Return to auth.c CVS log

Up to [local] / src / usr.bin / ssh

Annotation of src/usr.bin/ssh/auth.c, Revision 1.6.2.1

1.1       markus      1: /*
                      2:  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
                      3:  *                    All rights reserved
1.2       markus      4:  * Copyright (c) 2000 Markus Friedl. All rights reserved.
1.1       markus      5:  */
                      6:
                      7: #include "includes.h"
1.6.2.1 ! jason       8: RCSID("$OpenBSD: auth.c,v 1.7 2000/05/17 21:37:24 deraadt Exp $");
1.1       markus      9:
                     10: #include "xmalloc.h"
                     11: #include "rsa.h"
                     12: #include "ssh.h"
                     13: #include "pty.h"
                     14: #include "packet.h"
                     15: #include "buffer.h"
                     16: #include "cipher.h"
                     17: #include "mpaux.h"
                     18: #include "servconf.h"
1.2       markus     19: #include "compat.h"
1.1       markus     20: #include "channels.h"
                     21: #include "match.h"
1.6       markus     22:
1.2       markus     23: #include "bufaux.h"
                     24: #include "ssh2.h"
                     25: #include "auth.h"
1.1       markus     26: #include "session.h"
                     27: #include "dispatch.h"
                     28:
1.2       markus     29:
1.1       markus     30: /* import */
                     31: extern ServerOptions options;
                     32: extern char *forced_command;
                     33:
                     34: /*
                     35:  * Check if the user is allowed to log in via ssh. If user is listed in
                     36:  * DenyUsers or user's primary group is listed in DenyGroups, false will
                     37:  * be returned. If AllowUsers isn't empty and user isn't listed there, or
                     38:  * if AllowGroups isn't empty and user isn't listed there, false will be
1.4       markus     39:  * returned.
1.1       markus     40:  * If the user's shell is not executable, false will be returned.
1.4       markus     41:  * Otherwise true is returned.
1.1       markus     42:  */
1.5       markus     43: int
1.1       markus     44: allowed_user(struct passwd * pw)
                     45: {
                     46:        struct stat st;
                     47:        struct group *grp;
1.6.2.1 ! jason      48:        char *shell;
1.1       markus     49:        int i;
                     50:
                     51:        /* Shouldn't be called if pw is NULL, but better safe than sorry... */
                     52:        if (!pw)
                     53:                return 0;
                     54:
1.6.2.1 ! jason      55:        /*
        !            56:         * Get the shell from the password data.  An empty shell field is
        !            57:         * legal, and means /bin/sh.
        !            58:         */
        !            59:        shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
        !            60:
1.1       markus     61:        /* deny if shell does not exists or is not executable */
1.6.2.1 ! jason      62:        if (stat(shell, &st) != 0)
1.1       markus     63:                return 0;
                     64:        if (!((st.st_mode & S_IFREG) && (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP))))
                     65:                return 0;
                     66:
                     67:        /* Return false if user is listed in DenyUsers */
                     68:        if (options.num_deny_users > 0) {
                     69:                if (!pw->pw_name)
                     70:                        return 0;
                     71:                for (i = 0; i < options.num_deny_users; i++)
                     72:                        if (match_pattern(pw->pw_name, options.deny_users[i]))
                     73:                                return 0;
                     74:        }
                     75:        /* Return false if AllowUsers isn't empty and user isn't listed there */
                     76:        if (options.num_allow_users > 0) {
                     77:                if (!pw->pw_name)
                     78:                        return 0;
                     79:                for (i = 0; i < options.num_allow_users; i++)
                     80:                        if (match_pattern(pw->pw_name, options.allow_users[i]))
                     81:                                break;
                     82:                /* i < options.num_allow_users iff we break for loop */
                     83:                if (i >= options.num_allow_users)
                     84:                        return 0;
                     85:        }
                     86:        /* Get the primary group name if we need it. Return false if it fails */
                     87:        if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
                     88:                grp = getgrgid(pw->pw_gid);
                     89:                if (!grp)
                     90:                        return 0;
                     91:
                     92:                /* Return false if user's group is listed in DenyGroups */
                     93:                if (options.num_deny_groups > 0) {
                     94:                        if (!grp->gr_name)
                     95:                                return 0;
                     96:                        for (i = 0; i < options.num_deny_groups; i++)
                     97:                                if (match_pattern(grp->gr_name, options.deny_groups[i]))
                     98:                                        return 0;
                     99:                }
                    100:                /*
                    101:                 * Return false if AllowGroups isn't empty and user's group
                    102:                 * isn't listed there
                    103:                 */
                    104:                if (options.num_allow_groups > 0) {
                    105:                        if (!grp->gr_name)
                    106:                                return 0;
                    107:                        for (i = 0; i < options.num_allow_groups; i++)
                    108:                                if (match_pattern(grp->gr_name, options.allow_groups[i]))
                    109:                                        break;
                    110:                        /* i < options.num_allow_groups iff we break for
                    111:                           loop */
                    112:                        if (i >= options.num_allow_groups)
                    113:                                return 0;
                    114:                }
                    115:        }
                    116:        /* We found no reason not to let this user try to log on... */
                    117:        return 1;
                    118: }