Annotation of embedaddon/sudo/plugins/sudoers/auth/sudo_auth.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (c) 1999-2005, 2008-2010 Todd C. Miller <Todd.Miller@courtesan.com>
! 3: *
! 4: * Permission to use, copy, modify, and distribute this software for any
! 5: * purpose with or without fee is hereby granted, provided that the above
! 6: * copyright notice and this permission notice appear in all copies.
! 7: *
! 8: * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
! 9: * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
! 10: * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
! 11: * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
! 12: * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
! 13: * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
! 14: * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
! 15: *
! 16: * Sponsored in part by the Defense Advanced Research Projects
! 17: * Agency (DARPA) and Air Force Research Laboratory, Air Force
! 18: * Materiel Command, USAF, under agreement number F39502-99-1-0512.
! 19: */
! 20:
! 21: #include <config.h>
! 22:
! 23: #include <sys/types.h>
! 24: #include <sys/param.h>
! 25: #include <stdio.h>
! 26: #ifdef STDC_HEADERS
! 27: # include <stdlib.h>
! 28: # include <stddef.h>
! 29: #else
! 30: # ifdef HAVE_STDLIB_H
! 31: # include <stdlib.h>
! 32: # endif
! 33: #endif /* STDC_HEADERS */
! 34: #ifdef HAVE_STRING_H
! 35: # include <string.h>
! 36: #endif /* HAVE_STRING_H */
! 37: #ifdef HAVE_STRINGS_H
! 38: # include <strings.h>
! 39: #endif /* HAVE_STRINGS_H */
! 40: #ifdef HAVE_UNISTD_H
! 41: # include <unistd.h>
! 42: #endif /* HAVE_UNISTD_H */
! 43: #include <pwd.h>
! 44: #include <time.h>
! 45: #include <signal.h>
! 46:
! 47: #include "sudoers.h"
! 48: #include "sudo_auth.h"
! 49: #include "insults.h"
! 50:
! 51: static sudo_auth auth_switch[] = {
! 52: /* Standalone entries first */
! 53: #ifdef HAVE_PAM
! 54: AUTH_ENTRY("pam", FLAG_STANDALONE, pam_init, NULL, pam_verify, pam_cleanup, pam_begin_session, pam_end_session)
! 55: #endif
! 56: #ifdef HAVE_SECURID
! 57: AUTH_ENTRY("SecurId", FLAG_STANDALONE, securid_init, securid_setup, securid_verify, NULL, NULL, NULL)
! 58: #endif
! 59: #ifdef HAVE_SIA_SES_INIT
! 60: AUTH_ENTRY("sia", FLAG_STANDALONE, NULL, sia_setup, sia_verify, sia_cleanup, NULL, NULL)
! 61: #endif
! 62: #ifdef HAVE_AIXAUTH
! 63: AUTH_ENTRY("aixauth", FLAG_STANDALONE, NULL, NULL, aixauth_verify, aixauth_cleanup, NULL, NULL)
! 64: #endif
! 65: #ifdef HAVE_FWTK
! 66: AUTH_ENTRY("fwtk", FLAG_STANDALONE, fwtk_init, NULL, fwtk_verify, fwtk_cleanup, NULL, NULL)
! 67: #endif
! 68: #ifdef HAVE_BSD_AUTH_H
! 69: AUTH_ENTRY("bsdauth", FLAG_STANDALONE, bsdauth_init, NULL, bsdauth_verify, bsdauth_cleanup, NULL, NULL)
! 70: #endif
! 71:
! 72: /* Non-standalone entries */
! 73: #ifndef WITHOUT_PASSWD
! 74: AUTH_ENTRY("passwd", 0, passwd_init, NULL, passwd_verify, passwd_cleanup, NULL, NULL)
! 75: #endif
! 76: #if defined(HAVE_GETPRPWNAM) && !defined(WITHOUT_PASSWD)
! 77: AUTH_ENTRY("secureware", 0, secureware_init, NULL, secureware_verify, secureware_cleanup, NULL, NULL)
! 78: #endif
! 79: #ifdef HAVE_AFS
! 80: AUTH_ENTRY("afs", 0, NULL, NULL, afs_verify, NULL, NULL, NULL)
! 81: #endif
! 82: #ifdef HAVE_DCE
! 83: AUTH_ENTRY("dce", 0, NULL, NULL, dce_verify, NULL, NULL, NULL)
! 84: #endif
! 85: #ifdef HAVE_KERB4
! 86: AUTH_ENTRY("kerb4", 0, kerb4_init, NULL, kerb4_verify, NULL, NULL, NULL)
! 87: #endif
! 88: #ifdef HAVE_KERB5
! 89: AUTH_ENTRY("kerb5", 0, kerb5_init, kerb5_setup, kerb5_verify, kerb5_cleanup, NULL, NULL)
! 90: #endif
! 91: #ifdef HAVE_SKEY
! 92: AUTH_ENTRY("S/Key", 0, NULL, rfc1938_setup, rfc1938_verify, NULL, NULL, NULL)
! 93: #endif
! 94: #ifdef HAVE_OPIE
! 95: AUTH_ENTRY("OPIE", 0, NULL, rfc1938_setup, rfc1938_verify, NULL, NULL, NULL)
! 96: #endif
! 97: AUTH_ENTRY(NULL, 0, NULL, NULL, NULL, NULL, NULL, NULL)
! 98: };
! 99:
! 100: static int standalone;
! 101:
! 102: extern char **NewArgv; /* XXX - for auditing */
! 103:
! 104: static void pass_warn(void);
! 105:
! 106: int
! 107: sudo_auth_init(struct passwd *pw)
! 108: {
! 109: sudo_auth *auth;
! 110: int status = AUTH_SUCCESS;
! 111:
! 112: if (auth_switch[0].name == NULL)
! 113: return TRUE;
! 114:
! 115: /* Make sure we haven't mixed standalone and shared auth methods. */
! 116: standalone = IS_STANDALONE(&auth_switch[0]);
! 117: if (standalone && auth_switch[1].name != NULL) {
! 118: audit_failure(NewArgv, "invalid authentication methods");
! 119: log_error(0, _("Invalid authentication methods compiled into sudo! "
! 120: "You may mix standalone and non-standalone authentication."));
! 121: return -1;
! 122: }
! 123:
! 124: /* Set FLAG_ONEANDONLY if there is only one auth method. */
! 125: if (auth_switch[1].name == NULL)
! 126: SET(auth_switch[0].flags, FLAG_ONEANDONLY);
! 127:
! 128: /* Initialize auth methods and unconfigure the method if necessary. */
! 129: for (auth = auth_switch; auth->name; auth++) {
! 130: if (auth->init && !IS_DISABLED(auth)) {
! 131: if (NEEDS_USER(auth))
! 132: set_perms(PERM_USER);
! 133:
! 134: status = (auth->init)(pw, auth);
! 135:
! 136: if (NEEDS_USER(auth))
! 137: restore_perms();
! 138:
! 139: if (status == AUTH_FAILURE)
! 140: SET(auth->flags, FLAG_DISABLED);
! 141: else if (status == AUTH_FATAL) {
! 142: /* XXX log */
! 143: audit_failure(NewArgv, "authentication failure");
! 144: break; /* assume error msg already printed */
! 145: }
! 146: }
! 147: }
! 148: return status == AUTH_FATAL ? -1 : TRUE;
! 149: }
! 150:
! 151: int
! 152: sudo_auth_cleanup(struct passwd *pw)
! 153: {
! 154: sudo_auth *auth;
! 155: int status = AUTH_SUCCESS;
! 156:
! 157: /* Call cleanup routines. */
! 158: for (auth = auth_switch; auth->name; auth++) {
! 159: if (auth->cleanup && !IS_DISABLED(auth)) {
! 160: if (NEEDS_USER(auth))
! 161: set_perms(PERM_USER);
! 162:
! 163: status = (auth->cleanup)(pw, auth);
! 164:
! 165: if (NEEDS_USER(auth))
! 166: restore_perms();
! 167:
! 168: if (status == AUTH_FATAL) {
! 169: /* XXX log */
! 170: audit_failure(NewArgv, "authentication failure");
! 171: break; /* assume error msg already printed */
! 172: }
! 173: }
! 174: }
! 175: return status == AUTH_FATAL ? -1 : TRUE;
! 176: }
! 177:
! 178: int
! 179: verify_user(struct passwd *pw, char *prompt)
! 180: {
! 181: int counter = def_passwd_tries + 1;
! 182: int success = AUTH_FAILURE;
! 183: int flags, status, rval;
! 184: char *p;
! 185: sudo_auth *auth;
! 186: sigaction_t sa, osa;
! 187:
! 188: /* Enable suspend during password entry. */
! 189: sigemptyset(&sa.sa_mask);
! 190: sa.sa_flags = SA_RESTART;
! 191: sa.sa_handler = SIG_DFL;
! 192: (void) sigaction(SIGTSTP, &sa, &osa);
! 193:
! 194: /* Make sure we have at least one auth method. */
! 195: /* XXX - check FLAG_DISABLED too */
! 196: if (auth_switch[0].name == NULL) {
! 197: audit_failure(NewArgv, "no authentication methods");
! 198: log_error(0,
! 199: _("There are no authentication methods compiled into sudo! "
! 200: "If you want to turn off authentication, use the "
! 201: "--disable-authentication configure option."));
! 202: return -1;
! 203: }
! 204:
! 205: while (--counter) {
! 206: /* Do any per-method setup and unconfigure the method if needed */
! 207: for (auth = auth_switch; auth->name; auth++) {
! 208: if (auth->setup && !IS_DISABLED(auth)) {
! 209: if (NEEDS_USER(auth))
! 210: set_perms(PERM_USER);
! 211:
! 212: status = (auth->setup)(pw, &prompt, auth);
! 213:
! 214: if (NEEDS_USER(auth))
! 215: restore_perms();
! 216:
! 217: if (status == AUTH_FAILURE)
! 218: SET(auth->flags, FLAG_DISABLED);
! 219: else if (status == AUTH_FATAL) {
! 220: /* XXX log */
! 221: audit_failure(NewArgv, "authentication failure");
! 222: return -1; /* assume error msg already printed */
! 223: }
! 224: }
! 225: }
! 226:
! 227: /* Get the password unless the auth function will do it for us */
! 228: if (standalone) {
! 229: p = prompt;
! 230: } else {
! 231: p = auth_getpass(prompt, def_passwd_timeout * 60,
! 232: SUDO_CONV_PROMPT_ECHO_OFF);
! 233: if (p == NULL)
! 234: break;
! 235: }
! 236:
! 237: /* Call authentication functions. */
! 238: for (auth = auth_switch; auth->name; auth++) {
! 239: if (IS_DISABLED(auth))
! 240: continue;
! 241:
! 242: if (NEEDS_USER(auth))
! 243: set_perms(PERM_USER);
! 244:
! 245: success = auth->status = (auth->verify)(pw, p, auth);
! 246:
! 247: if (NEEDS_USER(auth))
! 248: restore_perms();
! 249:
! 250: if (auth->status != AUTH_FAILURE)
! 251: goto done;
! 252: }
! 253: if (!standalone)
! 254: zero_bytes(p, strlen(p));
! 255: pass_warn();
! 256: }
! 257:
! 258: done:
! 259: switch (success) {
! 260: case AUTH_SUCCESS:
! 261: (void) sigaction(SIGTSTP, &osa, NULL);
! 262: rval = TRUE;
! 263: break;
! 264: case AUTH_INTR:
! 265: case AUTH_FAILURE:
! 266: if (counter != def_passwd_tries) {
! 267: if (def_mail_badpass || def_mail_always)
! 268: flags = 0;
! 269: else
! 270: flags = NO_MAIL;
! 271: log_error(flags, ngettext("%d incorrect password attempt",
! 272: "%d incorrect password attempts",
! 273: def_passwd_tries - counter), def_passwd_tries - counter);
! 274: }
! 275: audit_failure(NewArgv, "authentication failure");
! 276: rval = FALSE;
! 277: break;
! 278: case AUTH_FATAL:
! 279: default:
! 280: audit_failure(NewArgv, "authentication failure");
! 281: rval = -1;
! 282: break;
! 283: }
! 284:
! 285: return rval;
! 286: }
! 287:
! 288: int
! 289: sudo_auth_begin_session(struct passwd *pw)
! 290: {
! 291: sudo_auth *auth;
! 292: int status;
! 293:
! 294: for (auth = auth_switch; auth->name; auth++) {
! 295: if (auth->begin_session && !IS_DISABLED(auth)) {
! 296: status = (auth->begin_session)(pw, auth);
! 297: if (status == AUTH_FATAL) {
! 298: /* XXX log */
! 299: audit_failure(NewArgv, "authentication failure");
! 300: return -1; /* assume error msg already printed */
! 301: }
! 302: }
! 303: }
! 304: return TRUE;
! 305: }
! 306:
! 307: int
! 308: sudo_auth_end_session(struct passwd *pw)
! 309: {
! 310: sudo_auth *auth;
! 311: int status;
! 312:
! 313: for (auth = auth_switch; auth->name; auth++) {
! 314: if (auth->end_session && !IS_DISABLED(auth)) {
! 315: status = (auth->end_session)(pw, auth);
! 316: if (status == AUTH_FATAL) {
! 317: /* XXX log */
! 318: return -1; /* assume error msg already printed */
! 319: }
! 320: }
! 321: }
! 322: return TRUE;
! 323: }
! 324:
! 325: static void
! 326: pass_warn(void)
! 327: {
! 328: const char *warning = def_badpass_message;
! 329:
! 330: #ifdef INSULT
! 331: if (def_insults)
! 332: warning = INSULT;
! 333: #endif
! 334: sudo_printf(SUDO_CONV_ERROR_MSG, "%s\n", warning);
! 335: }
! 336:
! 337: char *
! 338: auth_getpass(const char *prompt, int timeout, int type)
! 339: {
! 340: struct sudo_conv_message msg;
! 341: struct sudo_conv_reply repl;
! 342:
! 343: /* Mask user input if pwfeedback set and echo is off. */
! 344: if (type == SUDO_CONV_PROMPT_ECHO_OFF && def_pwfeedback)
! 345: type = SUDO_CONV_PROMPT_MASK;
! 346:
! 347: /* If visiblepw set, do not error out if there is no tty. */
! 348: if (def_visiblepw)
! 349: type |= SUDO_CONV_PROMPT_ECHO_OK;
! 350:
! 351: /* Call conversation function */
! 352: memset(&msg, 0, sizeof(msg));
! 353: msg.msg_type = type;
! 354: msg.timeout = def_passwd_timeout * 60;
! 355: msg.msg = prompt;
! 356: memset(&repl, 0, sizeof(repl));
! 357: sudo_conv(1, &msg, &repl);
! 358: /* XXX - check for ENOTTY? */
! 359: return repl.reply;
! 360: }
! 361:
! 362: void
! 363: dump_auth_methods(void)
! 364: {
! 365: sudo_auth *auth;
! 366:
! 367: sudo_printf(SUDO_CONV_INFO_MSG, _("Authentication methods:"));
! 368: for (auth = auth_switch; auth->name; auth++)
! 369: sudo_printf(SUDO_CONV_INFO_MSG, " '%s'", auth->name);
! 370: sudo_printf(SUDO_CONV_INFO_MSG, "\n");
! 371: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudo_auth.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / plugins / sudoers / auth