1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Author: Tatu Ylonen <ylo@cs.hut.fi> 3*0Sstevel@tonic-gate * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4*0Sstevel@tonic-gate * All rights reserved 5*0Sstevel@tonic-gate * RSA-based authentication. This code determines whether to admit a login 6*0Sstevel@tonic-gate * based on RSA authentication. This file also contains functions to check 7*0Sstevel@tonic-gate * validity of the host key. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * As far as I am concerned, the code I have written for this software 10*0Sstevel@tonic-gate * can be used freely for any purpose. Any derived versions of this 11*0Sstevel@tonic-gate * software must be clearly marked as such, and if the derived work is 12*0Sstevel@tonic-gate * incompatible with the protocol description in the RFC file, it must be 13*0Sstevel@tonic-gate * called by a name other than "ssh" or "Secure Shell". 14*0Sstevel@tonic-gate */ 15*0Sstevel@tonic-gate 16*0Sstevel@tonic-gate #include "includes.h" 17*0Sstevel@tonic-gate RCSID("$OpenBSD: auth-rsa.c,v 1.56 2002/06/10 16:53:06 stevesk Exp $"); 18*0Sstevel@tonic-gate 19*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 20*0Sstevel@tonic-gate 21*0Sstevel@tonic-gate #include <openssl/rsa.h> 22*0Sstevel@tonic-gate #include <openssl/md5.h> 23*0Sstevel@tonic-gate 24*0Sstevel@tonic-gate #include "rsa.h" 25*0Sstevel@tonic-gate #include "packet.h" 26*0Sstevel@tonic-gate #include "xmalloc.h" 27*0Sstevel@tonic-gate #include "ssh1.h" 28*0Sstevel@tonic-gate #include "mpaux.h" 29*0Sstevel@tonic-gate #include "uidswap.h" 30*0Sstevel@tonic-gate #include "match.h" 31*0Sstevel@tonic-gate #include "auth-options.h" 32*0Sstevel@tonic-gate #include "pathnames.h" 33*0Sstevel@tonic-gate #include "log.h" 34*0Sstevel@tonic-gate #include "servconf.h" 35*0Sstevel@tonic-gate #include "auth.h" 36*0Sstevel@tonic-gate #include "hostfile.h" 37*0Sstevel@tonic-gate #include "monitor_wrap.h" 38*0Sstevel@tonic-gate #include "ssh.h" 39*0Sstevel@tonic-gate 40*0Sstevel@tonic-gate /* import */ 41*0Sstevel@tonic-gate extern ServerOptions options; 42*0Sstevel@tonic-gate 43*0Sstevel@tonic-gate /* 44*0Sstevel@tonic-gate * Session identifier that is used to bind key exchange and authentication 45*0Sstevel@tonic-gate * responses to a particular session. 46*0Sstevel@tonic-gate */ 47*0Sstevel@tonic-gate extern u_char session_id[16]; 48*0Sstevel@tonic-gate 49*0Sstevel@tonic-gate /* 50*0Sstevel@tonic-gate * The .ssh/authorized_keys file contains public keys, one per line, in the 51*0Sstevel@tonic-gate * following format: 52*0Sstevel@tonic-gate * options bits e n comment 53*0Sstevel@tonic-gate * where bits, e and n are decimal numbers, 54*0Sstevel@tonic-gate * and comment is any string of characters up to newline. The maximum 55*0Sstevel@tonic-gate * length of a line is 8000 characters. See the documentation for a 56*0Sstevel@tonic-gate * description of the options. 57*0Sstevel@tonic-gate */ 58*0Sstevel@tonic-gate 59*0Sstevel@tonic-gate BIGNUM * 60*0Sstevel@tonic-gate auth_rsa_generate_challenge(Key *key) 61*0Sstevel@tonic-gate { 62*0Sstevel@tonic-gate BIGNUM *challenge; 63*0Sstevel@tonic-gate BN_CTX *ctx; 64*0Sstevel@tonic-gate 65*0Sstevel@tonic-gate if ((challenge = BN_new()) == NULL) 66*0Sstevel@tonic-gate fatal("auth_rsa_generate_challenge: BN_new() failed"); 67*0Sstevel@tonic-gate /* Generate a random challenge. */ 68*0Sstevel@tonic-gate BN_rand(challenge, 256, 0, 0); 69*0Sstevel@tonic-gate if ((ctx = BN_CTX_new()) == NULL) 70*0Sstevel@tonic-gate fatal("auth_rsa_generate_challenge: BN_CTX_new() failed"); 71*0Sstevel@tonic-gate BN_mod(challenge, challenge, key->rsa->n, ctx); 72*0Sstevel@tonic-gate BN_CTX_free(ctx); 73*0Sstevel@tonic-gate 74*0Sstevel@tonic-gate return challenge; 75*0Sstevel@tonic-gate } 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gate int 78*0Sstevel@tonic-gate auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16]) 79*0Sstevel@tonic-gate { 80*0Sstevel@tonic-gate u_char buf[32], mdbuf[16]; 81*0Sstevel@tonic-gate MD5_CTX md; 82*0Sstevel@tonic-gate int len; 83*0Sstevel@tonic-gate 84*0Sstevel@tonic-gate /* don't allow short keys */ 85*0Sstevel@tonic-gate if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { 86*0Sstevel@tonic-gate error("auth_rsa_verify_response: RSA modulus too small: %d < minimum %d bits", 87*0Sstevel@tonic-gate BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE); 88*0Sstevel@tonic-gate return (0); 89*0Sstevel@tonic-gate } 90*0Sstevel@tonic-gate 91*0Sstevel@tonic-gate /* The response is MD5 of decrypted challenge plus session id. */ 92*0Sstevel@tonic-gate len = BN_num_bytes(challenge); 93*0Sstevel@tonic-gate if (len <= 0 || len > 32) 94*0Sstevel@tonic-gate fatal("auth_rsa_verify_response: bad challenge length %d", len); 95*0Sstevel@tonic-gate memset(buf, 0, 32); 96*0Sstevel@tonic-gate BN_bn2bin(challenge, buf + 32 - len); 97*0Sstevel@tonic-gate MD5_Init(&md); 98*0Sstevel@tonic-gate MD5_Update(&md, buf, 32); 99*0Sstevel@tonic-gate MD5_Update(&md, session_id, 16); 100*0Sstevel@tonic-gate MD5_Final(mdbuf, &md); 101*0Sstevel@tonic-gate 102*0Sstevel@tonic-gate /* Verify that the response is the original challenge. */ 103*0Sstevel@tonic-gate if (memcmp(response, mdbuf, 16) != 0) { 104*0Sstevel@tonic-gate /* Wrong answer. */ 105*0Sstevel@tonic-gate return (0); 106*0Sstevel@tonic-gate } 107*0Sstevel@tonic-gate /* Correct answer. */ 108*0Sstevel@tonic-gate return (1); 109*0Sstevel@tonic-gate } 110*0Sstevel@tonic-gate 111*0Sstevel@tonic-gate /* 112*0Sstevel@tonic-gate * Performs the RSA authentication challenge-response dialog with the client, 113*0Sstevel@tonic-gate * and returns true (non-zero) if the client gave the correct answer to 114*0Sstevel@tonic-gate * our challenge; returns zero if the client gives a wrong answer. 115*0Sstevel@tonic-gate */ 116*0Sstevel@tonic-gate 117*0Sstevel@tonic-gate int 118*0Sstevel@tonic-gate auth_rsa_challenge_dialog(Key *key) 119*0Sstevel@tonic-gate { 120*0Sstevel@tonic-gate BIGNUM *challenge, *encrypted_challenge; 121*0Sstevel@tonic-gate u_char response[16]; 122*0Sstevel@tonic-gate int i, success; 123*0Sstevel@tonic-gate 124*0Sstevel@tonic-gate if ((encrypted_challenge = BN_new()) == NULL) 125*0Sstevel@tonic-gate fatal("auth_rsa_challenge_dialog: BN_new() failed"); 126*0Sstevel@tonic-gate 127*0Sstevel@tonic-gate challenge = PRIVSEP(auth_rsa_generate_challenge(key)); 128*0Sstevel@tonic-gate 129*0Sstevel@tonic-gate /* Encrypt the challenge with the public key. */ 130*0Sstevel@tonic-gate rsa_public_encrypt(encrypted_challenge, challenge, key->rsa); 131*0Sstevel@tonic-gate 132*0Sstevel@tonic-gate /* Send the encrypted challenge to the client. */ 133*0Sstevel@tonic-gate packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE); 134*0Sstevel@tonic-gate packet_put_bignum(encrypted_challenge); 135*0Sstevel@tonic-gate packet_send(); 136*0Sstevel@tonic-gate BN_clear_free(encrypted_challenge); 137*0Sstevel@tonic-gate packet_write_wait(); 138*0Sstevel@tonic-gate 139*0Sstevel@tonic-gate /* Wait for a response. */ 140*0Sstevel@tonic-gate packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE); 141*0Sstevel@tonic-gate for (i = 0; i < 16; i++) 142*0Sstevel@tonic-gate response[i] = packet_get_char(); 143*0Sstevel@tonic-gate packet_check_eom(); 144*0Sstevel@tonic-gate 145*0Sstevel@tonic-gate success = PRIVSEP(auth_rsa_verify_response(key, challenge, response)); 146*0Sstevel@tonic-gate BN_clear_free(challenge); 147*0Sstevel@tonic-gate return (success); 148*0Sstevel@tonic-gate } 149*0Sstevel@tonic-gate 150*0Sstevel@tonic-gate /* 151*0Sstevel@tonic-gate * check if there's user key matching client_n, 152*0Sstevel@tonic-gate * return key if login is allowed, NULL otherwise 153*0Sstevel@tonic-gate */ 154*0Sstevel@tonic-gate 155*0Sstevel@tonic-gate int 156*0Sstevel@tonic-gate auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) 157*0Sstevel@tonic-gate { 158*0Sstevel@tonic-gate char line[8192], *file; 159*0Sstevel@tonic-gate int allowed = 0; 160*0Sstevel@tonic-gate u_int bits; 161*0Sstevel@tonic-gate FILE *f; 162*0Sstevel@tonic-gate u_long linenum = 0; 163*0Sstevel@tonic-gate struct stat st; 164*0Sstevel@tonic-gate Key *key; 165*0Sstevel@tonic-gate 166*0Sstevel@tonic-gate /* Temporarily use the user's uid. */ 167*0Sstevel@tonic-gate temporarily_use_uid(pw); 168*0Sstevel@tonic-gate 169*0Sstevel@tonic-gate /* The authorized keys. */ 170*0Sstevel@tonic-gate file = authorized_keys_file(pw); 171*0Sstevel@tonic-gate debug("trying public RSA key file %s", file); 172*0Sstevel@tonic-gate 173*0Sstevel@tonic-gate /* Fail quietly if file does not exist */ 174*0Sstevel@tonic-gate if (stat(file, &st) < 0) { 175*0Sstevel@tonic-gate /* Restore the privileged uid. */ 176*0Sstevel@tonic-gate restore_uid(); 177*0Sstevel@tonic-gate xfree(file); 178*0Sstevel@tonic-gate return (0); 179*0Sstevel@tonic-gate } 180*0Sstevel@tonic-gate /* Open the file containing the authorized keys. */ 181*0Sstevel@tonic-gate f = fopen(file, "r"); 182*0Sstevel@tonic-gate if (!f) { 183*0Sstevel@tonic-gate /* Restore the privileged uid. */ 184*0Sstevel@tonic-gate restore_uid(); 185*0Sstevel@tonic-gate xfree(file); 186*0Sstevel@tonic-gate return (0); 187*0Sstevel@tonic-gate } 188*0Sstevel@tonic-gate if (options.strict_modes && 189*0Sstevel@tonic-gate secure_filename(f, file, pw, line, sizeof(line)) != 0) { 190*0Sstevel@tonic-gate xfree(file); 191*0Sstevel@tonic-gate fclose(f); 192*0Sstevel@tonic-gate log("Authentication refused: %s", line); 193*0Sstevel@tonic-gate restore_uid(); 194*0Sstevel@tonic-gate return (0); 195*0Sstevel@tonic-gate } 196*0Sstevel@tonic-gate 197*0Sstevel@tonic-gate /* Flag indicating whether the key is allowed. */ 198*0Sstevel@tonic-gate allowed = 0; 199*0Sstevel@tonic-gate 200*0Sstevel@tonic-gate key = key_new(KEY_RSA1); 201*0Sstevel@tonic-gate 202*0Sstevel@tonic-gate /* 203*0Sstevel@tonic-gate * Go though the accepted keys, looking for the current key. If 204*0Sstevel@tonic-gate * found, perform a challenge-response dialog to verify that the 205*0Sstevel@tonic-gate * user really has the corresponding private key. 206*0Sstevel@tonic-gate */ 207*0Sstevel@tonic-gate while (fgets(line, sizeof(line), f)) { 208*0Sstevel@tonic-gate char *cp; 209*0Sstevel@tonic-gate char *options; 210*0Sstevel@tonic-gate 211*0Sstevel@tonic-gate linenum++; 212*0Sstevel@tonic-gate 213*0Sstevel@tonic-gate /* Skip leading whitespace, empty and comment lines. */ 214*0Sstevel@tonic-gate for (cp = line; *cp == ' ' || *cp == '\t'; cp++) 215*0Sstevel@tonic-gate ; 216*0Sstevel@tonic-gate if (!*cp || *cp == '\n' || *cp == '#') 217*0Sstevel@tonic-gate continue; 218*0Sstevel@tonic-gate 219*0Sstevel@tonic-gate /* 220*0Sstevel@tonic-gate * Check if there are options for this key, and if so, 221*0Sstevel@tonic-gate * save their starting address and skip the option part 222*0Sstevel@tonic-gate * for now. If there are no options, set the starting 223*0Sstevel@tonic-gate * address to NULL. 224*0Sstevel@tonic-gate */ 225*0Sstevel@tonic-gate if (*cp < '0' || *cp > '9') { 226*0Sstevel@tonic-gate int quoted = 0; 227*0Sstevel@tonic-gate options = cp; 228*0Sstevel@tonic-gate for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { 229*0Sstevel@tonic-gate if (*cp == '\\' && cp[1] == '"') 230*0Sstevel@tonic-gate cp++; /* Skip both */ 231*0Sstevel@tonic-gate else if (*cp == '"') 232*0Sstevel@tonic-gate quoted = !quoted; 233*0Sstevel@tonic-gate } 234*0Sstevel@tonic-gate } else 235*0Sstevel@tonic-gate options = NULL; 236*0Sstevel@tonic-gate 237*0Sstevel@tonic-gate /* Parse the key from the line. */ 238*0Sstevel@tonic-gate if (hostfile_read_key(&cp, &bits, key) == 0) { 239*0Sstevel@tonic-gate debug("%.100s, line %lu: non ssh1 key syntax", 240*0Sstevel@tonic-gate file, linenum); 241*0Sstevel@tonic-gate continue; 242*0Sstevel@tonic-gate } 243*0Sstevel@tonic-gate /* cp now points to the comment part. */ 244*0Sstevel@tonic-gate 245*0Sstevel@tonic-gate /* Check if the we have found the desired key (identified by its modulus). */ 246*0Sstevel@tonic-gate if (BN_cmp(key->rsa->n, client_n) != 0) 247*0Sstevel@tonic-gate continue; 248*0Sstevel@tonic-gate 249*0Sstevel@tonic-gate /* check the real bits */ 250*0Sstevel@tonic-gate if (bits != BN_num_bits(key->rsa->n)) 251*0Sstevel@tonic-gate log("Warning: %s, line %lu: keysize mismatch: " 252*0Sstevel@tonic-gate "actual %d vs. announced %d.", 253*0Sstevel@tonic-gate file, linenum, BN_num_bits(key->rsa->n), bits); 254*0Sstevel@tonic-gate 255*0Sstevel@tonic-gate /* We have found the desired key. */ 256*0Sstevel@tonic-gate /* 257*0Sstevel@tonic-gate * If our options do not allow this key to be used, 258*0Sstevel@tonic-gate * do not send challenge. 259*0Sstevel@tonic-gate */ 260*0Sstevel@tonic-gate if (!auth_parse_options(pw, options, file, linenum)) 261*0Sstevel@tonic-gate continue; 262*0Sstevel@tonic-gate 263*0Sstevel@tonic-gate /* break out, this key is allowed */ 264*0Sstevel@tonic-gate allowed = 1; 265*0Sstevel@tonic-gate break; 266*0Sstevel@tonic-gate } 267*0Sstevel@tonic-gate 268*0Sstevel@tonic-gate /* Restore the privileged uid. */ 269*0Sstevel@tonic-gate restore_uid(); 270*0Sstevel@tonic-gate 271*0Sstevel@tonic-gate /* Close the file. */ 272*0Sstevel@tonic-gate xfree(file); 273*0Sstevel@tonic-gate fclose(f); 274*0Sstevel@tonic-gate 275*0Sstevel@tonic-gate /* return key if allowed */ 276*0Sstevel@tonic-gate if (allowed && rkey != NULL) 277*0Sstevel@tonic-gate *rkey = key; 278*0Sstevel@tonic-gate else 279*0Sstevel@tonic-gate key_free(key); 280*0Sstevel@tonic-gate return (allowed); 281*0Sstevel@tonic-gate } 282*0Sstevel@tonic-gate 283*0Sstevel@tonic-gate /* 284*0Sstevel@tonic-gate * Performs the RSA authentication dialog with the client. This returns 285*0Sstevel@tonic-gate * 0 if the client could not be authenticated, and 1 if authentication was 286*0Sstevel@tonic-gate * successful. This may exit if there is a serious protocol violation. 287*0Sstevel@tonic-gate */ 288*0Sstevel@tonic-gate int 289*0Sstevel@tonic-gate auth_rsa(struct passwd *pw, BIGNUM *client_n) 290*0Sstevel@tonic-gate { 291*0Sstevel@tonic-gate Key *key; 292*0Sstevel@tonic-gate char *fp; 293*0Sstevel@tonic-gate 294*0Sstevel@tonic-gate /* no user given */ 295*0Sstevel@tonic-gate if (pw == NULL) 296*0Sstevel@tonic-gate return 0; 297*0Sstevel@tonic-gate 298*0Sstevel@tonic-gate if (!PRIVSEP(auth_rsa_key_allowed(pw, client_n, &key))) { 299*0Sstevel@tonic-gate auth_clear_options(); 300*0Sstevel@tonic-gate return (0); 301*0Sstevel@tonic-gate } 302*0Sstevel@tonic-gate 303*0Sstevel@tonic-gate /* Perform the challenge-response dialog for this key. */ 304*0Sstevel@tonic-gate if (!auth_rsa_challenge_dialog(key)) { 305*0Sstevel@tonic-gate /* Wrong response. */ 306*0Sstevel@tonic-gate verbose("Wrong response to RSA authentication challenge."); 307*0Sstevel@tonic-gate packet_send_debug("Wrong response to RSA authentication challenge."); 308*0Sstevel@tonic-gate /* 309*0Sstevel@tonic-gate * Break out of the loop. Otherwise we might send 310*0Sstevel@tonic-gate * another challenge and break the protocol. 311*0Sstevel@tonic-gate */ 312*0Sstevel@tonic-gate key_free(key); 313*0Sstevel@tonic-gate return (0); 314*0Sstevel@tonic-gate } 315*0Sstevel@tonic-gate /* 316*0Sstevel@tonic-gate * Correct response. The client has been successfully 317*0Sstevel@tonic-gate * authenticated. Note that we have not yet processed the 318*0Sstevel@tonic-gate * options; this will be reset if the options cause the 319*0Sstevel@tonic-gate * authentication to be rejected. 320*0Sstevel@tonic-gate */ 321*0Sstevel@tonic-gate fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); 322*0Sstevel@tonic-gate verbose("Found matching %s key: %s", 323*0Sstevel@tonic-gate key_type(key), fp); 324*0Sstevel@tonic-gate xfree(fp); 325*0Sstevel@tonic-gate key_free(key); 326*0Sstevel@tonic-gate 327*0Sstevel@tonic-gate packet_send_debug("RSA authentication accepted."); 328*0Sstevel@tonic-gate return (1); 329*0Sstevel@tonic-gate } 330