + if (options.skey_authentication == 1 && + (skeyinfo = skey_fake_keyinfo(user)) != NULL) { + if (type == SSH_CMSG_AUTH_TIS) { + packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE); + packet_put_string(skeyinfo, strlen(skeyinfo)); + packet_send(); + packet_write_wait(); + continue; + } else if (type == SSH_CMSG_AUTH_PASSWORD && + options.password_authentication && + (password = packet_get_string(&dlen)) != NULL && + dlen == 5 && + strncasecmp(password, "s/key", 5) == 0 ) { + packet_send_debug(skeyinfo); + } + } + if (password != NULL) + xfree(password); +#endif + if (attempt > AUTH_FAIL_MAX) + packet_disconnect(AUTH_FAIL_MSG, user); + + /* + * Send failure. This should be indistinguishable from a + * failed authentication. + */ + packet_start(SSH_SMSG_FAILURE); + packet_send(); + packet_write_wait(); + } + /* NOTREACHED */ + abort(); +} + +/* + * read packets and try to authenticate local user *pw. + * return if authentication is successfull + */ +void +do_authloop(struct passwd * pw) +{ + int attempt = 0; + unsigned int bits; RSA *client_host_key; BIGNUM *n; char *client_user, *password; - char info[1024]; - u_int dlen; + char user[1024]; + unsigned int dlen; int plen, nlen, elen; - u_int ulen; + unsigned int ulen; int type = 0; - struct passwd *pw = authctxt->pw; + void (*authlog) (const char *fmt,...) = verbose; - debug("Attempting authentication for %s%.100s.", - authctxt->valid ? "" : "illegal user ", authctxt->user); - - /* If the user has no password, accept authentication immediately. */ - if (options.password_authentication && -#ifdef KRB4 - (!options.kerberos_authentication || options.kerberos_or_local_passwd) && -#endif - auth_password(pw, "")) { - auth_log(authctxt, 1, "without authentication", ""); - return; - } - /* Indicate that authentication is needed. */ packet_start(SSH_SMSG_FAILURE); packet_send(); packet_write_wait(); - for (;;) { - /* default to fail */ - authenticated = 0; + for (attempt = 1;; attempt++) { + int authenticated = 0; + strlcpy(user, "", sizeof user); - info[0] = '\0'; - /* Get a packet from the client. */ type = packet_read(&plen); @@ -107,6 +153,7 @@ #ifdef AFS case SSH_CMSG_HAVE_KERBEROS_TGT: if (!options.kerberos_tgt_passing) { + /* packet_get_all(); */ verbose("Kerberos tgt passing disabled."); break; } else { @@ -114,13 +161,14 @@ char *tgt = packet_get_string(&dlen); packet_integrity_check(plen, 4 + dlen, type); if (!auth_kerberos_tgt(pw, tgt)) - verbose("Kerberos tgt REFUSED for %.100s", authctxt->user); + verbose("Kerberos tgt REFUSED for %s", pw->pw_name); xfree(tgt); } continue; case SSH_CMSG_HAVE_AFS_TOKEN: if (!options.afs_token_passing || !k_hasafs()) { + /* packet_get_all(); */ verbose("AFS token passing disabled."); break; } else { @@ -128,7 +176,7 @@ char *token_string = packet_get_string(&dlen); packet_integrity_check(plen, 4 + dlen, type); if (!auth_afs_token(pw, token_string)) - verbose("AFS token REFUSED for %.100s", authctxt->user); + verbose("AFS token REFUSED for %s", pw->pw_name); xfree(token_string); } continue; @@ -136,26 +184,26 @@ #ifdef KRB4 case SSH_CMSG_AUTH_KERBEROS: if (!options.kerberos_authentication) { + /* packet_get_all(); */ verbose("Kerberos authentication disabled."); break; } else { /* Try Kerberos v4 authentication. */ KTEXT_ST auth; char *tkt_user = NULL; - char *kdata = packet_get_string((u_int *) &auth.length); + char *kdata = packet_get_string((unsigned int *) &auth.length); packet_integrity_check(plen, 4 + auth.length, type); - if (authctxt->valid) { - if (auth.length < MAX_KTXT_LEN) - memcpy(auth.dat, kdata, auth.length); - authenticated = auth_krb4(pw->pw_name, &auth, &tkt_user); - if (authenticated) { - snprintf(info, sizeof info, - " tktuser %.100s", tkt_user); - xfree(tkt_user); - } - } + if (auth.length < MAX_KTXT_LEN) + memcpy(auth.dat, kdata, auth.length); xfree(kdata); + + authenticated = auth_krb4(pw->pw_name, &auth, &tkt_user); + + if (authenticated) { + snprintf(user, sizeof user, " tktuser %s", tkt_user); + xfree(tkt_user); + } } break; #endif /* KRB4 */ @@ -174,10 +222,11 @@ client_user = packet_get_string(&ulen); packet_integrity_check(plen, 4 + ulen, type); - /* Try to authenticate using /etc/hosts.equiv and .rhosts. */ + /* Try to authenticate using /etc/hosts.equiv and + .rhosts. */ authenticated = auth_rhosts(pw, client_user); - snprintf(info, sizeof info, " ruser %.100s", client_user); + snprintf(user, sizeof user, " ruser %s", client_user); xfree(client_user); break; @@ -206,14 +255,14 @@ packet_get_bignum(client_host_key->n, &nlen); if (bits != BN_num_bits(client_host_key->n)) - verbose("Warning: keysize mismatch for client_host_key: " + log("Warning: keysize mismatch for client_host_key: " "actual %d, announced %d", BN_num_bits(client_host_key->n), bits); packet_integrity_check(plen, (4 + ulen) + 4 + elen + nlen, type); authenticated = auth_rhosts_rsa(pw, client_user, client_host_key); RSA_free(client_host_key); - snprintf(info, sizeof info, " ruser %.100s", client_user); + snprintf(user, sizeof user, " ruser %s", client_user); xfree(client_user); break; @@ -250,14 +299,20 @@ xfree(password); break; +#ifdef SKEY case SSH_CMSG_AUTH_TIS: debug("rcvd SSH_CMSG_AUTH_TIS"); - if (options.challenge_reponse_authentication == 1) { - char *challenge = get_challenge(authctxt, authctxt->style); - if (challenge != NULL) { - debug("sending challenge '%s'", challenge); + if (options.skey_authentication == 1) { + char *skeyinfo = skey_keyinfo(pw->pw_name); + if (skeyinfo == NULL) { + debug("generating fake skeyinfo for %.100s.", pw->pw_name); + skeyinfo = skey_fake_keyinfo(pw->pw_name); + } + if (skeyinfo != NULL) { + /* we send our s/key- in tis-challenge messages */ + debug("sending challenge '%s'", skeyinfo); packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE); - packet_put_cstring(challenge); + packet_put_string(skeyinfo, strlen(skeyinfo)); packet_send(); packet_write_wait(); continue; @@ -266,15 +321,21 @@ break; case SSH_CMSG_AUTH_TIS_RESPONSE: debug("rcvd SSH_CMSG_AUTH_TIS_RESPONSE"); - if (options.challenge_reponse_authentication == 1) { + if (options.skey_authentication == 1) { char *response = packet_get_string(&dlen); - debug("got response '%s'", response); + debug("skey response == '%s'", response); packet_integrity_check(plen, 4 + dlen, type); - authenticated = verify_response(authctxt, response); - memset(response, 'r', dlen); + authenticated = (skey_haskey(pw->pw_name) == 0 && + skey_passcheck(pw->pw_name, response) != -1); xfree(response); } break; +#else + case SSH_CMSG_AUTH_TIS: + /* TIS Authentication is unsupported */ + log("TIS authentication unsupported."); + break; +#endif default: /* @@ -284,24 +345,43 @@ log("Unknown message during authentication: type %d", type); break; } - if (!authctxt->valid && authenticated) - fatal("INTERNAL ERROR: authenticated invalid user %s", - authctxt->user); - /* Special handling for root */ - if (authenticated && authctxt->pw->pw_uid == 0 && - !auth_root_allowed(get_authname(type))) - authenticated = 0; + /* + * Check if the user is logging in as root and root logins + * are disallowed. + * Note that root login is allowed for forced commands. + */ + if (authenticated && pw->pw_uid == 0 && !options.permit_root_login) { + if (forced_command) { + log("Root login accepted for forced command."); + } else { + authenticated = 0; + log("ROOT LOGIN REFUSED FROM %.200s", + get_canonical_hostname()); + } + } - /* Log before sending the reply */ - auth_log(authctxt, authenticated, get_authname(type), info); + /* Raise logging level */ + if (authenticated || + attempt == AUTH_FAIL_LOG || + type == SSH_CMSG_AUTH_PASSWORD) + authlog = log; + authlog("%s %s for %.200s from %.200s port %d%s", + authenticated ? "Accepted" : "Failed", + get_authname(type), + pw->pw_uid == 0 ? "ROOT" : pw->pw_name, + get_remote_ipaddr(), + get_remote_port(), + user); + if (authenticated) return; - if (authctxt->failures++ > AUTH_FAIL_MAX) - packet_disconnect(AUTH_FAIL_MSG, authctxt->user); + if (attempt > AUTH_FAIL_MAX) + packet_disconnect(AUTH_FAIL_MSG, pw->pw_name); + /* Send a message indicating that the authentication attempt failed. */ packet_start(SSH_SMSG_FAILURE); packet_send(); packet_write_wait(); @@ -315,11 +395,10 @@ void do_authentication() { - Authctxt *authctxt; - struct passwd *pw; + struct passwd *pw, pwcopy; int plen; - u_int ulen; - char *user, *style = NULL; + unsigned int ulen; + char *user; /* Get the name of the user that we wish to log in as. */ packet_read_expect(&plen, SSH_CMSG_USER); @@ -328,46 +407,62 @@ user = packet_get_string(&ulen); packet_integrity_check(plen, (4 + ulen), SSH_CMSG_USER); - if ((style = strchr(user, ':')) != NULL) - *style++ = 0; + setproctitle("%s", user); - authctxt = authctxt_new(); - authctxt->user = user; - authctxt->style = style; +#ifdef AFS + /* If machine has AFS, set process authentication group. */ + if (k_hasafs()) { + k_setpag(); + k_unlog(); + } +#endif /* AFS */ /* Verify that the user is a valid user. */ pw = getpwnam(user); - if (pw && allowed_user(pw)) { - authctxt->valid = 1; - pw = pwcopy(pw); - } else { - debug("do_authentication: illegal user %s", user); - pw = NULL; - } - authctxt->pw = pw; + if (!pw || !allowed_user(pw)) + do_fake_authloop1(user); + xfree(user); - setproctitle("%s", pw ? user : "unknown"); + /* Take a copy of the returned structure. */ + memset(&pwcopy, 0, sizeof(pwcopy)); + pwcopy.pw_name = xstrdup(pw->pw_name); + pwcopy.pw_passwd = xstrdup(pw->pw_passwd); + pwcopy.pw_uid = pw->pw_uid; + pwcopy.pw_gid = pw->pw_gid; + pwcopy.pw_class = xstrdup(pw->pw_class); + pwcopy.pw_dir = xstrdup(pw->pw_dir); + pwcopy.pw_shell = xstrdup(pw->pw_shell); + pw = &pwcopy; /* * If we are not running as root, the user must have the same uid as * the server. */ - if (getuid() != 0 && pw && pw->pw_uid != getuid()) + if (getuid() != 0 && pw->pw_uid != getuid()) packet_disconnect("Cannot change user when server not running as root."); - /* - * Loop until the user has been authenticated or the connection is - * closed, do_authloop() returns only if authentication is successful - */ - do_authloop(authctxt); + debug("Attempting authentication for %.100s.", pw->pw_name); + /* If the user has no password, accept authentication immediately. */ + if (options.password_authentication && +#ifdef KRB4 + (!options.kerberos_authentication || options.kerberos_or_local_passwd) && +#endif /* KRB4 */ + auth_password(pw, "")) { + /* Authentication with empty password succeeded. */ + log("Login for user %s from %.100s, accepted without authentication.", + pw->pw_name, get_remote_ipaddr()); + } else { + /* Loop until the user has been authenticated or the + connection is closed, do_authloop() returns only if + authentication is successfull */ + do_authloop(pw); + } + /* The user has been authenticated and accepted. */ packet_start(SSH_SMSG_SUCCESS); packet_send(); packet_write_wait(); - - xfree(authctxt->user); - xfree(authctxt); /* Perform session preparation. */ do_authenticated(pw);