1 /* 2 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * All rights reserved 5 * Rhosts authentication. This file contains code to check whether to admit 6 * the login based on rhosts authentication. This file also processes 7 * /etc/hosts.equiv. 8 * 9 * As far as I am concerned, the code I have written for this software 10 * can be used freely for any purpose. Any derived versions of this 11 * software must be clearly marked as such, and if the derived work is 12 * incompatible with the protocol description in the RFC file, it must be 13 * called by a name other than "ssh" or "Secure Shell". 14 */ 15 16 #include "includes.h" 17 RCSID("$OpenBSD: auth-rhosts.c,v 1.31 2003/06/02 09:17:34 markus Exp $"); 18 19 #include "packet.h" 20 #include "uidswap.h" 21 #include "pathnames.h" 22 #include "log.h" 23 #include "servconf.h" 24 #include "canohost.h" 25 #include "auth.h" 26 27 /* import */ 28 extern ServerOptions options; 29 extern int use_privsep; 30 31 /* 32 * This function processes an rhosts-style file (.rhosts, .shosts, or 33 * /etc/hosts.equiv). This returns true if authentication can be granted 34 * based on the file, and returns zero otherwise. 35 */ 36 37 static int 38 check_rhosts_file(const char *filename, const char *hostname, 39 const char *ipaddr, const char *client_user, 40 const char *server_user) 41 { 42 FILE *f; 43 char buf[1024]; /* Must not be larger than host, user, dummy below. */ 44 45 /* Open the .rhosts file, deny if unreadable */ 46 f = fopen(filename, "r"); 47 if (!f) 48 return 0; 49 50 while (fgets(buf, sizeof(buf), f)) { 51 /* All three must be at least as big as buf to avoid overflows. */ 52 char hostbuf[1024], userbuf[1024], dummy[1024], *host, *user, *cp; 53 int negated; 54 55 for (cp = buf; *cp == ' ' || *cp == '\t'; cp++) 56 ; 57 if (*cp == '#' || *cp == '\n' || !*cp) 58 continue; 59 60 /* 61 * NO_PLUS is supported at least on OSF/1. We skip it (we 62 * don't ever support the plus syntax). 63 */ 64 if (strncmp(cp, "NO_PLUS", 7) == 0) 65 continue; 66 67 /* 68 * This should be safe because each buffer is as big as the 69 * whole string, and thus cannot be overwritten. 70 */ 71 switch (sscanf(buf, "%1023s %1023s %1023s", hostbuf, userbuf, 72 dummy)) { 73 case 0: 74 auth_debug_add("Found empty line in %.100s.", filename); 75 continue; 76 case 1: 77 /* Host name only. */ 78 strlcpy(userbuf, server_user, sizeof(userbuf)); 79 break; 80 case 2: 81 /* Got both host and user name. */ 82 break; 83 case 3: 84 auth_debug_add("Found garbage in %.100s.", filename); 85 continue; 86 default: 87 /* Weird... */ 88 continue; 89 } 90 91 host = hostbuf; 92 user = userbuf; 93 negated = 0; 94 95 /* Process negated host names, or positive netgroups. */ 96 if (host[0] == '-') { 97 negated = 1; 98 host++; 99 } else if (host[0] == '+') 100 host++; 101 102 if (user[0] == '-') { 103 negated = 1; 104 user++; 105 } else if (user[0] == '+') 106 user++; 107 108 /* Check for empty host/user names (particularly '+'). */ 109 if (!host[0] || !user[0]) { 110 /* We come here if either was '+' or '-'. */ 111 auth_debug_add("Ignoring wild host/user names in %.100s.", 112 filename); 113 continue; 114 } 115 /* Verify that host name matches. */ 116 if (host[0] == '@') { 117 if (!innetgr(host + 1, hostname, NULL, NULL) && 118 !innetgr(host + 1, ipaddr, NULL, NULL)) 119 continue; 120 } else if (strcasecmp(host, hostname) && strcmp(host, ipaddr) != 0) 121 continue; /* Different hostname. */ 122 123 /* Verify that user name matches. */ 124 if (user[0] == '@') { 125 if (!innetgr(user + 1, NULL, client_user, NULL)) 126 continue; 127 } else if (strcmp(user, client_user) != 0) 128 continue; /* Different username. */ 129 130 /* Found the user and host. */ 131 fclose(f); 132 133 /* If the entry was negated, deny access. */ 134 if (negated) { 135 auth_debug_add("Matched negative entry in %.100s.", 136 filename); 137 return 0; 138 } 139 /* Accept authentication. */ 140 return 1; 141 } 142 143 /* Authentication using this file denied. */ 144 fclose(f); 145 return 0; 146 } 147 148 /* 149 * Tries to authenticate the user using the .shosts or .rhosts file. Returns 150 * true if authentication succeeds. If ignore_rhosts is true, only 151 * /etc/hosts.equiv will be considered (.rhosts and .shosts are ignored). 152 */ 153 154 int 155 auth_rhosts(struct passwd *pw, const char *client_user) 156 { 157 const char *hostname, *ipaddr; 158 159 hostname = get_canonical_hostname(options.use_dns); 160 ipaddr = get_remote_ipaddr(); 161 return auth_rhosts2(pw, client_user, hostname, ipaddr); 162 } 163 164 static int 165 auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostname, 166 const char *ipaddr) 167 { 168 char buf[1024]; 169 struct stat st; 170 static const char *rhosts_files[] = {".shosts", ".rhosts", NULL}; 171 u_int rhosts_file_index; 172 173 debug2("auth_rhosts2: clientuser %s hostname %s ipaddr %s", 174 client_user, hostname, ipaddr); 175 176 /* no user given */ 177 if (pw == NULL) 178 return 0; 179 180 /* Switch to the user's uid. */ 181 temporarily_use_uid(pw); 182 /* 183 * Quick check: if the user has no .shosts or .rhosts files, return 184 * failure immediately without doing costly lookups from name 185 * servers. 186 */ 187 for (rhosts_file_index = 0; rhosts_files[rhosts_file_index]; 188 rhosts_file_index++) { 189 /* Check users .rhosts or .shosts. */ 190 snprintf(buf, sizeof buf, "%.500s/%.100s", 191 pw->pw_dir, rhosts_files[rhosts_file_index]); 192 if (stat(buf, &st) >= 0) 193 break; 194 } 195 /* Switch back to privileged uid. */ 196 restore_uid(); 197 198 /* Deny if The user has no .shosts or .rhosts file and there are no system-wide files. */ 199 if (!rhosts_files[rhosts_file_index] && 200 stat(_PATH_RHOSTS_EQUIV, &st) < 0 && 201 stat(_PATH_SSH_HOSTS_EQUIV, &st) < 0) 202 return 0; 203 204 /* If not logging in as superuser, try /etc/hosts.equiv and shosts.equiv. */ 205 if (pw->pw_uid != 0) { 206 if (check_rhosts_file(_PATH_RHOSTS_EQUIV, hostname, ipaddr, 207 client_user, pw->pw_name)) { 208 auth_debug_add("Accepted for %.100s [%.100s] by /etc/hosts.equiv.", 209 hostname, ipaddr); 210 return 1; 211 } 212 if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr, 213 client_user, pw->pw_name)) { 214 auth_debug_add("Accepted for %.100s [%.100s] by %.100s.", 215 hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV); 216 return 1; 217 } 218 } 219 /* 220 * Check that the home directory is owned by root or the user, and is 221 * not group or world writable. 222 */ 223 if (stat(pw->pw_dir, &st) < 0) { 224 logit("Rhosts authentication refused for %.100s: " 225 "no home directory %.200s", pw->pw_name, pw->pw_dir); 226 auth_debug_add("Rhosts authentication refused for %.100s: " 227 "no home directory %.200s", pw->pw_name, pw->pw_dir); 228 return 0; 229 } 230 if (options.strict_modes && 231 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || 232 (st.st_mode & 022) != 0)) { 233 logit("Rhosts authentication refused for %.100s: " 234 "bad ownership or modes for home directory.", pw->pw_name); 235 auth_debug_add("Rhosts authentication refused for %.100s: " 236 "bad ownership or modes for home directory.", pw->pw_name); 237 return 0; 238 } 239 /* Temporarily use the user's uid. */ 240 temporarily_use_uid(pw); 241 242 /* Check all .rhosts files (currently .shosts and .rhosts). */ 243 for (rhosts_file_index = 0; rhosts_files[rhosts_file_index]; 244 rhosts_file_index++) { 245 /* Check users .rhosts or .shosts. */ 246 snprintf(buf, sizeof buf, "%.500s/%.100s", 247 pw->pw_dir, rhosts_files[rhosts_file_index]); 248 if (stat(buf, &st) < 0) 249 continue; 250 251 /* 252 * Make sure that the file is either owned by the user or by 253 * root, and make sure it is not writable by anyone but the 254 * owner. This is to help avoid novices accidentally 255 * allowing access to their account by anyone. 256 */ 257 if (options.strict_modes && 258 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || 259 (st.st_mode & 022) != 0)) { 260 logit("Rhosts authentication refused for %.100s: bad modes for %.200s", 261 pw->pw_name, buf); 262 auth_debug_add("Bad file modes for %.200s", buf); 263 continue; 264 } 265 /* Check if we have been configured to ignore .rhosts and .shosts files. */ 266 if (options.ignore_rhosts) { 267 auth_debug_add("Server has been configured to ignore %.100s.", 268 rhosts_files[rhosts_file_index]); 269 continue; 270 } 271 /* Check if authentication is permitted by the file. */ 272 if (check_rhosts_file(buf, hostname, ipaddr, client_user, pw->pw_name)) { 273 auth_debug_add("Accepted by %.100s.", 274 rhosts_files[rhosts_file_index]); 275 /* Restore the privileged uid. */ 276 restore_uid(); 277 auth_debug_add("Accepted host %s ip %s client_user %s server_user %s", 278 hostname, ipaddr, client_user, pw->pw_name); 279 return 1; 280 } 281 } 282 283 /* Restore the privileged uid. */ 284 restore_uid(); 285 return 0; 286 } 287 288 int 289 auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, 290 const char *ipaddr) 291 { 292 int ret; 293 294 auth_debug_reset(); 295 ret = auth_rhosts2_raw(pw, client_user, hostname, ipaddr); 296 if (!use_privsep) 297 auth_debug_send(); 298 return ret; 299 } 300