1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright (c) 2000 Markus Friedl. All rights reserved. 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 5*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 6*0Sstevel@tonic-gate * are met: 7*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 8*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 9*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 10*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 11*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 12*0Sstevel@tonic-gate * 13*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 14*0Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 15*0Sstevel@tonic-gate * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 16*0Sstevel@tonic-gate * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 17*0Sstevel@tonic-gate * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 18*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 19*0Sstevel@tonic-gate * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 20*0Sstevel@tonic-gate * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 21*0Sstevel@tonic-gate * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 22*0Sstevel@tonic-gate * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 23*0Sstevel@tonic-gate */ 24*0Sstevel@tonic-gate /* 25*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 26*0Sstevel@tonic-gate * Use is subject to license terms. 27*0Sstevel@tonic-gate */ 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate #include "includes.h" 30*0Sstevel@tonic-gate RCSID("$OpenBSD: auth2.c,v 1.95 2002/08/22 21:33:58 markus Exp $"); 31*0Sstevel@tonic-gate 32*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 33*0Sstevel@tonic-gate 34*0Sstevel@tonic-gate #include "ssh2.h" 35*0Sstevel@tonic-gate #include "xmalloc.h" 36*0Sstevel@tonic-gate #include "packet.h" 37*0Sstevel@tonic-gate #include "log.h" 38*0Sstevel@tonic-gate #include "servconf.h" 39*0Sstevel@tonic-gate #include "compat.h" 40*0Sstevel@tonic-gate #include "misc.h" 41*0Sstevel@tonic-gate #include "auth.h" 42*0Sstevel@tonic-gate #include "dispatch.h" 43*0Sstevel@tonic-gate #include "sshlogin.h" 44*0Sstevel@tonic-gate #include "pathnames.h" 45*0Sstevel@tonic-gate #include "monitor_wrap.h" 46*0Sstevel@tonic-gate 47*0Sstevel@tonic-gate #ifdef HAVE_BSM 48*0Sstevel@tonic-gate #include "bsmaudit.h" 49*0Sstevel@tonic-gate extern adt_session_data_t *ah; 50*0Sstevel@tonic-gate #endif /* HAVE_BSM */ 51*0Sstevel@tonic-gate 52*0Sstevel@tonic-gate #ifdef GSSAPI 53*0Sstevel@tonic-gate #include "ssh-gss.h" 54*0Sstevel@tonic-gate #endif 55*0Sstevel@tonic-gate 56*0Sstevel@tonic-gate /* import */ 57*0Sstevel@tonic-gate extern ServerOptions options; 58*0Sstevel@tonic-gate extern u_char *session_id2; 59*0Sstevel@tonic-gate extern int session_id2_len; 60*0Sstevel@tonic-gate 61*0Sstevel@tonic-gate Authctxt *x_authctxt = NULL; 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate /* methods */ 64*0Sstevel@tonic-gate 65*0Sstevel@tonic-gate extern Authmethod method_none; 66*0Sstevel@tonic-gate extern Authmethod method_pubkey; 67*0Sstevel@tonic-gate extern Authmethod method_passwd; 68*0Sstevel@tonic-gate extern Authmethod method_kbdint; 69*0Sstevel@tonic-gate extern Authmethod method_hostbased; 70*0Sstevel@tonic-gate extern Authmethod method_external; 71*0Sstevel@tonic-gate extern Authmethod method_gssapi; 72*0Sstevel@tonic-gate 73*0Sstevel@tonic-gate static Authmethod *authmethods[] = { 74*0Sstevel@tonic-gate &method_none, 75*0Sstevel@tonic-gate #ifdef GSSAPI 76*0Sstevel@tonic-gate &method_external, 77*0Sstevel@tonic-gate &method_gssapi, 78*0Sstevel@tonic-gate #endif 79*0Sstevel@tonic-gate &method_pubkey, 80*0Sstevel@tonic-gate &method_passwd, 81*0Sstevel@tonic-gate &method_kbdint, 82*0Sstevel@tonic-gate &method_hostbased, 83*0Sstevel@tonic-gate NULL 84*0Sstevel@tonic-gate }; 85*0Sstevel@tonic-gate 86*0Sstevel@tonic-gate /* protocol */ 87*0Sstevel@tonic-gate 88*0Sstevel@tonic-gate static void input_service_request(int, u_int32_t, void *); 89*0Sstevel@tonic-gate static void input_userauth_request(int, u_int32_t, void *); 90*0Sstevel@tonic-gate 91*0Sstevel@tonic-gate /* helper */ 92*0Sstevel@tonic-gate static Authmethod *authmethod_lookup(const char *); 93*0Sstevel@tonic-gate static char *authmethods_get(void); 94*0Sstevel@tonic-gate static char *authmethods_check_abandonment(Authctxt *authctxt, 95*0Sstevel@tonic-gate Authmethod *method); 96*0Sstevel@tonic-gate static void authmethod_count_attempt(Authmethod *method); 97*0Sstevel@tonic-gate /*static char *authmethods_get_kbdint(void);*/ 98*0Sstevel@tonic-gate int user_key_allowed(struct passwd *, Key *); 99*0Sstevel@tonic-gate int hostbased_key_allowed(struct passwd *, const char *, char *, Key *); 100*0Sstevel@tonic-gate static int userauth_method_can_run(Authmethod *method); 101*0Sstevel@tonic-gate static void userauth_reset_methods(void); 102*0Sstevel@tonic-gate 103*0Sstevel@tonic-gate /* 104*0Sstevel@tonic-gate * loop until authctxt->success == TRUE 105*0Sstevel@tonic-gate */ 106*0Sstevel@tonic-gate 107*0Sstevel@tonic-gate Authctxt * 108*0Sstevel@tonic-gate do_authentication2(void) 109*0Sstevel@tonic-gate { 110*0Sstevel@tonic-gate Authctxt *authctxt = authctxt_new(); 111*0Sstevel@tonic-gate 112*0Sstevel@tonic-gate x_authctxt = authctxt; /*XXX*/ 113*0Sstevel@tonic-gate 114*0Sstevel@tonic-gate #ifdef HAVE_BSM 115*0Sstevel@tonic-gate fatal_add_cleanup(audit_failed_login_cleanup, authctxt); 116*0Sstevel@tonic-gate #endif /* HAVE_BSM */ 117*0Sstevel@tonic-gate 118*0Sstevel@tonic-gate /* challenge-response is implemented via keyboard interactive */ 119*0Sstevel@tonic-gate if (options.challenge_response_authentication) 120*0Sstevel@tonic-gate options.kbd_interactive_authentication = 1; 121*0Sstevel@tonic-gate if (options.pam_authentication_via_kbd_int) 122*0Sstevel@tonic-gate options.kbd_interactive_authentication = 1; 123*0Sstevel@tonic-gate if (use_privsep) 124*0Sstevel@tonic-gate options.pam_authentication_via_kbd_int = 0; 125*0Sstevel@tonic-gate 126*0Sstevel@tonic-gate dispatch_init(&dispatch_protocol_error); 127*0Sstevel@tonic-gate dispatch_set(SSH2_MSG_SERVICE_REQUEST, &input_service_request); 128*0Sstevel@tonic-gate dispatch_run(DISPATCH_BLOCK, &authctxt->success, authctxt); 129*0Sstevel@tonic-gate 130*0Sstevel@tonic-gate return (authctxt); 131*0Sstevel@tonic-gate } 132*0Sstevel@tonic-gate 133*0Sstevel@tonic-gate static void 134*0Sstevel@tonic-gate input_service_request(int type, u_int32_t seq, void *ctxt) 135*0Sstevel@tonic-gate { 136*0Sstevel@tonic-gate Authctxt *authctxt = ctxt; 137*0Sstevel@tonic-gate u_int len; 138*0Sstevel@tonic-gate int acceptit = 0; 139*0Sstevel@tonic-gate char *service = packet_get_string(&len); 140*0Sstevel@tonic-gate packet_check_eom(); 141*0Sstevel@tonic-gate 142*0Sstevel@tonic-gate if (authctxt == NULL) 143*0Sstevel@tonic-gate fatal("input_service_request: no authctxt"); 144*0Sstevel@tonic-gate 145*0Sstevel@tonic-gate if (strcmp(service, "ssh-userauth") == 0) { 146*0Sstevel@tonic-gate if (!authctxt->success) { 147*0Sstevel@tonic-gate acceptit = 1; 148*0Sstevel@tonic-gate /* now we can handle user-auth requests */ 149*0Sstevel@tonic-gate dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &input_userauth_request); 150*0Sstevel@tonic-gate } 151*0Sstevel@tonic-gate } 152*0Sstevel@tonic-gate /* XXX all other service requests are denied */ 153*0Sstevel@tonic-gate 154*0Sstevel@tonic-gate if (acceptit) { 155*0Sstevel@tonic-gate packet_start(SSH2_MSG_SERVICE_ACCEPT); 156*0Sstevel@tonic-gate packet_put_cstring(service); 157*0Sstevel@tonic-gate packet_send(); 158*0Sstevel@tonic-gate packet_write_wait(); 159*0Sstevel@tonic-gate } else { 160*0Sstevel@tonic-gate debug("bad service request %s", service); 161*0Sstevel@tonic-gate packet_disconnect("bad service request %s", service); 162*0Sstevel@tonic-gate } 163*0Sstevel@tonic-gate xfree(service); 164*0Sstevel@tonic-gate } 165*0Sstevel@tonic-gate 166*0Sstevel@tonic-gate static void 167*0Sstevel@tonic-gate input_userauth_request(int type, u_int32_t seq, void *ctxt) 168*0Sstevel@tonic-gate { 169*0Sstevel@tonic-gate Authctxt *authctxt = ctxt; 170*0Sstevel@tonic-gate Authmethod *m = NULL; 171*0Sstevel@tonic-gate char *user, *service, *method, *style = NULL; 172*0Sstevel@tonic-gate 173*0Sstevel@tonic-gate if (authctxt == NULL) 174*0Sstevel@tonic-gate fatal("input_userauth_request: no authctxt"); 175*0Sstevel@tonic-gate 176*0Sstevel@tonic-gate user = packet_get_string(NULL); 177*0Sstevel@tonic-gate service = packet_get_string(NULL); 178*0Sstevel@tonic-gate method = packet_get_string(NULL); 179*0Sstevel@tonic-gate debug("userauth-request for user %s service %s method %s", user, 180*0Sstevel@tonic-gate service, method); 181*0Sstevel@tonic-gate debug("attempt %d initial attempt %d failures %d initial failures %d", 182*0Sstevel@tonic-gate authctxt->attempt, authctxt->init_attempt, 183*0Sstevel@tonic-gate authctxt->failures, authctxt->init_failures); 184*0Sstevel@tonic-gate 185*0Sstevel@tonic-gate m = authmethod_lookup(method); 186*0Sstevel@tonic-gate 187*0Sstevel@tonic-gate if ((style = strchr(user, ':')) != NULL) 188*0Sstevel@tonic-gate *style++ = 0; 189*0Sstevel@tonic-gate 190*0Sstevel@tonic-gate authctxt->attempt++; 191*0Sstevel@tonic-gate if (m != NULL && m->is_initial) 192*0Sstevel@tonic-gate authctxt->init_attempt++; 193*0Sstevel@tonic-gate 194*0Sstevel@tonic-gate if (authctxt->attempt == 1) { 195*0Sstevel@tonic-gate /* setup auth context */ 196*0Sstevel@tonic-gate authctxt->pw = PRIVSEP(getpwnamallow(user)); 197*0Sstevel@tonic-gate /* May want to abstract SSHv2 services someday */ 198*0Sstevel@tonic-gate if (authctxt->pw && strcmp(service, "ssh-connection")==0) { 199*0Sstevel@tonic-gate /* enforced in userauth_finish() below */ 200*0Sstevel@tonic-gate authctxt->valid = 1; 201*0Sstevel@tonic-gate debug2("input_userauth_request: setting up authctxt for %s", user); 202*0Sstevel@tonic-gate } else { 203*0Sstevel@tonic-gate log("input_userauth_request: illegal user %s", user); 204*0Sstevel@tonic-gate } 205*0Sstevel@tonic-gate setproctitle("%s%s", authctxt->pw ? user : "unknown", 206*0Sstevel@tonic-gate use_privsep ? " [net]" : ""); 207*0Sstevel@tonic-gate authctxt->user = xstrdup(user); 208*0Sstevel@tonic-gate authctxt->service = xstrdup(service); 209*0Sstevel@tonic-gate authctxt->style = style ? xstrdup(style) : NULL; 210*0Sstevel@tonic-gate userauth_reset_methods(); 211*0Sstevel@tonic-gate if (use_privsep) 212*0Sstevel@tonic-gate mm_inform_authserv(service, style); 213*0Sstevel@tonic-gate } else { 214*0Sstevel@tonic-gate char *abandoned; 215*0Sstevel@tonic-gate 216*0Sstevel@tonic-gate /* 217*0Sstevel@tonic-gate * Check for abandoned [multi-round-trip] userauths 218*0Sstevel@tonic-gate * methods (e.g., kbdint). Userauth method abandonment 219*0Sstevel@tonic-gate * should be treated as userauth method failure and 220*0Sstevel@tonic-gate * counted against max_auth_tries. 221*0Sstevel@tonic-gate */ 222*0Sstevel@tonic-gate abandoned = authmethods_check_abandonment(authctxt, m); 223*0Sstevel@tonic-gate 224*0Sstevel@tonic-gate if (abandoned != NULL && 225*0Sstevel@tonic-gate authctxt->failures > options.max_auth_tries) { 226*0Sstevel@tonic-gate /* userauth_finish() will now packet_disconnect() */ 227*0Sstevel@tonic-gate userauth_finish(authctxt, abandoned); 228*0Sstevel@tonic-gate /* NOTREACHED */ 229*0Sstevel@tonic-gate } 230*0Sstevel@tonic-gate 231*0Sstevel@tonic-gate /* Handle user|service changes, possibly packet_disconnect() */ 232*0Sstevel@tonic-gate userauth_user_svc_change(authctxt, user, service); 233*0Sstevel@tonic-gate } 234*0Sstevel@tonic-gate 235*0Sstevel@tonic-gate authctxt->method = m; 236*0Sstevel@tonic-gate 237*0Sstevel@tonic-gate /* run userauth method, try to authenticate user */ 238*0Sstevel@tonic-gate if (m != NULL && userauth_method_can_run(m)) { 239*0Sstevel@tonic-gate debug2("input_userauth_request: try method %s", method); 240*0Sstevel@tonic-gate 241*0Sstevel@tonic-gate m->postponed = 0; 242*0Sstevel@tonic-gate m->abandoned = 0; 243*0Sstevel@tonic-gate m->authenticated = 0; 244*0Sstevel@tonic-gate 245*0Sstevel@tonic-gate if (!m->is_initial || 246*0Sstevel@tonic-gate authctxt->init_failures < options.max_init_auth_tries) 247*0Sstevel@tonic-gate m->userauth(authctxt); 248*0Sstevel@tonic-gate 249*0Sstevel@tonic-gate authmethod_count_attempt(m); 250*0Sstevel@tonic-gate 251*0Sstevel@tonic-gate if (authctxt->unwind_dispatch_loop) { 252*0Sstevel@tonic-gate /* 253*0Sstevel@tonic-gate * Method ran nested dispatch loop but was 254*0Sstevel@tonic-gate * abandoned. Cleanup and return without doing 255*0Sstevel@tonic-gate * anything else; we're just unwinding the stack. 256*0Sstevel@tonic-gate */ 257*0Sstevel@tonic-gate authctxt->unwind_dispatch_loop = 0; 258*0Sstevel@tonic-gate goto done; 259*0Sstevel@tonic-gate } 260*0Sstevel@tonic-gate 261*0Sstevel@tonic-gate if (m->postponed) 262*0Sstevel@tonic-gate goto done; /* multi-round trip userauth not finished */ 263*0Sstevel@tonic-gate 264*0Sstevel@tonic-gate if (m->abandoned) { 265*0Sstevel@tonic-gate /* multi-round trip userauth abandoned, log failure */ 266*0Sstevel@tonic-gate auth_log(authctxt, 0, method, " ssh2"); 267*0Sstevel@tonic-gate goto done; 268*0Sstevel@tonic-gate } 269*0Sstevel@tonic-gate } 270*0Sstevel@tonic-gate 271*0Sstevel@tonic-gate userauth_finish(authctxt, method); 272*0Sstevel@tonic-gate 273*0Sstevel@tonic-gate done: 274*0Sstevel@tonic-gate xfree(service); 275*0Sstevel@tonic-gate xfree(user); 276*0Sstevel@tonic-gate xfree(method); 277*0Sstevel@tonic-gate } 278*0Sstevel@tonic-gate 279*0Sstevel@tonic-gate void 280*0Sstevel@tonic-gate userauth_finish(Authctxt *authctxt, char *method) 281*0Sstevel@tonic-gate { 282*0Sstevel@tonic-gate int authenticated, partial; 283*0Sstevel@tonic-gate 284*0Sstevel@tonic-gate if (authctxt == NULL) 285*0Sstevel@tonic-gate fatal("%s: missing context", __func__); 286*0Sstevel@tonic-gate 287*0Sstevel@tonic-gate /* unknown method handling -- must elicit userauth failure msg */ 288*0Sstevel@tonic-gate if (authctxt->method == NULL) { 289*0Sstevel@tonic-gate authenticated = 0; 290*0Sstevel@tonic-gate partial = 0; 291*0Sstevel@tonic-gate goto done_checking; 292*0Sstevel@tonic-gate } 293*0Sstevel@tonic-gate 294*0Sstevel@tonic-gate #ifndef USE_PAM 295*0Sstevel@tonic-gate /* Special handling for root (done elsewhere for PAM) */ 296*0Sstevel@tonic-gate if (!use_privsep && 297*0Sstevel@tonic-gate authctxt->method->authenticated && 298*0Sstevel@tonic-gate authctxt->pw != NULL && authctxt->pw->pw_uid == 0 && 299*0Sstevel@tonic-gate !auth_root_allowed(method)) 300*0Sstevel@tonic-gate authctxt->method->authenticated = 0; 301*0Sstevel@tonic-gate #endif /* USE_PAM */ 302*0Sstevel@tonic-gate 303*0Sstevel@tonic-gate #ifdef _UNICOS 304*0Sstevel@tonic-gate if (authctxt->method->authenticated && 305*0Sstevel@tonic-gate cray_access_denied(authctxt->user)) { 306*0Sstevel@tonic-gate authctxt->method->authenticated = 0; 307*0Sstevel@tonic-gate fatal("Access denied for user %s.",authctxt->user); 308*0Sstevel@tonic-gate } 309*0Sstevel@tonic-gate #endif /* _UNICOS */ 310*0Sstevel@tonic-gate 311*0Sstevel@tonic-gate partial = userauth_check_partial_failure(authctxt); 312*0Sstevel@tonic-gate authenticated = authctxt->method->authenticated; 313*0Sstevel@tonic-gate 314*0Sstevel@tonic-gate #ifdef USE_PAM 315*0Sstevel@tonic-gate /* 316*0Sstevel@tonic-gate * If the userauth method failed to complete PAM work then force 317*0Sstevel@tonic-gate * partial failure. 318*0Sstevel@tonic-gate */ 319*0Sstevel@tonic-gate if (authenticated && !AUTHPAM_DONE(authctxt)) 320*0Sstevel@tonic-gate partial = 1; 321*0Sstevel@tonic-gate #endif /* USE_PAM */ 322*0Sstevel@tonic-gate 323*0Sstevel@tonic-gate /* 324*0Sstevel@tonic-gate * To properly support invalid userauth method names we set 325*0Sstevel@tonic-gate * authenticated=0, partial=0 above and know that 326*0Sstevel@tonic-gate * authctxt->method == NULL. 327*0Sstevel@tonic-gate * 328*0Sstevel@tonic-gate * No unguarded reference to authctxt->method allowed from here. 329*0Sstevel@tonic-gate * Checking authenticated != 0 is a valid guard; authctxt->method 330*0Sstevel@tonic-gate * MUST NOT be NULL if authenticated. 331*0Sstevel@tonic-gate */ 332*0Sstevel@tonic-gate done_checking: 333*0Sstevel@tonic-gate if (!authctxt->valid && authenticated) { 334*0Sstevel@tonic-gate /* 335*0Sstevel@tonic-gate * Should never happen -- if it does PAM's at fault 336*0Sstevel@tonic-gate * but we need not panic, just treat as a failure. 337*0Sstevel@tonic-gate */ 338*0Sstevel@tonic-gate authctxt->method->authenticated = 0; 339*0Sstevel@tonic-gate authenticated = 0; 340*0Sstevel@tonic-gate log("Ignoring authenticated invalid user %s", 341*0Sstevel@tonic-gate authctxt->user); 342*0Sstevel@tonic-gate auth_log(authctxt, 0, method, " ssh2"); 343*0Sstevel@tonic-gate } 344*0Sstevel@tonic-gate 345*0Sstevel@tonic-gate /* Log before sending the reply */ 346*0Sstevel@tonic-gate auth_log(authctxt, authenticated, method, " ssh2"); 347*0Sstevel@tonic-gate 348*0Sstevel@tonic-gate if (authenticated && !partial) { 349*0Sstevel@tonic-gate 350*0Sstevel@tonic-gate /* turn off userauth */ 351*0Sstevel@tonic-gate dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &dispatch_protocol_ignore); 352*0Sstevel@tonic-gate packet_start(SSH2_MSG_USERAUTH_SUCCESS); 353*0Sstevel@tonic-gate packet_send(); 354*0Sstevel@tonic-gate packet_write_wait(); 355*0Sstevel@tonic-gate /* now we can break out */ 356*0Sstevel@tonic-gate authctxt->success = 1; 357*0Sstevel@tonic-gate } else { 358*0Sstevel@tonic-gate char *methods; 359*0Sstevel@tonic-gate 360*0Sstevel@tonic-gate if (authctxt->method && authctxt->method->is_initial) 361*0Sstevel@tonic-gate authctxt->init_failures++; 362*0Sstevel@tonic-gate 363*0Sstevel@tonic-gate authctxt->method = NULL; 364*0Sstevel@tonic-gate 365*0Sstevel@tonic-gate #ifdef USE_PAM 366*0Sstevel@tonic-gate /* 367*0Sstevel@tonic-gate * Keep track of last PAM error (or PERM_DENIED) for BSM 368*0Sstevel@tonic-gate * login failure auditing, which may run after the PAM 369*0Sstevel@tonic-gate * state has been cleaned up. 370*0Sstevel@tonic-gate */ 371*0Sstevel@tonic-gate authctxt->pam_retval = AUTHPAM_ERROR(authctxt, PAM_PERM_DENIED); 372*0Sstevel@tonic-gate #endif /* USE_PAM */ 373*0Sstevel@tonic-gate 374*0Sstevel@tonic-gate if (authctxt->failures++ > options.max_auth_tries) { 375*0Sstevel@tonic-gate #ifdef HAVE_BSM 376*0Sstevel@tonic-gate fatal_remove_cleanup(audit_failed_login_cleanup, 377*0Sstevel@tonic-gate authctxt); 378*0Sstevel@tonic-gate audit_sshd_login_failure(&ah, PAM_MAXTRIES); 379*0Sstevel@tonic-gate #endif /* HAVE_BSM */ 380*0Sstevel@tonic-gate packet_disconnect(AUTH_FAIL_MSG, authctxt->user); 381*0Sstevel@tonic-gate } 382*0Sstevel@tonic-gate 383*0Sstevel@tonic-gate #ifdef _UNICOS 384*0Sstevel@tonic-gate if (strcmp(method, "password") == 0) 385*0Sstevel@tonic-gate cray_login_failure(authctxt->user, IA_UDBERR); 386*0Sstevel@tonic-gate #endif /* _UNICOS */ 387*0Sstevel@tonic-gate packet_start(SSH2_MSG_USERAUTH_FAILURE); 388*0Sstevel@tonic-gate 389*0Sstevel@tonic-gate /* 390*0Sstevel@tonic-gate * If (partial) then authmethods_get() will return only 391*0Sstevel@tonic-gate * required methods, likely only "keyboard-interactive;" 392*0Sstevel@tonic-gate * (methods == NULL) implies failure, even if (partial == 1) 393*0Sstevel@tonic-gate */ 394*0Sstevel@tonic-gate methods = authmethods_get(); 395*0Sstevel@tonic-gate packet_put_cstring(methods); 396*0Sstevel@tonic-gate packet_put_char((authenticated && partial && methods) ? 1 : 0); 397*0Sstevel@tonic-gate if (methods) 398*0Sstevel@tonic-gate xfree(methods); 399*0Sstevel@tonic-gate packet_send(); 400*0Sstevel@tonic-gate packet_write_wait(); 401*0Sstevel@tonic-gate } 402*0Sstevel@tonic-gate } 403*0Sstevel@tonic-gate 404*0Sstevel@tonic-gate /* get current user */ 405*0Sstevel@tonic-gate 406*0Sstevel@tonic-gate struct passwd* 407*0Sstevel@tonic-gate auth_get_user(void) 408*0Sstevel@tonic-gate { 409*0Sstevel@tonic-gate return (x_authctxt != NULL && x_authctxt->valid) ? x_authctxt->pw : NULL; 410*0Sstevel@tonic-gate } 411*0Sstevel@tonic-gate 412*0Sstevel@tonic-gate #define DELIM "," 413*0Sstevel@tonic-gate 414*0Sstevel@tonic-gate #if 0 415*0Sstevel@tonic-gate static char * 416*0Sstevel@tonic-gate authmethods_get_kbdint(void) 417*0Sstevel@tonic-gate { 418*0Sstevel@tonic-gate Buffer b; 419*0Sstevel@tonic-gate int i; 420*0Sstevel@tonic-gate 421*0Sstevel@tonic-gate for (i = 0; authmethods[i] != NULL; i++) { 422*0Sstevel@tonic-gate if (strcmp(authmethods[i]->name, "keyboard-interactive") != 0) 423*0Sstevel@tonic-gate continue; 424*0Sstevel@tonic-gate return xstrdup(authmethods[i]->name); 425*0Sstevel@tonic-gate } 426*0Sstevel@tonic-gate return NULL; 427*0Sstevel@tonic-gate } 428*0Sstevel@tonic-gate #endif 429*0Sstevel@tonic-gate 430*0Sstevel@tonic-gate void 431*0Sstevel@tonic-gate userauth_user_svc_change(Authctxt *authctxt, char *user, char *service) 432*0Sstevel@tonic-gate { 433*0Sstevel@tonic-gate /* 434*0Sstevel@tonic-gate * NOTE: 435*0Sstevel@tonic-gate * 436*0Sstevel@tonic-gate * SSHv2 services should be abstracted and service changes during 437*0Sstevel@tonic-gate * userauth should be supported as per the userauth draft. In the PAM 438*0Sstevel@tonic-gate * case, support for multiple SSHv2 services means that we have to 439*0Sstevel@tonic-gate * format the PAM service name according to the SSHv2 service *and* the 440*0Sstevel@tonic-gate * SSHv2 userauth being attempted ("passwd", "kbdint" and "other"). 441*0Sstevel@tonic-gate * 442*0Sstevel@tonic-gate * We'll cross that bridge when we come to it. For now disallow service 443*0Sstevel@tonic-gate * changes during userauth if using PAM, but allow username changes. 444*0Sstevel@tonic-gate */ 445*0Sstevel@tonic-gate 446*0Sstevel@tonic-gate /* authctxt->service must == ssh-connection here */ 447*0Sstevel@tonic-gate if (service != NULL && strcmp(service, authctxt->service) != 0) { 448*0Sstevel@tonic-gate packet_disconnect("Change of service not " 449*0Sstevel@tonic-gate "allowed: %s and %s", 450*0Sstevel@tonic-gate authctxt->service, service); 451*0Sstevel@tonic-gate } 452*0Sstevel@tonic-gate if (user != NULL && authctxt->user != NULL && 453*0Sstevel@tonic-gate strcmp(user, authctxt->user) == 0) 454*0Sstevel@tonic-gate return; 455*0Sstevel@tonic-gate 456*0Sstevel@tonic-gate /* All good; update authctxt */ 457*0Sstevel@tonic-gate xfree(authctxt->user); 458*0Sstevel@tonic-gate authctxt->user = xstrdup(user); 459*0Sstevel@tonic-gate pwfree(&authctxt->pw); 460*0Sstevel@tonic-gate authctxt->pw = PRIVSEP(getpwnamallow(user)); 461*0Sstevel@tonic-gate authctxt->valid = (authctxt->pw != NULL); 462*0Sstevel@tonic-gate 463*0Sstevel@tonic-gate /* Forget method state; abandon postponed userauths */ 464*0Sstevel@tonic-gate userauth_reset_methods(); 465*0Sstevel@tonic-gate } 466*0Sstevel@tonic-gate 467*0Sstevel@tonic-gate int 468*0Sstevel@tonic-gate userauth_check_partial_failure(Authctxt *authctxt) 469*0Sstevel@tonic-gate { 470*0Sstevel@tonic-gate int i; 471*0Sstevel@tonic-gate int required = 0; 472*0Sstevel@tonic-gate int sufficient = 0; 473*0Sstevel@tonic-gate 474*0Sstevel@tonic-gate /* 475*0Sstevel@tonic-gate * v1 does not set authctxt->method 476*0Sstevel@tonic-gate * partial userauth failure is a v2 concept 477*0Sstevel@tonic-gate */ 478*0Sstevel@tonic-gate if (authctxt->method == NULL) 479*0Sstevel@tonic-gate return 0; 480*0Sstevel@tonic-gate 481*0Sstevel@tonic-gate for (i = 0; authmethods[i] != NULL; i++) { 482*0Sstevel@tonic-gate if (authmethods[i]->required) 483*0Sstevel@tonic-gate required++; 484*0Sstevel@tonic-gate if (authmethods[i]->sufficient) 485*0Sstevel@tonic-gate sufficient++; 486*0Sstevel@tonic-gate } 487*0Sstevel@tonic-gate 488*0Sstevel@tonic-gate if (required == 0 && sufficient == 0) 489*0Sstevel@tonic-gate return !authctxt->method->authenticated; 490*0Sstevel@tonic-gate 491*0Sstevel@tonic-gate if (required == 1 && authctxt->method->required) 492*0Sstevel@tonic-gate return !authctxt->method->authenticated; 493*0Sstevel@tonic-gate 494*0Sstevel@tonic-gate if (sufficient && authctxt->method->sufficient) 495*0Sstevel@tonic-gate return !authctxt->method->authenticated; 496*0Sstevel@tonic-gate 497*0Sstevel@tonic-gate return 1; 498*0Sstevel@tonic-gate } 499*0Sstevel@tonic-gate 500*0Sstevel@tonic-gate int 501*0Sstevel@tonic-gate userauth_method_can_run(Authmethod *method) 502*0Sstevel@tonic-gate { 503*0Sstevel@tonic-gate if (method->not_again) 504*0Sstevel@tonic-gate return 0; 505*0Sstevel@tonic-gate 506*0Sstevel@tonic-gate return 1; 507*0Sstevel@tonic-gate } 508*0Sstevel@tonic-gate 509*0Sstevel@tonic-gate static 510*0Sstevel@tonic-gate void 511*0Sstevel@tonic-gate userauth_reset_methods(void) 512*0Sstevel@tonic-gate { 513*0Sstevel@tonic-gate int i; 514*0Sstevel@tonic-gate 515*0Sstevel@tonic-gate for (i = 0; authmethods[i] != NULL; i++) { 516*0Sstevel@tonic-gate /* note: counters not reset */ 517*0Sstevel@tonic-gate authmethods[i]->required = 0; 518*0Sstevel@tonic-gate authmethods[i]->sufficient = 0; 519*0Sstevel@tonic-gate authmethods[i]->authenticated = 0; 520*0Sstevel@tonic-gate authmethods[i]->not_again = 0; 521*0Sstevel@tonic-gate authmethods[i]->postponed = 0; 522*0Sstevel@tonic-gate authmethods[i]->abandoned = 0; 523*0Sstevel@tonic-gate } 524*0Sstevel@tonic-gate } 525*0Sstevel@tonic-gate 526*0Sstevel@tonic-gate void 527*0Sstevel@tonic-gate userauth_force_kbdint(void) 528*0Sstevel@tonic-gate { 529*0Sstevel@tonic-gate int i; 530*0Sstevel@tonic-gate 531*0Sstevel@tonic-gate for (i = 0; authmethods[i] != NULL; i++) { 532*0Sstevel@tonic-gate authmethods[i]->required = 0; 533*0Sstevel@tonic-gate authmethods[i]->sufficient = 0; 534*0Sstevel@tonic-gate } 535*0Sstevel@tonic-gate method_kbdint.required = 1; 536*0Sstevel@tonic-gate } 537*0Sstevel@tonic-gate 538*0Sstevel@tonic-gate /* 539*0Sstevel@tonic-gate * Check to see if a previously run multi-round trip userauth method has 540*0Sstevel@tonic-gate * been abandoned and call its cleanup function. 541*0Sstevel@tonic-gate * 542*0Sstevel@tonic-gate * Abandoned userauth method invocations are counted as userauth failures. 543*0Sstevel@tonic-gate */ 544*0Sstevel@tonic-gate static 545*0Sstevel@tonic-gate char * 546*0Sstevel@tonic-gate authmethods_check_abandonment(Authctxt *authctxt, Authmethod *method) 547*0Sstevel@tonic-gate { 548*0Sstevel@tonic-gate int i; 549*0Sstevel@tonic-gate 550*0Sstevel@tonic-gate /* optimization: check current method first */ 551*0Sstevel@tonic-gate if (method && method->postponed) { 552*0Sstevel@tonic-gate method->postponed = 0; 553*0Sstevel@tonic-gate if (method->abandon) 554*0Sstevel@tonic-gate method->abandon(authctxt, method); 555*0Sstevel@tonic-gate else 556*0Sstevel@tonic-gate method->abandons++; 557*0Sstevel@tonic-gate authctxt->failures++; /* abandonment -> failure */ 558*0Sstevel@tonic-gate if (method->is_initial) 559*0Sstevel@tonic-gate authctxt->init_failures++; 560*0Sstevel@tonic-gate 561*0Sstevel@tonic-gate /* 562*0Sstevel@tonic-gate * Since we check for abandonment whenever a userauth is 563*0Sstevel@tonic-gate * requested we know only one method could have been 564*0Sstevel@tonic-gate * in postponed state, so we can return now. 565*0Sstevel@tonic-gate */ 566*0Sstevel@tonic-gate return (method->name); 567*0Sstevel@tonic-gate } 568*0Sstevel@tonic-gate for (i = 0; authmethods[i] != NULL; i++) { 569*0Sstevel@tonic-gate if (!authmethods[i]->postponed) 570*0Sstevel@tonic-gate continue; 571*0Sstevel@tonic-gate 572*0Sstevel@tonic-gate /* some method was postponed and a diff one is being started */ 573*0Sstevel@tonic-gate if (method != authmethods[i]) { 574*0Sstevel@tonic-gate authmethods[i]->postponed = 0; 575*0Sstevel@tonic-gate if (authmethods[i]->abandon) 576*0Sstevel@tonic-gate authmethods[i]->abandon(authctxt, 577*0Sstevel@tonic-gate authmethods[i]); 578*0Sstevel@tonic-gate else 579*0Sstevel@tonic-gate authmethods[i]->abandons++; 580*0Sstevel@tonic-gate authctxt->failures++; 581*0Sstevel@tonic-gate if (authmethods[i]->is_initial) 582*0Sstevel@tonic-gate authctxt->init_failures++; 583*0Sstevel@tonic-gate return (authmethods[i]->name); /* see above */ 584*0Sstevel@tonic-gate } 585*0Sstevel@tonic-gate } 586*0Sstevel@tonic-gate 587*0Sstevel@tonic-gate return NULL; 588*0Sstevel@tonic-gate } 589*0Sstevel@tonic-gate 590*0Sstevel@tonic-gate static char * 591*0Sstevel@tonic-gate authmethods_get(void) 592*0Sstevel@tonic-gate { 593*0Sstevel@tonic-gate Buffer b; 594*0Sstevel@tonic-gate char *list; 595*0Sstevel@tonic-gate int i; 596*0Sstevel@tonic-gate int sufficient = 0; 597*0Sstevel@tonic-gate int required = 0; 598*0Sstevel@tonic-gate int authenticated = 0; 599*0Sstevel@tonic-gate int partial = 0; 600*0Sstevel@tonic-gate 601*0Sstevel@tonic-gate /* 602*0Sstevel@tonic-gate * If at least one method succeeded partially then at least one 603*0Sstevel@tonic-gate * authmethod will be required and only required methods should 604*0Sstevel@tonic-gate * continue. 605*0Sstevel@tonic-gate */ 606*0Sstevel@tonic-gate for (i = 0; authmethods[i] != NULL; i++) { 607*0Sstevel@tonic-gate if (authmethods[i]->authenticated) 608*0Sstevel@tonic-gate authenticated++; 609*0Sstevel@tonic-gate if (authmethods[i]->required) 610*0Sstevel@tonic-gate required++; 611*0Sstevel@tonic-gate if (authmethods[i]->sufficient) 612*0Sstevel@tonic-gate sufficient++; 613*0Sstevel@tonic-gate } 614*0Sstevel@tonic-gate 615*0Sstevel@tonic-gate partial = (required + sufficient) > 0; 616*0Sstevel@tonic-gate 617*0Sstevel@tonic-gate buffer_init(&b); 618*0Sstevel@tonic-gate for (i = 0; authmethods[i] != NULL; i++) { 619*0Sstevel@tonic-gate if (strcmp(authmethods[i]->name, "none") == 0) 620*0Sstevel@tonic-gate continue; 621*0Sstevel@tonic-gate if (required && !authmethods[i]->required) 622*0Sstevel@tonic-gate continue; 623*0Sstevel@tonic-gate if (sufficient && !required && !authmethods[i]->sufficient) 624*0Sstevel@tonic-gate continue; 625*0Sstevel@tonic-gate if (authmethods[i]->not_again) 626*0Sstevel@tonic-gate continue; 627*0Sstevel@tonic-gate 628*0Sstevel@tonic-gate if (authmethods[i]->required) { 629*0Sstevel@tonic-gate if (buffer_len(&b) > 0) 630*0Sstevel@tonic-gate buffer_append(&b, ",", 1); 631*0Sstevel@tonic-gate buffer_append(&b, authmethods[i]->name, 632*0Sstevel@tonic-gate strlen(authmethods[i]->name)); 633*0Sstevel@tonic-gate continue; 634*0Sstevel@tonic-gate } 635*0Sstevel@tonic-gate 636*0Sstevel@tonic-gate /* 637*0Sstevel@tonic-gate * A method can be enabled (marked sufficient) 638*0Sstevel@tonic-gate * dynamically provided that at least one other method 639*0Sstevel@tonic-gate * has succeeded partially. 640*0Sstevel@tonic-gate */ 641*0Sstevel@tonic-gate if ((partial && authmethods[i]->sufficient) || 642*0Sstevel@tonic-gate (authmethods[i]->enabled != NULL && 643*0Sstevel@tonic-gate *(authmethods[i]->enabled) != 0)) { 644*0Sstevel@tonic-gate if (buffer_len(&b) > 0) 645*0Sstevel@tonic-gate buffer_append(&b, ",", 1); 646*0Sstevel@tonic-gate buffer_append(&b, authmethods[i]->name, 647*0Sstevel@tonic-gate strlen(authmethods[i]->name)); 648*0Sstevel@tonic-gate } 649*0Sstevel@tonic-gate } 650*0Sstevel@tonic-gate buffer_append(&b, "\0", 1); 651*0Sstevel@tonic-gate list = xstrdup(buffer_ptr(&b)); 652*0Sstevel@tonic-gate buffer_free(&b); 653*0Sstevel@tonic-gate return list; 654*0Sstevel@tonic-gate } 655*0Sstevel@tonic-gate 656*0Sstevel@tonic-gate static Authmethod * 657*0Sstevel@tonic-gate authmethod_lookup(const char *name) 658*0Sstevel@tonic-gate { 659*0Sstevel@tonic-gate int i; 660*0Sstevel@tonic-gate 661*0Sstevel@tonic-gate /* 662*0Sstevel@tonic-gate * Method must be sufficient, required or enabled and must not 663*0Sstevel@tonic-gate * be marked as not able to run again 664*0Sstevel@tonic-gate */ 665*0Sstevel@tonic-gate if (name != NULL) 666*0Sstevel@tonic-gate for (i = 0; authmethods[i] != NULL; i++) 667*0Sstevel@tonic-gate if (((authmethods[i]->sufficient || 668*0Sstevel@tonic-gate authmethods[i]->required) || 669*0Sstevel@tonic-gate (authmethods[i]->enabled != NULL && 670*0Sstevel@tonic-gate *(authmethods[i]->enabled) != 0)) && 671*0Sstevel@tonic-gate !authmethods[i]->not_again && 672*0Sstevel@tonic-gate strcmp(name, authmethods[i]->name) == 0) 673*0Sstevel@tonic-gate return authmethods[i]; 674*0Sstevel@tonic-gate debug2("Unrecognized authentication method name: %s", 675*0Sstevel@tonic-gate name ? name : "NULL"); 676*0Sstevel@tonic-gate return NULL; 677*0Sstevel@tonic-gate } 678*0Sstevel@tonic-gate 679*0Sstevel@tonic-gate static void 680*0Sstevel@tonic-gate authmethod_count_attempt(Authmethod *method) 681*0Sstevel@tonic-gate { 682*0Sstevel@tonic-gate if (!method) 683*0Sstevel@tonic-gate fatal("Internal error in authmethod_count_attempt()"); 684*0Sstevel@tonic-gate 685*0Sstevel@tonic-gate if (method->postponed) 686*0Sstevel@tonic-gate return; 687*0Sstevel@tonic-gate 688*0Sstevel@tonic-gate method->attempts++; 689*0Sstevel@tonic-gate 690*0Sstevel@tonic-gate if (method->abandoned) 691*0Sstevel@tonic-gate method->abandons++; 692*0Sstevel@tonic-gate else if (method->authenticated) 693*0Sstevel@tonic-gate method->successes++; 694*0Sstevel@tonic-gate else 695*0Sstevel@tonic-gate method->failures++; 696*0Sstevel@tonic-gate 697*0Sstevel@tonic-gate return; 698*0Sstevel@tonic-gate } 699