94void badlogin(char *);
95void checknologin(void);
96void dolastlog(int);
97void getloginname(void);
98void motd(const char *);
99int rootterm(char *);
100void sigint(int);
101void sleepexit(int);
102void refused(char *,char *,int);
103char *stypeof(char *);
104void timedout(int);
105int login_access(char *, char *);
106void login_fbtab(char *, uid_t, gid_t);
107
108#ifdef USE_PAM
109static int auth_pam(void);
110static int export_pam_environment(void);
111static int ok_to_export(const char *);
112
113static pam_handle_t *pamh = NULL;
114static char **environ_pam;
115
116#define PAM_END { \
117 if ((e = pam_setcred(pamh, PAM_DELETE_CRED)) != PAM_SUCCESS) \
118 syslog(LOG_ERR, "pam_setcred: %s", pam_strerror(pamh, e)); \
119 if ((e = pam_close_session(pamh,0)) != PAM_SUCCESS) \
120 syslog(LOG_ERR, "pam_close_session: %s", pam_strerror(pamh, e)); \
121 if ((e = pam_end(pamh, e)) != PAM_SUCCESS) \
122 syslog(LOG_ERR, "pam_end: %s", pam_strerror(pamh, e)); \
123}
124#endif
125
126static int auth_traditional(void);
127extern void login(struct utmp *);
128static void usage(void);
129
130#define TTYGRPNAME "tty" /* name of group to own ttys */
131#define DEFAULT_BACKOFF 3
132#define DEFAULT_RETRIES 10
133#define DEFAULT_PROMPT "login: "
134#define DEFAULT_PASSWD_PROMPT "Password:"
135
136/*
137 * This bounds the time given to login. Not a define so it can
138 * be patched on machines where it's too small.
139 */
140u_int timeout = 300;
141
142/* Buffer for signal handling of timeout */
143jmp_buf timeout_buf;
144
145struct passwd *pwd;
146int failures;
147char *term, *envinit[1], *hostname, *tty, *username;
148const char *passwd_prompt, *prompt;
149char full_hostname[MAXHOSTNAMELEN];
150
151int
152main(argc, argv)
153 int argc;
154 char *argv[];
155{
156 extern char **environ;
157 struct group *gr;
158 struct stat st;
159 struct timeval tp;
160 struct utmp utmp;
161 int rootok, retries, backoff;
162 int ask, ch, cnt, fflag, hflag, pflag, quietlog, rootlogin, rval;
163 int changepass;
164 time_t warntime;
165 uid_t uid, euid;
166 gid_t egid;
167 char *p, *ttyn;
168 char tbuf[MAXPATHLEN + 2];
169 char tname[sizeof(_PATH_TTY) + 10];
170 const char *shell = NULL;
171 login_cap_t *lc = NULL;
172#ifdef USE_PAM
173 pid_t pid;
174 int e;
175#endif /* USE_PAM */
176
177 (void)signal(SIGQUIT, SIG_IGN);
178 (void)signal(SIGINT, SIG_IGN);
179 (void)signal(SIGHUP, SIG_IGN);
180 if (setjmp(timeout_buf)) {
181 if (failures)
182 badlogin(tbuf);
183 (void)fprintf(stderr, "Login timed out after %d seconds\n",
184 timeout);
185 exit(0);
186 }
187 (void)signal(SIGALRM, timedout);
188 (void)alarm(timeout);
189 (void)setpriority(PRIO_PROCESS, 0, 0);
190
191 openlog("login", LOG_ODELAY, LOG_AUTH);
192
193 /*
194 * -p is used by getty to tell login not to destroy the environment
195 * -f is used to skip a second login authentication
196 * -h is used by other servers to pass the name of the remote
197 * host to login so that it may be placed in utmp and wtmp
198 */
199 *full_hostname = '\0';
200 term = NULL;
201
202 fflag = hflag = pflag = 0;
203 uid = getuid();
204 euid = geteuid();
205 egid = getegid();
206 while ((ch = getopt(argc, argv, "fh:p")) != -1)
207 switch (ch) {
208 case 'f':
209 fflag = 1;
210 break;
211 case 'h':
212 if (uid)
213 errx(1, "-h option: %s", strerror(EPERM));
214 hflag = 1;
215 if (strlcpy(full_hostname, optarg,
216 sizeof(full_hostname)) >= sizeof(full_hostname))
217 errx(1, "-h option: %s: exceeds maximum "
218 "hostname size", optarg);
219
220 trimdomain(optarg, UT_HOSTSIZE);
221
222 if (strlen(optarg) > UT_HOSTSIZE) {
223 struct addrinfo hints, *res;
224 int ga_err;
225
226 memset(&hints, 0, sizeof(hints));
227 hints.ai_family = AF_UNSPEC;
228 ga_err = getaddrinfo(optarg, NULL, &hints,
229 &res);
230 if (ga_err == 0) {
231 char hostbuf[MAXHOSTNAMELEN];
232
233 getnameinfo(res->ai_addr,
234 res->ai_addrlen,
235 hostbuf,
236 sizeof(hostbuf), NULL, 0,
| 89void badlogin(char *);
90void checknologin(void);
91void dolastlog(int);
92void getloginname(void);
93void motd(const char *);
94int rootterm(char *);
95void sigint(int);
96void sleepexit(int);
97void refused(char *,char *,int);
98char *stypeof(char *);
99void timedout(int);
100int login_access(char *, char *);
101void login_fbtab(char *, uid_t, gid_t);
102
103#ifdef USE_PAM
104static int auth_pam(void);
105static int export_pam_environment(void);
106static int ok_to_export(const char *);
107
108static pam_handle_t *pamh = NULL;
109static char **environ_pam;
110
111#define PAM_END { \
112 if ((e = pam_setcred(pamh, PAM_DELETE_CRED)) != PAM_SUCCESS) \
113 syslog(LOG_ERR, "pam_setcred: %s", pam_strerror(pamh, e)); \
114 if ((e = pam_close_session(pamh,0)) != PAM_SUCCESS) \
115 syslog(LOG_ERR, "pam_close_session: %s", pam_strerror(pamh, e)); \
116 if ((e = pam_end(pamh, e)) != PAM_SUCCESS) \
117 syslog(LOG_ERR, "pam_end: %s", pam_strerror(pamh, e)); \
118}
119#endif
120
121static int auth_traditional(void);
122extern void login(struct utmp *);
123static void usage(void);
124
125#define TTYGRPNAME "tty" /* name of group to own ttys */
126#define DEFAULT_BACKOFF 3
127#define DEFAULT_RETRIES 10
128#define DEFAULT_PROMPT "login: "
129#define DEFAULT_PASSWD_PROMPT "Password:"
130
131/*
132 * This bounds the time given to login. Not a define so it can
133 * be patched on machines where it's too small.
134 */
135u_int timeout = 300;
136
137/* Buffer for signal handling of timeout */
138jmp_buf timeout_buf;
139
140struct passwd *pwd;
141int failures;
142char *term, *envinit[1], *hostname, *tty, *username;
143const char *passwd_prompt, *prompt;
144char full_hostname[MAXHOSTNAMELEN];
145
146int
147main(argc, argv)
148 int argc;
149 char *argv[];
150{
151 extern char **environ;
152 struct group *gr;
153 struct stat st;
154 struct timeval tp;
155 struct utmp utmp;
156 int rootok, retries, backoff;
157 int ask, ch, cnt, fflag, hflag, pflag, quietlog, rootlogin, rval;
158 int changepass;
159 time_t warntime;
160 uid_t uid, euid;
161 gid_t egid;
162 char *p, *ttyn;
163 char tbuf[MAXPATHLEN + 2];
164 char tname[sizeof(_PATH_TTY) + 10];
165 const char *shell = NULL;
166 login_cap_t *lc = NULL;
167#ifdef USE_PAM
168 pid_t pid;
169 int e;
170#endif /* USE_PAM */
171
172 (void)signal(SIGQUIT, SIG_IGN);
173 (void)signal(SIGINT, SIG_IGN);
174 (void)signal(SIGHUP, SIG_IGN);
175 if (setjmp(timeout_buf)) {
176 if (failures)
177 badlogin(tbuf);
178 (void)fprintf(stderr, "Login timed out after %d seconds\n",
179 timeout);
180 exit(0);
181 }
182 (void)signal(SIGALRM, timedout);
183 (void)alarm(timeout);
184 (void)setpriority(PRIO_PROCESS, 0, 0);
185
186 openlog("login", LOG_ODELAY, LOG_AUTH);
187
188 /*
189 * -p is used by getty to tell login not to destroy the environment
190 * -f is used to skip a second login authentication
191 * -h is used by other servers to pass the name of the remote
192 * host to login so that it may be placed in utmp and wtmp
193 */
194 *full_hostname = '\0';
195 term = NULL;
196
197 fflag = hflag = pflag = 0;
198 uid = getuid();
199 euid = geteuid();
200 egid = getegid();
201 while ((ch = getopt(argc, argv, "fh:p")) != -1)
202 switch (ch) {
203 case 'f':
204 fflag = 1;
205 break;
206 case 'h':
207 if (uid)
208 errx(1, "-h option: %s", strerror(EPERM));
209 hflag = 1;
210 if (strlcpy(full_hostname, optarg,
211 sizeof(full_hostname)) >= sizeof(full_hostname))
212 errx(1, "-h option: %s: exceeds maximum "
213 "hostname size", optarg);
214
215 trimdomain(optarg, UT_HOSTSIZE);
216
217 if (strlen(optarg) > UT_HOSTSIZE) {
218 struct addrinfo hints, *res;
219 int ga_err;
220
221 memset(&hints, 0, sizeof(hints));
222 hints.ai_family = AF_UNSPEC;
223 ga_err = getaddrinfo(optarg, NULL, &hints,
224 &res);
225 if (ga_err == 0) {
226 char hostbuf[MAXHOSTNAMELEN];
227
228 getnameinfo(res->ai_addr,
229 res->ai_addrlen,
230 hostbuf,
231 sizeof(hostbuf), NULL, 0,
|
239 optarg = strdup(hostbuf);
240 if (optarg == NULL) {
241 syslog(LOG_NOTICE,
242 "strdup(): %m");
243 sleepexit(1);
244 }
245 } else
246 optarg = "invalid hostname";
247 if (res != NULL)
248 freeaddrinfo(res);
249 }
250 hostname = optarg;
251 break;
252 case 'p':
253 pflag = 1;
254 break;
255 case '?':
256 default:
257 if (!uid)
258 syslog(LOG_ERR, "invalid flag %c", ch);
259 usage();
260 }
261 argc -= optind;
262 argv += optind;
263
264 if (*argv) {
265 username = *argv;
266 ask = 0;
267 } else
268 ask = 1;
269
270 for (cnt = getdtablesize(); cnt > 2; cnt--)
271 (void)close(cnt);
272
273 ttyn = ttyname(STDIN_FILENO);
274 if (ttyn == NULL || *ttyn == '\0') {
275 (void)snprintf(tname, sizeof(tname), "%s??", _PATH_TTY);
276 ttyn = tname;
277 }
278 if ((tty = strrchr(ttyn, '/')) != NULL)
279 ++tty;
280 else
281 tty = ttyn;
282
283 /*
284 * Get "login-retries" & "login-backoff" from default class
285 */
286 lc = login_getclass(NULL);
287 prompt = login_getcapstr(lc, "prompt", DEFAULT_PROMPT, DEFAULT_PROMPT);
288 passwd_prompt = login_getcapstr(lc, "passwd_prompt",
289 DEFAULT_PASSWD_PROMPT, DEFAULT_PASSWD_PROMPT);
290 retries = login_getcapnum(lc, "login-retries", DEFAULT_RETRIES,
291 DEFAULT_RETRIES);
292 backoff = login_getcapnum(lc, "login-backoff", DEFAULT_BACKOFF,
293 DEFAULT_BACKOFF);
294 login_close(lc);
295 lc = NULL;
296
297 for (cnt = 0;; ask = 1) {
298 if (ask) {
299 fflag = 0;
300 getloginname();
301 }
302 rootlogin = 0;
303 rootok = rootterm(tty); /* Default (auth may change) */
304
305 if (strlen(username) > UT_NAMESIZE)
306 username[UT_NAMESIZE] = '\0';
307
308 /*
309 * Note if trying multiple user names; log failures for
310 * previous user name, but don't bother logging one failure
311 * for nonexistent name (mistyped username).
312 */
313 if (failures && strcmp(tbuf, username)) {
314 if (failures > (pwd ? 0 : 1))
315 badlogin(tbuf);
316 }
317 (void)strlcpy(tbuf, username, sizeof(tbuf));
318
319 pwd = getpwnam(username);
320
321 /*
322 * if we have a valid account name, and it doesn't have a
323 * password, or the -f option was specified and the caller
324 * is root or the caller isn't changing their uid, don't
325 * authenticate.
326 */
327 if (pwd != NULL) {
328 if (pwd->pw_uid == 0)
329 rootlogin = 1;
330
331 if (fflag && (uid == (uid_t)0 ||
332 uid == (uid_t)pwd->pw_uid)) {
333 /* already authenticated */
334 break;
335 } else if (pwd->pw_passwd[0] == '\0') {
336 if (!rootlogin || rootok) {
337 /* pretend password okay */
338 rval = 0;
339 goto ttycheck;
340 }
341 }
342 }
343
344 fflag = 0;
345
346 (void)setpriority(PRIO_PROCESS, 0, -4);
347
348#ifdef USE_PAM
349 /*
350 * Try to authenticate using PAM. If a PAM system error
351 * occurs, perhaps because of a botched configuration,
352 * then fall back to using traditional Unix authentication.
353 */
354 if ((rval = auth_pam()) == -1)
355#endif /* USE_PAM */
356 rval = auth_traditional();
357
358 (void)setpriority(PRIO_PROCESS, 0, 0);
359
360#ifdef USE_PAM
361 /*
362 * PAM authentication may have changed "pwd" to the
363 * entry for the template user. Check again to see if
364 * this is a root login after all.
365 */
366 if (pwd != NULL && pwd->pw_uid == 0)
367 rootlogin = 1;
368#endif /* USE_PAM */
369
370 ttycheck:
371 /*
372 * If trying to log in as root without Kerberos,
373 * but with insecure terminal, refuse the login attempt.
374 */
375 if (pwd && !rval) {
376 if (rootlogin && !rootok)
377 refused(NULL, "NOROOT", 0);
378 else /* valid password & authenticated */
379 break;
380 }
381
382 (void)printf("Login incorrect\n");
383 failures++;
384
385 /*
386 * we allow up to 'retry' (10) tries,
387 * but after 'backoff' (3) we start backing off
388 */
389 if (++cnt > backoff) {
390 if (cnt >= retries) {
391 badlogin(username);
392 sleepexit(1);
393 }
394 sleep((u_int)((cnt - backoff) * 5));
395 }
396 }
397
398 /* committed to login -- turn off timeout */
399 (void)alarm((u_int)0);
400 (void)signal(SIGHUP, SIG_DFL);
401
402 endpwent();
403
404 /*
405 * Establish the login class.
406 */
407 lc = login_getpwclass(pwd);
408
409 /* if user not super-user, check for disabled logins */
410 if (!rootlogin)
411 auth_checknologin(lc);
412
413 quietlog = login_getcapbool(lc, "hushlogin", 0);
414 /*
415 * Switching needed for NFS with root access disabled.
416 *
417 * XXX: This change fails to modify the additional groups for the
418 * process, and as such, may restrict rights normally granted
419 * through those groups.
420 */
421 (void)setegid(pwd->pw_gid);
422 (void)seteuid(rootlogin ? 0 : pwd->pw_uid);
423 if (!*pwd->pw_dir || chdir(pwd->pw_dir) < 0) {
424 if (login_getcapbool(lc, "requirehome", 0))
425 refused("Home directory not available", "HOMEDIR", 1);
426 if (chdir("/") < 0)
427 refused("Cannot find root directory", "ROOTDIR", 1);
428 if (!quietlog || *pwd->pw_dir)
429 printf("No home directory.\nLogging in with home = \"/\".\n");
430 pwd->pw_dir = "/";
431 }
432 (void)seteuid(euid);
433 (void)setegid(egid);
434 if (!quietlog)
435 quietlog = access(_PATH_HUSHLOGIN, F_OK) == 0;
436
437 if (pwd->pw_change || pwd->pw_expire)
438 (void)gettimeofday(&tp, (struct timezone *)NULL);
439
440#define DEFAULT_WARN (2L * 7L * 86400L) /* Two weeks */
441
442 warntime = login_getcaptime(lc, "warnexpire", DEFAULT_WARN,
443 DEFAULT_WARN);
444
445 if (pwd->pw_expire) {
446 if (tp.tv_sec >= pwd->pw_expire) {
447 refused("Sorry -- your account has expired", "EXPIRED",
448 1);
449 } else if (pwd->pw_expire - tp.tv_sec < warntime && !quietlog)
450 (void)printf("Warning: your account expires on %s",
451 ctime(&pwd->pw_expire));
452 }
453
454 warntime = login_getcaptime(lc, "warnpassword", DEFAULT_WARN,
455 DEFAULT_WARN);
456
457 changepass = 0;
458 if (pwd->pw_change) {
459 if (tp.tv_sec >= pwd->pw_change) {
460 (void)printf("Sorry -- your password has expired.\n");
461 changepass = 1;
462 syslog(LOG_INFO, "%s Password expired - forcing change",
463 pwd->pw_name);
464 } else if (pwd->pw_change - tp.tv_sec < warntime && !quietlog)
465 (void)printf("Warning: your password expires on %s",
466 ctime(&pwd->pw_change));
467 }
468
469 if (lc != NULL) {
470 if (hostname) {
471 struct addrinfo hints, *res;
472 int ga_err;
473
474 memset(&hints, 0, sizeof(hints));
475 hints.ai_family = AF_UNSPEC;
476 ga_err = getaddrinfo(full_hostname, NULL, &hints,
477 &res);
478 if (ga_err == 0) {
479 char hostbuf[MAXHOSTNAMELEN];
480
481 getnameinfo(res->ai_addr, res->ai_addrlen,
482 hostbuf, sizeof(hostbuf), NULL, 0,
| 233 optarg = strdup(hostbuf);
234 if (optarg == NULL) {
235 syslog(LOG_NOTICE,
236 "strdup(): %m");
237 sleepexit(1);
238 }
239 } else
240 optarg = "invalid hostname";
241 if (res != NULL)
242 freeaddrinfo(res);
243 }
244 hostname = optarg;
245 break;
246 case 'p':
247 pflag = 1;
248 break;
249 case '?':
250 default:
251 if (!uid)
252 syslog(LOG_ERR, "invalid flag %c", ch);
253 usage();
254 }
255 argc -= optind;
256 argv += optind;
257
258 if (*argv) {
259 username = *argv;
260 ask = 0;
261 } else
262 ask = 1;
263
264 for (cnt = getdtablesize(); cnt > 2; cnt--)
265 (void)close(cnt);
266
267 ttyn = ttyname(STDIN_FILENO);
268 if (ttyn == NULL || *ttyn == '\0') {
269 (void)snprintf(tname, sizeof(tname), "%s??", _PATH_TTY);
270 ttyn = tname;
271 }
272 if ((tty = strrchr(ttyn, '/')) != NULL)
273 ++tty;
274 else
275 tty = ttyn;
276
277 /*
278 * Get "login-retries" & "login-backoff" from default class
279 */
280 lc = login_getclass(NULL);
281 prompt = login_getcapstr(lc, "prompt", DEFAULT_PROMPT, DEFAULT_PROMPT);
282 passwd_prompt = login_getcapstr(lc, "passwd_prompt",
283 DEFAULT_PASSWD_PROMPT, DEFAULT_PASSWD_PROMPT);
284 retries = login_getcapnum(lc, "login-retries", DEFAULT_RETRIES,
285 DEFAULT_RETRIES);
286 backoff = login_getcapnum(lc, "login-backoff", DEFAULT_BACKOFF,
287 DEFAULT_BACKOFF);
288 login_close(lc);
289 lc = NULL;
290
291 for (cnt = 0;; ask = 1) {
292 if (ask) {
293 fflag = 0;
294 getloginname();
295 }
296 rootlogin = 0;
297 rootok = rootterm(tty); /* Default (auth may change) */
298
299 if (strlen(username) > UT_NAMESIZE)
300 username[UT_NAMESIZE] = '\0';
301
302 /*
303 * Note if trying multiple user names; log failures for
304 * previous user name, but don't bother logging one failure
305 * for nonexistent name (mistyped username).
306 */
307 if (failures && strcmp(tbuf, username)) {
308 if (failures > (pwd ? 0 : 1))
309 badlogin(tbuf);
310 }
311 (void)strlcpy(tbuf, username, sizeof(tbuf));
312
313 pwd = getpwnam(username);
314
315 /*
316 * if we have a valid account name, and it doesn't have a
317 * password, or the -f option was specified and the caller
318 * is root or the caller isn't changing their uid, don't
319 * authenticate.
320 */
321 if (pwd != NULL) {
322 if (pwd->pw_uid == 0)
323 rootlogin = 1;
324
325 if (fflag && (uid == (uid_t)0 ||
326 uid == (uid_t)pwd->pw_uid)) {
327 /* already authenticated */
328 break;
329 } else if (pwd->pw_passwd[0] == '\0') {
330 if (!rootlogin || rootok) {
331 /* pretend password okay */
332 rval = 0;
333 goto ttycheck;
334 }
335 }
336 }
337
338 fflag = 0;
339
340 (void)setpriority(PRIO_PROCESS, 0, -4);
341
342#ifdef USE_PAM
343 /*
344 * Try to authenticate using PAM. If a PAM system error
345 * occurs, perhaps because of a botched configuration,
346 * then fall back to using traditional Unix authentication.
347 */
348 if ((rval = auth_pam()) == -1)
349#endif /* USE_PAM */
350 rval = auth_traditional();
351
352 (void)setpriority(PRIO_PROCESS, 0, 0);
353
354#ifdef USE_PAM
355 /*
356 * PAM authentication may have changed "pwd" to the
357 * entry for the template user. Check again to see if
358 * this is a root login after all.
359 */
360 if (pwd != NULL && pwd->pw_uid == 0)
361 rootlogin = 1;
362#endif /* USE_PAM */
363
364 ttycheck:
365 /*
366 * If trying to log in as root without Kerberos,
367 * but with insecure terminal, refuse the login attempt.
368 */
369 if (pwd && !rval) {
370 if (rootlogin && !rootok)
371 refused(NULL, "NOROOT", 0);
372 else /* valid password & authenticated */
373 break;
374 }
375
376 (void)printf("Login incorrect\n");
377 failures++;
378
379 /*
380 * we allow up to 'retry' (10) tries,
381 * but after 'backoff' (3) we start backing off
382 */
383 if (++cnt > backoff) {
384 if (cnt >= retries) {
385 badlogin(username);
386 sleepexit(1);
387 }
388 sleep((u_int)((cnt - backoff) * 5));
389 }
390 }
391
392 /* committed to login -- turn off timeout */
393 (void)alarm((u_int)0);
394 (void)signal(SIGHUP, SIG_DFL);
395
396 endpwent();
397
398 /*
399 * Establish the login class.
400 */
401 lc = login_getpwclass(pwd);
402
403 /* if user not super-user, check for disabled logins */
404 if (!rootlogin)
405 auth_checknologin(lc);
406
407 quietlog = login_getcapbool(lc, "hushlogin", 0);
408 /*
409 * Switching needed for NFS with root access disabled.
410 *
411 * XXX: This change fails to modify the additional groups for the
412 * process, and as such, may restrict rights normally granted
413 * through those groups.
414 */
415 (void)setegid(pwd->pw_gid);
416 (void)seteuid(rootlogin ? 0 : pwd->pw_uid);
417 if (!*pwd->pw_dir || chdir(pwd->pw_dir) < 0) {
418 if (login_getcapbool(lc, "requirehome", 0))
419 refused("Home directory not available", "HOMEDIR", 1);
420 if (chdir("/") < 0)
421 refused("Cannot find root directory", "ROOTDIR", 1);
422 if (!quietlog || *pwd->pw_dir)
423 printf("No home directory.\nLogging in with home = \"/\".\n");
424 pwd->pw_dir = "/";
425 }
426 (void)seteuid(euid);
427 (void)setegid(egid);
428 if (!quietlog)
429 quietlog = access(_PATH_HUSHLOGIN, F_OK) == 0;
430
431 if (pwd->pw_change || pwd->pw_expire)
432 (void)gettimeofday(&tp, (struct timezone *)NULL);
433
434#define DEFAULT_WARN (2L * 7L * 86400L) /* Two weeks */
435
436 warntime = login_getcaptime(lc, "warnexpire", DEFAULT_WARN,
437 DEFAULT_WARN);
438
439 if (pwd->pw_expire) {
440 if (tp.tv_sec >= pwd->pw_expire) {
441 refused("Sorry -- your account has expired", "EXPIRED",
442 1);
443 } else if (pwd->pw_expire - tp.tv_sec < warntime && !quietlog)
444 (void)printf("Warning: your account expires on %s",
445 ctime(&pwd->pw_expire));
446 }
447
448 warntime = login_getcaptime(lc, "warnpassword", DEFAULT_WARN,
449 DEFAULT_WARN);
450
451 changepass = 0;
452 if (pwd->pw_change) {
453 if (tp.tv_sec >= pwd->pw_change) {
454 (void)printf("Sorry -- your password has expired.\n");
455 changepass = 1;
456 syslog(LOG_INFO, "%s Password expired - forcing change",
457 pwd->pw_name);
458 } else if (pwd->pw_change - tp.tv_sec < warntime && !quietlog)
459 (void)printf("Warning: your password expires on %s",
460 ctime(&pwd->pw_change));
461 }
462
463 if (lc != NULL) {
464 if (hostname) {
465 struct addrinfo hints, *res;
466 int ga_err;
467
468 memset(&hints, 0, sizeof(hints));
469 hints.ai_family = AF_UNSPEC;
470 ga_err = getaddrinfo(full_hostname, NULL, &hints,
471 &res);
472 if (ga_err == 0) {
473 char hostbuf[MAXHOSTNAMELEN];
474
475 getnameinfo(res->ai_addr, res->ai_addrlen,
476 hostbuf, sizeof(hostbuf), NULL, 0,
|
484 if ((optarg = strdup(hostbuf)) == NULL) {
485 syslog(LOG_NOTICE, "strdup(): %m");
486 sleepexit(1);
487 }
488 } else
489 optarg = NULL;
490 if (res != NULL)
491 freeaddrinfo(res);
492 if (!auth_hostok(lc, full_hostname, optarg))
493 refused("Permission denied", "HOST", 1);
494 }
495
496 if (!auth_ttyok(lc, tty))
497 refused("Permission denied", "TTY", 1);
498
499 if (!auth_timeok(lc, time(NULL)))
500 refused("Logins not available right now", "TIME", 1);
501 }
502 shell = login_getcapstr(lc, "shell", pwd->pw_shell, pwd->pw_shell);
503 if (*pwd->pw_shell == '\0')
504 pwd->pw_shell = _PATH_BSHELL;
505 if (*shell == '\0') /* Not overridden */
506 shell = pwd->pw_shell;
507 if ((shell = strdup(shell)) == NULL) {
508 syslog(LOG_NOTICE, "strdup(): %m");
509 sleepexit(1);
510 }
511
512#ifdef LOGIN_ACCESS
513 if (login_access(pwd->pw_name, hostname ? full_hostname : tty) == 0)
514 refused("Permission denied", "ACCESS", 1);
515#endif /* LOGIN_ACCESS */
516
517 /* Nothing else left to fail -- really log in. */
518 memset((void *)&utmp, 0, sizeof(utmp));
519 (void)time(&utmp.ut_time);
520 (void)strncpy(utmp.ut_name, username, sizeof(utmp.ut_name));
521 if (hostname)
522 (void)strncpy(utmp.ut_host, hostname, sizeof(utmp.ut_host));
523 (void)strncpy(utmp.ut_line, tty, sizeof(utmp.ut_line));
524 login(&utmp);
525
526 dolastlog(quietlog);
527
528 /*
529 * Set device protections, depending on what terminal the
530 * user is logged in. This feature is used on Suns to give
531 * console users better privacy.
532 */
533 login_fbtab(tty, pwd->pw_uid, pwd->pw_gid);
534
535 /*
536 * Clear flags of the tty. None should be set, and when the
537 * user sets them otherwise, this can cause the chown to fail.
538 * Since it isn't clear that flags are useful on character
539 * devices, we just clear them.
540 */
541 if (chflags(ttyn, 0) && errno != EOPNOTSUPP)
542 syslog(LOG_ERR, "chmod(%s): %m", ttyn);
543 if (chown(ttyn, pwd->pw_uid,
544 (gr = getgrnam(TTYGRPNAME)) ? gr->gr_gid : pwd->pw_gid))
545 syslog(LOG_ERR, "chmod(%s): %m", ttyn);
546
547
548 /*
549 * Preserve TERM if it happens to be already set.
550 */
551 if ((term = getenv("TERM")) != NULL) {
552 if ((term = strdup(term)) == NULL) {
553 syslog(LOG_NOTICE,
554 "strdup(): %m");
555 sleepexit(1);
556 }
557 }
558
559 /*
560 * Exclude cons/vt/ptys only, assume dialup otherwise
561 * TODO: Make dialup tty determination a library call
562 * for consistency (finger etc.)
563 */
564 if (hostname==NULL && isdialuptty(tty))
565 syslog(LOG_INFO, "DIALUP %s, %s", tty, pwd->pw_name);
566
567#ifdef LOGALL
568 /*
569 * Syslog each successful login, so we don't have to watch hundreds
570 * of wtmp or lastlogin files.
571 */
572 if (hostname)
573 syslog(LOG_INFO, "login from %s on %s as %s",
574 full_hostname, tty, pwd->pw_name);
575 else
576 syslog(LOG_INFO, "login on %s as %s",
577 tty, pwd->pw_name);
578#endif
579
580 /*
581 * If fflag is on, assume caller/authenticator has logged root login.
582 */
583 if (rootlogin && fflag == 0)
584 {
585 if (hostname)
586 syslog(LOG_NOTICE, "ROOT LOGIN (%s) ON %s FROM %s",
587 username, tty, full_hostname);
588 else
589 syslog(LOG_NOTICE, "ROOT LOGIN (%s) ON %s",
590 username, tty);
591 }
592
593 /*
594 * Destroy environment unless user has requested its preservation.
595 * We need to do this before setusercontext() because that may
596 * set or reset some environment variables.
597 */
598 if (!pflag)
599 environ = envinit;
600
601 /*
602 * PAM modules might add supplementary groups during pam_setcred().
603 */
604 if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) != 0) {
605 syslog(LOG_ERR, "setusercontext() failed - exiting");
606 exit(1);
607 }
608
609#ifdef USE_PAM
610 if (pamh) {
611 if ((e = pam_open_session(pamh, 0)) != PAM_SUCCESS) {
612 syslog(LOG_ERR, "pam_open_session: %s",
613 pam_strerror(pamh, e));
614 } else if ((e = pam_setcred(pamh, PAM_ESTABLISH_CRED))
615 != PAM_SUCCESS) {
616 syslog(LOG_ERR, "pam_setcred: %s",
617 pam_strerror(pamh, e));
618 }
619
620 /*
621 * Add any environmental variables that the
622 * PAM modules may have set.
623 * Call *after* opening session!
624 */
625 if (pamh) {
626 environ_pam = pam_getenvlist(pamh);
627 if (environ_pam)
628 export_pam_environment();
629 }
630
631 /*
632 * We must fork() before setuid() because we need to call
633 * pam_close_session() as root.
634 */
635 pid = fork();
636 if (pid < 0) {
637 err(1, "fork");
638 PAM_END;
639 exit(0);
640 } else if (pid) {
641 /* parent - wait for child to finish, then cleanup
642 session */
643 wait(NULL);
644 PAM_END;
645 exit(0);
646 } else {
647 if ((e = pam_end(pamh, 0)) != PAM_SUCCESS)
648 syslog(LOG_ERR, "pam_end: %s",
649 pam_strerror(pamh, e));
650 }
651 }
652#endif /* USE_PAM */
653
654 /*
655 * We don't need to be root anymore, so
656 * set the user and session context
657 */
658 if (setlogin(username) != 0) {
659 syslog(LOG_ERR, "setlogin(%s): %m - exiting", username);
660 exit(1);
661 }
662 if (setusercontext(lc, pwd, pwd->pw_uid,
663 LOGIN_SETALL & ~(LOGIN_SETLOGIN|LOGIN_SETGROUP)) != 0) {
664 syslog(LOG_ERR, "setusercontext() failed - exiting");
665 exit(1);
666 }
667
668 (void)setenv("SHELL", pwd->pw_shell, 1);
669 (void)setenv("HOME", pwd->pw_dir, 1);
670 if (term != NULL && *term != '\0')
671 (void)setenv("TERM", term, 1); /* Preset overrides */
672 else {
673 (void)setenv("TERM", stypeof(tty), 0); /* Fallback doesn't */
674 }
675 (void)setenv("LOGNAME", username, 1);
676 (void)setenv("USER", username, 1);
677 (void)setenv("PATH", rootlogin ? _PATH_STDPATH : _PATH_DEFPATH, 0);
678
679 if (!quietlog) {
680 const char *cw;
681
682 cw = login_getcapstr(lc, "copyright", NULL, NULL);
683 if (cw != NULL && access(cw, F_OK) == 0)
684 motd(cw);
685 else
686 (void)printf("%s\n\t%s %s\n",
687 "Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994",
688 "The Regents of the University of California. ",
689 "All rights reserved.");
690
691 (void)printf("\n");
692
693 cw = login_getcapstr(lc, "welcome", NULL, NULL);
694 if (cw == NULL || access(cw, F_OK) != 0)
695 cw = _PATH_MOTDFILE;
696 motd(cw);
697
698 cw = getenv("MAIL"); /* $MAIL may have been set by class */
699 if (cw != NULL)
700 strlcpy(tbuf, cw, sizeof(tbuf));
701 else
702 snprintf(tbuf, sizeof(tbuf), "%s/%s", _PATH_MAILDIR,
703 pwd->pw_name);
704 if (stat(tbuf, &st) == 0 && st.st_size != 0)
705 (void)printf("You have %smail.\n",
706 (st.st_mtime > st.st_atime) ? "new " : "");
707 }
708
709 login_close(lc);
710
711 (void)signal(SIGALRM, SIG_DFL);
712 (void)signal(SIGQUIT, SIG_DFL);
713 (void)signal(SIGINT, SIG_DFL);
714 (void)signal(SIGTSTP, SIG_IGN);
715
716 /*
717 * Login shells have a leading '-' in front of argv[0]
718 */
719 if (snprintf(tbuf, sizeof(tbuf), "-%s",
720 (p = strrchr(pwd->pw_shell, '/')) ? p + 1 : pwd->pw_shell) >=
721 sizeof(tbuf)) {
722 syslog(LOG_ERR, "user: %s: shell exceeds maximum pathname size",
723 username);
724 errx(1, "shell exceeds maximum pathname size");
725 }
726
727 execlp(shell, tbuf, (char *)0);
728 err(1, "%s", shell);
729}
730
731static int
732auth_traditional()
733{
734 int rval;
735 char *p;
736 char *ep;
737 char *salt;
738
739 rval = 1;
740 salt = pwd != NULL ? pwd->pw_passwd : "xx";
741
742 p = getpass(passwd_prompt);
743 ep = crypt(p, salt);
744
745 if (pwd) {
746 if (!p[0] && pwd->pw_passwd[0])
747 ep = ":";
748 if (strcmp(ep, pwd->pw_passwd) == 0)
749 rval = 0;
750 }
751
752 /* clear entered password */
753 memset(p, 0, strlen(p));
754 return rval;
755}
756
757#ifdef USE_PAM
758/*
759 * Attempt to authenticate the user using PAM. Returns 0 if the user is
760 * authenticated, or 1 if not authenticated. If some sort of PAM system
761 * error occurs (e.g., the "/etc/pam.conf" file is missing) then this
762 * function returns -1. This can be used as an indication that we should
763 * fall back to a different authentication mechanism.
764 */
765static int
766auth_pam()
767{
768 const char *tmpl_user;
769 const void *item;
770 int rval;
771 int e;
772 static struct pam_conv conv = { openpam_ttyconv, NULL };
773
774 if ((e = pam_start("login", username, &conv, &pamh)) != PAM_SUCCESS) {
775 syslog(LOG_ERR, "pam_start: %s", pam_strerror(pamh, e));
776 return -1;
777 }
778 if ((e = pam_set_item(pamh, PAM_TTY, tty)) != PAM_SUCCESS) {
779 syslog(LOG_ERR, "pam_set_item(PAM_TTY): %s",
780 pam_strerror(pamh, e));
781 return -1;
782 }
783 if (hostname != NULL &&
784 (e = pam_set_item(pamh, PAM_RHOST, full_hostname)) != PAM_SUCCESS) {
785 syslog(LOG_ERR, "pam_set_item(PAM_RHOST): %s",
786 pam_strerror(pamh, e));
787 return -1;
788 }
789 e = pam_authenticate(pamh, 0);
790 switch (e) {
791
792 case PAM_SUCCESS:
793 /*
794 * With PAM we support the concept of a "template"
795 * user. The user enters a login name which is
796 * authenticated by PAM, usually via a remote service
797 * such as RADIUS or TACACS+. If authentication
798 * succeeds, a different but related "template" name
799 * is used for setting the credentials, shell, and
800 * home directory. The name the user enters need only
801 * exist on the remote authentication server, but the
802 * template name must be present in the local password
803 * database.
804 *
805 * This is supported by two various mechanisms in the
806 * individual modules. However, from the application's
807 * point of view, the template user is always passed
808 * back as a changed value of the PAM_USER item.
809 */
810 if ((e = pam_get_item(pamh, PAM_USER, &item)) ==
811 PAM_SUCCESS) {
812 tmpl_user = (const char *) item;
813 if (strcmp(username, tmpl_user) != 0)
814 pwd = getpwnam(tmpl_user);
815 } else
816 syslog(LOG_ERR, "Couldn't get PAM_USER: %s",
817 pam_strerror(pamh, e));
818 rval = 0;
819 break;
820
821 case PAM_AUTH_ERR:
822 case PAM_USER_UNKNOWN:
823 case PAM_MAXTRIES:
824 rval = 1;
825 break;
826
827 default:
828 syslog(LOG_ERR, "pam_authenticate: %s", pam_strerror(pamh, e));
829 rval = -1;
830 break;
831 }
832
833 if (rval == 0) {
834 e = pam_acct_mgmt(pamh, 0);
835 if (e == PAM_NEW_AUTHTOK_REQD) {
836 e = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
837 if (e != PAM_SUCCESS) {
838 syslog(LOG_ERR, "pam_chauthtok: %s",
839 pam_strerror(pamh, e));
840 rval = 1;
841 }
842 } else if (e != PAM_SUCCESS) {
843 rval = 1;
844 }
845 }
846
847 if (rval != 0) {
848 if ((e = pam_end(pamh, e)) != PAM_SUCCESS) {
849 syslog(LOG_ERR, "pam_end: %s", pam_strerror(pamh, e));
850 }
851 pamh = NULL;
852 }
853 return rval;
854}
855
856static int
857export_pam_environment()
858{
859 char **pp;
860
861 for (pp = environ_pam; *pp != NULL; pp++) {
862 if (ok_to_export(*pp))
863 (void) putenv(*pp);
864 free(*pp);
865 }
866 return PAM_SUCCESS;
867}
868
869/*
870 * Sanity checks on PAM environmental variables:
871 * - Make sure there is an '=' in the string.
872 * - Make sure the string doesn't run on too long.
873 * - Do not export certain variables. This list was taken from the
874 * Solaris pam_putenv(3) man page.
875 */
876static int
877ok_to_export(s)
878 const char *s;
879{
880 static const char *noexport[] = {
881 "SHELL", "HOME", "LOGNAME", "MAIL", "CDPATH",
882 "IFS", "PATH", NULL
883 };
884 const char **pp;
885 size_t n;
886
887 if (strlen(s) > 1024 || strchr(s, '=') == NULL)
888 return 0;
889 if (strncmp(s, "LD_", 3) == 0)
890 return 0;
891 for (pp = noexport; *pp != NULL; pp++) {
892 n = strlen(*pp);
893 if (s[n] == '=' && strncmp(s, *pp, n) == 0)
894 return 0;
895 }
896 return 1;
897}
898#endif /* USE_PAM */
899
900static void
901usage()
902{
903
904 (void)fprintf(stderr, "usage: login [-fp] [-h hostname] [username]\n");
905 exit(1);
906}
907
908/*
909 * Allow for authentication style and/or kerberos instance
910 */
911
912#define NBUFSIZ UT_NAMESIZE + 64
913
914void
915getloginname()
916{
917 int ch;
918 char *p;
919 static char nbuf[NBUFSIZ];
920
921 for (;;) {
922 (void)printf("%s", prompt);
923 for (p = nbuf; (ch = getchar()) != '\n'; ) {
924 if (ch == EOF) {
925 badlogin(username);
926 exit(0);
927 }
928 if (p < nbuf + (NBUFSIZ - 1))
929 *p++ = ch;
930 }
931 if (p > nbuf) {
932 if (nbuf[0] == '-')
933 (void)fprintf(stderr,
934 "login names may not start with '-'.\n");
935 else {
936 *p = '\0';
937 username = nbuf;
938 break;
939 }
940 }
941 }
942}
943
944int
945rootterm(ttyn)
946 char *ttyn;
947{
948 struct ttyent *t;
949
950 return ((t = getttynam(ttyn)) && t->ty_status & TTY_SECURE);
951}
952
953volatile int motdinterrupt;
954
955void
956sigint(signo)
957 int signo __unused;
958{
959 motdinterrupt = 1;
960}
961
962void
963motd(motdfile)
964 const char *motdfile;
965{
966 int fd, nchars;
967 sig_t oldint;
968 char tbuf[256];
969
970 if ((fd = open(motdfile, O_RDONLY, 0)) < 0)
971 return;
972 motdinterrupt = 0;
973 oldint = signal(SIGINT, sigint);
974 while ((nchars = read(fd, tbuf, sizeof(tbuf))) > 0 && !motdinterrupt)
975 (void)write(fileno(stdout), tbuf, nchars);
976 (void)signal(SIGINT, oldint);
977 (void)close(fd);
978}
979
980/* ARGSUSED */
981void
982timedout(signo)
983 int signo;
984{
985
986 longjmp(timeout_buf, signo);
987}
988
989
990void
991dolastlog(quiet)
992 int quiet;
993{
994 struct lastlog ll;
995 int fd;
996
997 if ((fd = open(_PATH_LASTLOG, O_RDWR, 0)) >= 0) {
998 (void)lseek(fd, (off_t)pwd->pw_uid * sizeof(ll), L_SET);
999 if (!quiet) {
1000 if (read(fd, (char *)&ll, sizeof(ll)) == sizeof(ll) &&
1001 ll.ll_time != 0) {
1002 (void)printf("Last login: %.*s ",
1003 24-5, (char *)ctime(&ll.ll_time));
1004 if (*ll.ll_host != '\0')
1005 (void)printf("from %.*s\n",
1006 (int)sizeof(ll.ll_host),
1007 ll.ll_host);
1008 else
1009 (void)printf("on %.*s\n",
1010 (int)sizeof(ll.ll_line),
1011 ll.ll_line);
1012 }
1013 (void)lseek(fd, (off_t)pwd->pw_uid * sizeof(ll), L_SET);
1014 }
1015 memset((void *)&ll, 0, sizeof(ll));
1016 (void)time(&ll.ll_time);
1017 (void)strncpy(ll.ll_line, tty, sizeof(ll.ll_line));
1018 if (hostname)
1019 (void)strncpy(ll.ll_host, hostname, sizeof(ll.ll_host));
1020 (void)write(fd, (char *)&ll, sizeof(ll));
1021 (void)close(fd);
1022 } else {
1023 syslog(LOG_ERR, "cannot open %s: %m", _PATH_LASTLOG);
1024 }
1025}
1026
1027void
1028badlogin(name)
1029 char *name;
1030{
1031
1032 if (failures == 0)
1033 return;
1034 if (hostname) {
1035 syslog(LOG_NOTICE, "%d LOGIN FAILURE%s FROM %s",
1036 failures, failures > 1 ? "S" : "", full_hostname);
1037 syslog(LOG_AUTHPRIV|LOG_NOTICE,
1038 "%d LOGIN FAILURE%s FROM %s, %s",
1039 failures, failures > 1 ? "S" : "", full_hostname, name);
1040 } else {
1041 syslog(LOG_NOTICE, "%d LOGIN FAILURE%s ON %s",
1042 failures, failures > 1 ? "S" : "", tty);
1043 syslog(LOG_AUTHPRIV|LOG_NOTICE,
1044 "%d LOGIN FAILURE%s ON %s, %s",
1045 failures, failures > 1 ? "S" : "", tty, name);
1046 }
1047 failures = 0;
1048}
1049
1050#undef UNKNOWN
1051#define UNKNOWN "su"
1052
1053char *
1054stypeof(ttyid)
1055 char *ttyid;
1056{
1057 struct ttyent *t;
1058
1059 if (ttyid != NULL && *ttyid != '\0') {
1060 t = getttynam(ttyid);
1061 if (t != NULL && t->ty_type != NULL)
1062 return (t->ty_type);
1063 }
1064 return (UNKNOWN);
1065}
1066
1067void
1068refused(msg, rtype, lout)
1069 char *msg;
1070 char *rtype;
1071 int lout;
1072{
1073
1074 if (msg != NULL)
1075 printf("%s.\n", msg);
1076 if (hostname)
1077 syslog(LOG_NOTICE, "LOGIN %s REFUSED (%s) FROM %s ON TTY %s",
1078 pwd->pw_name, rtype, full_hostname, tty);
1079 else
1080 syslog(LOG_NOTICE, "LOGIN %s REFUSED (%s) ON TTY %s",
1081 pwd->pw_name, rtype, tty);
1082 if (lout)
1083 sleepexit(1);
1084}
1085
1086void
1087sleepexit(eval)
1088 int eval;
1089{
1090
1091 (void)sleep(5);
1092 exit(eval);
1093}
| 478 if ((optarg = strdup(hostbuf)) == NULL) {
479 syslog(LOG_NOTICE, "strdup(): %m");
480 sleepexit(1);
481 }
482 } else
483 optarg = NULL;
484 if (res != NULL)
485 freeaddrinfo(res);
486 if (!auth_hostok(lc, full_hostname, optarg))
487 refused("Permission denied", "HOST", 1);
488 }
489
490 if (!auth_ttyok(lc, tty))
491 refused("Permission denied", "TTY", 1);
492
493 if (!auth_timeok(lc, time(NULL)))
494 refused("Logins not available right now", "TIME", 1);
495 }
496 shell = login_getcapstr(lc, "shell", pwd->pw_shell, pwd->pw_shell);
497 if (*pwd->pw_shell == '\0')
498 pwd->pw_shell = _PATH_BSHELL;
499 if (*shell == '\0') /* Not overridden */
500 shell = pwd->pw_shell;
501 if ((shell = strdup(shell)) == NULL) {
502 syslog(LOG_NOTICE, "strdup(): %m");
503 sleepexit(1);
504 }
505
506#ifdef LOGIN_ACCESS
507 if (login_access(pwd->pw_name, hostname ? full_hostname : tty) == 0)
508 refused("Permission denied", "ACCESS", 1);
509#endif /* LOGIN_ACCESS */
510
511 /* Nothing else left to fail -- really log in. */
512 memset((void *)&utmp, 0, sizeof(utmp));
513 (void)time(&utmp.ut_time);
514 (void)strncpy(utmp.ut_name, username, sizeof(utmp.ut_name));
515 if (hostname)
516 (void)strncpy(utmp.ut_host, hostname, sizeof(utmp.ut_host));
517 (void)strncpy(utmp.ut_line, tty, sizeof(utmp.ut_line));
518 login(&utmp);
519
520 dolastlog(quietlog);
521
522 /*
523 * Set device protections, depending on what terminal the
524 * user is logged in. This feature is used on Suns to give
525 * console users better privacy.
526 */
527 login_fbtab(tty, pwd->pw_uid, pwd->pw_gid);
528
529 /*
530 * Clear flags of the tty. None should be set, and when the
531 * user sets them otherwise, this can cause the chown to fail.
532 * Since it isn't clear that flags are useful on character
533 * devices, we just clear them.
534 */
535 if (chflags(ttyn, 0) && errno != EOPNOTSUPP)
536 syslog(LOG_ERR, "chmod(%s): %m", ttyn);
537 if (chown(ttyn, pwd->pw_uid,
538 (gr = getgrnam(TTYGRPNAME)) ? gr->gr_gid : pwd->pw_gid))
539 syslog(LOG_ERR, "chmod(%s): %m", ttyn);
540
541
542 /*
543 * Preserve TERM if it happens to be already set.
544 */
545 if ((term = getenv("TERM")) != NULL) {
546 if ((term = strdup(term)) == NULL) {
547 syslog(LOG_NOTICE,
548 "strdup(): %m");
549 sleepexit(1);
550 }
551 }
552
553 /*
554 * Exclude cons/vt/ptys only, assume dialup otherwise
555 * TODO: Make dialup tty determination a library call
556 * for consistency (finger etc.)
557 */
558 if (hostname==NULL && isdialuptty(tty))
559 syslog(LOG_INFO, "DIALUP %s, %s", tty, pwd->pw_name);
560
561#ifdef LOGALL
562 /*
563 * Syslog each successful login, so we don't have to watch hundreds
564 * of wtmp or lastlogin files.
565 */
566 if (hostname)
567 syslog(LOG_INFO, "login from %s on %s as %s",
568 full_hostname, tty, pwd->pw_name);
569 else
570 syslog(LOG_INFO, "login on %s as %s",
571 tty, pwd->pw_name);
572#endif
573
574 /*
575 * If fflag is on, assume caller/authenticator has logged root login.
576 */
577 if (rootlogin && fflag == 0)
578 {
579 if (hostname)
580 syslog(LOG_NOTICE, "ROOT LOGIN (%s) ON %s FROM %s",
581 username, tty, full_hostname);
582 else
583 syslog(LOG_NOTICE, "ROOT LOGIN (%s) ON %s",
584 username, tty);
585 }
586
587 /*
588 * Destroy environment unless user has requested its preservation.
589 * We need to do this before setusercontext() because that may
590 * set or reset some environment variables.
591 */
592 if (!pflag)
593 environ = envinit;
594
595 /*
596 * PAM modules might add supplementary groups during pam_setcred().
597 */
598 if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) != 0) {
599 syslog(LOG_ERR, "setusercontext() failed - exiting");
600 exit(1);
601 }
602
603#ifdef USE_PAM
604 if (pamh) {
605 if ((e = pam_open_session(pamh, 0)) != PAM_SUCCESS) {
606 syslog(LOG_ERR, "pam_open_session: %s",
607 pam_strerror(pamh, e));
608 } else if ((e = pam_setcred(pamh, PAM_ESTABLISH_CRED))
609 != PAM_SUCCESS) {
610 syslog(LOG_ERR, "pam_setcred: %s",
611 pam_strerror(pamh, e));
612 }
613
614 /*
615 * Add any environmental variables that the
616 * PAM modules may have set.
617 * Call *after* opening session!
618 */
619 if (pamh) {
620 environ_pam = pam_getenvlist(pamh);
621 if (environ_pam)
622 export_pam_environment();
623 }
624
625 /*
626 * We must fork() before setuid() because we need to call
627 * pam_close_session() as root.
628 */
629 pid = fork();
630 if (pid < 0) {
631 err(1, "fork");
632 PAM_END;
633 exit(0);
634 } else if (pid) {
635 /* parent - wait for child to finish, then cleanup
636 session */
637 wait(NULL);
638 PAM_END;
639 exit(0);
640 } else {
641 if ((e = pam_end(pamh, 0)) != PAM_SUCCESS)
642 syslog(LOG_ERR, "pam_end: %s",
643 pam_strerror(pamh, e));
644 }
645 }
646#endif /* USE_PAM */
647
648 /*
649 * We don't need to be root anymore, so
650 * set the user and session context
651 */
652 if (setlogin(username) != 0) {
653 syslog(LOG_ERR, "setlogin(%s): %m - exiting", username);
654 exit(1);
655 }
656 if (setusercontext(lc, pwd, pwd->pw_uid,
657 LOGIN_SETALL & ~(LOGIN_SETLOGIN|LOGIN_SETGROUP)) != 0) {
658 syslog(LOG_ERR, "setusercontext() failed - exiting");
659 exit(1);
660 }
661
662 (void)setenv("SHELL", pwd->pw_shell, 1);
663 (void)setenv("HOME", pwd->pw_dir, 1);
664 if (term != NULL && *term != '\0')
665 (void)setenv("TERM", term, 1); /* Preset overrides */
666 else {
667 (void)setenv("TERM", stypeof(tty), 0); /* Fallback doesn't */
668 }
669 (void)setenv("LOGNAME", username, 1);
670 (void)setenv("USER", username, 1);
671 (void)setenv("PATH", rootlogin ? _PATH_STDPATH : _PATH_DEFPATH, 0);
672
673 if (!quietlog) {
674 const char *cw;
675
676 cw = login_getcapstr(lc, "copyright", NULL, NULL);
677 if (cw != NULL && access(cw, F_OK) == 0)
678 motd(cw);
679 else
680 (void)printf("%s\n\t%s %s\n",
681 "Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994",
682 "The Regents of the University of California. ",
683 "All rights reserved.");
684
685 (void)printf("\n");
686
687 cw = login_getcapstr(lc, "welcome", NULL, NULL);
688 if (cw == NULL || access(cw, F_OK) != 0)
689 cw = _PATH_MOTDFILE;
690 motd(cw);
691
692 cw = getenv("MAIL"); /* $MAIL may have been set by class */
693 if (cw != NULL)
694 strlcpy(tbuf, cw, sizeof(tbuf));
695 else
696 snprintf(tbuf, sizeof(tbuf), "%s/%s", _PATH_MAILDIR,
697 pwd->pw_name);
698 if (stat(tbuf, &st) == 0 && st.st_size != 0)
699 (void)printf("You have %smail.\n",
700 (st.st_mtime > st.st_atime) ? "new " : "");
701 }
702
703 login_close(lc);
704
705 (void)signal(SIGALRM, SIG_DFL);
706 (void)signal(SIGQUIT, SIG_DFL);
707 (void)signal(SIGINT, SIG_DFL);
708 (void)signal(SIGTSTP, SIG_IGN);
709
710 /*
711 * Login shells have a leading '-' in front of argv[0]
712 */
713 if (snprintf(tbuf, sizeof(tbuf), "-%s",
714 (p = strrchr(pwd->pw_shell, '/')) ? p + 1 : pwd->pw_shell) >=
715 sizeof(tbuf)) {
716 syslog(LOG_ERR, "user: %s: shell exceeds maximum pathname size",
717 username);
718 errx(1, "shell exceeds maximum pathname size");
719 }
720
721 execlp(shell, tbuf, (char *)0);
722 err(1, "%s", shell);
723}
724
725static int
726auth_traditional()
727{
728 int rval;
729 char *p;
730 char *ep;
731 char *salt;
732
733 rval = 1;
734 salt = pwd != NULL ? pwd->pw_passwd : "xx";
735
736 p = getpass(passwd_prompt);
737 ep = crypt(p, salt);
738
739 if (pwd) {
740 if (!p[0] && pwd->pw_passwd[0])
741 ep = ":";
742 if (strcmp(ep, pwd->pw_passwd) == 0)
743 rval = 0;
744 }
745
746 /* clear entered password */
747 memset(p, 0, strlen(p));
748 return rval;
749}
750
751#ifdef USE_PAM
752/*
753 * Attempt to authenticate the user using PAM. Returns 0 if the user is
754 * authenticated, or 1 if not authenticated. If some sort of PAM system
755 * error occurs (e.g., the "/etc/pam.conf" file is missing) then this
756 * function returns -1. This can be used as an indication that we should
757 * fall back to a different authentication mechanism.
758 */
759static int
760auth_pam()
761{
762 const char *tmpl_user;
763 const void *item;
764 int rval;
765 int e;
766 static struct pam_conv conv = { openpam_ttyconv, NULL };
767
768 if ((e = pam_start("login", username, &conv, &pamh)) != PAM_SUCCESS) {
769 syslog(LOG_ERR, "pam_start: %s", pam_strerror(pamh, e));
770 return -1;
771 }
772 if ((e = pam_set_item(pamh, PAM_TTY, tty)) != PAM_SUCCESS) {
773 syslog(LOG_ERR, "pam_set_item(PAM_TTY): %s",
774 pam_strerror(pamh, e));
775 return -1;
776 }
777 if (hostname != NULL &&
778 (e = pam_set_item(pamh, PAM_RHOST, full_hostname)) != PAM_SUCCESS) {
779 syslog(LOG_ERR, "pam_set_item(PAM_RHOST): %s",
780 pam_strerror(pamh, e));
781 return -1;
782 }
783 e = pam_authenticate(pamh, 0);
784 switch (e) {
785
786 case PAM_SUCCESS:
787 /*
788 * With PAM we support the concept of a "template"
789 * user. The user enters a login name which is
790 * authenticated by PAM, usually via a remote service
791 * such as RADIUS or TACACS+. If authentication
792 * succeeds, a different but related "template" name
793 * is used for setting the credentials, shell, and
794 * home directory. The name the user enters need only
795 * exist on the remote authentication server, but the
796 * template name must be present in the local password
797 * database.
798 *
799 * This is supported by two various mechanisms in the
800 * individual modules. However, from the application's
801 * point of view, the template user is always passed
802 * back as a changed value of the PAM_USER item.
803 */
804 if ((e = pam_get_item(pamh, PAM_USER, &item)) ==
805 PAM_SUCCESS) {
806 tmpl_user = (const char *) item;
807 if (strcmp(username, tmpl_user) != 0)
808 pwd = getpwnam(tmpl_user);
809 } else
810 syslog(LOG_ERR, "Couldn't get PAM_USER: %s",
811 pam_strerror(pamh, e));
812 rval = 0;
813 break;
814
815 case PAM_AUTH_ERR:
816 case PAM_USER_UNKNOWN:
817 case PAM_MAXTRIES:
818 rval = 1;
819 break;
820
821 default:
822 syslog(LOG_ERR, "pam_authenticate: %s", pam_strerror(pamh, e));
823 rval = -1;
824 break;
825 }
826
827 if (rval == 0) {
828 e = pam_acct_mgmt(pamh, 0);
829 if (e == PAM_NEW_AUTHTOK_REQD) {
830 e = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
831 if (e != PAM_SUCCESS) {
832 syslog(LOG_ERR, "pam_chauthtok: %s",
833 pam_strerror(pamh, e));
834 rval = 1;
835 }
836 } else if (e != PAM_SUCCESS) {
837 rval = 1;
838 }
839 }
840
841 if (rval != 0) {
842 if ((e = pam_end(pamh, e)) != PAM_SUCCESS) {
843 syslog(LOG_ERR, "pam_end: %s", pam_strerror(pamh, e));
844 }
845 pamh = NULL;
846 }
847 return rval;
848}
849
850static int
851export_pam_environment()
852{
853 char **pp;
854
855 for (pp = environ_pam; *pp != NULL; pp++) {
856 if (ok_to_export(*pp))
857 (void) putenv(*pp);
858 free(*pp);
859 }
860 return PAM_SUCCESS;
861}
862
863/*
864 * Sanity checks on PAM environmental variables:
865 * - Make sure there is an '=' in the string.
866 * - Make sure the string doesn't run on too long.
867 * - Do not export certain variables. This list was taken from the
868 * Solaris pam_putenv(3) man page.
869 */
870static int
871ok_to_export(s)
872 const char *s;
873{
874 static const char *noexport[] = {
875 "SHELL", "HOME", "LOGNAME", "MAIL", "CDPATH",
876 "IFS", "PATH", NULL
877 };
878 const char **pp;
879 size_t n;
880
881 if (strlen(s) > 1024 || strchr(s, '=') == NULL)
882 return 0;
883 if (strncmp(s, "LD_", 3) == 0)
884 return 0;
885 for (pp = noexport; *pp != NULL; pp++) {
886 n = strlen(*pp);
887 if (s[n] == '=' && strncmp(s, *pp, n) == 0)
888 return 0;
889 }
890 return 1;
891}
892#endif /* USE_PAM */
893
894static void
895usage()
896{
897
898 (void)fprintf(stderr, "usage: login [-fp] [-h hostname] [username]\n");
899 exit(1);
900}
901
902/*
903 * Allow for authentication style and/or kerberos instance
904 */
905
906#define NBUFSIZ UT_NAMESIZE + 64
907
908void
909getloginname()
910{
911 int ch;
912 char *p;
913 static char nbuf[NBUFSIZ];
914
915 for (;;) {
916 (void)printf("%s", prompt);
917 for (p = nbuf; (ch = getchar()) != '\n'; ) {
918 if (ch == EOF) {
919 badlogin(username);
920 exit(0);
921 }
922 if (p < nbuf + (NBUFSIZ - 1))
923 *p++ = ch;
924 }
925 if (p > nbuf) {
926 if (nbuf[0] == '-')
927 (void)fprintf(stderr,
928 "login names may not start with '-'.\n");
929 else {
930 *p = '\0';
931 username = nbuf;
932 break;
933 }
934 }
935 }
936}
937
938int
939rootterm(ttyn)
940 char *ttyn;
941{
942 struct ttyent *t;
943
944 return ((t = getttynam(ttyn)) && t->ty_status & TTY_SECURE);
945}
946
947volatile int motdinterrupt;
948
949void
950sigint(signo)
951 int signo __unused;
952{
953 motdinterrupt = 1;
954}
955
956void
957motd(motdfile)
958 const char *motdfile;
959{
960 int fd, nchars;
961 sig_t oldint;
962 char tbuf[256];
963
964 if ((fd = open(motdfile, O_RDONLY, 0)) < 0)
965 return;
966 motdinterrupt = 0;
967 oldint = signal(SIGINT, sigint);
968 while ((nchars = read(fd, tbuf, sizeof(tbuf))) > 0 && !motdinterrupt)
969 (void)write(fileno(stdout), tbuf, nchars);
970 (void)signal(SIGINT, oldint);
971 (void)close(fd);
972}
973
974/* ARGSUSED */
975void
976timedout(signo)
977 int signo;
978{
979
980 longjmp(timeout_buf, signo);
981}
982
983
984void
985dolastlog(quiet)
986 int quiet;
987{
988 struct lastlog ll;
989 int fd;
990
991 if ((fd = open(_PATH_LASTLOG, O_RDWR, 0)) >= 0) {
992 (void)lseek(fd, (off_t)pwd->pw_uid * sizeof(ll), L_SET);
993 if (!quiet) {
994 if (read(fd, (char *)&ll, sizeof(ll)) == sizeof(ll) &&
995 ll.ll_time != 0) {
996 (void)printf("Last login: %.*s ",
997 24-5, (char *)ctime(&ll.ll_time));
998 if (*ll.ll_host != '\0')
999 (void)printf("from %.*s\n",
1000 (int)sizeof(ll.ll_host),
1001 ll.ll_host);
1002 else
1003 (void)printf("on %.*s\n",
1004 (int)sizeof(ll.ll_line),
1005 ll.ll_line);
1006 }
1007 (void)lseek(fd, (off_t)pwd->pw_uid * sizeof(ll), L_SET);
1008 }
1009 memset((void *)&ll, 0, sizeof(ll));
1010 (void)time(&ll.ll_time);
1011 (void)strncpy(ll.ll_line, tty, sizeof(ll.ll_line));
1012 if (hostname)
1013 (void)strncpy(ll.ll_host, hostname, sizeof(ll.ll_host));
1014 (void)write(fd, (char *)&ll, sizeof(ll));
1015 (void)close(fd);
1016 } else {
1017 syslog(LOG_ERR, "cannot open %s: %m", _PATH_LASTLOG);
1018 }
1019}
1020
1021void
1022badlogin(name)
1023 char *name;
1024{
1025
1026 if (failures == 0)
1027 return;
1028 if (hostname) {
1029 syslog(LOG_NOTICE, "%d LOGIN FAILURE%s FROM %s",
1030 failures, failures > 1 ? "S" : "", full_hostname);
1031 syslog(LOG_AUTHPRIV|LOG_NOTICE,
1032 "%d LOGIN FAILURE%s FROM %s, %s",
1033 failures, failures > 1 ? "S" : "", full_hostname, name);
1034 } else {
1035 syslog(LOG_NOTICE, "%d LOGIN FAILURE%s ON %s",
1036 failures, failures > 1 ? "S" : "", tty);
1037 syslog(LOG_AUTHPRIV|LOG_NOTICE,
1038 "%d LOGIN FAILURE%s ON %s, %s",
1039 failures, failures > 1 ? "S" : "", tty, name);
1040 }
1041 failures = 0;
1042}
1043
1044#undef UNKNOWN
1045#define UNKNOWN "su"
1046
1047char *
1048stypeof(ttyid)
1049 char *ttyid;
1050{
1051 struct ttyent *t;
1052
1053 if (ttyid != NULL && *ttyid != '\0') {
1054 t = getttynam(ttyid);
1055 if (t != NULL && t->ty_type != NULL)
1056 return (t->ty_type);
1057 }
1058 return (UNKNOWN);
1059}
1060
1061void
1062refused(msg, rtype, lout)
1063 char *msg;
1064 char *rtype;
1065 int lout;
1066{
1067
1068 if (msg != NULL)
1069 printf("%s.\n", msg);
1070 if (hostname)
1071 syslog(LOG_NOTICE, "LOGIN %s REFUSED (%s) FROM %s ON TTY %s",
1072 pwd->pw_name, rtype, full_hostname, tty);
1073 else
1074 syslog(LOG_NOTICE, "LOGIN %s REFUSED (%s) ON TTY %s",
1075 pwd->pw_name, rtype, tty);
1076 if (lout)
1077 sleepexit(1);
1078}
1079
1080void
1081sleepexit(eval)
1082 int eval;
1083{
1084
1085 (void)sleep(5);
1086 exit(eval);
1087}
|