1 /* $NetBSD: gss-serv-krb5.c,v 1.12 2019/01/27 02:08:33 pgoyette Exp $ */
2 /* $OpenBSD: gss-serv-krb5.c,v 1.9 2018/07/09 21:37:55 markus Exp $ */
3
4 /*
5 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28 #include "includes.h"
29 __RCSID("$NetBSD: gss-serv-krb5.c,v 1.12 2019/01/27 02:08:33 pgoyette Exp $");
30 #ifdef GSSAPI
31 #ifdef KRB5
32
33 #include <sys/types.h>
34
35 #include <stdarg.h>
36 #include <string.h>
37
38 #include "xmalloc.h"
39 #include "sshkey.h"
40 #include "hostfile.h"
41 #include "auth.h"
42 #include "log.h"
43 #include "misc.h"
44 #include "servconf.h"
45
46 #include "ssh-gss.h"
47
48 extern ServerOptions options;
49
50 #include <krb5.h>
51 #include <gssapi/gssapi_krb5.h>
52
53 static krb5_context krb_context = NULL;
54
55 /* Initialise the krb5 library, for the stuff that GSSAPI won't do */
56
57 static int
ssh_gssapi_krb5_init(void)58 ssh_gssapi_krb5_init(void)
59 {
60 krb5_error_code problem;
61
62 if (krb_context != NULL)
63 return 1;
64
65 problem = krb5_init_context(&krb_context);
66 if (problem) {
67 logit("Cannot initialize krb5 context");
68 return 0;
69 }
70 #ifdef isneeded
71 krb5_init_ets(krb_context);
72 #endif
73
74 return 1;
75 }
76
77 /* Check if this user is OK to login. This only works with krb5 - other
78 * GSSAPI mechanisms will need their own.
79 * Returns true if the user is OK to log in, otherwise returns 0
80 */
81
82 static int
ssh_gssapi_krb5_userok(ssh_gssapi_client * client,char * name)83 ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
84 {
85 krb5_principal princ;
86 int retval;
87 const char *errmsg;
88
89 if (ssh_gssapi_krb5_init() == 0)
90 return 0;
91
92 if ((retval = krb5_parse_name(krb_context, client->exportedname.value,
93 &princ))) {
94 errmsg = krb5_get_error_message(krb_context, retval);
95 logit("krb5_parse_name(): %.100s", errmsg);
96 krb5_free_error_message(krb_context, errmsg);
97 return 0;
98 }
99 if (krb5_kuserok(krb_context, princ, name)) {
100 retval = 1;
101 logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
102 name, (char *)client->displayname.value);
103 } else
104 retval = 0;
105
106 krb5_free_principal(krb_context, princ);
107 return retval;
108 }
109
110
111 /* This writes out any forwarded credentials from the structure populated
112 * during userauth. Called after we have setuid to the user */
113
114 static void
ssh_gssapi_krb5_storecreds(ssh_gssapi_client * client)115 ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
116 {
117 krb5_ccache ccache;
118 krb5_error_code problem;
119 krb5_principal princ;
120 OM_uint32 maj_status, min_status;
121 size_t len;
122 const char *errmsg;
123
124 if (client->creds == NULL) {
125 debug("No credentials stored");
126 return;
127 }
128
129 if (ssh_gssapi_krb5_init() == 0)
130 return;
131
132 if ((problem = krb5_cc_new_unique(krb_context, krb5_fcc_ops.prefix,
133 NULL, &ccache)) != 0) {
134 errmsg = krb5_get_error_message(krb_context, problem);
135 logit("krb5_cc_new_unique(): %.100s", errmsg);
136 krb5_free_error_message(krb_context, errmsg);
137 return;
138 }
139
140 if ((problem = krb5_parse_name(krb_context,
141 client->exportedname.value, &princ))) {
142 errmsg = krb5_get_error_message(krb_context, problem);
143 logit("krb5_parse_name(): %.100s", errmsg);
144 krb5_free_error_message(krb_context, errmsg);
145 krb5_cc_destroy(krb_context, ccache);
146 return;
147 }
148
149 if ((problem = krb5_cc_initialize(krb_context, ccache, princ))) {
150 errmsg = krb5_get_error_message(krb_context, problem);
151 logit("krb5_cc_initialize(): %.100s", errmsg);
152 krb5_free_error_message(krb_context, errmsg);
153 krb5_free_principal(krb_context, princ);
154 krb5_cc_destroy(krb_context, ccache);
155 return;
156 }
157
158 krb5_free_principal(krb_context, princ);
159
160 if ((maj_status = gss_krb5_copy_ccache(&min_status,
161 client->creds, ccache))) {
162 logit("gss_krb5_copy_ccache() failed");
163 krb5_cc_destroy(krb_context, ccache);
164 return;
165 }
166
167 client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));
168 client->store.envvar = __UNCONST("KRB5CCNAME");
169 len = strlen(client->store.filename) + 6;
170 client->store.envval = xmalloc(len);
171 snprintf(client->store.envval, len, "FILE:%s", client->store.filename);
172
173 #ifdef USE_PAM
174 if (options.use_pam)
175 do_pam_putenv(client->store.envvar, client->store.envval);
176 #endif
177
178 krb5_cc_close(krb_context, ccache);
179
180 return;
181 }
182
183 ssh_gssapi_mech gssapi_kerberos_mech = {
184 "toWM5Slw5Ew8Mqkay+al2g==",
185 "Kerberos",
186 {9, __UNCONST("\x2A\x86\x48\x86\xF7\x12\x01\x02\x02")},
187 NULL,
188 &ssh_gssapi_krb5_userok,
189 NULL,
190 &ssh_gssapi_krb5_storecreds
191 };
192
193 #endif /* KRB5 */
194
195 #endif /* GSSAPI */
196