1*0Sstevel@tonic-gate /* $OpenBSD: auth.h,v 1.41 2002/09/26 11:38:43 markus Exp $ */ 2*0Sstevel@tonic-gate 3*0Sstevel@tonic-gate #ifndef _AUTH_H 4*0Sstevel@tonic-gate #define _AUTH_H 5*0Sstevel@tonic-gate 6*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 7*0Sstevel@tonic-gate 8*0Sstevel@tonic-gate #ifdef __cplusplus 9*0Sstevel@tonic-gate extern "C" { 10*0Sstevel@tonic-gate #endif 11*0Sstevel@tonic-gate 12*0Sstevel@tonic-gate 13*0Sstevel@tonic-gate /* 14*0Sstevel@tonic-gate * Copyright (c) 2000 Markus Friedl. All rights reserved. 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 17*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 18*0Sstevel@tonic-gate * are met: 19*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 20*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 21*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 22*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 23*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 24*0Sstevel@tonic-gate * 25*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26*0Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27*0Sstevel@tonic-gate * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28*0Sstevel@tonic-gate * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29*0Sstevel@tonic-gate * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31*0Sstevel@tonic-gate * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32*0Sstevel@tonic-gate * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33*0Sstevel@tonic-gate * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34*0Sstevel@tonic-gate * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35*0Sstevel@tonic-gate * 36*0Sstevel@tonic-gate */ 37*0Sstevel@tonic-gate /* 38*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 39*0Sstevel@tonic-gate * Use is subject to license terms. 40*0Sstevel@tonic-gate */ 41*0Sstevel@tonic-gate 42*0Sstevel@tonic-gate #include "key.h" 43*0Sstevel@tonic-gate #include "hostfile.h" 44*0Sstevel@tonic-gate #include <openssl/rsa.h> 45*0Sstevel@tonic-gate 46*0Sstevel@tonic-gate #ifdef USE_PAM 47*0Sstevel@tonic-gate #include <security/pam_appl.h> 48*0Sstevel@tonic-gate #endif /* USE_PAM */ 49*0Sstevel@tonic-gate 50*0Sstevel@tonic-gate #ifdef HAVE_LOGIN_CAP 51*0Sstevel@tonic-gate #include <login_cap.h> 52*0Sstevel@tonic-gate #endif 53*0Sstevel@tonic-gate #ifdef BSD_AUTH 54*0Sstevel@tonic-gate #include <bsd_auth.h> 55*0Sstevel@tonic-gate #endif 56*0Sstevel@tonic-gate #ifdef KRB5 57*0Sstevel@tonic-gate #include <krb5.h> 58*0Sstevel@tonic-gate #endif 59*0Sstevel@tonic-gate 60*0Sstevel@tonic-gate typedef struct Authctxt Authctxt; 61*0Sstevel@tonic-gate typedef struct Authmethod Authmethod; 62*0Sstevel@tonic-gate typedef struct KbdintDevice KbdintDevice; 63*0Sstevel@tonic-gate 64*0Sstevel@tonic-gate #ifdef USE_PAM 65*0Sstevel@tonic-gate typedef struct pam_stuff pam_stuff; 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gate struct pam_stuff { 68*0Sstevel@tonic-gate Authctxt *authctxt; 69*0Sstevel@tonic-gate pam_handle_t *h; 70*0Sstevel@tonic-gate int state; 71*0Sstevel@tonic-gate int last_pam_retval; 72*0Sstevel@tonic-gate }; 73*0Sstevel@tonic-gate 74*0Sstevel@tonic-gate /* See auth-pam.h and auth-pam.c */ 75*0Sstevel@tonic-gate 76*0Sstevel@tonic-gate #define PAM_S_DONE_ACCT_MGMT 0x01 /* acct_mgmt done */ 77*0Sstevel@tonic-gate #define PAM_S_DONE_SETCRED 0x02 /* setcred done */ 78*0Sstevel@tonic-gate #define PAM_S_DONE_OPEN_SESSION 0x04 /* open_session done */ 79*0Sstevel@tonic-gate #define PAM_S_DONE 0x07 /* all done */ 80*0Sstevel@tonic-gate #endif /* USE_PAM */ 81*0Sstevel@tonic-gate 82*0Sstevel@tonic-gate struct Authctxt { 83*0Sstevel@tonic-gate int success; 84*0Sstevel@tonic-gate int valid; 85*0Sstevel@tonic-gate int attempt; /* all userauth attempt count */ 86*0Sstevel@tonic-gate int init_attempt; /* passwd/kbd-int attempt count */ 87*0Sstevel@tonic-gate int failures; 88*0Sstevel@tonic-gate int init_failures; 89*0Sstevel@tonic-gate int unwind_dispatch_loop; 90*0Sstevel@tonic-gate int v1_auth_type; 91*0Sstevel@tonic-gate char *v1_auth_name; 92*0Sstevel@tonic-gate Authmethod *method; 93*0Sstevel@tonic-gate char *user; 94*0Sstevel@tonic-gate char *service; 95*0Sstevel@tonic-gate struct passwd *pw; 96*0Sstevel@tonic-gate char *style; 97*0Sstevel@tonic-gate void *kbdintctxt; /* XXX Switch to method_data; 98*0Sstevel@tonic-gate v1 still needs this*/ 99*0Sstevel@tonic-gate #ifdef USE_PAM 100*0Sstevel@tonic-gate pam_stuff *pam; 101*0Sstevel@tonic-gate u_long last_login_time; /* need to get the time of 102*0Sstevel@tonic-gate last login before calling 103*0Sstevel@tonic-gate pam_open_session() */ 104*0Sstevel@tonic-gate char last_login_host[MAXHOSTNAMELEN]; 105*0Sstevel@tonic-gate int pam_retval; /* pam_stuff is cleaned before 106*0Sstevel@tonic-gate BSM login failure auditing */ 107*0Sstevel@tonic-gate #endif /* USE_PAM */ 108*0Sstevel@tonic-gate 109*0Sstevel@tonic-gate /* SUNW - What follows remains to reduce diffs with OpenSSH but 110*0Sstevel@tonic-gate * is not used in Solaris. The Solaris SSH internal 111*0Sstevel@tonic-gate * architecture requires that this stuff move into the 112*0Sstevel@tonic-gate * Authmethod method_data. 113*0Sstevel@tonic-gate */ 114*0Sstevel@tonic-gate #ifndef SUNW_SSH 115*0Sstevel@tonic-gate #ifdef BSD_AUTH 116*0Sstevel@tonic-gate auth_session_t *as; 117*0Sstevel@tonic-gate #endif 118*0Sstevel@tonic-gate #ifdef KRB4 119*0Sstevel@tonic-gate char *krb4_ticket_file; 120*0Sstevel@tonic-gate #endif 121*0Sstevel@tonic-gate #ifdef KRB5 122*0Sstevel@tonic-gate krb5_context krb5_ctx; 123*0Sstevel@tonic-gate krb5_auth_context krb5_auth_ctx; 124*0Sstevel@tonic-gate krb5_ccache krb5_fwd_ccache; 125*0Sstevel@tonic-gate krb5_principal krb5_user; 126*0Sstevel@tonic-gate char *krb5_ticket_file; 127*0Sstevel@tonic-gate #endif 128*0Sstevel@tonic-gate void *methoddata; 129*0Sstevel@tonic-gate #endif /* SUNW_SSH */ 130*0Sstevel@tonic-gate }; 131*0Sstevel@tonic-gate 132*0Sstevel@tonic-gate struct Authmethod { 133*0Sstevel@tonic-gate char *name; 134*0Sstevel@tonic-gate int *enabled; 135*0Sstevel@tonic-gate /* 136*0Sstevel@tonic-gate * Userauth method state tracking fields updated in 137*0Sstevel@tonic-gate * input_userauth_request() and auth-pam.c. 138*0Sstevel@tonic-gate * 139*0Sstevel@tonic-gate * The "void (*userauth)(Authctxt *authctxt)" function 140*0Sstevel@tonic-gate * communicates the userauth result (success, failure, 141*0Sstevel@tonic-gate * "postponed," abandoned) through the 'authenticated', 142*0Sstevel@tonic-gate * 'postponed' and 'abandoned' fields. Partial success is 143*0Sstevel@tonic-gate * indicated by requiring other userauths to be used by setting 144*0Sstevel@tonic-gate * their 'required' or 'sufficient' fields. 145*0Sstevel@tonic-gate * 146*0Sstevel@tonic-gate * Individual methods should only ever set 'not_again' if it 147*0Sstevel@tonic-gate * makes no sense to complete the same userauth more than once, 148*0Sstevel@tonic-gate * and they should set any methods' sufficient or required flags 149*0Sstevel@tonic-gate * in order to force partial authentication and require that 150*0Sstevel@tonic-gate * more userauths be tried. The (void *) 'method_data' and 151*0Sstevel@tonic-gate * 'hist_method_data' pointers can be used by methods such as 152*0Sstevel@tonic-gate * pubkey which may make sense to run more than once during 153*0Sstevel@tonic-gate * userauth or which may require multiple round tripes (e.g., 154*0Sstevel@tonic-gate * keyboard-interactive) and which need to keep some state; 155*0Sstevel@tonic-gate * 'hist_method_data' is there specifically for pubkey userauth 156*0Sstevel@tonic-gate * where multiple successful attempts should all use different 157*0Sstevel@tonic-gate * keys. 158*0Sstevel@tonic-gate * 159*0Sstevel@tonic-gate * The "attempts," "abandons," "successes" and "failures" fields 160*0Sstevel@tonic-gate * count the number of times a method has been attempted, 161*0Sstevel@tonic-gate * abandoned, and has succeeded or failed. Note that pubkey 162*0Sstevel@tonic-gate * userauth does not double-count sig-less probes that are 163*0Sstevel@tonic-gate * followed by a pubkey request for the same pubkey anw with a 164*0Sstevel@tonic-gate * signature. 165*0Sstevel@tonic-gate */ 166*0Sstevel@tonic-gate void (*userauth)(Authctxt *authctxt); 167*0Sstevel@tonic-gate void (*abandon)(Authctxt *, Authmethod *); 168*0Sstevel@tonic-gate void *method_data; 169*0Sstevel@tonic-gate void *hist_method_data; 170*0Sstevel@tonic-gate unsigned int is_initial; 171*0Sstevel@tonic-gate unsigned int attempts:8; 172*0Sstevel@tonic-gate unsigned int abandons:8; 173*0Sstevel@tonic-gate unsigned int successes:8; 174*0Sstevel@tonic-gate unsigned int failures:8; 175*0Sstevel@tonic-gate /* 176*0Sstevel@tonic-gate * Post-attempt state booleans (authenticated, abandoned, etc...) 177*0Sstevel@tonic-gate */ 178*0Sstevel@tonic-gate unsigned int authenticated:1; 179*0Sstevel@tonic-gate unsigned int not_again:1; 180*0Sstevel@tonic-gate unsigned int sufficient:1; 181*0Sstevel@tonic-gate unsigned int required:1; 182*0Sstevel@tonic-gate unsigned int postponed:1; 183*0Sstevel@tonic-gate unsigned int abandoned:1; 184*0Sstevel@tonic-gate /* 185*0Sstevel@tonic-gate * NOTE: multi-round-trip userauth methods can either 186*0Sstevel@tonic-gate * recursively call dispatch_run and detect abandonment 187*0Sstevel@tonic-gate * within their message handlers (as PAM kbd-int does) or 188*0Sstevel@tonic-gate * set the postponed flag and let input_userauth_request() 189*0Sstevel@tonic-gate * detect abandonment (i.e., initiation of some userauth 190*0Sstevel@tonic-gate * method before completion of a started, multi-round-trip 191*0Sstevel@tonic-gate * userauth method). 192*0Sstevel@tonic-gate * 193*0Sstevel@tonic-gate */ 194*0Sstevel@tonic-gate }; 195*0Sstevel@tonic-gate 196*0Sstevel@tonic-gate /* 197*0Sstevel@tonic-gate * Keyboard interactive device: 198*0Sstevel@tonic-gate * init_ctx returns: non NULL upon success 199*0Sstevel@tonic-gate * query returns: 0 - success, otherwise failure 200*0Sstevel@tonic-gate * respond returns: 0 - success, 1 - need further interaction, 201*0Sstevel@tonic-gate * otherwise - failure 202*0Sstevel@tonic-gate */ 203*0Sstevel@tonic-gate struct KbdintDevice 204*0Sstevel@tonic-gate { 205*0Sstevel@tonic-gate const char *name; 206*0Sstevel@tonic-gate void* (*init_ctx)(Authctxt*); 207*0Sstevel@tonic-gate int (*query)(void *ctx, char **name, char **infotxt, 208*0Sstevel@tonic-gate u_int *numprompts, char ***prompts, u_int **echo_on); 209*0Sstevel@tonic-gate int (*respond)(void *ctx, u_int numresp, char **responses); 210*0Sstevel@tonic-gate void (*free_ctx)(void *ctx); 211*0Sstevel@tonic-gate }; 212*0Sstevel@tonic-gate 213*0Sstevel@tonic-gate int auth_rhosts(struct passwd *, const char *); 214*0Sstevel@tonic-gate int 215*0Sstevel@tonic-gate auth_rhosts2(struct passwd *, const char *, const char *, const char *); 216*0Sstevel@tonic-gate 217*0Sstevel@tonic-gate int auth_rhosts_rsa(struct passwd *, char *, Key *); 218*0Sstevel@tonic-gate int auth_password(Authctxt *, const char *); 219*0Sstevel@tonic-gate int auth_rsa(struct passwd *, BIGNUM *); 220*0Sstevel@tonic-gate int auth_rsa_challenge_dialog(Key *); 221*0Sstevel@tonic-gate BIGNUM *auth_rsa_generate_challenge(Key *); 222*0Sstevel@tonic-gate int auth_rsa_verify_response(Key *, BIGNUM *, u_char[]); 223*0Sstevel@tonic-gate int auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **); 224*0Sstevel@tonic-gate 225*0Sstevel@tonic-gate int auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *); 226*0Sstevel@tonic-gate int hostbased_key_allowed(struct passwd *, const char *, char *, Key *); 227*0Sstevel@tonic-gate int user_key_allowed(struct passwd *, Key *); 228*0Sstevel@tonic-gate 229*0Sstevel@tonic-gate #ifdef KRB4 230*0Sstevel@tonic-gate #include <krb.h> 231*0Sstevel@tonic-gate int auth_krb4(Authctxt *, KTEXT, char **, KTEXT); 232*0Sstevel@tonic-gate int auth_krb4_password(Authctxt *, const char *); 233*0Sstevel@tonic-gate void krb4_cleanup_proc(void *); 234*0Sstevel@tonic-gate 235*0Sstevel@tonic-gate #ifdef AFS 236*0Sstevel@tonic-gate #include <kafs.h> 237*0Sstevel@tonic-gate int auth_krb4_tgt(Authctxt *, const char *); 238*0Sstevel@tonic-gate int auth_afs_token(Authctxt *, const char *); 239*0Sstevel@tonic-gate #endif /* AFS */ 240*0Sstevel@tonic-gate 241*0Sstevel@tonic-gate #endif /* KRB4 */ 242*0Sstevel@tonic-gate 243*0Sstevel@tonic-gate #ifdef KRB5 244*0Sstevel@tonic-gate int auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *); 245*0Sstevel@tonic-gate int auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt); 246*0Sstevel@tonic-gate int auth_krb5_password(Authctxt *authctxt, const char *password); 247*0Sstevel@tonic-gate void krb5_cleanup_proc(void *authctxt); 248*0Sstevel@tonic-gate #endif /* KRB5 */ 249*0Sstevel@tonic-gate 250*0Sstevel@tonic-gate #include "auth-pam.h" 251*0Sstevel@tonic-gate #include "auth2-pam.h" 252*0Sstevel@tonic-gate 253*0Sstevel@tonic-gate Authctxt *do_authentication(void); 254*0Sstevel@tonic-gate Authctxt *do_authentication2(void); 255*0Sstevel@tonic-gate 256*0Sstevel@tonic-gate #ifdef HAVE_BSM 257*0Sstevel@tonic-gate void audit_failed_login_cleanup(void *); 258*0Sstevel@tonic-gate #endif /* HAVE_BSM */ 259*0Sstevel@tonic-gate 260*0Sstevel@tonic-gate int userauth_check_partial_failure(Authctxt *authctxt); 261*0Sstevel@tonic-gate void userauth_force_kbdint(void); 262*0Sstevel@tonic-gate 263*0Sstevel@tonic-gate Authctxt *authctxt_new(void); 264*0Sstevel@tonic-gate void auth_log(Authctxt *, int, char *, char *); 265*0Sstevel@tonic-gate void userauth_finish(Authctxt *, char *); 266*0Sstevel@tonic-gate void userauth_user_svc_change(Authctxt *authctxt, 267*0Sstevel@tonic-gate char *user, 268*0Sstevel@tonic-gate char *service); 269*0Sstevel@tonic-gate int auth_root_allowed(char *); 270*0Sstevel@tonic-gate 271*0Sstevel@tonic-gate char *auth2_read_banner(void); 272*0Sstevel@tonic-gate 273*0Sstevel@tonic-gate void privsep_challenge_enable(void); 274*0Sstevel@tonic-gate 275*0Sstevel@tonic-gate void auth2_challenge(Authctxt *, char *); 276*0Sstevel@tonic-gate void auth2_challenge_abandon(Authctxt *); 277*0Sstevel@tonic-gate int bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **); 278*0Sstevel@tonic-gate int bsdauth_respond(void *, u_int, char **); 279*0Sstevel@tonic-gate int skey_query(void *, char **, char **, u_int *, char ***, u_int **); 280*0Sstevel@tonic-gate int skey_respond(void *, u_int, char **); 281*0Sstevel@tonic-gate 282*0Sstevel@tonic-gate struct passwd * getpwnamallow(const char *user); 283*0Sstevel@tonic-gate 284*0Sstevel@tonic-gate char *get_challenge(Authctxt *); 285*0Sstevel@tonic-gate int verify_response(Authctxt *, const char *); 286*0Sstevel@tonic-gate 287*0Sstevel@tonic-gate struct passwd * auth_get_user(void); 288*0Sstevel@tonic-gate 289*0Sstevel@tonic-gate char *authorized_keys_file(struct passwd *); 290*0Sstevel@tonic-gate char *authorized_keys_file2(struct passwd *); 291*0Sstevel@tonic-gate 292*0Sstevel@tonic-gate int 293*0Sstevel@tonic-gate secure_filename(FILE *, const char *, struct passwd *, char *, size_t); 294*0Sstevel@tonic-gate 295*0Sstevel@tonic-gate HostStatus 296*0Sstevel@tonic-gate check_key_in_hostfiles(struct passwd *, Key *, const char *, 297*0Sstevel@tonic-gate const char *, const char *); 298*0Sstevel@tonic-gate 299*0Sstevel@tonic-gate /* hostkey handling */ 300*0Sstevel@tonic-gate #ifndef lint 301*0Sstevel@tonic-gate Key *get_hostkey_by_index(int); 302*0Sstevel@tonic-gate Key *get_hostkey_by_type(int); 303*0Sstevel@tonic-gate int get_hostkey_index(Key *); 304*0Sstevel@tonic-gate #endif /* lint */ 305*0Sstevel@tonic-gate int ssh1_session_key(BIGNUM *); 306*0Sstevel@tonic-gate 307*0Sstevel@tonic-gate /* debug messages during authentication */ 308*0Sstevel@tonic-gate void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2))); 309*0Sstevel@tonic-gate void auth_debug_send(void); 310*0Sstevel@tonic-gate void auth_debug_reset(void); 311*0Sstevel@tonic-gate 312*0Sstevel@tonic-gate #define AUTH_FAIL_MAX 6 313*0Sstevel@tonic-gate #define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2) 314*0Sstevel@tonic-gate #define AUTH_FAIL_MSG "Too many authentication failures for %.100s" 315*0Sstevel@tonic-gate 316*0Sstevel@tonic-gate #define SKEY_PROMPT "\nS/Key Password: " 317*0Sstevel@tonic-gate 318*0Sstevel@tonic-gate #ifdef __cplusplus 319*0Sstevel@tonic-gate } 320*0Sstevel@tonic-gate #endif 321*0Sstevel@tonic-gate 322*0Sstevel@tonic-gate #endif /* _AUTH_H */ 323