Annotation of embedaddon/sudo/plugins/sudoers/auth/securid5.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (c) 1999-2005, 2007, 2010-2011
! 3: * Todd C. Miller <Todd.Miller@courtesan.com>
! 4: * Copyright (c) 2002 Michael Stroucken <michael@stroucken.org>
! 5: *
! 6: * Permission to use, copy, modify, and distribute this software for any
! 7: * purpose with or without fee is hereby granted, provided that the above
! 8: * copyright notice and this permission notice appear in all copies.
! 9: *
! 10: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
! 11: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
! 12: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
! 13: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
! 14: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
! 15: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
! 16: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
! 17: * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
! 18: * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
! 19: * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
! 20: *
! 21: * Sponsored in part by the Defense Advanced Research Projects
! 22: * Agency (DARPA) and Air Force Research Laboratory, Air Force
! 23: * Materiel Command, USAF, under agreement number F39502-99-1-0512.
! 24: */
! 25:
! 26: #include <config.h>
! 27:
! 28: #include <sys/types.h>
! 29: #include <sys/param.h>
! 30: #include <stdio.h>
! 31: #ifdef STDC_HEADERS
! 32: # include <stdlib.h>
! 33: # include <stddef.h>
! 34: #else
! 35: # ifdef HAVE_STDLIB_H
! 36: # include <stdlib.h>
! 37: # endif
! 38: #endif /* STDC_HEADERS */
! 39: #ifdef HAVE_STRING_H
! 40: # include <string.h>
! 41: #endif /* HAVE_STRING_H */
! 42: #ifdef HAVE_STRINGS_H
! 43: # include <strings.h>
! 44: #endif /* HAVE_STRINGS_H */
! 45: #ifdef HAVE_UNISTD_H
! 46: # include <unistd.h>
! 47: #endif /* HAVE_UNISTD_H */
! 48: #include <pwd.h>
! 49:
! 50: /* Needed for SecurID v5.0 Authentication on UNIX */
! 51: #define UNIX 1
! 52: #include <acexport.h>
! 53: #include <sdacmvls.h>
! 54:
! 55: #include "sudoers.h"
! 56: #include "sudo_auth.h"
! 57:
! 58: /*
! 59: * securid_init - Initialises communications with ACE server
! 60: * Arguments in:
! 61: * pw - UNUSED
! 62: * auth - sudo authentication structure
! 63: *
! 64: * Results out:
! 65: * auth - auth->data contains pointer to new SecurID handle
! 66: * return code - Fatal if initialization unsuccessful, otherwise
! 67: * success.
! 68: */
! 69: int
! 70: securid_init(struct passwd *pw, sudo_auth *auth)
! 71: {
! 72: static SDI_HANDLE sd_dat; /* SecurID handle */
! 73:
! 74: auth->data = (void *) &sd_dat; /* For method-specific data */
! 75:
! 76: /* Start communications */
! 77: if (AceInitialize() != SD_FALSE)
! 78: return AUTH_SUCCESS;
! 79:
! 80: warningx(_("failed to initialise the ACE API library"));
! 81: return AUTH_FATAL;
! 82: }
! 83:
! 84: /*
! 85: * securid_setup - Initialises a SecurID transaction and locks out other
! 86: * ACE servers
! 87: *
! 88: * Arguments in:
! 89: * pw - struct passwd for username
! 90: * promptp - UNUSED
! 91: * auth - sudo authentication structure for SecurID handle
! 92: *
! 93: * Results out:
! 94: * return code - Success if transaction started correctly, fatal
! 95: * otherwise
! 96: */
! 97: int
! 98: securid_setup(struct passwd *pw, char **promptp, sudo_auth *auth)
! 99: {
! 100: SDI_HANDLE *sd = (SDI_HANDLE *) auth->data;
! 101: int retval;
! 102:
! 103: /* Re-initialize SecurID every time. */
! 104: if (SD_Init(sd) != ACM_OK) {
! 105: warningx(_("unable to contact the SecurID server"));
! 106: return AUTH_FATAL;
! 107: }
! 108:
! 109: /* Lock new PIN code */
! 110: retval = SD_Lock(*sd, pw->pw_name);
! 111:
! 112: switch (retval) {
! 113: case ACM_OK:
! 114: warningx(_("User ID locked for SecurID Authentication"));
! 115: return AUTH_SUCCESS;
! 116:
! 117: case ACE_UNDEFINED_USERNAME:
! 118: warningx(_("invalid username length for SecurID"));
! 119: return AUTH_FATAL;
! 120:
! 121: case ACE_ERR_INVALID_HANDLE:
! 122: warningx(_("invalid Authentication Handle for SecurID"));
! 123: return AUTH_FATAL;
! 124:
! 125: case ACM_ACCESS_DENIED:
! 126: warningx(_("SecurID communication failed"));
! 127: return AUTH_FATAL;
! 128:
! 129: default:
! 130: warningx(_("unknown SecurID error"));
! 131: return AUTH_FATAL;
! 132: }
! 133: }
! 134:
! 135: /*
! 136: * securid_verify - Authenticates user and handles ACE responses
! 137: *
! 138: * Arguments in:
! 139: * pw - struct passwd for username
! 140: * pass - UNUSED
! 141: * auth - sudo authentication structure for SecurID handle
! 142: *
! 143: * Results out:
! 144: * return code - Success on successful authentication, failure on
! 145: * incorrect authentication, fatal on errors
! 146: */
! 147: int
! 148: securid_verify(struct passwd *pw, char *pass, sudo_auth *auth)
! 149: {
! 150: SDI_HANDLE *sd = (SDI_HANDLE *) auth->data;
! 151: int rval;
! 152:
! 153: pass = auth_getpass("Enter your PASSCODE: ",
! 154: def_passwd_timeout * 60, SUDO_CONV_PROMPT_ECHO_OFF);
! 155:
! 156: /* Have ACE verify password */
! 157: switch (SD_Check(*sd, pass, pw->pw_name)) {
! 158: case ACM_OK:
! 159: rval = AUTH_SUCESS;
! 160: break;
! 161:
! 162: case ACE_UNDEFINED_PASSCODE:
! 163: warningx(_("invalid passcode length for SecurID"));
! 164: rval = AUTH_FATAL;
! 165: break;
! 166:
! 167: case ACE_UNDEFINED_USERNAME:
! 168: warningx(_("invalid username length for SecurID"));
! 169: rval = AUTH_FATAL;
! 170: break;
! 171:
! 172: case ACE_ERR_INVALID_HANDLE:
! 173: warningx(_("invalid Authentication Handle for SecurID"));
! 174: rval = AUTH_FATAL;
! 175: break;
! 176:
! 177: case ACM_ACCESS_DENIED:
! 178: rval = AUTH_FAILURE;
! 179: break;
! 180:
! 181: case ACM_NEXT_CODE_REQUIRED:
! 182: /* Sometimes (when current token close to expire?)
! 183: ACE challenges for the next token displayed
! 184: (entered without the PIN) */
! 185: pass = auth_getpass("\
! 186: !!! ATTENTION !!!\n\
! 187: Wait for the token code to change, \n\
! 188: then enter the new token code.\n", \
! 189: def_passwd_timeout * 60, SUDO_CONV_PROMPT_ECHO_OFF);
! 190:
! 191: if (SD_Next(*sd, pass) == ACM_OK) {
! 192: rval = AUTH_SUCCESS;
! 193: break;
! 194: }
! 195:
! 196: rval = AUTH_FAILURE;
! 197: break;
! 198:
! 199: case ACM_NEW_PIN_REQUIRED:
! 200: /*
! 201: * This user's SecurID has not been activated yet,
! 202: * or the pin has been reset
! 203: */
! 204: /* XXX - Is setting up a new PIN within sudo's scope? */
! 205: SD_Pin(*sd, "");
! 206: fprintf(stderr, "Your SecurID access has not yet been set up.\n");
! 207: fprintf(stderr, "Please set up a PIN before you try to authenticate.\n");
! 208: rval = AUTH_FATAL;
! 209: break;
! 210:
! 211: default:
! 212: warningx(_("unknown SecurID error"));
! 213: rval = AUTH_FATAL;
! 214: break;
! 215: }
! 216:
! 217: /* Free resources */
! 218: SD_Close(*sd);
! 219:
! 220: /* Return stored state to calling process */
! 221: return rval;
! 222: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to securid5.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers / auth