1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * CDDL HEADER START
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only
6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance
7*0Sstevel@tonic-gate * with the License.
8*0Sstevel@tonic-gate *
9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
11*0Sstevel@tonic-gate * See the License for the specific language governing permissions
12*0Sstevel@tonic-gate * and limitations under the License.
13*0Sstevel@tonic-gate *
14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * CDDL HEADER END
21*0Sstevel@tonic-gate */
22*0Sstevel@tonic-gate /*
23*0Sstevel@tonic-gate * Copyright 2003 Sun Microsystems, Inc. All rights reserved.
24*0Sstevel@tonic-gate * Use is subject to license terms.
25*0Sstevel@tonic-gate */
26*0Sstevel@tonic-gate
27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
28*0Sstevel@tonic-gate
29*0Sstevel@tonic-gate #include <security/pam_appl.h>
30*0Sstevel@tonic-gate #include <security/pam_modules.h>
31*0Sstevel@tonic-gate #include <string.h>
32*0Sstevel@tonic-gate #include <stdio.h>
33*0Sstevel@tonic-gate #include <stdlib.h>
34*0Sstevel@tonic-gate #include <sys/types.h>
35*0Sstevel@tonic-gate #include <pwd.h>
36*0Sstevel@tonic-gate #include <syslog.h>
37*0Sstevel@tonic-gate #include <libintl.h>
38*0Sstevel@tonic-gate
39*0Sstevel@tonic-gate #include "sample_utils.h"
40*0Sstevel@tonic-gate
41*0Sstevel@tonic-gate /*
42*0Sstevel@tonic-gate *
43*0Sstevel@tonic-gate * Sample module for pam_sm_authenticate.
44*0Sstevel@tonic-gate *
45*0Sstevel@tonic-gate * options -
46*0Sstevel@tonic-gate *
47*0Sstevel@tonic-gate * debug
48*0Sstevel@tonic-gate * use_first_pass
49*0Sstevel@tonic-gate * try_first_pass
50*0Sstevel@tonic-gate * first_pass_good (first password is always good when used with use/try)
51*0Sstevel@tonic-gate * first_pass_bad (first password is always bad when used with use/try)
52*0Sstevel@tonic-gate * pass=foobar (set good password to "foobar". default good password
53*0Sstevel@tonic-gate * is test)
54*0Sstevel@tonic-gate * always_fail always return PAM_AUTH_ERR
55*0Sstevel@tonic-gate * always_succeed always return PAM_SUCCESS
56*0Sstevel@tonic-gate * always_ignore
57*0Sstevel@tonic-gate *
58*0Sstevel@tonic-gate *
59*0Sstevel@tonic-gate */
60*0Sstevel@tonic-gate
61*0Sstevel@tonic-gate /*
62*0Sstevel@tonic-gate * pam_sm_authenticate - Authenticate user
63*0Sstevel@tonic-gate */
64*0Sstevel@tonic-gate /*ARGSUSED*/
65*0Sstevel@tonic-gate int
pam_sm_authenticate(pam_handle_t * pamh,int flags,int argc,const char ** argv)66*0Sstevel@tonic-gate pam_sm_authenticate(
67*0Sstevel@tonic-gate pam_handle_t *pamh,
68*0Sstevel@tonic-gate int flags,
69*0Sstevel@tonic-gate int argc,
70*0Sstevel@tonic-gate const char **argv)
71*0Sstevel@tonic-gate {
72*0Sstevel@tonic-gate char *user;
73*0Sstevel@tonic-gate struct pam_conv *pam_convp;
74*0Sstevel@tonic-gate int err, result = PAM_AUTH_ERR;
75*0Sstevel@tonic-gate struct pam_response *ret_resp = (struct pam_response *)0;
76*0Sstevel@tonic-gate char messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
77*0Sstevel@tonic-gate int debug = 0;
78*0Sstevel@tonic-gate int try_first_pass = 0;
79*0Sstevel@tonic-gate int use_first_pass = 0;
80*0Sstevel@tonic-gate int first_pass_good = 0;
81*0Sstevel@tonic-gate int first_pass_bad = 0;
82*0Sstevel@tonic-gate int i, num_msg;
83*0Sstevel@tonic-gate char *firstpass, *password;
84*0Sstevel@tonic-gate char the_password[64];
85*0Sstevel@tonic-gate
86*0Sstevel@tonic-gate if (debug)
87*0Sstevel@tonic-gate syslog(LOG_DEBUG, "Sample Authentication\n");
88*0Sstevel@tonic-gate
89*0Sstevel@tonic-gate (void) strcpy(the_password, "test");
90*0Sstevel@tonic-gate
91*0Sstevel@tonic-gate for (i = 0; i < argc; i++) {
92*0Sstevel@tonic-gate if (strcmp(argv[i], "debug") == 0)
93*0Sstevel@tonic-gate debug = 1;
94*0Sstevel@tonic-gate else if (strcmp(argv[i], "try_first_pass") == 0)
95*0Sstevel@tonic-gate try_first_pass = 1;
96*0Sstevel@tonic-gate else if (strcmp(argv[i], "first_pass_good") == 0)
97*0Sstevel@tonic-gate first_pass_good = 1;
98*0Sstevel@tonic-gate else if (strcmp(argv[i], "first_pass_bad") == 0)
99*0Sstevel@tonic-gate first_pass_bad = 1;
100*0Sstevel@tonic-gate else if (strcmp(argv[i], "use_first_pass") == 0)
101*0Sstevel@tonic-gate use_first_pass = 1;
102*0Sstevel@tonic-gate else if (strcmp(argv[i], "always_fail") == 0)
103*0Sstevel@tonic-gate return (PAM_AUTH_ERR);
104*0Sstevel@tonic-gate else if (strcmp(argv[i], "always_succeed") == 0)
105*0Sstevel@tonic-gate return (PAM_SUCCESS);
106*0Sstevel@tonic-gate else if (strcmp(argv[i], "always_ignore") == 0)
107*0Sstevel@tonic-gate return (PAM_IGNORE);
108*0Sstevel@tonic-gate else if (sscanf(argv[i], "pass=%64s", the_password) == 1) {
109*0Sstevel@tonic-gate /*EMPTY*/;
110*0Sstevel@tonic-gate }
111*0Sstevel@tonic-gate else
112*0Sstevel@tonic-gate syslog(LOG_DEBUG, "illegal scheme option %s", argv[i]);
113*0Sstevel@tonic-gate }
114*0Sstevel@tonic-gate
115*0Sstevel@tonic-gate err = pam_get_user(pamh, &user, NULL);
116*0Sstevel@tonic-gate if (err != PAM_SUCCESS)
117*0Sstevel@tonic-gate return (err);
118*0Sstevel@tonic-gate
119*0Sstevel@tonic-gate err = pam_get_item(pamh, PAM_CONV, (void**) &pam_convp);
120*0Sstevel@tonic-gate if (err != PAM_SUCCESS)
121*0Sstevel@tonic-gate return (err);
122*0Sstevel@tonic-gate
123*0Sstevel@tonic-gate (void) pam_get_item(pamh, PAM_AUTHTOK, (void **) &firstpass);
124*0Sstevel@tonic-gate
125*0Sstevel@tonic-gate if (firstpass && (use_first_pass || try_first_pass)) {
126*0Sstevel@tonic-gate
127*0Sstevel@tonic-gate if ((first_pass_good ||
128*0Sstevel@tonic-gate strncmp(firstpass, the_password,
129*0Sstevel@tonic-gate strlen(the_password)) == 0) &&
130*0Sstevel@tonic-gate !first_pass_bad) {
131*0Sstevel@tonic-gate result = PAM_SUCCESS;
132*0Sstevel@tonic-gate goto out;
133*0Sstevel@tonic-gate }
134*0Sstevel@tonic-gate if (use_first_pass) goto out;
135*0Sstevel@tonic-gate }
136*0Sstevel@tonic-gate
137*0Sstevel@tonic-gate /*
138*0Sstevel@tonic-gate * Get the password from the user
139*0Sstevel@tonic-gate */
140*0Sstevel@tonic-gate if (firstpass) {
141*0Sstevel@tonic-gate (void) snprintf(messages[0], sizeof (messages[0]),
142*0Sstevel@tonic-gate dgettext(TEXT_DOMAIN, "TEST Password: "));
143*0Sstevel@tonic-gate } else {
144*0Sstevel@tonic-gate (void) snprintf(messages[0], sizeof (messages[0]),
145*0Sstevel@tonic-gate dgettext(TEXT_DOMAIN, "Password: "));
146*0Sstevel@tonic-gate }
147*0Sstevel@tonic-gate num_msg = 1;
148*0Sstevel@tonic-gate err = __get_authtok(pam_convp->conv,
149*0Sstevel@tonic-gate num_msg, messages, NULL, &ret_resp);
150*0Sstevel@tonic-gate
151*0Sstevel@tonic-gate if (err != PAM_SUCCESS) {
152*0Sstevel@tonic-gate result = err;
153*0Sstevel@tonic-gate goto out;
154*0Sstevel@tonic-gate }
155*0Sstevel@tonic-gate
156*0Sstevel@tonic-gate password = ret_resp->resp;
157*0Sstevel@tonic-gate
158*0Sstevel@tonic-gate if (password == NULL) {
159*0Sstevel@tonic-gate result = PAM_AUTH_ERR;
160*0Sstevel@tonic-gate goto out;
161*0Sstevel@tonic-gate }
162*0Sstevel@tonic-gate
163*0Sstevel@tonic-gate /* one last ditch attempt to "login" to TEST */
164*0Sstevel@tonic-gate
165*0Sstevel@tonic-gate if (strncmp(password, the_password, strlen(the_password)) == 0) {
166*0Sstevel@tonic-gate result = PAM_SUCCESS;
167*0Sstevel@tonic-gate if (firstpass == NULL) {
168*0Sstevel@tonic-gate /* this is the first password, stash it away */
169*0Sstevel@tonic-gate (void) pam_set_item(pamh, PAM_AUTHTOK, password);
170*0Sstevel@tonic-gate }
171*0Sstevel@tonic-gate }
172*0Sstevel@tonic-gate
173*0Sstevel@tonic-gate out:
174*0Sstevel@tonic-gate if (num_msg > 0) {
175*0Sstevel@tonic-gate if (ret_resp != 0) {
176*0Sstevel@tonic-gate if (ret_resp->resp != 0) {
177*0Sstevel@tonic-gate /* avoid leaving password cleartext around */
178*0Sstevel@tonic-gate (void) memset(ret_resp->resp, 0,
179*0Sstevel@tonic-gate strlen(ret_resp->resp));
180*0Sstevel@tonic-gate }
181*0Sstevel@tonic-gate __free_resp(num_msg, ret_resp);
182*0Sstevel@tonic-gate ret_resp = 0;
183*0Sstevel@tonic-gate }
184*0Sstevel@tonic-gate }
185*0Sstevel@tonic-gate
186*0Sstevel@tonic-gate return (result);
187*0Sstevel@tonic-gate }
188