1/* $OpenBSD: auth.h,v 1.50 2004/05/23 23:59:53 dtucker Exp $ */
| 1/* $OpenBSD: auth.h,v 1.50 2004/05/23 23:59:53 dtucker Exp $ */
|
2/* $FreeBSD: head/crypto/openssh/auth.h 137019 2004-10-28 16:11:31Z des $ */
| 2/* $FreeBSD: head/crypto/openssh/auth.h 147005 2005-06-05 15:46:09Z des $ */
|
3
4/*
5 * Copyright (c) 2000 Markus Friedl. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 *
27 */
28
29#ifndef AUTH_H
30#define AUTH_H
31
32#include "key.h"
33#include "hostfile.h"
| 3
4/*
5 * Copyright (c) 2000 Markus Friedl. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 *
27 */
28
29#ifndef AUTH_H
30#define AUTH_H
31
32#include "key.h"
33#include "hostfile.h"
|
| 34#include "buffer.h"
|
34#include <openssl/rsa.h>
35
36#ifdef HAVE_LOGIN_CAP
37#include <login_cap.h>
38#endif
39#ifdef BSD_AUTH
40#include <bsd_auth.h>
41#endif
42#ifdef KRB5
43#include <krb5.h>
44#endif
45
46typedef struct Authctxt Authctxt;
47typedef struct Authmethod Authmethod;
48typedef struct KbdintDevice KbdintDevice;
49
50struct Authctxt {
51 int success;
52 int postponed; /* authentication needs another step */
53 int valid; /* user exists and is allowed to login */
54 int attempt;
55 int failures;
56 int force_pwchange;
57 char *user; /* username sent by the client */
58 char *service;
59 struct passwd *pw; /* set if 'valid' */
60 char *style;
61 void *kbdintctxt;
62#ifdef BSD_AUTH
63 auth_session_t *as;
64#endif
65#ifdef KRB5
66 krb5_context krb5_ctx;
67 krb5_ccache krb5_fwd_ccache;
68 krb5_principal krb5_user;
69 char *krb5_ticket_file;
70 char *krb5_ccname;
71#endif
| 35#include <openssl/rsa.h>
36
37#ifdef HAVE_LOGIN_CAP
38#include <login_cap.h>
39#endif
40#ifdef BSD_AUTH
41#include <bsd_auth.h>
42#endif
43#ifdef KRB5
44#include <krb5.h>
45#endif
46
47typedef struct Authctxt Authctxt;
48typedef struct Authmethod Authmethod;
49typedef struct KbdintDevice KbdintDevice;
50
51struct Authctxt {
52 int success;
53 int postponed; /* authentication needs another step */
54 int valid; /* user exists and is allowed to login */
55 int attempt;
56 int failures;
57 int force_pwchange;
58 char *user; /* username sent by the client */
59 char *service;
60 struct passwd *pw; /* set if 'valid' */
61 char *style;
62 void *kbdintctxt;
63#ifdef BSD_AUTH
64 auth_session_t *as;
65#endif
66#ifdef KRB5
67 krb5_context krb5_ctx;
68 krb5_ccache krb5_fwd_ccache;
69 krb5_principal krb5_user;
70 char *krb5_ticket_file;
71 char *krb5_ccname;
72#endif
|
| 73 Buffer *loginmsg;
|
72 void *methoddata;
73};
74/*
75 * Every authentication method has to handle authentication requests for
76 * non-existing users, or for users that are not allowed to login. In this
77 * case 'valid' is set to 0, but 'user' points to the username requested by
78 * the client.
79 */
80
81struct Authmethod {
82 char *name;
83 int (*userauth)(Authctxt *authctxt);
84 int *enabled;
85};
86
87/*
88 * Keyboard interactive device:
89 * init_ctx returns: non NULL upon success
90 * query returns: 0 - success, otherwise failure
91 * respond returns: 0 - success, 1 - need further interaction,
92 * otherwise - failure
93 */
94struct KbdintDevice
95{
96 const char *name;
97 void* (*init_ctx)(Authctxt*);
98 int (*query)(void *ctx, char **name, char **infotxt,
99 u_int *numprompts, char ***prompts, u_int **echo_on);
100 int (*respond)(void *ctx, u_int numresp, char **responses);
101 void (*free_ctx)(void *ctx);
102};
103
104int auth_rhosts(struct passwd *, const char *);
105int
106auth_rhosts2(struct passwd *, const char *, const char *, const char *);
107
108int auth_rhosts_rsa(Authctxt *, char *, Key *);
109int auth_password(Authctxt *, const char *);
110int auth_rsa(Authctxt *, BIGNUM *);
111int auth_rsa_challenge_dialog(Key *);
112BIGNUM *auth_rsa_generate_challenge(Key *);
113int auth_rsa_verify_response(Key *, BIGNUM *, u_char[]);
114int auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
115
116int auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
117int hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
118int user_key_allowed(struct passwd *, Key *);
119
120#ifdef KRB5
121int auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *);
122int auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt);
123int auth_krb5_password(Authctxt *authctxt, const char *password);
124void krb5_cleanup_proc(Authctxt *authctxt);
125#endif /* KRB5 */
126
127#if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
128#include <shadow.h>
129int auth_shadow_acctexpired(struct spwd *);
130int auth_shadow_pwexpired(Authctxt *);
131#endif
132
133#include "auth-pam.h"
| 74 void *methoddata;
75};
76/*
77 * Every authentication method has to handle authentication requests for
78 * non-existing users, or for users that are not allowed to login. In this
79 * case 'valid' is set to 0, but 'user' points to the username requested by
80 * the client.
81 */
82
83struct Authmethod {
84 char *name;
85 int (*userauth)(Authctxt *authctxt);
86 int *enabled;
87};
88
89/*
90 * Keyboard interactive device:
91 * init_ctx returns: non NULL upon success
92 * query returns: 0 - success, otherwise failure
93 * respond returns: 0 - success, 1 - need further interaction,
94 * otherwise - failure
95 */
96struct KbdintDevice
97{
98 const char *name;
99 void* (*init_ctx)(Authctxt*);
100 int (*query)(void *ctx, char **name, char **infotxt,
101 u_int *numprompts, char ***prompts, u_int **echo_on);
102 int (*respond)(void *ctx, u_int numresp, char **responses);
103 void (*free_ctx)(void *ctx);
104};
105
106int auth_rhosts(struct passwd *, const char *);
107int
108auth_rhosts2(struct passwd *, const char *, const char *, const char *);
109
110int auth_rhosts_rsa(Authctxt *, char *, Key *);
111int auth_password(Authctxt *, const char *);
112int auth_rsa(Authctxt *, BIGNUM *);
113int auth_rsa_challenge_dialog(Key *);
114BIGNUM *auth_rsa_generate_challenge(Key *);
115int auth_rsa_verify_response(Key *, BIGNUM *, u_char[]);
116int auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
117
118int auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
119int hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
120int user_key_allowed(struct passwd *, Key *);
121
122#ifdef KRB5
123int auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *);
124int auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt);
125int auth_krb5_password(Authctxt *authctxt, const char *password);
126void krb5_cleanup_proc(Authctxt *authctxt);
127#endif /* KRB5 */
128
129#if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
130#include <shadow.h>
131int auth_shadow_acctexpired(struct spwd *);
132int auth_shadow_pwexpired(Authctxt *);
133#endif
134
135#include "auth-pam.h"
|
| 136#include "audit.h"
137void remove_kbdint_device(const char *);
138
|
134void disable_forwarding(void);
135
136void do_authentication(Authctxt *);
137void do_authentication2(Authctxt *);
138
139void auth_log(Authctxt *, int, char *, char *);
140void userauth_finish(Authctxt *, int, char *);
| 139void disable_forwarding(void);
140
141void do_authentication(Authctxt *);
142void do_authentication2(Authctxt *);
143
144void auth_log(Authctxt *, int, char *, char *);
145void userauth_finish(Authctxt *, int, char *);
|
| 146void userauth_send_banner(const char *);
|
141int auth_root_allowed(char *);
142
143char *auth2_read_banner(void);
144
145void privsep_challenge_enable(void);
146
147int auth2_challenge(Authctxt *, char *);
148void auth2_challenge_stop(Authctxt *);
149int bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **);
150int bsdauth_respond(void *, u_int, char **);
151int skey_query(void *, char **, char **, u_int *, char ***, u_int **);
152int skey_respond(void *, u_int, char **);
153
154int allowed_user(struct passwd *);
155struct passwd * getpwnamallow(const char *user);
156
157char *get_challenge(Authctxt *);
158int verify_response(Authctxt *, const char *);
159void abandon_challenge_response(Authctxt *);
160
161char *expand_filename(const char *, struct passwd *);
162char *authorized_keys_file(struct passwd *);
163char *authorized_keys_file2(struct passwd *);
164
165int
166secure_filename(FILE *, const char *, struct passwd *, char *, size_t);
167
168HostStatus
169check_key_in_hostfiles(struct passwd *, Key *, const char *,
170 const char *, const char *);
171
172/* hostkey handling */
173Key *get_hostkey_by_index(int);
174Key *get_hostkey_by_type(int);
175int get_hostkey_index(Key *);
176int ssh1_session_key(BIGNUM *);
177
178/* debug messages during authentication */
179void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2)));
180void auth_debug_send(void);
181void auth_debug_reset(void);
182
183struct passwd *fakepw(void);
184
| 147int auth_root_allowed(char *);
148
149char *auth2_read_banner(void);
150
151void privsep_challenge_enable(void);
152
153int auth2_challenge(Authctxt *, char *);
154void auth2_challenge_stop(Authctxt *);
155int bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **);
156int bsdauth_respond(void *, u_int, char **);
157int skey_query(void *, char **, char **, u_int *, char ***, u_int **);
158int skey_respond(void *, u_int, char **);
159
160int allowed_user(struct passwd *);
161struct passwd * getpwnamallow(const char *user);
162
163char *get_challenge(Authctxt *);
164int verify_response(Authctxt *, const char *);
165void abandon_challenge_response(Authctxt *);
166
167char *expand_filename(const char *, struct passwd *);
168char *authorized_keys_file(struct passwd *);
169char *authorized_keys_file2(struct passwd *);
170
171int
172secure_filename(FILE *, const char *, struct passwd *, char *, size_t);
173
174HostStatus
175check_key_in_hostfiles(struct passwd *, Key *, const char *,
176 const char *, const char *);
177
178/* hostkey handling */
179Key *get_hostkey_by_index(int);
180Key *get_hostkey_by_type(int);
181int get_hostkey_index(Key *);
182int ssh1_session_key(BIGNUM *);
183
184/* debug messages during authentication */
185void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2)));
186void auth_debug_send(void);
187void auth_debug_reset(void);
188
189struct passwd *fakepw(void);
190
|
| 191int sys_auth_passwd(Authctxt *, const char *);
192
|
185#define AUTH_FAIL_MSG "Too many authentication failures for %.100s"
186
187#ifdef SKEY
188#ifdef OPIE
189#define SKEY_PROMPT "\nOPIE Password: "
190#else
191#define SKEY_PROMPT "\nS/Key Password: "
192#endif
193#endif
194
195#endif
| 193#define AUTH_FAIL_MSG "Too many authentication failures for %.100s"
194
195#ifdef SKEY
196#ifdef OPIE
197#define SKEY_PROMPT "\nOPIE Password: "
198#else
199#define SKEY_PROMPT "\nS/Key Password: "
200#endif
201#endif
202
203#endif
|