1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate #include <security/pam_appl.h> 30*0Sstevel@tonic-gate #include <pwd.h> 31*0Sstevel@tonic-gate #include <string.h> 32*0Sstevel@tonic-gate #include <stdlib.h> 33*0Sstevel@tonic-gate #include <malloc.h> 34*0Sstevel@tonic-gate #include <unistd.h> 35*0Sstevel@tonic-gate #include <ctype.h> 36*0Sstevel@tonic-gate #include <syslog.h> 37*0Sstevel@tonic-gate 38*0Sstevel@tonic-gate #include "utils.h" 39*0Sstevel@tonic-gate 40*0Sstevel@tonic-gate extern const char *error_message(long); 41*0Sstevel@tonic-gate 42*0Sstevel@tonic-gate /* ******************************************************************** */ 43*0Sstevel@tonic-gate /* */ 44*0Sstevel@tonic-gate /* Utilities Functions */ 45*0Sstevel@tonic-gate /* */ 46*0Sstevel@tonic-gate /* ******************************************************************** */ 47*0Sstevel@tonic-gate 48*0Sstevel@tonic-gate /* 49*0Sstevel@tonic-gate * get_pw_uid(): 50*0Sstevel@tonic-gate * To get the uid from the passwd entry for specified user 51*0Sstevel@tonic-gate * It returns 0 if the user can't be found, otherwise returns 1. 52*0Sstevel@tonic-gate */ 53*0Sstevel@tonic-gate int 54*0Sstevel@tonic-gate get_pw_uid(char *user, uid_t *uid) 55*0Sstevel@tonic-gate { 56*0Sstevel@tonic-gate struct passwd sp; 57*0Sstevel@tonic-gate char buffer[1024]; 58*0Sstevel@tonic-gate 59*0Sstevel@tonic-gate if (getpwnam_r(user, &sp, buffer, sizeof (buffer)) == NULL) { 60*0Sstevel@tonic-gate return (0); 61*0Sstevel@tonic-gate } 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate *uid = sp.pw_uid; 64*0Sstevel@tonic-gate 65*0Sstevel@tonic-gate return (1); 66*0Sstevel@tonic-gate } 67*0Sstevel@tonic-gate 68*0Sstevel@tonic-gate /* 69*0Sstevel@tonic-gate * get_pw_gid(): 70*0Sstevel@tonic-gate * To get the gid from the passwd entry for specified user 71*0Sstevel@tonic-gate * It returns 0 if the user can't be found, otherwise returns 1. 72*0Sstevel@tonic-gate */ 73*0Sstevel@tonic-gate int 74*0Sstevel@tonic-gate get_pw_gid(char *user, gid_t *gid) 75*0Sstevel@tonic-gate { 76*0Sstevel@tonic-gate struct passwd sp; 77*0Sstevel@tonic-gate char buffer[1024]; 78*0Sstevel@tonic-gate 79*0Sstevel@tonic-gate if (getpwnam_r(user, &sp, buffer, sizeof (buffer)) == NULL) { 80*0Sstevel@tonic-gate return (0); 81*0Sstevel@tonic-gate } 82*0Sstevel@tonic-gate 83*0Sstevel@tonic-gate *gid = sp.pw_gid; 84*0Sstevel@tonic-gate 85*0Sstevel@tonic-gate return (1); 86*0Sstevel@tonic-gate } 87*0Sstevel@tonic-gate 88*0Sstevel@tonic-gate 89*0Sstevel@tonic-gate /* 90*0Sstevel@tonic-gate * get_kmd_kuser(): 91*0Sstevel@tonic-gate * To get the kerberos user name for the specified user. 92*0Sstevel@tonic-gate * Assumes that the kuser string is allocated. It will be 93*0Sstevel@tonic-gate * overwritten. This saves us having to deal will allocating 94*0Sstevel@tonic-gate * and freeing the kuser string. 95*0Sstevel@tonic-gate * 96*0Sstevel@tonic-gate * RFC 1510 does not mention how to handle mixed case domainnames 97*0Sstevel@tonic-gate * while constructing client principals. So we will follow the same 98*0Sstevel@tonic-gate * procedure as for server principals and lowercase the domainname. 99*0Sstevel@tonic-gate * 100*0Sstevel@tonic-gate * Returns: 101*0Sstevel@tonic-gate * PAM_AUTH_ERR - if local host name is not found 102*0Sstevel@tonic-gate * PAM_BUF_ERR - if there is an error from krb5_sname_to_principal(), 103*0Sstevel@tonic-gate * or krb5_unparse_name() 104*0Sstevel@tonic-gate * 0 - if there was no error 105*0Sstevel@tonic-gate */ 106*0Sstevel@tonic-gate int 107*0Sstevel@tonic-gate get_kmd_kuser(krb5_context kcontext, const char *user, char *kuser, int length) 108*0Sstevel@tonic-gate { 109*0Sstevel@tonic-gate if (strcmp(user, ROOT_UNAME) == 0) { 110*0Sstevel@tonic-gate krb5_principal princ; 111*0Sstevel@tonic-gate char *name, *princname, *lasts; 112*0Sstevel@tonic-gate 113*0Sstevel@tonic-gate if (krb5_sname_to_principal(kcontext, NULL, ROOT_UNAME, 114*0Sstevel@tonic-gate KRB5_NT_SRV_HST, &princ)) { 115*0Sstevel@tonic-gate return (PAM_BUF_ERR); 116*0Sstevel@tonic-gate } 117*0Sstevel@tonic-gate if (krb5_unparse_name(kcontext, princ, &princname)) { 118*0Sstevel@tonic-gate krb5_free_principal(kcontext, princ); 119*0Sstevel@tonic-gate return (PAM_BUF_ERR); 120*0Sstevel@tonic-gate } 121*0Sstevel@tonic-gate /* just interested in princ name before the @REALM part */ 122*0Sstevel@tonic-gate if ((name = strtok_r(princname, "@", &lasts)) == NULL) { 123*0Sstevel@tonic-gate krb5_free_principal(kcontext, princ); 124*0Sstevel@tonic-gate free(princname); 125*0Sstevel@tonic-gate return (PAM_BUF_ERR); 126*0Sstevel@tonic-gate } 127*0Sstevel@tonic-gate if (strlcpy(kuser, name, length) >= length) { 128*0Sstevel@tonic-gate krb5_free_principal(kcontext, princ); 129*0Sstevel@tonic-gate free(princname); 130*0Sstevel@tonic-gate return (PAM_BUF_ERR); 131*0Sstevel@tonic-gate } 132*0Sstevel@tonic-gate krb5_free_principal(kcontext, princ); 133*0Sstevel@tonic-gate free(princname); 134*0Sstevel@tonic-gate } else { 135*0Sstevel@tonic-gate if (strlcpy(kuser, user, length) >= length) { 136*0Sstevel@tonic-gate return (PAM_BUF_ERR); 137*0Sstevel@tonic-gate } 138*0Sstevel@tonic-gate } 139*0Sstevel@tonic-gate return (0); 140*0Sstevel@tonic-gate } 141*0Sstevel@tonic-gate 142*0Sstevel@tonic-gate /* 143*0Sstevel@tonic-gate * return true (1) if the user's key is in the (default) keytab 144*0Sstevel@tonic-gate */ 145*0Sstevel@tonic-gate int 146*0Sstevel@tonic-gate key_in_keytab(const char *user, int debug) 147*0Sstevel@tonic-gate { 148*0Sstevel@tonic-gate krb5_keytab kt_handle; 149*0Sstevel@tonic-gate krb5_keytab_entry kt_ent; 150*0Sstevel@tonic-gate char *whoami = "key_in_keytab"; 151*0Sstevel@tonic-gate krb5_error_code retval = 0; 152*0Sstevel@tonic-gate krb5_error_code code = 0; 153*0Sstevel@tonic-gate krb5_context kcontext = NULL; 154*0Sstevel@tonic-gate krb5_principal princ = NULL; 155*0Sstevel@tonic-gate char kuser[2*MAXHOSTNAMELEN]; 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate 158*0Sstevel@tonic-gate if (debug) 159*0Sstevel@tonic-gate syslog(LOG_DEBUG, 160*0Sstevel@tonic-gate "PAM-KRB5 (%s): start for user '%s'", 161*0Sstevel@tonic-gate whoami, user ? user : "<null>"); 162*0Sstevel@tonic-gate 163*0Sstevel@tonic-gate if (!user) 164*0Sstevel@tonic-gate return (retval); 165*0Sstevel@tonic-gate 166*0Sstevel@tonic-gate /* need to free context with krb5_free_context */ 167*0Sstevel@tonic-gate if (code = krb5_init_context(&kcontext)) { 168*0Sstevel@tonic-gate if (debug) 169*0Sstevel@tonic-gate syslog(LOG_DEBUG, 170*0Sstevel@tonic-gate "PAM-KRB5 (%s): Error initializing " 171*0Sstevel@tonic-gate "krb5: %s", whoami, 172*0Sstevel@tonic-gate error_message(code)); 173*0Sstevel@tonic-gate return (retval); 174*0Sstevel@tonic-gate } 175*0Sstevel@tonic-gate 176*0Sstevel@tonic-gate if ((code = get_kmd_kuser(kcontext, (const char *)user, kuser, 177*0Sstevel@tonic-gate 2*MAXHOSTNAMELEN)) != 0) { 178*0Sstevel@tonic-gate goto out; 179*0Sstevel@tonic-gate } 180*0Sstevel@tonic-gate 181*0Sstevel@tonic-gate /* need to free princ with krb5_free_principal */ 182*0Sstevel@tonic-gate if ((code = krb5_parse_name(kcontext, kuser, &princ)) != 0) { 183*0Sstevel@tonic-gate if (debug) 184*0Sstevel@tonic-gate syslog(LOG_DEBUG, 185*0Sstevel@tonic-gate "PAM-KRB5 (%s): can't parse name (%s)", 186*0Sstevel@tonic-gate whoami, error_message(code)); 187*0Sstevel@tonic-gate goto out; 188*0Sstevel@tonic-gate } 189*0Sstevel@tonic-gate 190*0Sstevel@tonic-gate /* need to close keytab handle with krb5_kt_close */ 191*0Sstevel@tonic-gate if ((code = krb5_kt_default(kcontext, &kt_handle))) { 192*0Sstevel@tonic-gate if (debug) 193*0Sstevel@tonic-gate syslog(LOG_DEBUG, 194*0Sstevel@tonic-gate "PAM-KRB5 (%s): krb5_kt_default failed (%s)", 195*0Sstevel@tonic-gate whoami, error_message(code)); 196*0Sstevel@tonic-gate goto out; 197*0Sstevel@tonic-gate } 198*0Sstevel@tonic-gate 199*0Sstevel@tonic-gate code = krb5_kt_get_entry(kcontext, kt_handle, princ, 0, 0, &kt_ent); 200*0Sstevel@tonic-gate if (code != 0) { 201*0Sstevel@tonic-gate if (code == ENOENT) { 202*0Sstevel@tonic-gate if (debug) 203*0Sstevel@tonic-gate syslog(LOG_DEBUG, 204*0Sstevel@tonic-gate "PAM-KRB5 (%s): " 205*0Sstevel@tonic-gate "Keytab does not exist", 206*0Sstevel@tonic-gate whoami); 207*0Sstevel@tonic-gate } else if (code == KRB5_KT_NOTFOUND) { 208*0Sstevel@tonic-gate if (debug) 209*0Sstevel@tonic-gate syslog(LOG_DEBUG, 210*0Sstevel@tonic-gate "PAM-KRB5 (%s): " 211*0Sstevel@tonic-gate "No entry for principal " 212*0Sstevel@tonic-gate "'%s' exists in keytab", 213*0Sstevel@tonic-gate whoami, kuser); 214*0Sstevel@tonic-gate } else { 215*0Sstevel@tonic-gate if (debug) 216*0Sstevel@tonic-gate syslog(LOG_DEBUG, 217*0Sstevel@tonic-gate "PAM-KRB5 (%s): " 218*0Sstevel@tonic-gate "krb5_kt_get_entry failed (%s)", 219*0Sstevel@tonic-gate whoami, error_message(code)); 220*0Sstevel@tonic-gate } 221*0Sstevel@tonic-gate } else { /* Key found in keytab, return success */ 222*0Sstevel@tonic-gate (void) krb5_kt_free_entry(kcontext, &kt_ent); 223*0Sstevel@tonic-gate if (debug) 224*0Sstevel@tonic-gate syslog(LOG_DEBUG, 225*0Sstevel@tonic-gate "PAM-KRB5 (%s): " 226*0Sstevel@tonic-gate "keytab entry for '%s' found", 227*0Sstevel@tonic-gate whoami, user); 228*0Sstevel@tonic-gate retval = 1; 229*0Sstevel@tonic-gate } 230*0Sstevel@tonic-gate 231*0Sstevel@tonic-gate (void) krb5_kt_close(kcontext, kt_handle); 232*0Sstevel@tonic-gate out: 233*0Sstevel@tonic-gate if (princ && kcontext) 234*0Sstevel@tonic-gate krb5_free_principal(kcontext, princ); 235*0Sstevel@tonic-gate 236*0Sstevel@tonic-gate if (kcontext) 237*0Sstevel@tonic-gate krb5_free_context(kcontext); 238*0Sstevel@tonic-gate 239*0Sstevel@tonic-gate return (retval); 240*0Sstevel@tonic-gate } 241