version 1.87, 2002/03/18 01:12:14 |
version 1.88, 2002/03/18 17:50:31 |
|
|
#include "hostfile.h" |
#include "hostfile.h" |
#include "canohost.h" |
#include "canohost.h" |
#include "match.h" |
#include "match.h" |
|
#include "monitor_wrap.h" |
|
|
/* import */ |
/* import */ |
extern ServerOptions options; |
extern ServerOptions options; |
extern u_char *session_id2; |
extern u_char *session_id2; |
extern int session_id2_len; |
extern int session_id2_len; |
|
|
static Authctxt *x_authctxt = NULL; |
Authctxt *x_authctxt = NULL; |
static int one = 1; |
static int one = 1; |
|
|
typedef struct Authmethod Authmethod; |
typedef struct Authmethod Authmethod; |
|
|
/* helper */ |
/* helper */ |
static Authmethod *authmethod_lookup(const char *); |
static Authmethod *authmethod_lookup(const char *); |
static char *authmethods_get(void); |
static char *authmethods_get(void); |
static int user_key_allowed(struct passwd *, Key *); |
int user_key_allowed(struct passwd *, Key *); |
static int hostbased_key_allowed(struct passwd *, const char *, char *, Key *); |
int hostbased_key_allowed(struct passwd *, const char *, char *, Key *); |
|
|
/* auth */ |
/* auth */ |
static void userauth_banner(void); |
static void userauth_banner(void); |
|
|
if (authctxt->attempt++ == 0) { |
if (authctxt->attempt++ == 0) { |
/* setup auth context */ |
/* setup auth context */ |
struct passwd *pw = NULL; |
struct passwd *pw = NULL; |
pw = getpwnamallow(user); |
pw = PRIVSEP(getpwnamallow(user)); |
if (pw && strcmp(service, "ssh-connection")==0) { |
if (pw && strcmp(service, "ssh-connection")==0) { |
authctxt->pw = pwcopy(pw); |
authctxt->pw = pwcopy(pw); |
authctxt->valid = 1; |
authctxt->valid = 1; |
|
|
} else { |
} else { |
log("input_userauth_request: illegal user %s", user); |
log("input_userauth_request: illegal user %s", user); |
} |
} |
setproctitle("%s", pw ? user : "unknown"); |
/* Free memory */ |
|
if (use_privsep && pw != NULL) |
|
pwfree(pw); |
|
|
|
setproctitle("%s%s", pw ? user : "unknown", |
|
use_privsep ? " [net]" : ""); |
authctxt->user = xstrdup(user); |
authctxt->user = xstrdup(user); |
authctxt->service = xstrdup(service); |
authctxt->service = xstrdup(service); |
authctxt->style = style ? xstrdup(style) : NULL; |
authctxt->style = style ? xstrdup(style) : NULL; |
|
|
|
if (use_privsep) |
|
mm_inform_authserv(service, style); |
} else if (strcmp(user, authctxt->user) != 0 || |
} else if (strcmp(user, authctxt->user) != 0 || |
strcmp(service, authctxt->service) != 0) { |
strcmp(service, authctxt->service) != 0) { |
packet_disconnect("Change of username or service not allowed: " |
packet_disconnect("Change of username or service not allowed: " |
|
|
m->enabled = NULL; |
m->enabled = NULL; |
packet_check_eom(); |
packet_check_eom(); |
userauth_banner(); |
userauth_banner(); |
return authctxt->valid ? auth_password(authctxt, "") : 0; |
return (authctxt->valid ? PRIVSEP(auth_password(authctxt, "")) : 0); |
} |
} |
|
|
static int |
static int |
|
|
password = packet_get_string(&len); |
password = packet_get_string(&len); |
packet_check_eom(); |
packet_check_eom(); |
if (authctxt->valid && |
if (authctxt->valid && |
auth_password(authctxt, password) == 1) |
PRIVSEP(auth_password(authctxt, password)) == 1) |
authenticated = 1; |
authenticated = 1; |
memset(password, 0, len); |
memset(password, 0, len); |
xfree(password); |
xfree(password); |
|
|
buffer_dump(&b); |
buffer_dump(&b); |
#endif |
#endif |
/* test for correct signature */ |
/* test for correct signature */ |
if (user_key_allowed(authctxt->pw, key) && |
authenticated = 0; |
key_verify(key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1) |
if (PRIVSEP(user_key_allowed(authctxt->pw, key)) && |
|
PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b), |
|
buffer_len(&b))) == 1) |
authenticated = 1; |
authenticated = 1; |
buffer_clear(&b); |
buffer_clear(&b); |
xfree(sig); |
xfree(sig); |
|
|
* if a user is not allowed to login. is this an |
* if a user is not allowed to login. is this an |
* issue? -markus |
* issue? -markus |
*/ |
*/ |
if (user_key_allowed(authctxt->pw, key)) { |
if (PRIVSEP(user_key_allowed(authctxt->pw, key))) { |
packet_start(SSH2_MSG_USERAUTH_PK_OK); |
packet_start(SSH2_MSG_USERAUTH_PK_OK); |
packet_put_string(pkalg, alen); |
packet_put_string(pkalg, alen); |
packet_put_string(pkblob, blen); |
packet_put_string(pkblob, blen); |
|
|
buffer_dump(&b); |
buffer_dump(&b); |
#endif |
#endif |
/* test for allowed key and correct signature */ |
/* test for allowed key and correct signature */ |
if (hostbased_key_allowed(authctxt->pw, cuser, chost, key) && |
authenticated = 0; |
key_verify(key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1) |
if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) && |
|
PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b), |
|
buffer_len(&b))) == 1) |
authenticated = 1; |
authenticated = 1; |
|
|
buffer_clear(&b); |
buffer_clear(&b); |
|
|
} |
} |
|
|
/* check whether given key is in .ssh/authorized_keys* */ |
/* check whether given key is in .ssh/authorized_keys* */ |
static int |
int |
user_key_allowed(struct passwd *pw, Key *key) |
user_key_allowed(struct passwd *pw, Key *key) |
{ |
{ |
int success; |
int success; |
|
|
} |
} |
|
|
/* return 1 if given hostkey is allowed */ |
/* return 1 if given hostkey is allowed */ |
static int |
int |
hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost, |
hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost, |
Key *key) |
Key *key) |
{ |
{ |