1 /* $NetBSD: skeyinit.c,v 1.24 2004/11/03 20:10:08 dsl Exp $ */ 2 3 /* S/KEY v1.1b (skeyinit.c) 4 * 5 * Authors: 6 * Neil M. Haller <nmh@thumper.bellcore.com> 7 * Philip R. Karn <karn@chicago.qualcomm.com> 8 * John S. Walden <jsw@thumper.bellcore.com> 9 * Scott Chasin <chasin@crimelab.com> 10 * 11 * Modifications: 12 * Todd C. Miller <Todd.Miller@courtesan.com> 13 * 14 * S/KEY initialization and seed update 15 */ 16 17 #include <sys/cdefs.h> 18 19 #ifndef lint 20 __RCSID("$NetBSD: skeyinit.c,v 1.24 2004/11/03 20:10:08 dsl Exp $"); 21 #endif 22 23 #include <sys/param.h> 24 #include <sys/time.h> 25 #include <sys/resource.h> 26 27 #include <ctype.h> 28 #include <err.h> 29 #include <errno.h> 30 #include <fcntl.h> 31 #include <paths.h> 32 #include <pwd.h> 33 #include <stdio.h> 34 #include <stdlib.h> 35 #include <string.h> 36 #include <time.h> 37 #include <unistd.h> 38 39 #include <skey.h> 40 41 #ifndef SKEY_NAMELEN 42 #define SKEY_NAMELEN 4 43 #endif 44 45 int main __P((int, char **)); 46 47 int main(int argc, char **argv) 48 { 49 int rval, nn, i, l; 50 int n = 0, defaultsetup = 1, zerokey = 0, hexmode = 0; 51 time_t now; 52 char hostname[MAXHOSTNAMELEN + 1]; 53 char seed[SKEY_MAX_PW_LEN+2], key[SKEY_BINKEY_SIZE], defaultseed[SKEY_MAX_SEED_LEN+1]; 54 char passwd[SKEY_MAX_PW_LEN+2], passwd2[SKEY_MAX_PW_LEN+2], tbuf[27], buf[80]; 55 char lastc, me[LOGIN_NAME_MAX+1], *p, *pw, *ht = NULL; 56 const char *salt; 57 struct skey skey; 58 struct passwd *pp; 59 struct tm *tm; 60 int c; 61 62 /* 63 * Make sure using stdin/stdout/stderr is safe 64 * after opening any file. 65 */ 66 i = open(_PATH_DEVNULL, O_RDWR); 67 while (i >= 0 && i < 2) 68 i = dup(i); 69 if (i > 2) 70 close(i); 71 72 if (geteuid() != 0) 73 errx(1, "must be setuid root."); 74 75 if (gethostname(hostname, sizeof(hostname)) < 0) 76 err(1, "gethostname"); 77 78 /* 79 * Copy the hostname into the default seed, eliminating any 80 * non alpha-numeric characters. 81 */ 82 for (i = 0, l = 0; l < sizeof(defaultseed); i++) { 83 if (hostname[i] == '\0') { 84 defaultseed[l] = hostname[i]; 85 break; 86 } 87 if (isalnum((unsigned char)hostname[i])) 88 defaultseed[l++] = hostname[i]; 89 } 90 91 defaultseed[SKEY_NAMELEN] = '\0'; 92 (void)time(&now); 93 (void)snprintf(tbuf, sizeof(tbuf), "%05ld", (long) (now % 100000)); 94 (void)strlcat(defaultseed, tbuf, sizeof(defaultseed)); 95 96 if ((pp = getpwuid(getuid())) == NULL) 97 err(1, "no user with uid %ld", (u_long)getuid()); 98 (void)strlcpy(me, pp->pw_name, sizeof(me)); 99 100 if ((pp = getpwnam(me)) == NULL) 101 err(1, "Who are you?"); 102 salt = pp->pw_passwd; 103 104 while((c = getopt(argc, argv, "n:t:sxz")) != -1) { 105 switch(c) { 106 case 'n': 107 n = atoi(optarg); 108 if(n < 1 || n > SKEY_MAX_SEQ) 109 errx(1, "count must be between 1 and %d", SKEY_MAX_SEQ); 110 break; 111 case 't': 112 if(skey_set_algorithm(optarg) == NULL) 113 errx(1, "Unknown hash algorithm %s", optarg); 114 ht = optarg; 115 break; 116 case 's': 117 defaultsetup = 0; 118 break; 119 case 'x': 120 hexmode = 1; 121 break; 122 case 'z': 123 zerokey = 1; 124 break; 125 default: 126 errx(1, "usage: %s [-n count] [-t md4|md5|sha1] [-s] [-x] [-z] [user]", argv[0]); 127 } 128 } 129 130 if(argc > optind) { 131 pp = getpwnam(argv[optind]); 132 if (pp == NULL) 133 errx(1, "User %s unknown", argv[optind]); 134 } 135 136 if (strcmp(pp->pw_name, me) != 0) { 137 if (getuid() != 0) { 138 /* Only root can change other's passwds */ 139 errx(1, "Permission denied."); 140 } 141 } 142 143 if (getuid() != 0) { 144 pw = getpass("Password:"); 145 p = crypt(pw, salt); 146 147 if (strcmp(p, pp->pw_passwd)) { 148 errx(1, "Password incorrect."); 149 } 150 } 151 152 rval = skeylookup(&skey, pp->pw_name); 153 switch (rval) { 154 case -1: 155 err(1, "cannot open database"); 156 case 0: 157 /* comment out user if asked to */ 158 if (zerokey) 159 exit(skeyzero(&skey, pp->pw_name)); 160 161 printf("[Updating %s]\n", pp->pw_name); 162 printf("Old key: [%s] %s\n", skey_get_algorithm(), skey.seed); 163 164 /* 165 * lets be nice if they have a skey.seed that 166 * ends in 0-8 just add one 167 */ 168 l = strlen(skey.seed); 169 if (l > 0) { 170 lastc = skey.seed[l - 1]; 171 if (isdigit((unsigned char)lastc) && lastc != '9') { 172 (void)strlcpy(defaultseed, skey.seed, 173 sizeof(defaultseed)); 174 defaultseed[l - 1] = lastc + 1; 175 } 176 if (isdigit((unsigned char)lastc) && lastc == '9' && 177 l < 16) { 178 (void)strlcpy(defaultseed, skey.seed, 179 sizeof(defaultseed)); 180 defaultseed[l - 1] = '0'; 181 defaultseed[l] = '0'; 182 defaultseed[l + 1] = '\0'; 183 } 184 } 185 break; 186 case 1: 187 if (zerokey) 188 errx(1, "You have no entry to zero."); 189 printf("[Adding %s]\n", pp->pw_name); 190 break; 191 } 192 193 if(n==0) 194 n = 99; 195 196 /* Set hash type if asked to */ 197 if (ht) { 198 /* Need to zero out old key when changing algorithm */ 199 if (strcmp(ht, skey_get_algorithm()) && skey_set_algorithm(ht)) 200 zerokey = 1; 201 } 202 203 if (!defaultsetup) { 204 printf("You need the 6 english words generated from the \"skey\" command.\n"); 205 for (i = 0;; i++) { 206 if (i >= 2) 207 exit(1); 208 printf("Enter sequence count from 1 to %d: ", SKEY_MAX_SEQ); 209 fgets(buf, sizeof(buf), stdin); 210 n = atoi(buf); 211 if (n > 0 && n < SKEY_MAX_SEQ) 212 break; /* Valid range */ 213 printf("\nError: Count must be between 0 and %d\n", SKEY_MAX_SEQ); 214 } 215 216 for (i = 0;; i++) { 217 if (i >= 2) 218 exit(1); 219 220 printf("Enter new seed [default %s]: ", defaultseed); 221 fflush(stdout); 222 fgets(seed, sizeof(seed), stdin); 223 rip(seed); 224 for (p = seed; *p; p++) { 225 if (isalpha((unsigned char)*p)) { 226 *p = tolower((unsigned char)*p); 227 } else if (!isdigit((unsigned char)*p)) { 228 (void)puts("Error: seed may only contain alphanumeric characters"); 229 break; 230 } 231 } 232 if (*p == '\0') 233 break; /* Valid seed */ 234 } 235 if (strlen(seed) > SKEY_MAX_SEED_LEN) { 236 printf("Notice: Seed truncated to %d characters.\n", SKEY_MAX_SEED_LEN); 237 seed[SKEY_MAX_SEED_LEN] = '\0'; 238 } 239 if (seed[0] == '\0') 240 (void)strlcpy(seed, defaultseed, sizeof(seed)); 241 242 for (i = 0;; i++) { 243 if (i >= 2) 244 exit(1); 245 246 printf("otp-%s %d %s\ns/key access password: ", 247 skey_get_algorithm(), n, seed); 248 fgets(buf, sizeof(buf), stdin); 249 rip(buf); 250 backspace(buf); 251 252 if (buf[0] == '?') { 253 puts("Enter 6 English words from secure S/Key calculation."); 254 continue; 255 } else if (buf[0] == '\0') { 256 exit(1); 257 } 258 if (etob(key, buf) == 1 || atob8(key, buf) == 0) 259 break; /* Valid format */ 260 (void)puts("Invalid format - try again with 6 English words."); 261 } 262 } else { 263 /* Get user's secret password */ 264 puts("Reminder - Only use this method if you are directly connected\n" 265 " or have an encrypted channel. If you are using telnet\n" 266 " or rlogin, exit with no password and use skeyinit -s.\n"); 267 268 for (i = 0;; i++) { 269 if (i >= 2) 270 exit(1); 271 272 printf("Enter secret password: "); 273 readpass(passwd, sizeof(passwd)); 274 if (passwd[0] == '\0') 275 exit(1); 276 277 if (strlen(passwd) < SKEY_MIN_PW_LEN) { 278 (void)fprintf(stderr, 279 "Your password must be at least %d characters long.\n", SKEY_MIN_PW_LEN); 280 continue; 281 } else if (strcmp(passwd, pp->pw_name) == 0) { 282 (void)fputs("Your password may not be the same as your user name.\n", stderr); 283 continue; 284 } 285 #if 0 286 else if (strspn(passwd, "abcdefghijklmnopqrstuvwxyz") == strlen(passwd)) { 287 (void)fputs("Your password must contain more than just lower case letters.\n" 288 "Whitespace, numbers, and puctuation are suggested.\n", stderr); 289 continue; 290 } 291 #endif 292 printf("Again secret password: "); 293 readpass(passwd2, sizeof(passwd)); 294 if (passwd2[0] == '\0') 295 exit(1); 296 297 if (strcmp(passwd, passwd2) == 0) 298 break; 299 300 puts("Passwords do not match."); 301 } 302 303 /* Crunch seed and password into starting key */ 304 (void)strlcpy(seed, defaultseed, sizeof(seed)); 305 if (keycrunch(key, seed, passwd) != 0) 306 err(2, "key crunch failed"); 307 nn = n; 308 while (nn-- != 0) 309 f(key); 310 } 311 (void)time(&now); 312 tm = localtime(&now); 313 (void)strftime(tbuf, sizeof(tbuf), " %b %d,%Y %T", tm); 314 315 if ((skey.val = (char *)malloc(16 + 1)) == NULL) 316 err(1, "Can't allocate memory"); 317 318 /* Zero out old key if necessary (entry would change size) */ 319 if (zerokey) { 320 (void)skeyzero(&skey, pp->pw_name); 321 /* Re-open keys file and seek to the end */ 322 if (skeylookup(&skey, pp->pw_name) == -1) 323 err(1, "cannot open database"); 324 } 325 326 btoa8(skey.val, key); 327 328 /* 329 * Obtain an exclusive lock on the key file so we don't 330 * clobber someone authenticating themselves at the same time. 331 */ 332 for (i = 0; i < 300; i++) { 333 if ((rval = flock(fileno(skey.keyfile), LOCK_EX|LOCK_NB)) == 0 334 || errno != EWOULDBLOCK) 335 break; 336 usleep(100000); /* Sleep for 0.1 seconds */ 337 } 338 if (rval == -1) { /* Can't get exclusive lock */ 339 errno = EAGAIN; 340 err(1, "cannot open database"); 341 } 342 343 /* Don't save algorithm type for md4 (keep record length same) */ 344 if (strcmp(skey_get_algorithm(), "md4") == 0) 345 (void)fprintf(skey.keyfile, "%s %04d %-16s %s %-21s\n", 346 pp->pw_name, n, seed, skey.val, tbuf); 347 else 348 (void)fprintf(skey.keyfile, "%s %s %04d %-16s %s %-21s\n", 349 pp->pw_name, skey_get_algorithm(), n, seed, skey.val, tbuf); 350 351 (void)fclose(skey.keyfile); 352 353 (void)printf("\nID %s skey is otp-%s %d %s\n", pp->pw_name, 354 skey_get_algorithm(), n, seed); 355 (void)printf("Next login password: %s\n\n", 356 hexmode ? put8(buf, key) : btoe(buf, key)); 357 358 return(0); 359 } 360