1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate  * CDDL HEADER START
3*0Sstevel@tonic-gate  *
4*0Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate  * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate  * (the "License").  You may not use this file except in compliance
7*0Sstevel@tonic-gate  * with the License.
8*0Sstevel@tonic-gate  *
9*0Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate  * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate  * and limitations under the License.
13*0Sstevel@tonic-gate  *
14*0Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate  *
20*0Sstevel@tonic-gate  * CDDL HEADER END
21*0Sstevel@tonic-gate  */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
24*0Sstevel@tonic-gate  * Use is subject to license terms.
25*0Sstevel@tonic-gate  */
26*0Sstevel@tonic-gate 
27*0Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
28*0Sstevel@tonic-gate 
29*0Sstevel@tonic-gate #include <security/pam_appl.h>
30*0Sstevel@tonic-gate #include <pwd.h>
31*0Sstevel@tonic-gate #include <string.h>
32*0Sstevel@tonic-gate #include <stdlib.h>
33*0Sstevel@tonic-gate #include <malloc.h>
34*0Sstevel@tonic-gate #include <unistd.h>
35*0Sstevel@tonic-gate #include <ctype.h>
36*0Sstevel@tonic-gate #include <syslog.h>
37*0Sstevel@tonic-gate 
38*0Sstevel@tonic-gate #include "utils.h"
39*0Sstevel@tonic-gate 
40*0Sstevel@tonic-gate extern const char *error_message(long);
41*0Sstevel@tonic-gate 
42*0Sstevel@tonic-gate /* ******************************************************************** */
43*0Sstevel@tonic-gate /*									*/
44*0Sstevel@tonic-gate /* 		Utilities Functions					*/
45*0Sstevel@tonic-gate /*									*/
46*0Sstevel@tonic-gate /* ******************************************************************** */
47*0Sstevel@tonic-gate 
48*0Sstevel@tonic-gate /*
49*0Sstevel@tonic-gate  * get_pw_uid():
50*0Sstevel@tonic-gate  *	To get the uid from the passwd entry for specified user
51*0Sstevel@tonic-gate  *	It returns 0 if the user can't be found, otherwise returns 1.
52*0Sstevel@tonic-gate  */
53*0Sstevel@tonic-gate int
54*0Sstevel@tonic-gate get_pw_uid(char *user, uid_t *uid)
55*0Sstevel@tonic-gate {
56*0Sstevel@tonic-gate 	struct passwd sp;
57*0Sstevel@tonic-gate 	char buffer[1024];
58*0Sstevel@tonic-gate 
59*0Sstevel@tonic-gate 	if (getpwnam_r(user, &sp, buffer, sizeof (buffer)) == NULL) {
60*0Sstevel@tonic-gate 		return (0);
61*0Sstevel@tonic-gate 	}
62*0Sstevel@tonic-gate 
63*0Sstevel@tonic-gate 	*uid = sp.pw_uid;
64*0Sstevel@tonic-gate 
65*0Sstevel@tonic-gate 	return (1);
66*0Sstevel@tonic-gate }
67*0Sstevel@tonic-gate 
68*0Sstevel@tonic-gate /*
69*0Sstevel@tonic-gate  * get_pw_gid():
70*0Sstevel@tonic-gate  *	To get the gid from the passwd entry for specified user
71*0Sstevel@tonic-gate  *	It returns 0 if the user can't be found, otherwise returns 1.
72*0Sstevel@tonic-gate  */
73*0Sstevel@tonic-gate int
74*0Sstevel@tonic-gate get_pw_gid(char *user, gid_t *gid)
75*0Sstevel@tonic-gate {
76*0Sstevel@tonic-gate 	struct passwd sp;
77*0Sstevel@tonic-gate 	char buffer[1024];
78*0Sstevel@tonic-gate 
79*0Sstevel@tonic-gate 	if (getpwnam_r(user, &sp, buffer, sizeof (buffer)) == NULL) {
80*0Sstevel@tonic-gate 		return (0);
81*0Sstevel@tonic-gate 	}
82*0Sstevel@tonic-gate 
83*0Sstevel@tonic-gate 	*gid = sp.pw_gid;
84*0Sstevel@tonic-gate 
85*0Sstevel@tonic-gate 	return (1);
86*0Sstevel@tonic-gate }
87*0Sstevel@tonic-gate 
88*0Sstevel@tonic-gate 
89*0Sstevel@tonic-gate /*
90*0Sstevel@tonic-gate  * get_kmd_kuser():
91*0Sstevel@tonic-gate  *	To get the kerberos user name for the specified user.
92*0Sstevel@tonic-gate  *	Assumes that the kuser string is allocated.  It will be
93*0Sstevel@tonic-gate  *	overwritten.  This saves us having to deal will allocating
94*0Sstevel@tonic-gate  *	and freeing the kuser string.
95*0Sstevel@tonic-gate  *
96*0Sstevel@tonic-gate  * RFC 1510 does not mention how to handle mixed case domainnames
97*0Sstevel@tonic-gate  * while constructing client principals. So we will follow the same
98*0Sstevel@tonic-gate  * procedure as for server principals and lowercase the domainname.
99*0Sstevel@tonic-gate  *
100*0Sstevel@tonic-gate  * Returns:
101*0Sstevel@tonic-gate  *	PAM_AUTH_ERR	- if local host name is not found
102*0Sstevel@tonic-gate  *	PAM_BUF_ERR	- if there is an error from krb5_sname_to_principal(),
103*0Sstevel@tonic-gate  *			  or krb5_unparse_name()
104*0Sstevel@tonic-gate  *	0		- if there was no error
105*0Sstevel@tonic-gate  */
106*0Sstevel@tonic-gate int
107*0Sstevel@tonic-gate get_kmd_kuser(krb5_context kcontext, const char *user, char *kuser, int length)
108*0Sstevel@tonic-gate {
109*0Sstevel@tonic-gate 	if (strcmp(user, ROOT_UNAME) == 0) {
110*0Sstevel@tonic-gate 		krb5_principal princ;
111*0Sstevel@tonic-gate 		char *name, *princname, *lasts;
112*0Sstevel@tonic-gate 
113*0Sstevel@tonic-gate 		if (krb5_sname_to_principal(kcontext, NULL, ROOT_UNAME,
114*0Sstevel@tonic-gate 			KRB5_NT_SRV_HST, &princ)) {
115*0Sstevel@tonic-gate 			return (PAM_BUF_ERR);
116*0Sstevel@tonic-gate 		}
117*0Sstevel@tonic-gate 		if (krb5_unparse_name(kcontext, princ, &princname)) {
118*0Sstevel@tonic-gate 			krb5_free_principal(kcontext, princ);
119*0Sstevel@tonic-gate 			return (PAM_BUF_ERR);
120*0Sstevel@tonic-gate 		}
121*0Sstevel@tonic-gate 		/* just interested in princ name before the @REALM part */
122*0Sstevel@tonic-gate 		if ((name = strtok_r(princname, "@", &lasts)) == NULL) {
123*0Sstevel@tonic-gate 			krb5_free_principal(kcontext, princ);
124*0Sstevel@tonic-gate 			free(princname);
125*0Sstevel@tonic-gate 			return (PAM_BUF_ERR);
126*0Sstevel@tonic-gate 		}
127*0Sstevel@tonic-gate 		if (strlcpy(kuser, name, length) >= length) {
128*0Sstevel@tonic-gate 			krb5_free_principal(kcontext, princ);
129*0Sstevel@tonic-gate 			free(princname);
130*0Sstevel@tonic-gate 			return (PAM_BUF_ERR);
131*0Sstevel@tonic-gate 		}
132*0Sstevel@tonic-gate 		krb5_free_principal(kcontext, princ);
133*0Sstevel@tonic-gate 		free(princname);
134*0Sstevel@tonic-gate 	} else {
135*0Sstevel@tonic-gate 		if (strlcpy(kuser, user, length) >= length) {
136*0Sstevel@tonic-gate 			return (PAM_BUF_ERR);
137*0Sstevel@tonic-gate 		}
138*0Sstevel@tonic-gate 	}
139*0Sstevel@tonic-gate 	return (0);
140*0Sstevel@tonic-gate }
141*0Sstevel@tonic-gate 
142*0Sstevel@tonic-gate /*
143*0Sstevel@tonic-gate  * return true (1) if the user's key is in the (default) keytab
144*0Sstevel@tonic-gate  */
145*0Sstevel@tonic-gate int
146*0Sstevel@tonic-gate key_in_keytab(const char *user, int debug)
147*0Sstevel@tonic-gate {
148*0Sstevel@tonic-gate 	krb5_keytab kt_handle;
149*0Sstevel@tonic-gate 	krb5_keytab_entry kt_ent;
150*0Sstevel@tonic-gate 	char *whoami = "key_in_keytab";
151*0Sstevel@tonic-gate 	krb5_error_code retval = 0;
152*0Sstevel@tonic-gate 	krb5_error_code code = 0;
153*0Sstevel@tonic-gate 	krb5_context kcontext = NULL;
154*0Sstevel@tonic-gate 	krb5_principal	princ = NULL;
155*0Sstevel@tonic-gate 	char		kuser[2*MAXHOSTNAMELEN];
156*0Sstevel@tonic-gate 
157*0Sstevel@tonic-gate 
158*0Sstevel@tonic-gate 	if (debug)
159*0Sstevel@tonic-gate 		syslog(LOG_DEBUG,
160*0Sstevel@tonic-gate 		    "PAM-KRB5 (%s): start for user '%s'",
161*0Sstevel@tonic-gate 				    whoami, user ? user : "<null>");
162*0Sstevel@tonic-gate 
163*0Sstevel@tonic-gate 	if (!user)
164*0Sstevel@tonic-gate 		return (retval);
165*0Sstevel@tonic-gate 
166*0Sstevel@tonic-gate 	/* need to free context with krb5_free_context */
167*0Sstevel@tonic-gate 	if (code = krb5_init_context(&kcontext)) {
168*0Sstevel@tonic-gate 		if (debug)
169*0Sstevel@tonic-gate 			syslog(LOG_DEBUG,
170*0Sstevel@tonic-gate 			    "PAM-KRB5 (%s): Error initializing "
171*0Sstevel@tonic-gate 			    "krb5: %s", whoami,
172*0Sstevel@tonic-gate 			    error_message(code));
173*0Sstevel@tonic-gate 		return (retval);
174*0Sstevel@tonic-gate 	}
175*0Sstevel@tonic-gate 
176*0Sstevel@tonic-gate 	if ((code = get_kmd_kuser(kcontext, (const char *)user, kuser,
177*0Sstevel@tonic-gate 		2*MAXHOSTNAMELEN)) != 0) {
178*0Sstevel@tonic-gate 		goto out;
179*0Sstevel@tonic-gate 	}
180*0Sstevel@tonic-gate 
181*0Sstevel@tonic-gate 	/* need to free princ with krb5_free_principal */
182*0Sstevel@tonic-gate 	if ((code = krb5_parse_name(kcontext, kuser, &princ)) != 0) {
183*0Sstevel@tonic-gate 		if (debug)
184*0Sstevel@tonic-gate 			syslog(LOG_DEBUG,
185*0Sstevel@tonic-gate 			    "PAM-KRB5 (%s): can't parse name (%s)",
186*0Sstevel@tonic-gate 				    whoami, error_message(code));
187*0Sstevel@tonic-gate 		goto out;
188*0Sstevel@tonic-gate 	}
189*0Sstevel@tonic-gate 
190*0Sstevel@tonic-gate 	/* need to close keytab handle with krb5_kt_close */
191*0Sstevel@tonic-gate 	if ((code = krb5_kt_default(kcontext, &kt_handle))) {
192*0Sstevel@tonic-gate 		if (debug)
193*0Sstevel@tonic-gate 			syslog(LOG_DEBUG,
194*0Sstevel@tonic-gate 			    "PAM-KRB5 (%s): krb5_kt_default failed (%s)",
195*0Sstevel@tonic-gate 			    whoami, error_message(code));
196*0Sstevel@tonic-gate 		goto out;
197*0Sstevel@tonic-gate 	}
198*0Sstevel@tonic-gate 
199*0Sstevel@tonic-gate 	code = krb5_kt_get_entry(kcontext, kt_handle, princ, 0, 0, &kt_ent);
200*0Sstevel@tonic-gate 	if (code != 0) {
201*0Sstevel@tonic-gate 		if (code == ENOENT) {
202*0Sstevel@tonic-gate 				if (debug)
203*0Sstevel@tonic-gate 					syslog(LOG_DEBUG,
204*0Sstevel@tonic-gate 					    "PAM-KRB5 (%s): "
205*0Sstevel@tonic-gate 					    "Keytab does not exist",
206*0Sstevel@tonic-gate 					    whoami);
207*0Sstevel@tonic-gate 		} else if (code == KRB5_KT_NOTFOUND) {
208*0Sstevel@tonic-gate 				if (debug)
209*0Sstevel@tonic-gate 					syslog(LOG_DEBUG,
210*0Sstevel@tonic-gate 					    "PAM-KRB5 (%s): "
211*0Sstevel@tonic-gate 					    "No entry for principal "
212*0Sstevel@tonic-gate 					    "'%s' exists in keytab",
213*0Sstevel@tonic-gate 					    whoami, kuser);
214*0Sstevel@tonic-gate 		} else {
215*0Sstevel@tonic-gate 				if (debug)
216*0Sstevel@tonic-gate 					syslog(LOG_DEBUG,
217*0Sstevel@tonic-gate 					    "PAM-KRB5 (%s): "
218*0Sstevel@tonic-gate 					    "krb5_kt_get_entry failed (%s)",
219*0Sstevel@tonic-gate 					    whoami, error_message(code));
220*0Sstevel@tonic-gate 		}
221*0Sstevel@tonic-gate 	} else { /* Key found in keytab, return success */
222*0Sstevel@tonic-gate 			(void) krb5_kt_free_entry(kcontext, &kt_ent);
223*0Sstevel@tonic-gate 			if (debug)
224*0Sstevel@tonic-gate 				syslog(LOG_DEBUG,
225*0Sstevel@tonic-gate 				    "PAM-KRB5 (%s): "
226*0Sstevel@tonic-gate 				    "keytab entry for '%s' found",
227*0Sstevel@tonic-gate 				    whoami, user);
228*0Sstevel@tonic-gate 			retval = 1;
229*0Sstevel@tonic-gate 	}
230*0Sstevel@tonic-gate 
231*0Sstevel@tonic-gate 	(void) krb5_kt_close(kcontext, kt_handle);
232*0Sstevel@tonic-gate out:
233*0Sstevel@tonic-gate 	if (princ && kcontext)
234*0Sstevel@tonic-gate 		krb5_free_principal(kcontext, princ);
235*0Sstevel@tonic-gate 
236*0Sstevel@tonic-gate 	if (kcontext)
237*0Sstevel@tonic-gate 		krb5_free_context(kcontext);
238*0Sstevel@tonic-gate 
239*0Sstevel@tonic-gate 	return (retval);
240*0Sstevel@tonic-gate }
241