1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * Author: Tatu Ylonen <ylo@cs.hut.fi>
3*0Sstevel@tonic-gate * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4*0Sstevel@tonic-gate * All rights reserved
5*0Sstevel@tonic-gate * Password authentication. This file contains the functions to check whether
6*0Sstevel@tonic-gate * the password is valid for the user.
7*0Sstevel@tonic-gate *
8*0Sstevel@tonic-gate * As far as I am concerned, the code I have written for this software
9*0Sstevel@tonic-gate * can be used freely for any purpose. Any derived versions of this
10*0Sstevel@tonic-gate * software must be clearly marked as such, and if the derived work is
11*0Sstevel@tonic-gate * incompatible with the protocol description in the RFC file, it must be
12*0Sstevel@tonic-gate * called by a name other than "ssh" or "Secure Shell".
13*0Sstevel@tonic-gate *
14*0Sstevel@tonic-gate * Copyright (c) 1999 Dug Song. All rights reserved.
15*0Sstevel@tonic-gate * Copyright (c) 2000 Markus Friedl. All rights reserved.
16*0Sstevel@tonic-gate *
17*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without
18*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions
19*0Sstevel@tonic-gate * are met:
20*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright
21*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer.
22*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright
23*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the
24*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution.
25*0Sstevel@tonic-gate *
26*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27*0Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28*0Sstevel@tonic-gate * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29*0Sstevel@tonic-gate * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30*0Sstevel@tonic-gate * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32*0Sstevel@tonic-gate * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33*0Sstevel@tonic-gate * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34*0Sstevel@tonic-gate * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35*0Sstevel@tonic-gate * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36*0Sstevel@tonic-gate */
37*0Sstevel@tonic-gate
38*0Sstevel@tonic-gate #include "includes.h"
39*0Sstevel@tonic-gate RCSID("$OpenBSD: auth-passwd.c,v 1.27 2002/05/24 16:45:16 stevesk Exp $");
40*0Sstevel@tonic-gate
41*0Sstevel@tonic-gate #include "packet.h"
42*0Sstevel@tonic-gate #include "log.h"
43*0Sstevel@tonic-gate #include "servconf.h"
44*0Sstevel@tonic-gate #include "auth.h"
45*0Sstevel@tonic-gate
46*0Sstevel@tonic-gate #if !defined(USE_PAM) && !defined(HAVE_OSF_SIA)
47*0Sstevel@tonic-gate /* Don't need any of these headers for the PAM or SIA cases */
48*0Sstevel@tonic-gate # ifdef HAVE_CRYPT_H
49*0Sstevel@tonic-gate # include <crypt.h>
50*0Sstevel@tonic-gate # endif
51*0Sstevel@tonic-gate # ifdef WITH_AIXAUTHENTICATE
52*0Sstevel@tonic-gate # include <login.h>
53*0Sstevel@tonic-gate # endif
54*0Sstevel@tonic-gate # ifdef __hpux
55*0Sstevel@tonic-gate # include <hpsecurity.h>
56*0Sstevel@tonic-gate # include <prot.h>
57*0Sstevel@tonic-gate # endif
58*0Sstevel@tonic-gate # if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
59*0Sstevel@tonic-gate # include <shadow.h>
60*0Sstevel@tonic-gate # endif
61*0Sstevel@tonic-gate # if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
62*0Sstevel@tonic-gate # include <sys/label.h>
63*0Sstevel@tonic-gate # include <sys/audit.h>
64*0Sstevel@tonic-gate # include <pwdadj.h>
65*0Sstevel@tonic-gate # endif
66*0Sstevel@tonic-gate # if defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT)
67*0Sstevel@tonic-gate # include "md5crypt.h"
68*0Sstevel@tonic-gate # endif /* defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT) */
69*0Sstevel@tonic-gate
70*0Sstevel@tonic-gate # ifdef HAVE_CYGWIN
71*0Sstevel@tonic-gate # undef ERROR
72*0Sstevel@tonic-gate # include <windows.h>
73*0Sstevel@tonic-gate # include <sys/cygwin.h>
74*0Sstevel@tonic-gate # define is_winnt (GetVersion() < 0x80000000)
75*0Sstevel@tonic-gate # endif
76*0Sstevel@tonic-gate #endif /* !USE_PAM && !HAVE_OSF_SIA */
77*0Sstevel@tonic-gate
78*0Sstevel@tonic-gate extern ServerOptions options;
79*0Sstevel@tonic-gate #ifdef WITH_AIXAUTHENTICATE
80*0Sstevel@tonic-gate extern char *aixloginmsg;
81*0Sstevel@tonic-gate #endif
82*0Sstevel@tonic-gate
83*0Sstevel@tonic-gate /*
84*0Sstevel@tonic-gate * Tries to authenticate the user using password. Returns true if
85*0Sstevel@tonic-gate * authentication succeeds.
86*0Sstevel@tonic-gate */
87*0Sstevel@tonic-gate int
auth_password(Authctxt * authctxt,const char * password)88*0Sstevel@tonic-gate auth_password(Authctxt *authctxt, const char *password)
89*0Sstevel@tonic-gate {
90*0Sstevel@tonic-gate #if defined(USE_PAM)
91*0Sstevel@tonic-gate if (*password == '\0' && options.permit_empty_passwd == 0)
92*0Sstevel@tonic-gate return 0;
93*0Sstevel@tonic-gate return auth_pam_password(authctxt, password);
94*0Sstevel@tonic-gate #elif defined(HAVE_OSF_SIA)
95*0Sstevel@tonic-gate if (*password == '\0' && options.permit_empty_passwd == 0)
96*0Sstevel@tonic-gate return 0;
97*0Sstevel@tonic-gate return auth_sia_password(authctxt, password);
98*0Sstevel@tonic-gate #else
99*0Sstevel@tonic-gate struct passwd * pw = authctxt->pw;
100*0Sstevel@tonic-gate char *encrypted_password;
101*0Sstevel@tonic-gate char *pw_password;
102*0Sstevel@tonic-gate char *salt;
103*0Sstevel@tonic-gate #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
104*0Sstevel@tonic-gate struct spwd *spw;
105*0Sstevel@tonic-gate #endif
106*0Sstevel@tonic-gate #if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
107*0Sstevel@tonic-gate struct passwd_adjunct *spw;
108*0Sstevel@tonic-gate #endif
109*0Sstevel@tonic-gate #ifdef WITH_AIXAUTHENTICATE
110*0Sstevel@tonic-gate char *authmsg;
111*0Sstevel@tonic-gate int authsuccess;
112*0Sstevel@tonic-gate int reenter = 1;
113*0Sstevel@tonic-gate #endif
114*0Sstevel@tonic-gate
115*0Sstevel@tonic-gate /* deny if no user. */
116*0Sstevel@tonic-gate if (pw == NULL)
117*0Sstevel@tonic-gate return 0;
118*0Sstevel@tonic-gate #ifndef HAVE_CYGWIN
119*0Sstevel@tonic-gate if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
120*0Sstevel@tonic-gate return 0;
121*0Sstevel@tonic-gate #endif
122*0Sstevel@tonic-gate if (*password == '\0' && options.permit_empty_passwd == 0)
123*0Sstevel@tonic-gate return 0;
124*0Sstevel@tonic-gate #ifdef KRB5
125*0Sstevel@tonic-gate if (options.kerberos_authentication == 1) {
126*0Sstevel@tonic-gate int ret = auth_krb5_password(authctxt, password);
127*0Sstevel@tonic-gate if (ret == 1 || ret == 0)
128*0Sstevel@tonic-gate return ret;
129*0Sstevel@tonic-gate /* Fall back to ordinary passwd authentication. */
130*0Sstevel@tonic-gate }
131*0Sstevel@tonic-gate #endif
132*0Sstevel@tonic-gate #ifdef HAVE_CYGWIN
133*0Sstevel@tonic-gate if (is_winnt) {
134*0Sstevel@tonic-gate HANDLE hToken = cygwin_logon_user(pw, password);
135*0Sstevel@tonic-gate
136*0Sstevel@tonic-gate if (hToken == INVALID_HANDLE_VALUE)
137*0Sstevel@tonic-gate return 0;
138*0Sstevel@tonic-gate cygwin_set_impersonation_token(hToken);
139*0Sstevel@tonic-gate return 1;
140*0Sstevel@tonic-gate }
141*0Sstevel@tonic-gate #endif
142*0Sstevel@tonic-gate #ifdef WITH_AIXAUTHENTICATE
143*0Sstevel@tonic-gate authsuccess = (authenticate(pw->pw_name,password,&reenter,&authmsg) == 0);
144*0Sstevel@tonic-gate
145*0Sstevel@tonic-gate if (authsuccess)
146*0Sstevel@tonic-gate /* We don't have a pty yet, so just label the line as "ssh" */
147*0Sstevel@tonic-gate if (loginsuccess(authctxt->user,
148*0Sstevel@tonic-gate get_canonical_hostname(options.verify_reverse_mapping),
149*0Sstevel@tonic-gate "ssh", &aixloginmsg) < 0)
150*0Sstevel@tonic-gate aixloginmsg = NULL;
151*0Sstevel@tonic-gate
152*0Sstevel@tonic-gate return(authsuccess);
153*0Sstevel@tonic-gate #endif
154*0Sstevel@tonic-gate #ifdef KRB4
155*0Sstevel@tonic-gate if (options.kerberos_authentication == 1) {
156*0Sstevel@tonic-gate int ret = auth_krb4_password(authctxt, password);
157*0Sstevel@tonic-gate if (ret == 1 || ret == 0)
158*0Sstevel@tonic-gate return ret;
159*0Sstevel@tonic-gate /* Fall back to ordinary passwd authentication. */
160*0Sstevel@tonic-gate }
161*0Sstevel@tonic-gate #endif
162*0Sstevel@tonic-gate #ifdef BSD_AUTH
163*0Sstevel@tonic-gate if (auth_userokay(pw->pw_name, authctxt->style, "auth-ssh",
164*0Sstevel@tonic-gate (char *)password) == 0)
165*0Sstevel@tonic-gate return 0;
166*0Sstevel@tonic-gate else
167*0Sstevel@tonic-gate return 1;
168*0Sstevel@tonic-gate #endif
169*0Sstevel@tonic-gate pw_password = pw->pw_passwd;
170*0Sstevel@tonic-gate
171*0Sstevel@tonic-gate /*
172*0Sstevel@tonic-gate * Various interfaces to shadow or protected password data
173*0Sstevel@tonic-gate */
174*0Sstevel@tonic-gate #if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
175*0Sstevel@tonic-gate spw = getspnam(pw->pw_name);
176*0Sstevel@tonic-gate if (spw != NULL)
177*0Sstevel@tonic-gate pw_password = spw->sp_pwdp;
178*0Sstevel@tonic-gate #endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
179*0Sstevel@tonic-gate
180*0Sstevel@tonic-gate #if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
181*0Sstevel@tonic-gate if (issecure() && (spw = getpwanam(pw->pw_name)) != NULL)
182*0Sstevel@tonic-gate pw_password = spw->pwa_passwd;
183*0Sstevel@tonic-gate #endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */
184*0Sstevel@tonic-gate
185*0Sstevel@tonic-gate /* Check for users with no password. */
186*0Sstevel@tonic-gate if ((password[0] == '\0') && (pw_password[0] == '\0'))
187*0Sstevel@tonic-gate return 1;
188*0Sstevel@tonic-gate
189*0Sstevel@tonic-gate if (pw_password[0] != '\0')
190*0Sstevel@tonic-gate salt = pw_password;
191*0Sstevel@tonic-gate else
192*0Sstevel@tonic-gate salt = "xx";
193*0Sstevel@tonic-gate
194*0Sstevel@tonic-gate #ifdef HAVE_MD5_PASSWORDS
195*0Sstevel@tonic-gate if (is_md5_salt(salt))
196*0Sstevel@tonic-gate encrypted_password = md5_crypt(password, salt);
197*0Sstevel@tonic-gate else
198*0Sstevel@tonic-gate encrypted_password = crypt(password, salt);
199*0Sstevel@tonic-gate #else /* HAVE_MD5_PASSWORDS */
200*0Sstevel@tonic-gate encrypted_password = crypt(password, salt);
201*0Sstevel@tonic-gate #endif /* HAVE_MD5_PASSWORDS */
202*0Sstevel@tonic-gate
203*0Sstevel@tonic-gate /* Authentication is accepted if the encrypted passwords are identical. */
204*0Sstevel@tonic-gate return (strcmp(encrypted_password, pw_password) == 0);
205*0Sstevel@tonic-gate #endif /* !USE_PAM && !HAVE_OSF_SIA */
206*0Sstevel@tonic-gate }
207