Annotation of src/usr.bin/ssh/auth-passwd.c, Revision 1.7
1.1 deraadt 1: /*
2:
3: auth-passwd.c
4:
5: Author: Tatu Ylonen <ylo@cs.hut.fi>
6:
7: Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
8: All rights reserved
9:
10: Created: Sat Mar 18 05:11:38 1995 ylo
11:
12: Password authentication. This file contains the functions to check whether
13: the password is valid for the user.
14:
15: */
16:
17: #include "includes.h"
1.7 ! markus 18: RCSID("$Id: auth-passwd.c,v 1.6 1999/10/07 21:45:02 markus Exp $");
1.1 deraadt 19:
20: #include "packet.h"
21: #include "ssh.h"
22: #include "servconf.h"
23: #include "xmalloc.h"
24:
25: #ifdef KRB4
26: extern char *ticket;
27: #endif /* KRB4 */
28:
29: /* Tries to authenticate the user using password. Returns true if
30: authentication succeeds. */
31:
1.6 markus 32: int auth_password(struct passwd *pw, const char *password)
1.1 deraadt 33: {
34: extern ServerOptions options;
35: char *encrypted_password;
1.7 ! markus 36:
! 37: if (pw->pw_uid == 0 && options.permit_root_login == 2)
! 38: {
! 39: packet_send_debug("Server does not permit root login with password.");
! 40: return 0;
! 41: }
1.1 deraadt 42:
43: if (*password == '\0' && options.permit_empty_passwd == 0)
44: {
45: packet_send_debug("Server does not permit empty password login.");
46: return 0;
47: }
48:
1.6 markus 49: /* deny if no user. */
50: if (pw == NULL)
1.1 deraadt 51: return 0;
52:
1.6 markus 53: #ifdef SKEY
54: if (options.skey_authentication == 1) {
55: if (strncasecmp(password, "s/key", 5) == 0) {
56: char *skeyinfo = skey_keyinfo(pw->pw_name);
57: if(skeyinfo == NULL){
58: debug("generating fake skeyinfo for %.100s.", pw->pw_name);
59: skeyinfo = skey_fake_keyinfo(pw->pw_name);
60: }
61: if(skeyinfo != NULL)
62: packet_send_debug(skeyinfo);
63: /* Try again. */
64: return 0;
65: }
66: else if (skey_haskey(pw->pw_name) == 0 &&
67: skey_passcheck(pw->pw_name, (char *)password) != -1) {
68: /* Authentication succeeded. */
69: return 1;
70: }
71: /* Fall back to ordinary passwd authentication. */
72: }
73: #endif
74:
1.2 dugsong 75: #if defined(KRB4)
76: /* Support for Kerberos v4 authentication - Dug Song <dugsong@UMICH.EDU> */
77: if (options.kerberos_authentication)
78: {
79: AUTH_DAT adata;
80: KTEXT_ST tkt;
81: struct hostent *hp;
82: unsigned long faddr;
83: char localhost[MAXHOSTNAMELEN]; /* local host name */
84: char phost[INST_SZ]; /* host instance */
85: char realm[REALM_SZ]; /* local Kerberos realm */
86: int r;
87:
88: /* Try Kerberos password authentication only for non-root
89: users and only if Kerberos is installed. */
90: if (pw->pw_uid != 0 && krb_get_lrealm(realm, 1) == KSUCCESS) {
91:
92: /* Set up our ticket file. */
93: if (!ssh_tf_init(pw->pw_uid)) {
94: log("Couldn't initialize Kerberos ticket file for %s!",
1.6 markus 95: pw->pw_name);
1.2 dugsong 96: goto kerberos_auth_failure;
97: }
98: /* Try to get TGT using our password. */
1.6 markus 99: r = krb_get_pw_in_tkt((char *)pw->pw_name, "", realm, "krbtgt", realm,
1.2 dugsong 100: DEFAULT_TKT_LIFE, (char *)password);
101: if (r != INTK_OK) {
102: packet_send_debug("Kerberos V4 password authentication for %s "
1.6 markus 103: "failed: %s", pw->pw_name, krb_err_txt[r]);
1.2 dugsong 104: goto kerberos_auth_failure;
105: }
106: /* Successful authentication. */
107: chown(ticket, pw->pw_uid, pw->pw_gid);
108:
109: (void) gethostname(localhost, sizeof(localhost));
1.3 deraadt 110: (void) strlcpy(phost, (char *)krb_get_phost(localhost), INST_SZ);
1.2 dugsong 111:
112: /* Now that we have a TGT, try to get a local "rcmd" ticket to
113: ensure that we are not talking to a bogus Kerberos server. */
114: r = krb_mk_req(&tkt, KRB4_SERVICE_NAME, phost, realm, 33);
115:
116: if (r == KSUCCESS) {
117: if (!(hp = gethostbyname(localhost))) {
118: log("Couldn't get local host address!");
119: goto kerberos_auth_failure;
120: }
121: memmove((void *)&faddr, (void *)hp->h_addr, sizeof(faddr));
122:
123: /* Verify our "rcmd" ticket. */
124: r = krb_rd_req(&tkt, KRB4_SERVICE_NAME, phost, faddr, &adata, "");
125: if (r == RD_AP_UNDEC) {
126: /* Probably didn't have a srvtab on localhost. Allow login. */
127: log("Kerberos V4 TGT for %s unverifiable, no srvtab installed? "
1.6 markus 128: "krb_rd_req: %s", pw->pw_name, krb_err_txt[r]);
1.2 dugsong 129: }
130: else if (r != KSUCCESS) {
131: log("Kerberos V4 %s ticket unverifiable: %s",
132: KRB4_SERVICE_NAME, krb_err_txt[r]);
133: goto kerberos_auth_failure;
134: }
135: }
136: else if (r == KDC_PR_UNKNOWN) {
137: /* Allow login if no rcmd service exists, but log the error. */
138: log("Kerberos V4 TGT for %s unverifiable: %s; %s.%s "
1.6 markus 139: "not registered, or srvtab is wrong?", pw->pw_name,
1.2 dugsong 140: krb_err_txt[r], KRB4_SERVICE_NAME, phost);
141: }
142: else {
143: /* TGT is bad, forget it. Possibly spoofed! */
144: packet_send_debug("WARNING: Kerberos V4 TGT possibly spoofed for"
1.6 markus 145: "%s: %s", pw->pw_name, krb_err_txt[r]);
1.2 dugsong 146: goto kerberos_auth_failure;
147: }
148:
149: /* Authentication succeeded. */
150: return 1;
151:
152: kerberos_auth_failure:
153: (void) dest_tkt();
154: xfree(ticket);
155: ticket = NULL;
156: if (!options.kerberos_or_local_passwd ) return 0;
157: }
158: else {
159: /* Logging in as root or no local Kerberos realm. */
160: packet_send_debug("Unable to authenticate to Kerberos.");
161: }
162: /* Fall back to ordinary passwd authentication. */
163: }
164: #endif /* KRB4 */
1.6 markus 165:
1.1 deraadt 166: /* Check for users with no password. */
1.6 markus 167: if (strcmp(password, "") == 0 && strcmp(pw->pw_passwd, "") == 0)
1.1 deraadt 168: {
169: packet_send_debug("Login permitted without a password because the account has no password.");
170: return 1; /* The user has no password and an empty password was tried. */
171: }
172:
173: /* Encrypt the candidate password using the proper salt. */
174: encrypted_password = crypt(password,
1.6 markus 175: (pw->pw_passwd[0] && pw->pw_passwd[1]) ?
176: pw->pw_passwd : "xx");
1.1 deraadt 177:
178: /* Authentication is accepted if the encrypted passwords are identical. */
1.6 markus 179: return (strcmp(encrypted_password, pw->pw_passwd) == 0);
1.1 deraadt 180: }
![[BACK]](/icons/back.gif){kind=icon}
Return to auth-passwd.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh