29
30/* Session id for the current session. */
31unsigned char session_id[16];
32
33/* authentications supported by server */
34unsigned int supported_authentications;
35
36extern Options options;
37extern char *__progname;
38
39/*
40 * Connect to the given ssh server using a proxy command.
41 */
42int
43ssh_proxy_connect(const char *host, u_short port, uid_t original_real_uid,
44 const char *proxy_command)
45{
46 Buffer command;
47 const char *cp;
48 char *command_string;
49 int pin[2], pout[2];
50 int pid;
51 char strport[NI_MAXSERV];
52
53 /* Convert the port number into a string. */
54 snprintf(strport, sizeof strport, "%hu", port);
55
56 /* Build the final command string in the buffer by making the
57 appropriate substitutions to the given proxy command. */
58 buffer_init(&command);
59 for (cp = proxy_command; *cp; cp++) {
60 if (cp[0] == '%' && cp[1] == '%') {
61 buffer_append(&command, "%", 1);
62 cp++;
63 continue;
64 }
65 if (cp[0] == '%' && cp[1] == 'h') {
66 buffer_append(&command, host, strlen(host));
67 cp++;
68 continue;
69 }
70 if (cp[0] == '%' && cp[1] == 'p') {
71 buffer_append(&command, strport, strlen(strport));
72 cp++;
73 continue;
74 }
75 buffer_append(&command, cp, 1);
76 }
77 buffer_append(&command, "\0", 1);
78
79 /* Get the final command string. */
80 command_string = buffer_ptr(&command);
81
82 /* Create pipes for communicating with the proxy. */
83 if (pipe(pin) < 0 || pipe(pout) < 0)
84 fatal("Could not create pipes to communicate with the proxy: %.100s",
85 strerror(errno));
86
87 debug("Executing proxy command: %.500s", command_string);
88
89 /* Fork and execute the proxy command. */
90 if ((pid = fork()) == 0) {
91 char *argv[10];
92
93 /* Child. Permanently give up superuser privileges. */
94 permanently_set_uid(original_real_uid);
95
96 /* Redirect stdin and stdout. */
97 close(pin[1]);
98 if (pin[0] != 0) {
99 if (dup2(pin[0], 0) < 0)
100 perror("dup2 stdin");
101 close(pin[0]);
102 }
103 close(pout[0]);
104 if (dup2(pout[1], 1) < 0)
105 perror("dup2 stdout");
106 /* Cannot be 1 because pin allocated two descriptors. */
107 close(pout[1]);
108
109 /* Stderr is left as it is so that error messages get
110 printed on the user's terminal. */
111 argv[0] = "/bin/sh";
112 argv[1] = "-c";
113 argv[2] = command_string;
114 argv[3] = NULL;
115
116 /* Execute the proxy command. Note that we gave up any
117 extra privileges above. */
118 execv("/bin/sh", argv);
119 perror("/bin/sh");
120 exit(1);
121 }
122 /* Parent. */
123 if (pid < 0)
124 fatal("fork failed: %.100s", strerror(errno));
125
126 /* Close child side of the descriptors. */
127 close(pin[0]);
128 close(pout[1]);
129
130 /* Free the command name. */
131 buffer_free(&command);
132
133 /* Set the connection file descriptors. */
134 packet_set_connection(pout[0], pin[1]);
135
136 return 1;
137}
138
139/*
140 * Creates a (possibly privileged) socket for use as the ssh connection.
141 */
142int
143ssh_create_socket(uid_t original_real_uid, int privileged, int family)
144{
145 int sock;
146
147 /*
148 * If we are running as root and want to connect to a privileged
149 * port, bind our own socket to a privileged port.
150 */
151 if (privileged) {
152 int p = IPPORT_RESERVED - 1;
153 sock = rresvport_af(&p, family);
154 if (sock < 0)
155 error("rresvport: af=%d %.100s", family, strerror(errno));
156 else
157 debug("Allocated local port %d.", p);
158 } else {
159 /*
160 * Just create an ordinary socket on arbitrary port. We use
161 * the user's uid to create the socket.
162 */
163 temporarily_use_uid(original_real_uid);
164 sock = socket(family, SOCK_STREAM, 0);
165 if (sock < 0)
166 error("socket: %.100s", strerror(errno));
167 restore_uid();
168 }
169 return sock;
170}
171
172/*
173 * Opens a TCP/IP connection to the remote server on the given host.
174 * The address of the remote host will be returned in hostaddr.
175 * If port is 0, the default port will be used. If anonymous is zero,
176 * a privileged port will be allocated to make the connection.
177 * This requires super-user privileges if anonymous is false.
178 * Connection_attempts specifies the maximum number of tries (one per
179 * second). If proxy_command is non-NULL, it specifies the command (with %h
180 * and %p substituted for host and port, respectively) to use to contact
181 * the daemon.
182 */
183int
184ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
185 u_short port, int connection_attempts,
186 int anonymous, uid_t original_real_uid,
187 const char *proxy_command)
188{
189 int sock = -1, attempt;
190 struct servent *sp;
191 struct addrinfo hints, *ai, *aitop;
192 char ntop[NI_MAXHOST], strport[NI_MAXSERV];
193 int gaierr;
194 struct linger linger;
195
196 debug("ssh_connect: getuid %d geteuid %d anon %d",
197 (int) getuid(), (int) geteuid(), anonymous);
198
199 /* Get default port if port has not been set. */
200 if (port == 0) {
201 sp = getservbyname(SSH_SERVICE_NAME, "tcp");
202 if (sp)
203 port = ntohs(sp->s_port);
204 else
205 port = SSH_DEFAULT_PORT;
206 }
207 /* If a proxy command is given, connect using it. */
208 if (proxy_command != NULL)
209 return ssh_proxy_connect(host, port, original_real_uid, proxy_command);
210
211 /* No proxy command. */
212
213 memset(&hints, 0, sizeof(hints));
214 hints.ai_family = IPv4or6;
215 hints.ai_socktype = SOCK_STREAM;
216 snprintf(strport, sizeof strport, "%d", port);
217 if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)
218 fatal("%s: %.100s: %s", __progname, host,
219 gai_strerror(gaierr));
220
221 /*
222 * Try to connect several times. On some machines, the first time
223 * will sometimes fail. In general socket code appears to behave
224 * quite magically on many machines.
225 */
226 for (attempt = 0; attempt < connection_attempts; attempt++) {
227 if (attempt > 0)
228 debug("Trying again...");
229
230 /* Loop through addresses for this host, and try each one in
231 sequence until the connection succeeds. */
232 for (ai = aitop; ai; ai = ai->ai_next) {
233 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
234 continue;
235 if (getnameinfo(ai->ai_addr, ai->ai_addrlen,
236 ntop, sizeof(ntop), strport, sizeof(strport),
237 NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
238 error("ssh_connect: getnameinfo failed");
239 continue;
240 }
241 debug("Connecting to %.200s [%.100s] port %s.",
242 host, ntop, strport);
243
244 /* Create a socket for connecting. */
245 sock = ssh_create_socket(original_real_uid,
246 !anonymous && geteuid() == 0 && port < IPPORT_RESERVED,
247 ai->ai_family);
248 if (sock < 0)
249 continue;
250
251 /* Connect to the host. We use the user's uid in the
252 * hope that it will help with tcp_wrappers showing
253 * the remote uid as root.
254 */
255 temporarily_use_uid(original_real_uid);
256 if (connect(sock, ai->ai_addr, ai->ai_addrlen) >= 0) {
257 /* Successful connection. */
258 memcpy(hostaddr, ai->ai_addr, sizeof(*hostaddr));
259 restore_uid();
260 break;
261 } else {
262 debug("connect: %.100s", strerror(errno));
263 restore_uid();
264 /*
265 * Close the failed socket; there appear to
266 * be some problems when reusing a socket for
267 * which connect() has already returned an
268 * error.
269 */
270 shutdown(sock, SHUT_RDWR);
271 close(sock);
272 }
273 }
274 if (ai)
275 break; /* Successful connection. */
276
277 /* Sleep a moment before retrying. */
278 sleep(1);
279 }
280
281 freeaddrinfo(aitop);
282
283 /* Return failure if we didn't get a successful connection. */
284 if (attempt >= connection_attempts)
285 return 0;
286
287 debug("Connection established.");
288
289 /*
290 * Set socket options. We would like the socket to disappear as soon
291 * as it has been closed for whatever reason.
292 */
293 /* setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on)); */
294 linger.l_onoff = 1;
295 linger.l_linger = 5;
296 setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *) &linger, sizeof(linger));
297
298 /* Set the connection. */
299 packet_set_connection(sock, sock);
300
301 return 1;
302}
303
304/*
305 * Checks if the user has an authentication agent, and if so, tries to
306 * authenticate using the agent.
307 */
308int
309try_agent_authentication()
310{
311 int status, type;
312 char *comment;
313 AuthenticationConnection *auth;
314 unsigned char response[16];
315 unsigned int i;
316 BIGNUM *e, *n, *challenge;
317
318 /* Get connection to the agent. */
319 auth = ssh_get_authentication_connection();
320 if (!auth)
321 return 0;
322
323 e = BN_new();
324 n = BN_new();
325 challenge = BN_new();
326
327 /* Loop through identities served by the agent. */
328 for (status = ssh_get_first_identity(auth, e, n, &comment);
329 status;
330 status = ssh_get_next_identity(auth, e, n, &comment)) {
331 int plen, clen;
332
333 /* Try this identity. */
334 debug("Trying RSA authentication via agent with '%.100s'", comment);
335 xfree(comment);
336
337 /* Tell the server that we are willing to authenticate using this key. */
338 packet_start(SSH_CMSG_AUTH_RSA);
339 packet_put_bignum(n);
340 packet_send();
341 packet_write_wait();
342
343 /* Wait for server's response. */
344 type = packet_read(&plen);
345
346 /* The server sends failure if it doesn\'t like our key or
347 does not support RSA authentication. */
348 if (type == SSH_SMSG_FAILURE) {
349 debug("Server refused our key.");
350 continue;
351 }
352 /* Otherwise it should have sent a challenge. */
353 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
354 packet_disconnect("Protocol error during RSA authentication: %d",
355 type);
356
357 packet_get_bignum(challenge, &clen);
358
359 packet_integrity_check(plen, clen, type);
360
361 debug("Received RSA challenge from server.");
362
363 /* Ask the agent to decrypt the challenge. */
364 if (!ssh_decrypt_challenge(auth, e, n, challenge,
365 session_id, 1, response)) {
366 /* The agent failed to authenticate this identifier although it
367 advertised it supports this. Just return a wrong value. */
368 log("Authentication agent failed to decrypt challenge.");
369 memset(response, 0, sizeof(response));
370 }
371 debug("Sending response to RSA challenge.");
372
373 /* Send the decrypted challenge back to the server. */
374 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
375 for (i = 0; i < 16; i++)
376 packet_put_char(response[i]);
377 packet_send();
378 packet_write_wait();
379
380 /* Wait for response from the server. */
381 type = packet_read(&plen);
382
383 /* The server returns success if it accepted the authentication. */
384 if (type == SSH_SMSG_SUCCESS) {
385 debug("RSA authentication accepted by server.");
386 BN_clear_free(e);
387 BN_clear_free(n);
388 BN_clear_free(challenge);
389 return 1;
390 }
391 /* Otherwise it should return failure. */
392 if (type != SSH_SMSG_FAILURE)
393 packet_disconnect("Protocol error waiting RSA auth response: %d",
394 type);
395 }
396
397 BN_clear_free(e);
398 BN_clear_free(n);
399 BN_clear_free(challenge);
400
401 debug("RSA authentication using agent refused.");
402 return 0;
403}
404
405/*
406 * Computes the proper response to a RSA challenge, and sends the response to
407 * the server.
408 */
409void
410respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
411{
412 unsigned char buf[32], response[16];
413 MD5_CTX md;
414 int i, len;
415
416 /* Decrypt the challenge using the private key. */
417 rsa_private_decrypt(challenge, challenge, prv);
418
419 /* Compute the response. */
420 /* The response is MD5 of decrypted challenge plus session id. */
421 len = BN_num_bytes(challenge);
422 if (len <= 0 || len > sizeof(buf))
423 packet_disconnect("respond_to_rsa_challenge: bad challenge length %d",
424 len);
425
426 memset(buf, 0, sizeof(buf));
427 BN_bn2bin(challenge, buf + sizeof(buf) - len);
428 MD5_Init(&md);
429 MD5_Update(&md, buf, 32);
430 MD5_Update(&md, session_id, 16);
431 MD5_Final(response, &md);
432
433 debug("Sending response to host key RSA challenge.");
434
435 /* Send the response back to the server. */
436 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
437 for (i = 0; i < 16; i++)
438 packet_put_char(response[i]);
439 packet_send();
440 packet_write_wait();
441
442 memset(buf, 0, sizeof(buf));
443 memset(response, 0, sizeof(response));
444 memset(&md, 0, sizeof(md));
445}
446
447/*
448 * Checks if the user has authentication file, and if so, tries to authenticate
449 * the user using it.
450 */
451int
452try_rsa_authentication(const char *authfile)
453{
454 BIGNUM *challenge;
455 RSA *private_key;
456 RSA *public_key;
457 char *passphrase, *comment;
458 int type, i;
459 int plen, clen;
460
461 /* Try to load identification for the authentication key. */
462 public_key = RSA_new();
463 if (!load_public_key(authfile, public_key, &comment)) {
464 RSA_free(public_key);
465 /* Could not load it. Fail. */
466 return 0;
467 }
468 debug("Trying RSA authentication with key '%.100s'", comment);
469
470 /* Tell the server that we are willing to authenticate using this key. */
471 packet_start(SSH_CMSG_AUTH_RSA);
472 packet_put_bignum(public_key->n);
473 packet_send();
474 packet_write_wait();
475
476 /* We no longer need the public key. */
477 RSA_free(public_key);
478
479 /* Wait for server's response. */
480 type = packet_read(&plen);
481
482 /*
483 * The server responds with failure if it doesn\'t like our key or
484 * doesn\'t support RSA authentication.
485 */
486 if (type == SSH_SMSG_FAILURE) {
487 debug("Server refused our key.");
488 xfree(comment);
489 return 0;
490 }
491 /* Otherwise, the server should respond with a challenge. */
492 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
493 packet_disconnect("Protocol error during RSA authentication: %d", type);
494
495 /* Get the challenge from the packet. */
496 challenge = BN_new();
497 packet_get_bignum(challenge, &clen);
498
499 packet_integrity_check(plen, clen, type);
500
501 debug("Received RSA challenge from server.");
502
503 private_key = RSA_new();
504 /*
505 * Load the private key. Try first with empty passphrase; if it
506 * fails, ask for a passphrase.
507 */
508 if (!load_private_key(authfile, "", private_key, NULL)) {
509 char buf[300];
510 snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
511 comment);
512 if (!options.batch_mode)
513 passphrase = read_passphrase(buf, 0);
514 else {
515 debug("Will not query passphrase for %.100s in batch mode.",
516 comment);
517 passphrase = xstrdup("");
518 }
519
520 /* Load the authentication file using the pasphrase. */
521 if (!load_private_key(authfile, passphrase, private_key, NULL)) {
522 memset(passphrase, 0, strlen(passphrase));
523 xfree(passphrase);
524 error("Bad passphrase.");
525
526 /* Send a dummy response packet to avoid protocol error. */
527 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
528 for (i = 0; i < 16; i++)
529 packet_put_char(0);
530 packet_send();
531 packet_write_wait();
532
533 /* Expect the server to reject it... */
534 packet_read_expect(&plen, SSH_SMSG_FAILURE);
535 xfree(comment);
536 return 0;
537 }
538 /* Destroy the passphrase. */
539 memset(passphrase, 0, strlen(passphrase));
540 xfree(passphrase);
541 }
542 /* We no longer need the comment. */
543 xfree(comment);
544
545 /* Compute and send a response to the challenge. */
546 respond_to_rsa_challenge(challenge, private_key);
547
548 /* Destroy the private key. */
549 RSA_free(private_key);
550
551 /* We no longer need the challenge. */
552 BN_clear_free(challenge);
553
554 /* Wait for response from the server. */
555 type = packet_read(&plen);
556 if (type == SSH_SMSG_SUCCESS) {
557 debug("RSA authentication accepted by server.");
558 return 1;
559 }
560 if (type != SSH_SMSG_FAILURE)
561 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
562 debug("RSA authentication refused.");
563 return 0;
564}
565
566/*
567 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
568 * authentication and RSA host authentication.
569 */
570int
571try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
572{
573 int type;
574 BIGNUM *challenge;
575 int plen, clen;
576
577 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
578
579 /* Tell the server that we are willing to authenticate using this key. */
580 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
581 packet_put_string(local_user, strlen(local_user));
582 packet_put_int(BN_num_bits(host_key->n));
583 packet_put_bignum(host_key->e);
584 packet_put_bignum(host_key->n);
585 packet_send();
586 packet_write_wait();
587
588 /* Wait for server's response. */
589 type = packet_read(&plen);
590
591 /* The server responds with failure if it doesn't admit our
592 .rhosts authentication or doesn't know our host key. */
593 if (type == SSH_SMSG_FAILURE) {
594 debug("Server refused our rhosts authentication or host key.");
595 return 0;
596 }
597 /* Otherwise, the server should respond with a challenge. */
598 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
599 packet_disconnect("Protocol error during RSA authentication: %d", type);
600
601 /* Get the challenge from the packet. */
602 challenge = BN_new();
603 packet_get_bignum(challenge, &clen);
604
605 packet_integrity_check(plen, clen, type);
606
607 debug("Received RSA challenge for host key from server.");
608
609 /* Compute a response to the challenge. */
610 respond_to_rsa_challenge(challenge, host_key);
611
612 /* We no longer need the challenge. */
613 BN_clear_free(challenge);
614
615 /* Wait for response from the server. */
616 type = packet_read(&plen);
617 if (type == SSH_SMSG_SUCCESS) {
618 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
619 return 1;
620 }
621 if (type != SSH_SMSG_FAILURE)
622 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
623 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
624 return 0;
625}
626
627#ifdef KRB4
628int
629try_kerberos_authentication()
630{
631 KTEXT_ST auth; /* Kerberos data */
632 char *reply;
633 char inst[INST_SZ];
634 char *realm;
635 CREDENTIALS cred;
636 int r, type, plen;
637 Key_schedule schedule;
638 u_long checksum, cksum;
639 MSG_DAT msg_data;
640 struct sockaddr_in local, foreign;
641 struct stat st;
642
643 /* Don't do anything if we don't have any tickets. */
644 if (stat(tkt_string(), &st) < 0)
645 return 0;
646
647 strncpy(inst, (char *) krb_get_phost(get_canonical_hostname()), INST_SZ);
648
649 realm = (char *) krb_realmofhost(get_canonical_hostname());
650 if (!realm) {
651 debug("Kerberos V4: no realm for %s", get_canonical_hostname());
652 return 0;
653 }
654 /* This can really be anything. */
655 checksum = (u_long) getpid();
656
657 r = krb_mk_req(&auth, KRB4_SERVICE_NAME, inst, realm, checksum);
658 if (r != KSUCCESS) {
659 debug("Kerberos V4 krb_mk_req failed: %s", krb_err_txt[r]);
660 return 0;
661 }
662 /* Get session key to decrypt the server's reply with. */
663 r = krb_get_cred(KRB4_SERVICE_NAME, inst, realm, &cred);
664 if (r != KSUCCESS) {
665 debug("get_cred failed: %s", krb_err_txt[r]);
666 return 0;
667 }
668 des_key_sched((des_cblock *) cred.session, schedule);
669
670 /* Send authentication info to server. */
671 packet_start(SSH_CMSG_AUTH_KERBEROS);
672 packet_put_string((char *) auth.dat, auth.length);
673 packet_send();
674 packet_write_wait();
675
676 /* Zero the buffer. */
677 (void) memset(auth.dat, 0, MAX_KTXT_LEN);
678
679 r = sizeof(local);
680 memset(&local, 0, sizeof(local));
681 if (getsockname(packet_get_connection_in(),
682 (struct sockaddr *) & local, &r) < 0)
683 debug("getsockname failed: %s", strerror(errno));
684
685 r = sizeof(foreign);
686 memset(&foreign, 0, sizeof(foreign));
687 if (getpeername(packet_get_connection_in(),
688 (struct sockaddr *) & foreign, &r) < 0) {
689 debug("getpeername failed: %s", strerror(errno));
690 fatal_cleanup();
691 }
692 /* Get server reply. */
693 type = packet_read(&plen);
694 switch (type) {
695 case SSH_SMSG_FAILURE:
696 /* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
697 debug("Kerberos V4 authentication failed.");
698 return 0;
699 break;
700
701 case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
702 /* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
703 debug("Kerberos V4 authentication accepted.");
704
705 /* Get server's response. */
706 reply = packet_get_string((unsigned int *) &auth.length);
707 memcpy(auth.dat, reply, auth.length);
708 xfree(reply);
709
710 packet_integrity_check(plen, 4 + auth.length, type);
711
712 /*
713 * If his response isn't properly encrypted with the session
714 * key, and the decrypted checksum fails to match, he's
715 * bogus. Bail out.
716 */
717 r = krb_rd_priv(auth.dat, auth.length, schedule, &cred.session,
718 &foreign, &local, &msg_data);
719 if (r != KSUCCESS) {
720 debug("Kerberos V4 krb_rd_priv failed: %s", krb_err_txt[r]);
721 packet_disconnect("Kerberos V4 challenge failed!");
722 }
723 /* Fetch the (incremented) checksum that we supplied in the request. */
724 (void) memcpy((char *) &cksum, (char *) msg_data.app_data, sizeof(cksum));
725 cksum = ntohl(cksum);
726
727 /* If it matches, we're golden. */
728 if (cksum == checksum + 1) {
729 debug("Kerberos V4 challenge successful.");
730 return 1;
731 } else
732 packet_disconnect("Kerberos V4 challenge failed!");
733 break;
734
735 default:
736 packet_disconnect("Protocol error on Kerberos V4 response: %d", type);
737 }
738 return 0;
739}
740
741#endif /* KRB4 */
742
743#ifdef AFS
744int
745send_kerberos_tgt()
746{
747 CREDENTIALS *creds;
748 char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
749 int r, type, plen;
750 unsigned char buffer[8192];
751 struct stat st;
752
753 /* Don't do anything if we don't have any tickets. */
754 if (stat(tkt_string(), &st) < 0)
755 return 0;
756
757 creds = xmalloc(sizeof(*creds));
758
759 if ((r = krb_get_tf_fullname(TKT_FILE, pname, pinst, prealm)) != KSUCCESS) {
760 debug("Kerberos V4 tf_fullname failed: %s", krb_err_txt[r]);
761 return 0;
762 }
763 if ((r = krb_get_cred("krbtgt", prealm, prealm, creds)) != GC_OK) {
764 debug("Kerberos V4 get_cred failed: %s", krb_err_txt[r]);
765 return 0;
766 }
767 if (time(0) > krb_life_to_time(creds->issue_date, creds->lifetime)) {
768 debug("Kerberos V4 ticket expired: %s", TKT_FILE);
769 return 0;
770 }
771 creds_to_radix(creds, buffer);
772 xfree(creds);
773
774 packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
775 packet_put_string((char *) buffer, strlen(buffer));
776 packet_send();
777 packet_write_wait();
778
779 type = packet_read(&plen);
780
781 if (type == SSH_SMSG_FAILURE)
782 debug("Kerberos TGT for realm %s rejected.", prealm);
783 else if (type != SSH_SMSG_SUCCESS)
784 packet_disconnect("Protocol error on Kerberos TGT response: %d", type);
785
786 return 1;
787}
788
789void
790send_afs_tokens(void)
791{
792 CREDENTIALS creds;
793 struct ViceIoctl parms;
794 struct ClearToken ct;
795 int i, type, len, plen;
796 char buf[2048], *p, *server_cell;
797 unsigned char buffer[8192];
798
799 /* Move over ktc_GetToken, here's something leaner. */
800 for (i = 0; i < 100; i++) { /* just in case */
801 parms.in = (char *) &i;
802 parms.in_size = sizeof(i);
803 parms.out = buf;
804 parms.out_size = sizeof(buf);
805 if (k_pioctl(0, VIOCGETTOK, &parms, 0) != 0)
806 break;
807 p = buf;
808
809 /* Get secret token. */
810 memcpy(&creds.ticket_st.length, p, sizeof(unsigned int));
811 if (creds.ticket_st.length > MAX_KTXT_LEN)
812 break;
813 p += sizeof(unsigned int);
814 memcpy(creds.ticket_st.dat, p, creds.ticket_st.length);
815 p += creds.ticket_st.length;
816
817 /* Get clear token. */
818 memcpy(&len, p, sizeof(len));
819 if (len != sizeof(struct ClearToken))
820 break;
821 p += sizeof(len);
822 memcpy(&ct, p, len);
823 p += len;
824 p += sizeof(len); /* primary flag */
825 server_cell = p;
826
827 /* Flesh out our credentials. */
828 strlcpy(creds.service, "afs", sizeof creds.service);
829 creds.instance[0] = '\0';
830 strlcpy(creds.realm, server_cell, REALM_SZ);
831 memcpy(creds.session, ct.HandShakeKey, DES_KEY_SZ);
832 creds.issue_date = ct.BeginTimestamp;
833 creds.lifetime = krb_time_to_life(creds.issue_date, ct.EndTimestamp);
834 creds.kvno = ct.AuthHandle;
835 snprintf(creds.pname, sizeof(creds.pname), "AFS ID %d", ct.ViceId);
836 creds.pinst[0] = '\0';
837
838 /* Encode token, ship it off. */
839 if (!creds_to_radix(&creds, buffer))
840 break;
841 packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
842 packet_put_string((char *) buffer, strlen(buffer));
843 packet_send();
844 packet_write_wait();
845
846 /* Roger, Roger. Clearance, Clarence. What's your vector,
847 Victor? */
848 type = packet_read(&plen);
849
850 if (type == SSH_SMSG_FAILURE)
851 debug("AFS token for cell %s rejected.", server_cell);
852 else if (type != SSH_SMSG_SUCCESS)
853 packet_disconnect("Protocol error on AFS token response: %d", type);
854 }
855}
856
857#endif /* AFS */
858
859/*
860 * Tries to authenticate with any string-based challenge/response system.
861 * Note that the client code is not tied to s/key or TIS.
862 */
863int
864try_skey_authentication()
865{
866 int type, i, payload_len;
867 char *challenge, *response;
868
869 debug("Doing skey authentication.");
870
871 /* request a challenge */
872 packet_start(SSH_CMSG_AUTH_TIS);
873 packet_send();
874 packet_write_wait();
875
876 type = packet_read(&payload_len);
877 if (type != SSH_SMSG_FAILURE &&
878 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
879 packet_disconnect("Protocol error: got %d in response "
880 "to skey-auth", type);
881 }
882 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
883 debug("No challenge for skey authentication.");
884 return 0;
885 }
886 challenge = packet_get_string(&payload_len);
887 if (options.cipher == SSH_CIPHER_NONE)
888 log("WARNING: Encryption is disabled! "
889 "Reponse will be transmitted in clear text.");
890 fprintf(stderr, "%s\n", challenge);
891 xfree(challenge);
892 fflush(stderr);
893 for (i = 0; i < options.number_of_password_prompts; i++) {
894 if (i != 0)
895 error("Permission denied, please try again.");
896 response = read_passphrase("Response: ", 0);
897 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
898 packet_put_string(response, strlen(response));
899 memset(response, 0, strlen(response));
900 xfree(response);
901 packet_send();
902 packet_write_wait();
903 type = packet_read(&payload_len);
904 if (type == SSH_SMSG_SUCCESS)
905 return 1;
906 if (type != SSH_SMSG_FAILURE)
907 packet_disconnect("Protocol error: got %d in response "
908 "to skey-auth-reponse", type);
909 }
910 /* failure */
911 return 0;
912}
913
914/*
915 * Tries to authenticate with plain passwd authentication.
916 */
917int
918try_password_authentication(char *prompt)
919{
920 int type, i, payload_len;
921 char *password;
922
923 debug("Doing password authentication.");
924 if (options.cipher == SSH_CIPHER_NONE)
925 log("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
926 for (i = 0; i < options.number_of_password_prompts; i++) {
927 if (i != 0)
928 error("Permission denied, please try again.");
929 password = read_passphrase(prompt, 0);
930 packet_start(SSH_CMSG_AUTH_PASSWORD);
931 packet_put_string(password, strlen(password));
932 memset(password, 0, strlen(password));
933 xfree(password);
934 packet_send();
935 packet_write_wait();
936
937 type = packet_read(&payload_len);
938 if (type == SSH_SMSG_SUCCESS)
939 return 1;
940 if (type != SSH_SMSG_FAILURE)
941 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
942 }
943 /* failure */
944 return 0;
945}
946
947/*
948 * Waits for the server identification string, and sends our own
949 * identification string.
950 */
951void
952ssh_exchange_identification()
953{
954 char buf[256], remote_version[256]; /* must be same size! */
955 int remote_major, remote_minor, i;
956 int connection_in = packet_get_connection_in();
957 int connection_out = packet_get_connection_out();
958
959 /* Read other side\'s version identification. */
960 for (i = 0; i < sizeof(buf) - 1; i++) {
961 int len = read(connection_in, &buf[i], 1);
962 if (len < 0)
963 fatal("ssh_exchange_identification: read: %.100s", strerror(errno));
964 if (len != 1)
965 fatal("ssh_exchange_identification: Connection closed by remote host");
966 if (buf[i] == '\r') {
967 buf[i] = '\n';
968 buf[i + 1] = 0;
969 break;
970 }
971 if (buf[i] == '\n') {
972 buf[i + 1] = 0;
973 break;
974 }
975 }
976 buf[sizeof(buf) - 1] = 0;
977
978 /*
979 * Check that the versions match. In future this might accept
980 * several versions and set appropriate flags to handle them.
981 */
982 if (sscanf(buf, "SSH-%d.%d-%[^\n]\n", &remote_major, &remote_minor,
983 remote_version) != 3)
984 fatal("Bad remote protocol version identification: '%.100s'", buf);
985 debug("Remote protocol version %d.%d, remote software version %.100s",
986 remote_major, remote_minor, remote_version);
987
988 /* Check if the remote protocol version is too old. */
989 if (remote_major == 1 && remote_minor < 3)
990 fatal("Remote machine has too old SSH software version.");
991
992 /* We speak 1.3, too. */
993 if (remote_major == 1 && remote_minor == 3) {
994 enable_compat13();
995 if (options.forward_agent) {
996 log("Agent forwarding disabled for protocol 1.3");
997 options.forward_agent = 0;
998 }
999 }
1000#if 0
1001 /*
1002 * Removed for now, to permit compatibility with latter versions. The
1003 * server will reject our version and disconnect if it doesn't
1004 * support it.
1005 */
1006 if (remote_major != PROTOCOL_MAJOR)
1007 fatal("Protocol major versions differ: %d vs. %d",
1008 PROTOCOL_MAJOR, remote_major);
1009#endif
1010
1011 /* Send our own protocol version identification. */
1012 snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n",
1013 PROTOCOL_MAJOR, PROTOCOL_MINOR, SSH_VERSION);
1014 if (atomicio(write, connection_out, buf, strlen(buf)) != strlen(buf))
1015 fatal("write: %.100s", strerror(errno));
1016}
1017
1018int ssh_cipher_default = SSH_CIPHER_3DES;
1019
1020int
1021read_yes_or_no(const char *prompt, int defval)
1022{
1023 char buf[1024];
1024 FILE *f;
1025 int retval = -1;
1026
1027 if (isatty(0))
1028 f = stdin;
1029 else
1030 f = fopen("/dev/tty", "rw");
1031
1032 if (f == NULL)
1033 return 0;
1034
1035 fflush(stdout);
1036
1037 while (1) {
1038 fprintf(stderr, "%s", prompt);
1039 if (fgets(buf, sizeof(buf), f) == NULL) {
1040 /* Print a newline (the prompt probably didn\'t have one). */
1041 fprintf(stderr, "\n");
1042 strlcpy(buf, "no", sizeof buf);
1043 }
1044 /* Remove newline from response. */
1045 if (strchr(buf, '\n'))
1046 *strchr(buf, '\n') = 0;
1047
1048 if (buf[0] == 0)
1049 retval = defval;
1050 if (strcmp(buf, "yes") == 0)
1051 retval = 1;
1052 if (strcmp(buf, "no") == 0)
1053 retval = 0;
1054
1055 if (retval != -1) {
1056 if (f != stdin)
1057 fclose(f);
1058 return retval;
1059 }
1060 }
1061}
1062
1063/*
1064 * check whether the supplied host key is valid, return only if ok.
1065 */
1066
1067void
1068check_host_key(char *host, struct sockaddr *hostaddr, RSA *host_key)
1069{
1070 RSA *file_key;
1071 char *ip = NULL;
1072 char hostline[1000], *hostp;
1073 HostStatus host_status;
1074 HostStatus ip_status;
1075 int local = 0, host_ip_differ = 0;
1076 char ntop[NI_MAXHOST];
1077
1078 /*
1079 * Force accepting of the host key for loopback/localhost. The
1080 * problem is that if the home directory is NFS-mounted to multiple
1081 * machines, localhost will refer to a different machine in each of
1082 * them, and the user will get bogus HOST_CHANGED warnings. This
1083 * essentially disables host authentication for localhost; however,
1084 * this is probably not a real problem.
1085 */
1086 switch (hostaddr->sa_family) {
1087 case AF_INET:
1088 local = (ntohl(((struct sockaddr_in *)hostaddr)->sin_addr.s_addr) >> 24) == IN_LOOPBACKNET;
1089 break;
1090#ifdef INET6
1091 case AF_INET6:
1092 local = IN6_IS_ADDR_LOOPBACK(&(((struct sockaddr_in6 *)hostaddr)->sin6_addr));
1093 break;
1094#endif
1095 default:
1096 local = 0;
1097 break;
1098 }
1099 if (local) {
1100 debug("Forcing accepting of host key for loopback/localhost.");
1101 return;
1102 }
1103
1104 /*
1105 * Turn off check_host_ip for proxy connects, since
1106 * we don't have the remote ip-address
1107 */
1108 if (options.proxy_command != NULL && options.check_host_ip)
1109 options.check_host_ip = 0;
1110
1111 if (options.check_host_ip) {
1112 if (getnameinfo(hostaddr, hostaddr->sa_len, ntop, sizeof(ntop),
1113 NULL, 0, NI_NUMERICHOST) != 0)
1114 fatal("check_host_key: getnameinfo failed");
1115 ip = xstrdup(ntop);
1116 }
1117
1118 /*
1119 * Store the host key from the known host file in here so that we can
1120 * compare it with the key for the IP address.
1121 */
1122 file_key = RSA_new();
1123 file_key->n = BN_new();
1124 file_key->e = BN_new();
1125
1126 /*
1127 * Check if the host key is present in the user\'s list of known
1128 * hosts or in the systemwide list.
1129 */
1130 host_status = check_host_in_hostfile(options.user_hostfile, host,
1131 host_key->e, host_key->n,
1132 file_key->e, file_key->n);
1133 if (host_status == HOST_NEW)
1134 host_status = check_host_in_hostfile(options.system_hostfile, host,
1135 host_key->e, host_key->n,
1136 file_key->e, file_key->n);
1137 /*
1138 * Also perform check for the ip address, skip the check if we are
1139 * localhost or the hostname was an ip address to begin with
1140 */
1141 if (options.check_host_ip && !local && strcmp(host, ip)) {
1142 RSA *ip_key = RSA_new();
1143 ip_key->n = BN_new();
1144 ip_key->e = BN_new();
1145 ip_status = check_host_in_hostfile(options.user_hostfile, ip,
1146 host_key->e, host_key->n,
1147 ip_key->e, ip_key->n);
1148
1149 if (ip_status == HOST_NEW)
1150 ip_status = check_host_in_hostfile(options.system_hostfile, ip,
1151 host_key->e, host_key->n,
1152 ip_key->e, ip_key->n);
1153 if (host_status == HOST_CHANGED &&
1154 (ip_status != HOST_CHANGED ||
1155 (BN_cmp(ip_key->e, file_key->e) || BN_cmp(ip_key->n, file_key->n))))
1156 host_ip_differ = 1;
1157
1158 RSA_free(ip_key);
1159 } else
1160 ip_status = host_status;
1161
1162 RSA_free(file_key);
1163
1164 switch (host_status) {
1165 case HOST_OK:
1166 /* The host is known and the key matches. */
1167 debug("Host '%.200s' is known and matches the host key.", host);
1168 if (options.check_host_ip) {
1169 if (ip_status == HOST_NEW) {
1170 if (!add_host_to_hostfile(options.user_hostfile, ip,
1171 host_key->e, host_key->n))
1172 log("Failed to add the host key for IP address '%.30s' to the list of known hosts (%.30s).",
1173 ip, options.user_hostfile);
1174 else
1175 log("Warning: Permanently added host key for IP address '%.30s' to the list of known hosts.",
1176 ip);
1177 } else if (ip_status != HOST_OK)
1178 log("Warning: the host key for '%.200s' differs from the key for the IP address '%.30s'",
1179 host, ip);
1180 }
1181 break;
1182 case HOST_NEW:
1183 /* The host is new. */
1184 if (options.strict_host_key_checking == 1) {
1185 /* User has requested strict host key checking. We will not add the host key
1186 automatically. The only alternative left is to abort. */
1187 fatal("No host key is known for %.200s and you have requested strict checking.", host);
1188 } else if (options.strict_host_key_checking == 2) {
1189 /* The default */
1190 char prompt[1024];
1191 char *fp = fingerprint(host_key->e, host_key->n);
1192 snprintf(prompt, sizeof(prompt),
1193 "The authenticity of host '%.200s' can't be established.\n"
1194 "Key fingerprint is %d %s.\n"
1195 "Are you sure you want to continue connecting (yes/no)? ",
1196 host, BN_num_bits(host_key->n), fp);
1197 if (!read_yes_or_no(prompt, -1))
1198 fatal("Aborted by user!\n");
1199 }
1200 if (options.check_host_ip && ip_status == HOST_NEW && strcmp(host, ip)) {
1201 snprintf(hostline, sizeof(hostline), "%s,%s", host, ip);
1202 hostp = hostline;
1203 } else
1204 hostp = host;
1205
1206 /* If not in strict mode, add the key automatically to the local known_hosts file. */
1207 if (!add_host_to_hostfile(options.user_hostfile, hostp,
1208 host_key->e, host_key->n))
1209 log("Failed to add the host to the list of known hosts (%.500s).",
1210 options.user_hostfile);
1211 else
1212 log("Warning: Permanently added '%.200s' to the list of known hosts.",
1213 hostp);
1214 break;
1215 case HOST_CHANGED:
1216 if (options.check_host_ip && host_ip_differ) {
1217 char *msg;
1218 if (ip_status == HOST_NEW)
1219 msg = "is unknown";
1220 else if (ip_status == HOST_OK)
1221 msg = "is unchanged";
1222 else
1223 msg = "has a different value";
1224 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1225 error("@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @");
1226 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1227 error("The host key for %s has changed,", host);
1228 error("and the key for the according IP address %s", ip);
1229 error("%s. This could either mean that", msg);
1230 error("DNS SPOOFING is happening or the IP address for the host");
1231 error("and its host key have changed at the same time");
1232 }
1233 /* The host key has changed. */
1234 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1235 error("@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @");
1236 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1237 error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
1238 error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
1239 error("It is also possible that the host key has just been changed.");
1240 error("Please contact your system administrator.");
1241 error("Add correct host key in %.100s to get rid of this message.",
1242 options.user_hostfile);
1243
1244 /*
1245 * If strict host key checking is in use, the user will have
1246 * to edit the key manually and we can only abort.
1247 */
1248 if (options.strict_host_key_checking)
1249 fatal("Host key for %.200s has changed and you have requested strict checking.", host);
1250
1251 /*
1252 * If strict host key checking has not been requested, allow
1253 * the connection but without password authentication or
1254 * agent forwarding.
1255 */
1256 if (options.password_authentication) {
1257 error("Password authentication is disabled to avoid trojan horses.");
1258 options.password_authentication = 0;
1259 }
1260 if (options.forward_agent) {
1261 error("Agent forwarding is disabled to avoid trojan horses.");
1262 options.forward_agent = 0;
1263 }
1264 /*
1265 * XXX Should permit the user to change to use the new id.
1266 * This could be done by converting the host key to an
1267 * identifying sentence, tell that the host identifies itself
1268 * by that sentence, and ask the user if he/she whishes to
1269 * accept the authentication.
1270 */
1271 break;
1272 }
1273 if (options.check_host_ip)
1274 xfree(ip);
1275}
1276
1277/*
1278 * SSH1 key exchange
1279 */
1280void
1281ssh_kex(char *host, struct sockaddr *hostaddr)
1282{
1283 int i;
1284 BIGNUM *key;
1285 RSA *host_key;
1286 RSA *public_key;
1287 int bits, rbits;
1288 unsigned char session_key[SSH_SESSION_KEY_LENGTH];
1289 unsigned char cookie[8];
1290 unsigned int supported_ciphers;
1291 unsigned int server_flags, client_flags;
1292 int payload_len, clen, sum_len = 0;
1293 u_int32_t rand = 0;
1294
1295 debug("Waiting for server public key.");
1296
1297 /* Wait for a public key packet from the server. */
1298 packet_read_expect(&payload_len, SSH_SMSG_PUBLIC_KEY);
1299
1300 /* Get cookie from the packet. */
1301 for (i = 0; i < 8; i++)
1302 cookie[i] = packet_get_char();
1303
1304 /* Get the public key. */
1305 public_key = RSA_new();
1306 bits = packet_get_int();/* bits */
1307 public_key->e = BN_new();
1308 packet_get_bignum(public_key->e, &clen);
1309 sum_len += clen;
1310 public_key->n = BN_new();
1311 packet_get_bignum(public_key->n, &clen);
1312 sum_len += clen;
1313
1314 rbits = BN_num_bits(public_key->n);
1315 if (bits != rbits) {
1316 log("Warning: Server lies about size of server public key: "
1317 "actual size is %d bits vs. announced %d.", rbits, bits);
1318 log("Warning: This may be due to an old implementation of ssh.");
1319 }
1320 /* Get the host key. */
1321 host_key = RSA_new();
1322 bits = packet_get_int();/* bits */
1323 host_key->e = BN_new();
1324 packet_get_bignum(host_key->e, &clen);
1325 sum_len += clen;
1326 host_key->n = BN_new();
1327 packet_get_bignum(host_key->n, &clen);
1328 sum_len += clen;
1329
1330 rbits = BN_num_bits(host_key->n);
1331 if (bits != rbits) {
1332 log("Warning: Server lies about size of server host key: "
1333 "actual size is %d bits vs. announced %d.", rbits, bits);
1334 log("Warning: This may be due to an old implementation of ssh.");
1335 }
1336
1337 /* Get protocol flags. */
1338 server_flags = packet_get_int();
1339 packet_set_protocol_flags(server_flags);
1340
1341 supported_ciphers = packet_get_int();
1342 supported_authentications = packet_get_int();
1343
1344 debug("Received server public key (%d bits) and host key (%d bits).",
1345 BN_num_bits(public_key->n), BN_num_bits(host_key->n));
1346
1347 packet_integrity_check(payload_len,
1348 8 + 4 + sum_len + 0 + 4 + 0 + 0 + 4 + 4 + 4,
1349 SSH_SMSG_PUBLIC_KEY);
1350
1351 check_host_key(host, hostaddr, host_key);
1352
1353 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
1354
1355 compute_session_id(session_id, cookie, host_key->n, public_key->n);
1356
1357 /* Generate a session key. */
1358 arc4random_stir();
1359
1360 /*
1361 * Generate an encryption key for the session. The key is a 256 bit
1362 * random number, interpreted as a 32-byte key, with the least
1363 * significant 8 bits being the first byte of the key.
1364 */
1365 for (i = 0; i < 32; i++) {
1366 if (i % 4 == 0)
1367 rand = arc4random();
1368 session_key[i] = rand & 0xff;
1369 rand >>= 8;
1370 }
1371
1372 /*
1373 * According to the protocol spec, the first byte of the session key
1374 * is the highest byte of the integer. The session key is xored with
1375 * the first 16 bytes of the session id.
1376 */
1377 key = BN_new();
1378 BN_set_word(key, 0);
1379 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
1380 BN_lshift(key, key, 8);
1381 if (i < 16)
1382 BN_add_word(key, session_key[i] ^ session_id[i]);
1383 else
1384 BN_add_word(key, session_key[i]);
1385 }
1386
1387 /*
1388 * Encrypt the integer using the public key and host key of the
1389 * server (key with smaller modulus first).
1390 */
1391 if (BN_cmp(public_key->n, host_key->n) < 0) {
1392 /* Public key has smaller modulus. */
1393 if (BN_num_bits(host_key->n) <
1394 BN_num_bits(public_key->n) + SSH_KEY_BITS_RESERVED) {
1395 fatal("respond_to_rsa_challenge: host_key %d < public_key %d + "
1396 "SSH_KEY_BITS_RESERVED %d",
1397 BN_num_bits(host_key->n),
1398 BN_num_bits(public_key->n),
1399 SSH_KEY_BITS_RESERVED);
1400 }
1401 rsa_public_encrypt(key, key, public_key);
1402 rsa_public_encrypt(key, key, host_key);
1403 } else {
1404 /* Host key has smaller modulus (or they are equal). */
1405 if (BN_num_bits(public_key->n) <
1406 BN_num_bits(host_key->n) + SSH_KEY_BITS_RESERVED) {
1407 fatal("respond_to_rsa_challenge: public_key %d < host_key %d + "
1408 "SSH_KEY_BITS_RESERVED %d",
1409 BN_num_bits(public_key->n),
1410 BN_num_bits(host_key->n),
1411 SSH_KEY_BITS_RESERVED);
1412 }
1413 rsa_public_encrypt(key, key, host_key);
1414 rsa_public_encrypt(key, key, public_key);
1415 }
1416
1417 /* Destroy the public keys since we no longer need them. */
1418 RSA_free(public_key);
1419 RSA_free(host_key);
1420
1421 if (options.cipher == SSH_CIPHER_NOT_SET) {
1422 if (cipher_mask() & supported_ciphers & (1 << ssh_cipher_default))
1423 options.cipher = ssh_cipher_default;
1424 else {
1425 debug("Cipher %s not supported, using %.100s instead.",
1426 cipher_name(ssh_cipher_default),
1427 cipher_name(SSH_FALLBACK_CIPHER));
1428 options.cipher = SSH_FALLBACK_CIPHER;
1429 }
1430 }
1431 /* Check that the selected cipher is supported. */
1432 if (!(supported_ciphers & (1 << options.cipher)))
1433 fatal("Selected cipher type %.100s not supported by server.",
1434 cipher_name(options.cipher));
1435
1436 debug("Encryption type: %.100s", cipher_name(options.cipher));
1437
1438 /* Send the encrypted session key to the server. */
1439 packet_start(SSH_CMSG_SESSION_KEY);
1440 packet_put_char(options.cipher);
1441
1442 /* Send the cookie back to the server. */
1443 for (i = 0; i < 8; i++)
1444 packet_put_char(cookie[i]);
1445
1446 /* Send and destroy the encrypted encryption key integer. */
1447 packet_put_bignum(key);
1448 BN_clear_free(key);
1449
1450 /* Send protocol flags. */
1451 packet_put_int(client_flags);
1452
1453 /* Send the packet now. */
1454 packet_send();
1455 packet_write_wait();
1456
1457 debug("Sent encrypted session key.");
1458
1459 /* Set the encryption key. */
1460 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
1461
1462 /* We will no longer need the session key here. Destroy any extra copies. */
1463 memset(session_key, 0, sizeof(session_key));
1464
1465 /*
1466 * Expect a success message from the server. Note that this message
1467 * will be received in encrypted form.
1468 */
1469 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
1470
1471 debug("Received encrypted confirmation.");
1472}
1473
1474/*
1475 * Authenticate user
1476 */
1477void
1478ssh_userauth(int host_key_valid, RSA *own_host_key,
1479 uid_t original_real_uid, char *host)
1480{
1481 int i, type;
1482 int payload_len;
1483 struct passwd *pw;
1484 const char *server_user, *local_user;
1485
1486 /* Get local user name. Use it as server user if no user name was given. */
1487 pw = getpwuid(original_real_uid);
1488 if (!pw)
1489 fatal("User id %d not found from user database.", original_real_uid);
1490 local_user = xstrdup(pw->pw_name);
1491 server_user = options.user ? options.user : local_user;
1492
1493 /* Send the name of the user to log in as on the server. */
1494 packet_start(SSH_CMSG_USER);
1495 packet_put_string(server_user, strlen(server_user));
1496 packet_send();
1497 packet_write_wait();
1498
1499 /*
1500 * The server should respond with success if no authentication is
1501 * needed (the user has no password). Otherwise the server responds
1502 * with failure.
1503 */
1504 type = packet_read(&payload_len);
1505
1506 /* check whether the connection was accepted without authentication. */
1507 if (type == SSH_SMSG_SUCCESS)
1508 return;
1509 if (type != SSH_SMSG_FAILURE)
1510 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER",
1511 type);
1512
1513#ifdef AFS
1514 /* Try Kerberos tgt passing if the server supports it. */
1515 if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
1516 options.kerberos_tgt_passing) {
1517 if (options.cipher == SSH_CIPHER_NONE)
1518 log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
1519 (void) send_kerberos_tgt();
1520 }
1521 /* Try AFS token passing if the server supports it. */
1522 if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
1523 options.afs_token_passing && k_hasafs()) {
1524 if (options.cipher == SSH_CIPHER_NONE)
1525 log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
1526 send_afs_tokens();
1527 }
1528#endif /* AFS */
1529
1530#ifdef KRB4
1531 if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
1532 options.kerberos_authentication) {
1533 debug("Trying Kerberos authentication.");
1534 if (try_kerberos_authentication()) {
1535 /* The server should respond with success or failure. */
1536 type = packet_read(&payload_len);
1537 if (type == SSH_SMSG_SUCCESS)
1538 return;
1539 if (type != SSH_SMSG_FAILURE)
1540 packet_disconnect("Protocol error: got %d in response to Kerberos auth", type);
1541 }
1542 }
1543#endif /* KRB4 */
1544
1545 /*
1546 * Use rhosts authentication if running in privileged socket and we
1547 * do not wish to remain anonymous.
1548 */
1549 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) &&
1550 options.rhosts_authentication) {
1551 debug("Trying rhosts authentication.");
1552 packet_start(SSH_CMSG_AUTH_RHOSTS);
1553 packet_put_string(local_user, strlen(local_user));
1554 packet_send();
1555 packet_write_wait();
1556
1557 /* The server should respond with success or failure. */
1558 type = packet_read(&payload_len);
1559 if (type == SSH_SMSG_SUCCESS)
1560 return;
1561 if (type != SSH_SMSG_FAILURE)
1562 packet_disconnect("Protocol error: got %d in response to rhosts auth",
1563 type);
1564 }
1565 /*
1566 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
1567 * authentication.
1568 */
1569 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
1570 options.rhosts_rsa_authentication && host_key_valid) {
1571 if (try_rhosts_rsa_authentication(local_user, own_host_key))
1572 return;
1573 }
1574 /* Try RSA authentication if the server supports it. */
1575 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
1576 options.rsa_authentication) {
1577 /*
1578 * Try RSA authentication using the authentication agent. The
1579 * agent is tried first because no passphrase is needed for
1580 * it, whereas identity files may require passphrases.
1581 */
1582 if (try_agent_authentication())
1583 return;
1584
1585 /* Try RSA authentication for each identity. */
1586 for (i = 0; i < options.num_identity_files; i++)
1587 if (try_rsa_authentication(options.identity_files[i]))
1588 return;
1589 }
1590 /* Try skey authentication if the server supports it. */
1591 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
1592 options.skey_authentication && !options.batch_mode) {
1593 if (try_skey_authentication())
1594 return;
1595 }
1596 /* Try password authentication if the server supports it. */
1597 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
1598 options.password_authentication && !options.batch_mode) {
1599 char prompt[80];
1600
1601 snprintf(prompt, sizeof(prompt), "%.30s@%.40s's password: ",
1602 server_user, host);
1603 if (try_password_authentication(prompt))
1604 return;
1605 }
1606 /* All authentication methods have failed. Exit with an error message. */
1607 fatal("Permission denied.");
1608 /* NOTREACHED */
1609}
1610
1611/*
1612 * Starts a dialog with the server, and authenticates the current user on the
1613 * server. This does not need any extra privileges. The basic connection
1614 * to the server must already have been established before this is called.
1615 * If login fails, this function prints an error and never returns.
1616 * This function does not require super-user privileges.
1617 */
1618void
1619ssh_login(int host_key_valid, RSA *own_host_key, const char *orighost,
1620 struct sockaddr *hostaddr, uid_t original_real_uid)
1621{
1622 char *host, *cp;
1623
1624 /* Convert the user-supplied hostname into all lowercase. */
1625 host = xstrdup(orighost);
1626 for (cp = host; *cp; cp++)
1627 if (isupper(*cp))
1628 *cp = tolower(*cp);
1629
1630 /* Exchange protocol version identification strings with the server. */
1631 ssh_exchange_identification();
1632
1633 /* Put the connection into non-blocking mode. */
1634 packet_set_nonblocking();
1635
1636 supported_authentications = 0;
1637 /* key exchange */
1638 ssh_kex(host, hostaddr);
1639 if (supported_authentications == 0)
1640 fatal("supported_authentications == 0.");
1641 /* authenticate user */
1642 ssh_userauth(host_key_valid, own_host_key, original_real_uid, host);
1643}
| 29
30/* Session id for the current session. */
31unsigned char session_id[16];
32
33/* authentications supported by server */
34unsigned int supported_authentications;
35
36extern Options options;
37extern char *__progname;
38
39/*
40 * Connect to the given ssh server using a proxy command.
41 */
42int
43ssh_proxy_connect(const char *host, u_short port, uid_t original_real_uid,
44 const char *proxy_command)
45{
46 Buffer command;
47 const char *cp;
48 char *command_string;
49 int pin[2], pout[2];
50 int pid;
51 char strport[NI_MAXSERV];
52
53 /* Convert the port number into a string. */
54 snprintf(strport, sizeof strport, "%hu", port);
55
56 /* Build the final command string in the buffer by making the
57 appropriate substitutions to the given proxy command. */
58 buffer_init(&command);
59 for (cp = proxy_command; *cp; cp++) {
60 if (cp[0] == '%' && cp[1] == '%') {
61 buffer_append(&command, "%", 1);
62 cp++;
63 continue;
64 }
65 if (cp[0] == '%' && cp[1] == 'h') {
66 buffer_append(&command, host, strlen(host));
67 cp++;
68 continue;
69 }
70 if (cp[0] == '%' && cp[1] == 'p') {
71 buffer_append(&command, strport, strlen(strport));
72 cp++;
73 continue;
74 }
75 buffer_append(&command, cp, 1);
76 }
77 buffer_append(&command, "\0", 1);
78
79 /* Get the final command string. */
80 command_string = buffer_ptr(&command);
81
82 /* Create pipes for communicating with the proxy. */
83 if (pipe(pin) < 0 || pipe(pout) < 0)
84 fatal("Could not create pipes to communicate with the proxy: %.100s",
85 strerror(errno));
86
87 debug("Executing proxy command: %.500s", command_string);
88
89 /* Fork and execute the proxy command. */
90 if ((pid = fork()) == 0) {
91 char *argv[10];
92
93 /* Child. Permanently give up superuser privileges. */
94 permanently_set_uid(original_real_uid);
95
96 /* Redirect stdin and stdout. */
97 close(pin[1]);
98 if (pin[0] != 0) {
99 if (dup2(pin[0], 0) < 0)
100 perror("dup2 stdin");
101 close(pin[0]);
102 }
103 close(pout[0]);
104 if (dup2(pout[1], 1) < 0)
105 perror("dup2 stdout");
106 /* Cannot be 1 because pin allocated two descriptors. */
107 close(pout[1]);
108
109 /* Stderr is left as it is so that error messages get
110 printed on the user's terminal. */
111 argv[0] = "/bin/sh";
112 argv[1] = "-c";
113 argv[2] = command_string;
114 argv[3] = NULL;
115
116 /* Execute the proxy command. Note that we gave up any
117 extra privileges above. */
118 execv("/bin/sh", argv);
119 perror("/bin/sh");
120 exit(1);
121 }
122 /* Parent. */
123 if (pid < 0)
124 fatal("fork failed: %.100s", strerror(errno));
125
126 /* Close child side of the descriptors. */
127 close(pin[0]);
128 close(pout[1]);
129
130 /* Free the command name. */
131 buffer_free(&command);
132
133 /* Set the connection file descriptors. */
134 packet_set_connection(pout[0], pin[1]);
135
136 return 1;
137}
138
139/*
140 * Creates a (possibly privileged) socket for use as the ssh connection.
141 */
142int
143ssh_create_socket(uid_t original_real_uid, int privileged, int family)
144{
145 int sock;
146
147 /*
148 * If we are running as root and want to connect to a privileged
149 * port, bind our own socket to a privileged port.
150 */
151 if (privileged) {
152 int p = IPPORT_RESERVED - 1;
153 sock = rresvport_af(&p, family);
154 if (sock < 0)
155 error("rresvport: af=%d %.100s", family, strerror(errno));
156 else
157 debug("Allocated local port %d.", p);
158 } else {
159 /*
160 * Just create an ordinary socket on arbitrary port. We use
161 * the user's uid to create the socket.
162 */
163 temporarily_use_uid(original_real_uid);
164 sock = socket(family, SOCK_STREAM, 0);
165 if (sock < 0)
166 error("socket: %.100s", strerror(errno));
167 restore_uid();
168 }
169 return sock;
170}
171
172/*
173 * Opens a TCP/IP connection to the remote server on the given host.
174 * The address of the remote host will be returned in hostaddr.
175 * If port is 0, the default port will be used. If anonymous is zero,
176 * a privileged port will be allocated to make the connection.
177 * This requires super-user privileges if anonymous is false.
178 * Connection_attempts specifies the maximum number of tries (one per
179 * second). If proxy_command is non-NULL, it specifies the command (with %h
180 * and %p substituted for host and port, respectively) to use to contact
181 * the daemon.
182 */
183int
184ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
185 u_short port, int connection_attempts,
186 int anonymous, uid_t original_real_uid,
187 const char *proxy_command)
188{
189 int sock = -1, attempt;
190 struct servent *sp;
191 struct addrinfo hints, *ai, *aitop;
192 char ntop[NI_MAXHOST], strport[NI_MAXSERV];
193 int gaierr;
194 struct linger linger;
195
196 debug("ssh_connect: getuid %d geteuid %d anon %d",
197 (int) getuid(), (int) geteuid(), anonymous);
198
199 /* Get default port if port has not been set. */
200 if (port == 0) {
201 sp = getservbyname(SSH_SERVICE_NAME, "tcp");
202 if (sp)
203 port = ntohs(sp->s_port);
204 else
205 port = SSH_DEFAULT_PORT;
206 }
207 /* If a proxy command is given, connect using it. */
208 if (proxy_command != NULL)
209 return ssh_proxy_connect(host, port, original_real_uid, proxy_command);
210
211 /* No proxy command. */
212
213 memset(&hints, 0, sizeof(hints));
214 hints.ai_family = IPv4or6;
215 hints.ai_socktype = SOCK_STREAM;
216 snprintf(strport, sizeof strport, "%d", port);
217 if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)
218 fatal("%s: %.100s: %s", __progname, host,
219 gai_strerror(gaierr));
220
221 /*
222 * Try to connect several times. On some machines, the first time
223 * will sometimes fail. In general socket code appears to behave
224 * quite magically on many machines.
225 */
226 for (attempt = 0; attempt < connection_attempts; attempt++) {
227 if (attempt > 0)
228 debug("Trying again...");
229
230 /* Loop through addresses for this host, and try each one in
231 sequence until the connection succeeds. */
232 for (ai = aitop; ai; ai = ai->ai_next) {
233 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
234 continue;
235 if (getnameinfo(ai->ai_addr, ai->ai_addrlen,
236 ntop, sizeof(ntop), strport, sizeof(strport),
237 NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
238 error("ssh_connect: getnameinfo failed");
239 continue;
240 }
241 debug("Connecting to %.200s [%.100s] port %s.",
242 host, ntop, strport);
243
244 /* Create a socket for connecting. */
245 sock = ssh_create_socket(original_real_uid,
246 !anonymous && geteuid() == 0 && port < IPPORT_RESERVED,
247 ai->ai_family);
248 if (sock < 0)
249 continue;
250
251 /* Connect to the host. We use the user's uid in the
252 * hope that it will help with tcp_wrappers showing
253 * the remote uid as root.
254 */
255 temporarily_use_uid(original_real_uid);
256 if (connect(sock, ai->ai_addr, ai->ai_addrlen) >= 0) {
257 /* Successful connection. */
258 memcpy(hostaddr, ai->ai_addr, sizeof(*hostaddr));
259 restore_uid();
260 break;
261 } else {
262 debug("connect: %.100s", strerror(errno));
263 restore_uid();
264 /*
265 * Close the failed socket; there appear to
266 * be some problems when reusing a socket for
267 * which connect() has already returned an
268 * error.
269 */
270 shutdown(sock, SHUT_RDWR);
271 close(sock);
272 }
273 }
274 if (ai)
275 break; /* Successful connection. */
276
277 /* Sleep a moment before retrying. */
278 sleep(1);
279 }
280
281 freeaddrinfo(aitop);
282
283 /* Return failure if we didn't get a successful connection. */
284 if (attempt >= connection_attempts)
285 return 0;
286
287 debug("Connection established.");
288
289 /*
290 * Set socket options. We would like the socket to disappear as soon
291 * as it has been closed for whatever reason.
292 */
293 /* setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on)); */
294 linger.l_onoff = 1;
295 linger.l_linger = 5;
296 setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *) &linger, sizeof(linger));
297
298 /* Set the connection. */
299 packet_set_connection(sock, sock);
300
301 return 1;
302}
303
304/*
305 * Checks if the user has an authentication agent, and if so, tries to
306 * authenticate using the agent.
307 */
308int
309try_agent_authentication()
310{
311 int status, type;
312 char *comment;
313 AuthenticationConnection *auth;
314 unsigned char response[16];
315 unsigned int i;
316 BIGNUM *e, *n, *challenge;
317
318 /* Get connection to the agent. */
319 auth = ssh_get_authentication_connection();
320 if (!auth)
321 return 0;
322
323 e = BN_new();
324 n = BN_new();
325 challenge = BN_new();
326
327 /* Loop through identities served by the agent. */
328 for (status = ssh_get_first_identity(auth, e, n, &comment);
329 status;
330 status = ssh_get_next_identity(auth, e, n, &comment)) {
331 int plen, clen;
332
333 /* Try this identity. */
334 debug("Trying RSA authentication via agent with '%.100s'", comment);
335 xfree(comment);
336
337 /* Tell the server that we are willing to authenticate using this key. */
338 packet_start(SSH_CMSG_AUTH_RSA);
339 packet_put_bignum(n);
340 packet_send();
341 packet_write_wait();
342
343 /* Wait for server's response. */
344 type = packet_read(&plen);
345
346 /* The server sends failure if it doesn\'t like our key or
347 does not support RSA authentication. */
348 if (type == SSH_SMSG_FAILURE) {
349 debug("Server refused our key.");
350 continue;
351 }
352 /* Otherwise it should have sent a challenge. */
353 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
354 packet_disconnect("Protocol error during RSA authentication: %d",
355 type);
356
357 packet_get_bignum(challenge, &clen);
358
359 packet_integrity_check(plen, clen, type);
360
361 debug("Received RSA challenge from server.");
362
363 /* Ask the agent to decrypt the challenge. */
364 if (!ssh_decrypt_challenge(auth, e, n, challenge,
365 session_id, 1, response)) {
366 /* The agent failed to authenticate this identifier although it
367 advertised it supports this. Just return a wrong value. */
368 log("Authentication agent failed to decrypt challenge.");
369 memset(response, 0, sizeof(response));
370 }
371 debug("Sending response to RSA challenge.");
372
373 /* Send the decrypted challenge back to the server. */
374 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
375 for (i = 0; i < 16; i++)
376 packet_put_char(response[i]);
377 packet_send();
378 packet_write_wait();
379
380 /* Wait for response from the server. */
381 type = packet_read(&plen);
382
383 /* The server returns success if it accepted the authentication. */
384 if (type == SSH_SMSG_SUCCESS) {
385 debug("RSA authentication accepted by server.");
386 BN_clear_free(e);
387 BN_clear_free(n);
388 BN_clear_free(challenge);
389 return 1;
390 }
391 /* Otherwise it should return failure. */
392 if (type != SSH_SMSG_FAILURE)
393 packet_disconnect("Protocol error waiting RSA auth response: %d",
394 type);
395 }
396
397 BN_clear_free(e);
398 BN_clear_free(n);
399 BN_clear_free(challenge);
400
401 debug("RSA authentication using agent refused.");
402 return 0;
403}
404
405/*
406 * Computes the proper response to a RSA challenge, and sends the response to
407 * the server.
408 */
409void
410respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
411{
412 unsigned char buf[32], response[16];
413 MD5_CTX md;
414 int i, len;
415
416 /* Decrypt the challenge using the private key. */
417 rsa_private_decrypt(challenge, challenge, prv);
418
419 /* Compute the response. */
420 /* The response is MD5 of decrypted challenge plus session id. */
421 len = BN_num_bytes(challenge);
422 if (len <= 0 || len > sizeof(buf))
423 packet_disconnect("respond_to_rsa_challenge: bad challenge length %d",
424 len);
425
426 memset(buf, 0, sizeof(buf));
427 BN_bn2bin(challenge, buf + sizeof(buf) - len);
428 MD5_Init(&md);
429 MD5_Update(&md, buf, 32);
430 MD5_Update(&md, session_id, 16);
431 MD5_Final(response, &md);
432
433 debug("Sending response to host key RSA challenge.");
434
435 /* Send the response back to the server. */
436 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
437 for (i = 0; i < 16; i++)
438 packet_put_char(response[i]);
439 packet_send();
440 packet_write_wait();
441
442 memset(buf, 0, sizeof(buf));
443 memset(response, 0, sizeof(response));
444 memset(&md, 0, sizeof(md));
445}
446
447/*
448 * Checks if the user has authentication file, and if so, tries to authenticate
449 * the user using it.
450 */
451int
452try_rsa_authentication(const char *authfile)
453{
454 BIGNUM *challenge;
455 RSA *private_key;
456 RSA *public_key;
457 char *passphrase, *comment;
458 int type, i;
459 int plen, clen;
460
461 /* Try to load identification for the authentication key. */
462 public_key = RSA_new();
463 if (!load_public_key(authfile, public_key, &comment)) {
464 RSA_free(public_key);
465 /* Could not load it. Fail. */
466 return 0;
467 }
468 debug("Trying RSA authentication with key '%.100s'", comment);
469
470 /* Tell the server that we are willing to authenticate using this key. */
471 packet_start(SSH_CMSG_AUTH_RSA);
472 packet_put_bignum(public_key->n);
473 packet_send();
474 packet_write_wait();
475
476 /* We no longer need the public key. */
477 RSA_free(public_key);
478
479 /* Wait for server's response. */
480 type = packet_read(&plen);
481
482 /*
483 * The server responds with failure if it doesn\'t like our key or
484 * doesn\'t support RSA authentication.
485 */
486 if (type == SSH_SMSG_FAILURE) {
487 debug("Server refused our key.");
488 xfree(comment);
489 return 0;
490 }
491 /* Otherwise, the server should respond with a challenge. */
492 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
493 packet_disconnect("Protocol error during RSA authentication: %d", type);
494
495 /* Get the challenge from the packet. */
496 challenge = BN_new();
497 packet_get_bignum(challenge, &clen);
498
499 packet_integrity_check(plen, clen, type);
500
501 debug("Received RSA challenge from server.");
502
503 private_key = RSA_new();
504 /*
505 * Load the private key. Try first with empty passphrase; if it
506 * fails, ask for a passphrase.
507 */
508 if (!load_private_key(authfile, "", private_key, NULL)) {
509 char buf[300];
510 snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
511 comment);
512 if (!options.batch_mode)
513 passphrase = read_passphrase(buf, 0);
514 else {
515 debug("Will not query passphrase for %.100s in batch mode.",
516 comment);
517 passphrase = xstrdup("");
518 }
519
520 /* Load the authentication file using the pasphrase. */
521 if (!load_private_key(authfile, passphrase, private_key, NULL)) {
522 memset(passphrase, 0, strlen(passphrase));
523 xfree(passphrase);
524 error("Bad passphrase.");
525
526 /* Send a dummy response packet to avoid protocol error. */
527 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
528 for (i = 0; i < 16; i++)
529 packet_put_char(0);
530 packet_send();
531 packet_write_wait();
532
533 /* Expect the server to reject it... */
534 packet_read_expect(&plen, SSH_SMSG_FAILURE);
535 xfree(comment);
536 return 0;
537 }
538 /* Destroy the passphrase. */
539 memset(passphrase, 0, strlen(passphrase));
540 xfree(passphrase);
541 }
542 /* We no longer need the comment. */
543 xfree(comment);
544
545 /* Compute and send a response to the challenge. */
546 respond_to_rsa_challenge(challenge, private_key);
547
548 /* Destroy the private key. */
549 RSA_free(private_key);
550
551 /* We no longer need the challenge. */
552 BN_clear_free(challenge);
553
554 /* Wait for response from the server. */
555 type = packet_read(&plen);
556 if (type == SSH_SMSG_SUCCESS) {
557 debug("RSA authentication accepted by server.");
558 return 1;
559 }
560 if (type != SSH_SMSG_FAILURE)
561 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
562 debug("RSA authentication refused.");
563 return 0;
564}
565
566/*
567 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
568 * authentication and RSA host authentication.
569 */
570int
571try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
572{
573 int type;
574 BIGNUM *challenge;
575 int plen, clen;
576
577 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
578
579 /* Tell the server that we are willing to authenticate using this key. */
580 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
581 packet_put_string(local_user, strlen(local_user));
582 packet_put_int(BN_num_bits(host_key->n));
583 packet_put_bignum(host_key->e);
584 packet_put_bignum(host_key->n);
585 packet_send();
586 packet_write_wait();
587
588 /* Wait for server's response. */
589 type = packet_read(&plen);
590
591 /* The server responds with failure if it doesn't admit our
592 .rhosts authentication or doesn't know our host key. */
593 if (type == SSH_SMSG_FAILURE) {
594 debug("Server refused our rhosts authentication or host key.");
595 return 0;
596 }
597 /* Otherwise, the server should respond with a challenge. */
598 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
599 packet_disconnect("Protocol error during RSA authentication: %d", type);
600
601 /* Get the challenge from the packet. */
602 challenge = BN_new();
603 packet_get_bignum(challenge, &clen);
604
605 packet_integrity_check(plen, clen, type);
606
607 debug("Received RSA challenge for host key from server.");
608
609 /* Compute a response to the challenge. */
610 respond_to_rsa_challenge(challenge, host_key);
611
612 /* We no longer need the challenge. */
613 BN_clear_free(challenge);
614
615 /* Wait for response from the server. */
616 type = packet_read(&plen);
617 if (type == SSH_SMSG_SUCCESS) {
618 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
619 return 1;
620 }
621 if (type != SSH_SMSG_FAILURE)
622 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
623 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
624 return 0;
625}
626
627#ifdef KRB4
628int
629try_kerberos_authentication()
630{
631 KTEXT_ST auth; /* Kerberos data */
632 char *reply;
633 char inst[INST_SZ];
634 char *realm;
635 CREDENTIALS cred;
636 int r, type, plen;
637 Key_schedule schedule;
638 u_long checksum, cksum;
639 MSG_DAT msg_data;
640 struct sockaddr_in local, foreign;
641 struct stat st;
642
643 /* Don't do anything if we don't have any tickets. */
644 if (stat(tkt_string(), &st) < 0)
645 return 0;
646
647 strncpy(inst, (char *) krb_get_phost(get_canonical_hostname()), INST_SZ);
648
649 realm = (char *) krb_realmofhost(get_canonical_hostname());
650 if (!realm) {
651 debug("Kerberos V4: no realm for %s", get_canonical_hostname());
652 return 0;
653 }
654 /* This can really be anything. */
655 checksum = (u_long) getpid();
656
657 r = krb_mk_req(&auth, KRB4_SERVICE_NAME, inst, realm, checksum);
658 if (r != KSUCCESS) {
659 debug("Kerberos V4 krb_mk_req failed: %s", krb_err_txt[r]);
660 return 0;
661 }
662 /* Get session key to decrypt the server's reply with. */
663 r = krb_get_cred(KRB4_SERVICE_NAME, inst, realm, &cred);
664 if (r != KSUCCESS) {
665 debug("get_cred failed: %s", krb_err_txt[r]);
666 return 0;
667 }
668 des_key_sched((des_cblock *) cred.session, schedule);
669
670 /* Send authentication info to server. */
671 packet_start(SSH_CMSG_AUTH_KERBEROS);
672 packet_put_string((char *) auth.dat, auth.length);
673 packet_send();
674 packet_write_wait();
675
676 /* Zero the buffer. */
677 (void) memset(auth.dat, 0, MAX_KTXT_LEN);
678
679 r = sizeof(local);
680 memset(&local, 0, sizeof(local));
681 if (getsockname(packet_get_connection_in(),
682 (struct sockaddr *) & local, &r) < 0)
683 debug("getsockname failed: %s", strerror(errno));
684
685 r = sizeof(foreign);
686 memset(&foreign, 0, sizeof(foreign));
687 if (getpeername(packet_get_connection_in(),
688 (struct sockaddr *) & foreign, &r) < 0) {
689 debug("getpeername failed: %s", strerror(errno));
690 fatal_cleanup();
691 }
692 /* Get server reply. */
693 type = packet_read(&plen);
694 switch (type) {
695 case SSH_SMSG_FAILURE:
696 /* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
697 debug("Kerberos V4 authentication failed.");
698 return 0;
699 break;
700
701 case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
702 /* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
703 debug("Kerberos V4 authentication accepted.");
704
705 /* Get server's response. */
706 reply = packet_get_string((unsigned int *) &auth.length);
707 memcpy(auth.dat, reply, auth.length);
708 xfree(reply);
709
710 packet_integrity_check(plen, 4 + auth.length, type);
711
712 /*
713 * If his response isn't properly encrypted with the session
714 * key, and the decrypted checksum fails to match, he's
715 * bogus. Bail out.
716 */
717 r = krb_rd_priv(auth.dat, auth.length, schedule, &cred.session,
718 &foreign, &local, &msg_data);
719 if (r != KSUCCESS) {
720 debug("Kerberos V4 krb_rd_priv failed: %s", krb_err_txt[r]);
721 packet_disconnect("Kerberos V4 challenge failed!");
722 }
723 /* Fetch the (incremented) checksum that we supplied in the request. */
724 (void) memcpy((char *) &cksum, (char *) msg_data.app_data, sizeof(cksum));
725 cksum = ntohl(cksum);
726
727 /* If it matches, we're golden. */
728 if (cksum == checksum + 1) {
729 debug("Kerberos V4 challenge successful.");
730 return 1;
731 } else
732 packet_disconnect("Kerberos V4 challenge failed!");
733 break;
734
735 default:
736 packet_disconnect("Protocol error on Kerberos V4 response: %d", type);
737 }
738 return 0;
739}
740
741#endif /* KRB4 */
742
743#ifdef AFS
744int
745send_kerberos_tgt()
746{
747 CREDENTIALS *creds;
748 char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
749 int r, type, plen;
750 unsigned char buffer[8192];
751 struct stat st;
752
753 /* Don't do anything if we don't have any tickets. */
754 if (stat(tkt_string(), &st) < 0)
755 return 0;
756
757 creds = xmalloc(sizeof(*creds));
758
759 if ((r = krb_get_tf_fullname(TKT_FILE, pname, pinst, prealm)) != KSUCCESS) {
760 debug("Kerberos V4 tf_fullname failed: %s", krb_err_txt[r]);
761 return 0;
762 }
763 if ((r = krb_get_cred("krbtgt", prealm, prealm, creds)) != GC_OK) {
764 debug("Kerberos V4 get_cred failed: %s", krb_err_txt[r]);
765 return 0;
766 }
767 if (time(0) > krb_life_to_time(creds->issue_date, creds->lifetime)) {
768 debug("Kerberos V4 ticket expired: %s", TKT_FILE);
769 return 0;
770 }
771 creds_to_radix(creds, buffer);
772 xfree(creds);
773
774 packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
775 packet_put_string((char *) buffer, strlen(buffer));
776 packet_send();
777 packet_write_wait();
778
779 type = packet_read(&plen);
780
781 if (type == SSH_SMSG_FAILURE)
782 debug("Kerberos TGT for realm %s rejected.", prealm);
783 else if (type != SSH_SMSG_SUCCESS)
784 packet_disconnect("Protocol error on Kerberos TGT response: %d", type);
785
786 return 1;
787}
788
789void
790send_afs_tokens(void)
791{
792 CREDENTIALS creds;
793 struct ViceIoctl parms;
794 struct ClearToken ct;
795 int i, type, len, plen;
796 char buf[2048], *p, *server_cell;
797 unsigned char buffer[8192];
798
799 /* Move over ktc_GetToken, here's something leaner. */
800 for (i = 0; i < 100; i++) { /* just in case */
801 parms.in = (char *) &i;
802 parms.in_size = sizeof(i);
803 parms.out = buf;
804 parms.out_size = sizeof(buf);
805 if (k_pioctl(0, VIOCGETTOK, &parms, 0) != 0)
806 break;
807 p = buf;
808
809 /* Get secret token. */
810 memcpy(&creds.ticket_st.length, p, sizeof(unsigned int));
811 if (creds.ticket_st.length > MAX_KTXT_LEN)
812 break;
813 p += sizeof(unsigned int);
814 memcpy(creds.ticket_st.dat, p, creds.ticket_st.length);
815 p += creds.ticket_st.length;
816
817 /* Get clear token. */
818 memcpy(&len, p, sizeof(len));
819 if (len != sizeof(struct ClearToken))
820 break;
821 p += sizeof(len);
822 memcpy(&ct, p, len);
823 p += len;
824 p += sizeof(len); /* primary flag */
825 server_cell = p;
826
827 /* Flesh out our credentials. */
828 strlcpy(creds.service, "afs", sizeof creds.service);
829 creds.instance[0] = '\0';
830 strlcpy(creds.realm, server_cell, REALM_SZ);
831 memcpy(creds.session, ct.HandShakeKey, DES_KEY_SZ);
832 creds.issue_date = ct.BeginTimestamp;
833 creds.lifetime = krb_time_to_life(creds.issue_date, ct.EndTimestamp);
834 creds.kvno = ct.AuthHandle;
835 snprintf(creds.pname, sizeof(creds.pname), "AFS ID %d", ct.ViceId);
836 creds.pinst[0] = '\0';
837
838 /* Encode token, ship it off. */
839 if (!creds_to_radix(&creds, buffer))
840 break;
841 packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
842 packet_put_string((char *) buffer, strlen(buffer));
843 packet_send();
844 packet_write_wait();
845
846 /* Roger, Roger. Clearance, Clarence. What's your vector,
847 Victor? */
848 type = packet_read(&plen);
849
850 if (type == SSH_SMSG_FAILURE)
851 debug("AFS token for cell %s rejected.", server_cell);
852 else if (type != SSH_SMSG_SUCCESS)
853 packet_disconnect("Protocol error on AFS token response: %d", type);
854 }
855}
856
857#endif /* AFS */
858
859/*
860 * Tries to authenticate with any string-based challenge/response system.
861 * Note that the client code is not tied to s/key or TIS.
862 */
863int
864try_skey_authentication()
865{
866 int type, i, payload_len;
867 char *challenge, *response;
868
869 debug("Doing skey authentication.");
870
871 /* request a challenge */
872 packet_start(SSH_CMSG_AUTH_TIS);
873 packet_send();
874 packet_write_wait();
875
876 type = packet_read(&payload_len);
877 if (type != SSH_SMSG_FAILURE &&
878 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
879 packet_disconnect("Protocol error: got %d in response "
880 "to skey-auth", type);
881 }
882 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
883 debug("No challenge for skey authentication.");
884 return 0;
885 }
886 challenge = packet_get_string(&payload_len);
887 if (options.cipher == SSH_CIPHER_NONE)
888 log("WARNING: Encryption is disabled! "
889 "Reponse will be transmitted in clear text.");
890 fprintf(stderr, "%s\n", challenge);
891 xfree(challenge);
892 fflush(stderr);
893 for (i = 0; i < options.number_of_password_prompts; i++) {
894 if (i != 0)
895 error("Permission denied, please try again.");
896 response = read_passphrase("Response: ", 0);
897 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
898 packet_put_string(response, strlen(response));
899 memset(response, 0, strlen(response));
900 xfree(response);
901 packet_send();
902 packet_write_wait();
903 type = packet_read(&payload_len);
904 if (type == SSH_SMSG_SUCCESS)
905 return 1;
906 if (type != SSH_SMSG_FAILURE)
907 packet_disconnect("Protocol error: got %d in response "
908 "to skey-auth-reponse", type);
909 }
910 /* failure */
911 return 0;
912}
913
914/*
915 * Tries to authenticate with plain passwd authentication.
916 */
917int
918try_password_authentication(char *prompt)
919{
920 int type, i, payload_len;
921 char *password;
922
923 debug("Doing password authentication.");
924 if (options.cipher == SSH_CIPHER_NONE)
925 log("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
926 for (i = 0; i < options.number_of_password_prompts; i++) {
927 if (i != 0)
928 error("Permission denied, please try again.");
929 password = read_passphrase(prompt, 0);
930 packet_start(SSH_CMSG_AUTH_PASSWORD);
931 packet_put_string(password, strlen(password));
932 memset(password, 0, strlen(password));
933 xfree(password);
934 packet_send();
935 packet_write_wait();
936
937 type = packet_read(&payload_len);
938 if (type == SSH_SMSG_SUCCESS)
939 return 1;
940 if (type != SSH_SMSG_FAILURE)
941 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
942 }
943 /* failure */
944 return 0;
945}
946
947/*
948 * Waits for the server identification string, and sends our own
949 * identification string.
950 */
951void
952ssh_exchange_identification()
953{
954 char buf[256], remote_version[256]; /* must be same size! */
955 int remote_major, remote_minor, i;
956 int connection_in = packet_get_connection_in();
957 int connection_out = packet_get_connection_out();
958
959 /* Read other side\'s version identification. */
960 for (i = 0; i < sizeof(buf) - 1; i++) {
961 int len = read(connection_in, &buf[i], 1);
962 if (len < 0)
963 fatal("ssh_exchange_identification: read: %.100s", strerror(errno));
964 if (len != 1)
965 fatal("ssh_exchange_identification: Connection closed by remote host");
966 if (buf[i] == '\r') {
967 buf[i] = '\n';
968 buf[i + 1] = 0;
969 break;
970 }
971 if (buf[i] == '\n') {
972 buf[i + 1] = 0;
973 break;
974 }
975 }
976 buf[sizeof(buf) - 1] = 0;
977
978 /*
979 * Check that the versions match. In future this might accept
980 * several versions and set appropriate flags to handle them.
981 */
982 if (sscanf(buf, "SSH-%d.%d-%[^\n]\n", &remote_major, &remote_minor,
983 remote_version) != 3)
984 fatal("Bad remote protocol version identification: '%.100s'", buf);
985 debug("Remote protocol version %d.%d, remote software version %.100s",
986 remote_major, remote_minor, remote_version);
987
988 /* Check if the remote protocol version is too old. */
989 if (remote_major == 1 && remote_minor < 3)
990 fatal("Remote machine has too old SSH software version.");
991
992 /* We speak 1.3, too. */
993 if (remote_major == 1 && remote_minor == 3) {
994 enable_compat13();
995 if (options.forward_agent) {
996 log("Agent forwarding disabled for protocol 1.3");
997 options.forward_agent = 0;
998 }
999 }
1000#if 0
1001 /*
1002 * Removed for now, to permit compatibility with latter versions. The
1003 * server will reject our version and disconnect if it doesn't
1004 * support it.
1005 */
1006 if (remote_major != PROTOCOL_MAJOR)
1007 fatal("Protocol major versions differ: %d vs. %d",
1008 PROTOCOL_MAJOR, remote_major);
1009#endif
1010
1011 /* Send our own protocol version identification. */
1012 snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n",
1013 PROTOCOL_MAJOR, PROTOCOL_MINOR, SSH_VERSION);
1014 if (atomicio(write, connection_out, buf, strlen(buf)) != strlen(buf))
1015 fatal("write: %.100s", strerror(errno));
1016}
1017
1018int ssh_cipher_default = SSH_CIPHER_3DES;
1019
1020int
1021read_yes_or_no(const char *prompt, int defval)
1022{
1023 char buf[1024];
1024 FILE *f;
1025 int retval = -1;
1026
1027 if (isatty(0))
1028 f = stdin;
1029 else
1030 f = fopen("/dev/tty", "rw");
1031
1032 if (f == NULL)
1033 return 0;
1034
1035 fflush(stdout);
1036
1037 while (1) {
1038 fprintf(stderr, "%s", prompt);
1039 if (fgets(buf, sizeof(buf), f) == NULL) {
1040 /* Print a newline (the prompt probably didn\'t have one). */
1041 fprintf(stderr, "\n");
1042 strlcpy(buf, "no", sizeof buf);
1043 }
1044 /* Remove newline from response. */
1045 if (strchr(buf, '\n'))
1046 *strchr(buf, '\n') = 0;
1047
1048 if (buf[0] == 0)
1049 retval = defval;
1050 if (strcmp(buf, "yes") == 0)
1051 retval = 1;
1052 if (strcmp(buf, "no") == 0)
1053 retval = 0;
1054
1055 if (retval != -1) {
1056 if (f != stdin)
1057 fclose(f);
1058 return retval;
1059 }
1060 }
1061}
1062
1063/*
1064 * check whether the supplied host key is valid, return only if ok.
1065 */
1066
1067void
1068check_host_key(char *host, struct sockaddr *hostaddr, RSA *host_key)
1069{
1070 RSA *file_key;
1071 char *ip = NULL;
1072 char hostline[1000], *hostp;
1073 HostStatus host_status;
1074 HostStatus ip_status;
1075 int local = 0, host_ip_differ = 0;
1076 char ntop[NI_MAXHOST];
1077
1078 /*
1079 * Force accepting of the host key for loopback/localhost. The
1080 * problem is that if the home directory is NFS-mounted to multiple
1081 * machines, localhost will refer to a different machine in each of
1082 * them, and the user will get bogus HOST_CHANGED warnings. This
1083 * essentially disables host authentication for localhost; however,
1084 * this is probably not a real problem.
1085 */
1086 switch (hostaddr->sa_family) {
1087 case AF_INET:
1088 local = (ntohl(((struct sockaddr_in *)hostaddr)->sin_addr.s_addr) >> 24) == IN_LOOPBACKNET;
1089 break;
1090#ifdef INET6
1091 case AF_INET6:
1092 local = IN6_IS_ADDR_LOOPBACK(&(((struct sockaddr_in6 *)hostaddr)->sin6_addr));
1093 break;
1094#endif
1095 default:
1096 local = 0;
1097 break;
1098 }
1099 if (local) {
1100 debug("Forcing accepting of host key for loopback/localhost.");
1101 return;
1102 }
1103
1104 /*
1105 * Turn off check_host_ip for proxy connects, since
1106 * we don't have the remote ip-address
1107 */
1108 if (options.proxy_command != NULL && options.check_host_ip)
1109 options.check_host_ip = 0;
1110
1111 if (options.check_host_ip) {
1112 if (getnameinfo(hostaddr, hostaddr->sa_len, ntop, sizeof(ntop),
1113 NULL, 0, NI_NUMERICHOST) != 0)
1114 fatal("check_host_key: getnameinfo failed");
1115 ip = xstrdup(ntop);
1116 }
1117
1118 /*
1119 * Store the host key from the known host file in here so that we can
1120 * compare it with the key for the IP address.
1121 */
1122 file_key = RSA_new();
1123 file_key->n = BN_new();
1124 file_key->e = BN_new();
1125
1126 /*
1127 * Check if the host key is present in the user\'s list of known
1128 * hosts or in the systemwide list.
1129 */
1130 host_status = check_host_in_hostfile(options.user_hostfile, host,
1131 host_key->e, host_key->n,
1132 file_key->e, file_key->n);
1133 if (host_status == HOST_NEW)
1134 host_status = check_host_in_hostfile(options.system_hostfile, host,
1135 host_key->e, host_key->n,
1136 file_key->e, file_key->n);
1137 /*
1138 * Also perform check for the ip address, skip the check if we are
1139 * localhost or the hostname was an ip address to begin with
1140 */
1141 if (options.check_host_ip && !local && strcmp(host, ip)) {
1142 RSA *ip_key = RSA_new();
1143 ip_key->n = BN_new();
1144 ip_key->e = BN_new();
1145 ip_status = check_host_in_hostfile(options.user_hostfile, ip,
1146 host_key->e, host_key->n,
1147 ip_key->e, ip_key->n);
1148
1149 if (ip_status == HOST_NEW)
1150 ip_status = check_host_in_hostfile(options.system_hostfile, ip,
1151 host_key->e, host_key->n,
1152 ip_key->e, ip_key->n);
1153 if (host_status == HOST_CHANGED &&
1154 (ip_status != HOST_CHANGED ||
1155 (BN_cmp(ip_key->e, file_key->e) || BN_cmp(ip_key->n, file_key->n))))
1156 host_ip_differ = 1;
1157
1158 RSA_free(ip_key);
1159 } else
1160 ip_status = host_status;
1161
1162 RSA_free(file_key);
1163
1164 switch (host_status) {
1165 case HOST_OK:
1166 /* The host is known and the key matches. */
1167 debug("Host '%.200s' is known and matches the host key.", host);
1168 if (options.check_host_ip) {
1169 if (ip_status == HOST_NEW) {
1170 if (!add_host_to_hostfile(options.user_hostfile, ip,
1171 host_key->e, host_key->n))
1172 log("Failed to add the host key for IP address '%.30s' to the list of known hosts (%.30s).",
1173 ip, options.user_hostfile);
1174 else
1175 log("Warning: Permanently added host key for IP address '%.30s' to the list of known hosts.",
1176 ip);
1177 } else if (ip_status != HOST_OK)
1178 log("Warning: the host key for '%.200s' differs from the key for the IP address '%.30s'",
1179 host, ip);
1180 }
1181 break;
1182 case HOST_NEW:
1183 /* The host is new. */
1184 if (options.strict_host_key_checking == 1) {
1185 /* User has requested strict host key checking. We will not add the host key
1186 automatically. The only alternative left is to abort. */
1187 fatal("No host key is known for %.200s and you have requested strict checking.", host);
1188 } else if (options.strict_host_key_checking == 2) {
1189 /* The default */
1190 char prompt[1024];
1191 char *fp = fingerprint(host_key->e, host_key->n);
1192 snprintf(prompt, sizeof(prompt),
1193 "The authenticity of host '%.200s' can't be established.\n"
1194 "Key fingerprint is %d %s.\n"
1195 "Are you sure you want to continue connecting (yes/no)? ",
1196 host, BN_num_bits(host_key->n), fp);
1197 if (!read_yes_or_no(prompt, -1))
1198 fatal("Aborted by user!\n");
1199 }
1200 if (options.check_host_ip && ip_status == HOST_NEW && strcmp(host, ip)) {
1201 snprintf(hostline, sizeof(hostline), "%s,%s", host, ip);
1202 hostp = hostline;
1203 } else
1204 hostp = host;
1205
1206 /* If not in strict mode, add the key automatically to the local known_hosts file. */
1207 if (!add_host_to_hostfile(options.user_hostfile, hostp,
1208 host_key->e, host_key->n))
1209 log("Failed to add the host to the list of known hosts (%.500s).",
1210 options.user_hostfile);
1211 else
1212 log("Warning: Permanently added '%.200s' to the list of known hosts.",
1213 hostp);
1214 break;
1215 case HOST_CHANGED:
1216 if (options.check_host_ip && host_ip_differ) {
1217 char *msg;
1218 if (ip_status == HOST_NEW)
1219 msg = "is unknown";
1220 else if (ip_status == HOST_OK)
1221 msg = "is unchanged";
1222 else
1223 msg = "has a different value";
1224 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1225 error("@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @");
1226 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1227 error("The host key for %s has changed,", host);
1228 error("and the key for the according IP address %s", ip);
1229 error("%s. This could either mean that", msg);
1230 error("DNS SPOOFING is happening or the IP address for the host");
1231 error("and its host key have changed at the same time");
1232 }
1233 /* The host key has changed. */
1234 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1235 error("@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @");
1236 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1237 error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
1238 error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
1239 error("It is also possible that the host key has just been changed.");
1240 error("Please contact your system administrator.");
1241 error("Add correct host key in %.100s to get rid of this message.",
1242 options.user_hostfile);
1243
1244 /*
1245 * If strict host key checking is in use, the user will have
1246 * to edit the key manually and we can only abort.
1247 */
1248 if (options.strict_host_key_checking)
1249 fatal("Host key for %.200s has changed and you have requested strict checking.", host);
1250
1251 /*
1252 * If strict host key checking has not been requested, allow
1253 * the connection but without password authentication or
1254 * agent forwarding.
1255 */
1256 if (options.password_authentication) {
1257 error("Password authentication is disabled to avoid trojan horses.");
1258 options.password_authentication = 0;
1259 }
1260 if (options.forward_agent) {
1261 error("Agent forwarding is disabled to avoid trojan horses.");
1262 options.forward_agent = 0;
1263 }
1264 /*
1265 * XXX Should permit the user to change to use the new id.
1266 * This could be done by converting the host key to an
1267 * identifying sentence, tell that the host identifies itself
1268 * by that sentence, and ask the user if he/she whishes to
1269 * accept the authentication.
1270 */
1271 break;
1272 }
1273 if (options.check_host_ip)
1274 xfree(ip);
1275}
1276
1277/*
1278 * SSH1 key exchange
1279 */
1280void
1281ssh_kex(char *host, struct sockaddr *hostaddr)
1282{
1283 int i;
1284 BIGNUM *key;
1285 RSA *host_key;
1286 RSA *public_key;
1287 int bits, rbits;
1288 unsigned char session_key[SSH_SESSION_KEY_LENGTH];
1289 unsigned char cookie[8];
1290 unsigned int supported_ciphers;
1291 unsigned int server_flags, client_flags;
1292 int payload_len, clen, sum_len = 0;
1293 u_int32_t rand = 0;
1294
1295 debug("Waiting for server public key.");
1296
1297 /* Wait for a public key packet from the server. */
1298 packet_read_expect(&payload_len, SSH_SMSG_PUBLIC_KEY);
1299
1300 /* Get cookie from the packet. */
1301 for (i = 0; i < 8; i++)
1302 cookie[i] = packet_get_char();
1303
1304 /* Get the public key. */
1305 public_key = RSA_new();
1306 bits = packet_get_int();/* bits */
1307 public_key->e = BN_new();
1308 packet_get_bignum(public_key->e, &clen);
1309 sum_len += clen;
1310 public_key->n = BN_new();
1311 packet_get_bignum(public_key->n, &clen);
1312 sum_len += clen;
1313
1314 rbits = BN_num_bits(public_key->n);
1315 if (bits != rbits) {
1316 log("Warning: Server lies about size of server public key: "
1317 "actual size is %d bits vs. announced %d.", rbits, bits);
1318 log("Warning: This may be due to an old implementation of ssh.");
1319 }
1320 /* Get the host key. */
1321 host_key = RSA_new();
1322 bits = packet_get_int();/* bits */
1323 host_key->e = BN_new();
1324 packet_get_bignum(host_key->e, &clen);
1325 sum_len += clen;
1326 host_key->n = BN_new();
1327 packet_get_bignum(host_key->n, &clen);
1328 sum_len += clen;
1329
1330 rbits = BN_num_bits(host_key->n);
1331 if (bits != rbits) {
1332 log("Warning: Server lies about size of server host key: "
1333 "actual size is %d bits vs. announced %d.", rbits, bits);
1334 log("Warning: This may be due to an old implementation of ssh.");
1335 }
1336
1337 /* Get protocol flags. */
1338 server_flags = packet_get_int();
1339 packet_set_protocol_flags(server_flags);
1340
1341 supported_ciphers = packet_get_int();
1342 supported_authentications = packet_get_int();
1343
1344 debug("Received server public key (%d bits) and host key (%d bits).",
1345 BN_num_bits(public_key->n), BN_num_bits(host_key->n));
1346
1347 packet_integrity_check(payload_len,
1348 8 + 4 + sum_len + 0 + 4 + 0 + 0 + 4 + 4 + 4,
1349 SSH_SMSG_PUBLIC_KEY);
1350
1351 check_host_key(host, hostaddr, host_key);
1352
1353 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
1354
1355 compute_session_id(session_id, cookie, host_key->n, public_key->n);
1356
1357 /* Generate a session key. */
1358 arc4random_stir();
1359
1360 /*
1361 * Generate an encryption key for the session. The key is a 256 bit
1362 * random number, interpreted as a 32-byte key, with the least
1363 * significant 8 bits being the first byte of the key.
1364 */
1365 for (i = 0; i < 32; i++) {
1366 if (i % 4 == 0)
1367 rand = arc4random();
1368 session_key[i] = rand & 0xff;
1369 rand >>= 8;
1370 }
1371
1372 /*
1373 * According to the protocol spec, the first byte of the session key
1374 * is the highest byte of the integer. The session key is xored with
1375 * the first 16 bytes of the session id.
1376 */
1377 key = BN_new();
1378 BN_set_word(key, 0);
1379 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
1380 BN_lshift(key, key, 8);
1381 if (i < 16)
1382 BN_add_word(key, session_key[i] ^ session_id[i]);
1383 else
1384 BN_add_word(key, session_key[i]);
1385 }
1386
1387 /*
1388 * Encrypt the integer using the public key and host key of the
1389 * server (key with smaller modulus first).
1390 */
1391 if (BN_cmp(public_key->n, host_key->n) < 0) {
1392 /* Public key has smaller modulus. */
1393 if (BN_num_bits(host_key->n) <
1394 BN_num_bits(public_key->n) + SSH_KEY_BITS_RESERVED) {
1395 fatal("respond_to_rsa_challenge: host_key %d < public_key %d + "
1396 "SSH_KEY_BITS_RESERVED %d",
1397 BN_num_bits(host_key->n),
1398 BN_num_bits(public_key->n),
1399 SSH_KEY_BITS_RESERVED);
1400 }
1401 rsa_public_encrypt(key, key, public_key);
1402 rsa_public_encrypt(key, key, host_key);
1403 } else {
1404 /* Host key has smaller modulus (or they are equal). */
1405 if (BN_num_bits(public_key->n) <
1406 BN_num_bits(host_key->n) + SSH_KEY_BITS_RESERVED) {
1407 fatal("respond_to_rsa_challenge: public_key %d < host_key %d + "
1408 "SSH_KEY_BITS_RESERVED %d",
1409 BN_num_bits(public_key->n),
1410 BN_num_bits(host_key->n),
1411 SSH_KEY_BITS_RESERVED);
1412 }
1413 rsa_public_encrypt(key, key, host_key);
1414 rsa_public_encrypt(key, key, public_key);
1415 }
1416
1417 /* Destroy the public keys since we no longer need them. */
1418 RSA_free(public_key);
1419 RSA_free(host_key);
1420
1421 if (options.cipher == SSH_CIPHER_NOT_SET) {
1422 if (cipher_mask() & supported_ciphers & (1 << ssh_cipher_default))
1423 options.cipher = ssh_cipher_default;
1424 else {
1425 debug("Cipher %s not supported, using %.100s instead.",
1426 cipher_name(ssh_cipher_default),
1427 cipher_name(SSH_FALLBACK_CIPHER));
1428 options.cipher = SSH_FALLBACK_CIPHER;
1429 }
1430 }
1431 /* Check that the selected cipher is supported. */
1432 if (!(supported_ciphers & (1 << options.cipher)))
1433 fatal("Selected cipher type %.100s not supported by server.",
1434 cipher_name(options.cipher));
1435
1436 debug("Encryption type: %.100s", cipher_name(options.cipher));
1437
1438 /* Send the encrypted session key to the server. */
1439 packet_start(SSH_CMSG_SESSION_KEY);
1440 packet_put_char(options.cipher);
1441
1442 /* Send the cookie back to the server. */
1443 for (i = 0; i < 8; i++)
1444 packet_put_char(cookie[i]);
1445
1446 /* Send and destroy the encrypted encryption key integer. */
1447 packet_put_bignum(key);
1448 BN_clear_free(key);
1449
1450 /* Send protocol flags. */
1451 packet_put_int(client_flags);
1452
1453 /* Send the packet now. */
1454 packet_send();
1455 packet_write_wait();
1456
1457 debug("Sent encrypted session key.");
1458
1459 /* Set the encryption key. */
1460 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
1461
1462 /* We will no longer need the session key here. Destroy any extra copies. */
1463 memset(session_key, 0, sizeof(session_key));
1464
1465 /*
1466 * Expect a success message from the server. Note that this message
1467 * will be received in encrypted form.
1468 */
1469 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
1470
1471 debug("Received encrypted confirmation.");
1472}
1473
1474/*
1475 * Authenticate user
1476 */
1477void
1478ssh_userauth(int host_key_valid, RSA *own_host_key,
1479 uid_t original_real_uid, char *host)
1480{
1481 int i, type;
1482 int payload_len;
1483 struct passwd *pw;
1484 const char *server_user, *local_user;
1485
1486 /* Get local user name. Use it as server user if no user name was given. */
1487 pw = getpwuid(original_real_uid);
1488 if (!pw)
1489 fatal("User id %d not found from user database.", original_real_uid);
1490 local_user = xstrdup(pw->pw_name);
1491 server_user = options.user ? options.user : local_user;
1492
1493 /* Send the name of the user to log in as on the server. */
1494 packet_start(SSH_CMSG_USER);
1495 packet_put_string(server_user, strlen(server_user));
1496 packet_send();
1497 packet_write_wait();
1498
1499 /*
1500 * The server should respond with success if no authentication is
1501 * needed (the user has no password). Otherwise the server responds
1502 * with failure.
1503 */
1504 type = packet_read(&payload_len);
1505
1506 /* check whether the connection was accepted without authentication. */
1507 if (type == SSH_SMSG_SUCCESS)
1508 return;
1509 if (type != SSH_SMSG_FAILURE)
1510 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER",
1511 type);
1512
1513#ifdef AFS
1514 /* Try Kerberos tgt passing if the server supports it. */
1515 if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
1516 options.kerberos_tgt_passing) {
1517 if (options.cipher == SSH_CIPHER_NONE)
1518 log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
1519 (void) send_kerberos_tgt();
1520 }
1521 /* Try AFS token passing if the server supports it. */
1522 if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
1523 options.afs_token_passing && k_hasafs()) {
1524 if (options.cipher == SSH_CIPHER_NONE)
1525 log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
1526 send_afs_tokens();
1527 }
1528#endif /* AFS */
1529
1530#ifdef KRB4
1531 if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
1532 options.kerberos_authentication) {
1533 debug("Trying Kerberos authentication.");
1534 if (try_kerberos_authentication()) {
1535 /* The server should respond with success or failure. */
1536 type = packet_read(&payload_len);
1537 if (type == SSH_SMSG_SUCCESS)
1538 return;
1539 if (type != SSH_SMSG_FAILURE)
1540 packet_disconnect("Protocol error: got %d in response to Kerberos auth", type);
1541 }
1542 }
1543#endif /* KRB4 */
1544
1545 /*
1546 * Use rhosts authentication if running in privileged socket and we
1547 * do not wish to remain anonymous.
1548 */
1549 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) &&
1550 options.rhosts_authentication) {
1551 debug("Trying rhosts authentication.");
1552 packet_start(SSH_CMSG_AUTH_RHOSTS);
1553 packet_put_string(local_user, strlen(local_user));
1554 packet_send();
1555 packet_write_wait();
1556
1557 /* The server should respond with success or failure. */
1558 type = packet_read(&payload_len);
1559 if (type == SSH_SMSG_SUCCESS)
1560 return;
1561 if (type != SSH_SMSG_FAILURE)
1562 packet_disconnect("Protocol error: got %d in response to rhosts auth",
1563 type);
1564 }
1565 /*
1566 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
1567 * authentication.
1568 */
1569 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
1570 options.rhosts_rsa_authentication && host_key_valid) {
1571 if (try_rhosts_rsa_authentication(local_user, own_host_key))
1572 return;
1573 }
1574 /* Try RSA authentication if the server supports it. */
1575 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
1576 options.rsa_authentication) {
1577 /*
1578 * Try RSA authentication using the authentication agent. The
1579 * agent is tried first because no passphrase is needed for
1580 * it, whereas identity files may require passphrases.
1581 */
1582 if (try_agent_authentication())
1583 return;
1584
1585 /* Try RSA authentication for each identity. */
1586 for (i = 0; i < options.num_identity_files; i++)
1587 if (try_rsa_authentication(options.identity_files[i]))
1588 return;
1589 }
1590 /* Try skey authentication if the server supports it. */
1591 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
1592 options.skey_authentication && !options.batch_mode) {
1593 if (try_skey_authentication())
1594 return;
1595 }
1596 /* Try password authentication if the server supports it. */
1597 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
1598 options.password_authentication && !options.batch_mode) {
1599 char prompt[80];
1600
1601 snprintf(prompt, sizeof(prompt), "%.30s@%.40s's password: ",
1602 server_user, host);
1603 if (try_password_authentication(prompt))
1604 return;
1605 }
1606 /* All authentication methods have failed. Exit with an error message. */
1607 fatal("Permission denied.");
1608 /* NOTREACHED */
1609}
1610
1611/*
1612 * Starts a dialog with the server, and authenticates the current user on the
1613 * server. This does not need any extra privileges. The basic connection
1614 * to the server must already have been established before this is called.
1615 * If login fails, this function prints an error and never returns.
1616 * This function does not require super-user privileges.
1617 */
1618void
1619ssh_login(int host_key_valid, RSA *own_host_key, const char *orighost,
1620 struct sockaddr *hostaddr, uid_t original_real_uid)
1621{
1622 char *host, *cp;
1623
1624 /* Convert the user-supplied hostname into all lowercase. */
1625 host = xstrdup(orighost);
1626 for (cp = host; *cp; cp++)
1627 if (isupper(*cp))
1628 *cp = tolower(*cp);
1629
1630 /* Exchange protocol version identification strings with the server. */
1631 ssh_exchange_identification();
1632
1633 /* Put the connection into non-blocking mode. */
1634 packet_set_nonblocking();
1635
1636 supported_authentications = 0;
1637 /* key exchange */
1638 ssh_kex(host, hostaddr);
1639 if (supported_authentications == 0)
1640 fatal("supported_authentications == 0.");
1641 /* authenticate user */
1642 ssh_userauth(host_key_valid, own_host_key, original_real_uid, host);
1643}
|