Annotation of src/usr.bin/ssh/auth-rhosts.c, Revision 1.58
1.58 ! djm 1: /* $OpenBSD: auth-rhosts.c,v 1.57 2022/12/09 00:17:40 dtucker Exp $ */
1.1 deraadt 2: /*
1.10 deraadt 3: * Author: Tatu Ylonen <ylo@cs.hut.fi>
4: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5: * All rights reserved
6: * Rhosts authentication. This file contains code to check whether to admit
7: * the login based on rhosts authentication. This file also processes
8: * /etc/hosts.equiv.
1.13 markus 9: *
1.15 deraadt 10: * As far as I am concerned, the code I have written for this software
11: * can be used freely for any purpose. Any derived versions of this
12: * software must be clearly marked as such, and if the derived work is
13: * incompatible with the protocol description in the RFC file, it must be
14: * called by a name other than "ssh" or "Secure Shell".
1.10 deraadt 15: */
1.1 deraadt 16:
1.35 stevesk 17: #include <sys/types.h>
18: #include <sys/stat.h>
1.34 stevesk 19:
1.57 dtucker 20: #include <errno.h>
1.42 djm 21: #include <fcntl.h>
1.34 stevesk 22: #include <netgroup.h>
1.38 stevesk 23: #include <pwd.h>
1.40 stevesk 24: #include <stdio.h>
1.39 stevesk 25: #include <string.h>
1.41 deraadt 26: #include <stdarg.h>
1.56 djm 27: #include <stdlib.h>
1.43 dtucker 28: #include <unistd.h>
1.1 deraadt 29:
30: #include "packet.h"
31: #include "uidswap.h"
1.19 markus 32: #include "pathnames.h"
33: #include "log.h"
1.45 millert 34: #include "misc.h"
1.55 djm 35: #include "xmalloc.h"
1.49 markus 36: #include "sshbuf.h"
37: #include "sshkey.h"
1.6 markus 38: #include "servconf.h"
1.19 markus 39: #include "canohost.h"
1.41 deraadt 40: #include "hostfile.h"
1.21 itojun 41: #include "auth.h"
1.1 deraadt 42:
1.23 markus 43: /* import */
44: extern ServerOptions options;
45:
1.11 markus 46: /*
47: * This function processes an rhosts-style file (.rhosts, .shosts, or
48: * /etc/hosts.equiv). This returns true if authentication can be granted
49: * based on the file, and returns zero otherwise.
50: */
1.1 deraadt 51:
1.24 itojun 52: static int
1.9 markus 53: check_rhosts_file(const char *filename, const char *hostname,
54: const char *ipaddr, const char *client_user,
55: const char *server_user)
1.1 deraadt 56: {
1.9 markus 57: FILE *f;
1.46 djm 58: #define RBUFLN 1024
59: char buf[RBUFLN];/* Must not be larger than host, user, dummy below. */
1.42 djm 60: int fd;
61: struct stat st;
1.1 deraadt 62:
1.9 markus 63: /* Open the .rhosts file, deny if unreadable */
1.42 djm 64: if ((fd = open(filename, O_RDONLY|O_NONBLOCK)) == -1)
1.9 markus 65: return 0;
1.42 djm 66: if (fstat(fd, &st) == -1) {
67: close(fd);
68: return 0;
69: }
70: if (!S_ISREG(st.st_mode)) {
71: logit("User %s hosts file %s is not a regular file",
72: server_user, filename);
73: close(fd);
74: return 0;
75: }
76: unset_nonblock(fd);
77: if ((f = fdopen(fd, "r")) == NULL) {
78: close(fd);
79: return 0;
80: }
1.9 markus 81: while (fgets(buf, sizeof(buf), f)) {
1.46 djm 82: /* All three must have length >= buf to avoid overflows. */
83: char hostbuf[RBUFLN], userbuf[RBUFLN], dummy[RBUFLN];
84: char *host, *user, *cp;
1.9 markus 85: int negated;
86:
87: for (cp = buf; *cp == ' ' || *cp == '\t'; cp++)
88: ;
89: if (*cp == '#' || *cp == '\n' || !*cp)
90: continue;
91:
1.11 markus 92: /*
93: * NO_PLUS is supported at least on OSF/1. We skip it (we
94: * don't ever support the plus syntax).
95: */
1.9 markus 96: if (strncmp(cp, "NO_PLUS", 7) == 0)
97: continue;
98:
1.11 markus 99: /*
100: * This should be safe because each buffer is as big as the
101: * whole string, and thus cannot be overwritten.
102: */
1.30 itojun 103: switch (sscanf(buf, "%1023s %1023s %1023s", hostbuf, userbuf,
104: dummy)) {
1.9 markus 105: case 0:
1.28 markus 106: auth_debug_add("Found empty line in %.100s.", filename);
1.9 markus 107: continue;
108: case 1:
109: /* Host name only. */
110: strlcpy(userbuf, server_user, sizeof(userbuf));
111: break;
112: case 2:
113: /* Got both host and user name. */
114: break;
115: case 3:
1.28 markus 116: auth_debug_add("Found garbage in %.100s.", filename);
1.9 markus 117: continue;
118: default:
119: /* Weird... */
120: continue;
121: }
122:
123: host = hostbuf;
124: user = userbuf;
125: negated = 0;
126:
127: /* Process negated host names, or positive netgroups. */
128: if (host[0] == '-') {
129: negated = 1;
130: host++;
131: } else if (host[0] == '+')
132: host++;
133:
134: if (user[0] == '-') {
135: negated = 1;
136: user++;
137: } else if (user[0] == '+')
138: user++;
139:
140: /* Check for empty host/user names (particularly '+'). */
141: if (!host[0] || !user[0]) {
142: /* We come here if either was '+' or '-'. */
1.46 djm 143: auth_debug_add("Ignoring wild host/user names "
144: "in %.100s.", filename);
1.9 markus 145: continue;
146: }
147: /* Verify that host name matches. */
148: if (host[0] == '@') {
149: if (!innetgr(host + 1, hostname, NULL, NULL) &&
150: !innetgr(host + 1, ipaddr, NULL, NULL))
151: continue;
1.46 djm 152: } else if (strcasecmp(host, hostname) &&
153: strcmp(host, ipaddr) != 0)
1.9 markus 154: continue; /* Different hostname. */
155:
156: /* Verify that user name matches. */
157: if (user[0] == '@') {
158: if (!innetgr(user + 1, NULL, client_user, NULL))
159: continue;
160: } else if (strcmp(user, client_user) != 0)
161: continue; /* Different username. */
162:
163: /* Found the user and host. */
164: fclose(f);
165:
166: /* If the entry was negated, deny access. */
167: if (negated) {
1.28 markus 168: auth_debug_add("Matched negative entry in %.100s.",
1.33 djm 169: filename);
1.9 markus 170: return 0;
171: }
172: /* Accept authentication. */
173: return 1;
174: }
175:
176: /* Authentication using this file denied. */
177: fclose(f);
178: return 0;
1.1 deraadt 179: }
180:
1.11 markus 181: /*
182: * Tries to authenticate the user using the .shosts or .rhosts file. Returns
183: * true if authentication succeeds. If ignore_rhosts is true, only
184: * /etc/hosts.equiv will be considered (.rhosts and .shosts are ignored).
185: */
1.13 markus 186: int
1.48 markus 187: auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname,
1.23 markus 188: const char *ipaddr)
189: {
1.55 djm 190: char *path = NULL;
1.9 markus 191: struct stat st;
1.54 djm 192: static const char * const rhosts_files[] = {".shosts", ".rhosts", NULL};
1.17 markus 193: u_int rhosts_file_index;
1.55 djm 194: int r;
1.9 markus 195:
1.55 djm 196: debug2_f("clientuser %s hostname %s ipaddr %s",
1.23 markus 197: client_user, hostname, ipaddr);
198:
1.9 markus 199: /* Switch to the user's uid. */
1.22 markus 200: temporarily_use_uid(pw);
1.11 markus 201: /*
1.46 djm 202: * Quick check: if the user has no .shosts or .rhosts files and
203: * no system hosts.equiv/shosts.equiv files exist then return
1.11 markus 204: * failure immediately without doing costly lookups from name
205: * servers.
206: */
1.9 markus 207: for (rhosts_file_index = 0; rhosts_files[rhosts_file_index];
1.25 deraadt 208: rhosts_file_index++) {
1.9 markus 209: /* Check users .rhosts or .shosts. */
1.55 djm 210: xasprintf(&path, "%s/%s",
211: pw->pw_dir, rhosts_files[rhosts_file_index]);
212: r = stat(path, &st);
213: free(path);
214: if (r >= 0)
1.9 markus 215: break;
216: }
217: /* Switch back to privileged uid. */
218: restore_uid();
219:
1.46 djm 220: /*
221: * Deny if The user has no .shosts or .rhosts file and there
222: * are no system-wide files.
223: */
1.9 markus 224: if (!rhosts_files[rhosts_file_index] &&
1.50 deraadt 225: stat(_PATH_RHOSTS_EQUIV, &st) == -1 &&
226: stat(_PATH_SSH_HOSTS_EQUIV, &st) == -1) {
1.53 djm 227: debug3_f("no hosts access files exist");
1.9 markus 228: return 0;
1.46 djm 229: }
1.9 markus 230:
1.46 djm 231: /*
232: * If not logging in as superuser, try /etc/hosts.equiv and
233: * shosts.equiv.
234: */
235: if (pw->pw_uid == 0)
1.53 djm 236: debug3_f("root user, ignoring system hosts files");
1.46 djm 237: else {
1.25 deraadt 238: if (check_rhosts_file(_PATH_RHOSTS_EQUIV, hostname, ipaddr,
239: client_user, pw->pw_name)) {
1.46 djm 240: auth_debug_add("Accepted for %.100s [%.100s] by "
241: "/etc/hosts.equiv.", hostname, ipaddr);
1.9 markus 242: return 1;
243: }
1.25 deraadt 244: if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr,
245: client_user, pw->pw_name)) {
1.46 djm 246: auth_debug_add("Accepted for %.100s [%.100s] by "
247: "%.100s.", hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV);
1.9 markus 248: return 1;
249: }
250: }
1.46 djm 251:
1.11 markus 252: /*
253: * Check that the home directory is owned by root or the user, and is
254: * not group or world writable.
255: */
1.50 deraadt 256: if (stat(pw->pw_dir, &st) == -1) {
1.29 itojun 257: logit("Rhosts authentication refused for %.100s: "
1.28 markus 258: "no home directory %.200s", pw->pw_name, pw->pw_dir);
259: auth_debug_add("Rhosts authentication refused for %.100s: "
260: "no home directory %.200s", pw->pw_name, pw->pw_dir);
1.9 markus 261: return 0;
262: }
263: if (options.strict_modes &&
264: ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
1.25 deraadt 265: (st.st_mode & 022) != 0)) {
1.29 itojun 266: logit("Rhosts authentication refused for %.100s: "
1.28 markus 267: "bad ownership or modes for home directory.", pw->pw_name);
268: auth_debug_add("Rhosts authentication refused for %.100s: "
269: "bad ownership or modes for home directory.", pw->pw_name);
1.9 markus 270: return 0;
271: }
272: /* Temporarily use the user's uid. */
1.22 markus 273: temporarily_use_uid(pw);
1.9 markus 274:
275: /* Check all .rhosts files (currently .shosts and .rhosts). */
276: for (rhosts_file_index = 0; rhosts_files[rhosts_file_index];
1.25 deraadt 277: rhosts_file_index++) {
1.9 markus 278: /* Check users .rhosts or .shosts. */
1.55 djm 279: xasprintf(&path, "%s/%s",
280: pw->pw_dir, rhosts_files[rhosts_file_index]);
281: if (stat(path, &st) == -1) {
1.57 dtucker 282: debug3_f("stat %s: %s", path, strerror(errno));
1.55 djm 283: free(path);
1.9 markus 284: continue;
1.55 djm 285: }
1.9 markus 286:
1.11 markus 287: /*
288: * Make sure that the file is either owned by the user or by
289: * root, and make sure it is not writable by anyone but the
290: * owner. This is to help avoid novices accidentally
291: * allowing access to their account by anyone.
292: */
1.9 markus 293: if (options.strict_modes &&
294: ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
1.25 deraadt 295: (st.st_mode & 022) != 0)) {
1.55 djm 296: logit("Rhosts authentication refused for %.100s: "
297: "bad modes for %.200s", pw->pw_name, path);
298: auth_debug_add("Bad file modes for %.200s", path);
299: free(path);
1.9 markus 300: continue;
301: }
1.46 djm 302: /*
303: * Check if we have been configured to ignore .rhosts
304: * and .shosts files.
305: */
1.52 djm 306: if (options.ignore_rhosts == IGNORE_RHOSTS_YES ||
307: (options.ignore_rhosts == IGNORE_RHOSTS_SHOSTS &&
308: strcmp(rhosts_files[rhosts_file_index], ".shosts") != 0)) {
1.46 djm 309: auth_debug_add("Server has been configured to "
310: "ignore %.100s.", rhosts_files[rhosts_file_index]);
1.55 djm 311: free(path);
1.9 markus 312: continue;
313: }
314: /* Check if authentication is permitted by the file. */
1.55 djm 315: if (check_rhosts_file(path, hostname, ipaddr,
1.46 djm 316: client_user, pw->pw_name)) {
1.28 markus 317: auth_debug_add("Accepted by %.100s.",
318: rhosts_files[rhosts_file_index]);
1.9 markus 319: /* Restore the privileged uid. */
320: restore_uid();
1.46 djm 321: auth_debug_add("Accepted host %s ip %s client_user "
322: "%s server_user %s", hostname, ipaddr,
323: client_user, pw->pw_name);
1.55 djm 324: free(path);
1.9 markus 325: return 1;
326: }
1.55 djm 327: free(path);
1.9 markus 328: }
329:
330: /* Restore the privileged uid. */
331: restore_uid();
332: return 0;
1.1 deraadt 333: }
![[BACK]](/icons/back.gif){kind=icon}
Return to auth-rhosts.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh