pam_unix.c revision 125650 
1/*-
2 * Copyright 1998 Juniper Networks, Inc.
3 * All rights reserved.
4 * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
5 * All rights reserved.
6 *
7 * Portions of this software was developed for the FreeBSD Project by
8 * ThinkSec AS and NAI Labs, the Security Research Division of Network
9 * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
10 * ("CBOSS"), as part of the DARPA CHATS research program.
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 *    notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 *    notice, this list of conditions and the following disclaimer in the
19 *    documentation and/or other materials provided with the distribution.
20 * 3. The name of the author may not be used to endorse or promote
21 *    products derived from this software without specific prior written
22 *    permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37#include <sys/cdefs.h>
38__FBSDID("$FreeBSD: head/lib/libpam/modules/pam_unix/pam_unix.c 125650 2004-02-10 10:13:21Z des $");
39
40#include <sys/param.h>
41#include <sys/socket.h>
42#include <sys/time.h>
43#include <netinet/in.h>
44#include <arpa/inet.h>
45
46#include <login_cap.h>
47#include <netdb.h>
48#include <pwd.h>
49#include <stdlib.h>
50#include <string.h>
51#include <stdio.h>
52#include <syslog.h>
53#include <unistd.h>
54
55#include <libutil.h>
56
57#ifdef YP
58#include <ypclnt.h>
59#endif
60
61#define PAM_SM_AUTH
62#define PAM_SM_ACCOUNT
63#define	PAM_SM_PASSWORD
64
65#include <security/pam_appl.h>
66#include <security/pam_modules.h>
67#include <security/pam_mod_misc.h>
68
69#define PASSWORD_HASH		"md5"
70#define DEFAULT_WARN		(2L * 7L * 86400L)  /* Two weeks */
71#define	SALTSIZE		32
72
73static void makesalt(char []);
74
75static char password_hash[] =		PASSWORD_HASH;
76
77#define PAM_OPT_LOCAL_PASS	"local_pass"
78#define PAM_OPT_NIS_PASS	"nis_pass"
79
80char *tempname = NULL;
81
82/*
83 * authentication management
84 */
85PAM_EXTERN int
86pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
87    int argc __unused, const char *argv[] __unused)
88{
89	login_cap_t *lc;
90	struct passwd *pwd;
91	int retval;
92	const char *pass, *user, *realpw, *prompt;
93
94	if (openpam_get_option(pamh, PAM_OPT_AUTH_AS_SELF)) {
95		pwd = getpwnam(getlogin());
96	} else {
97		retval = pam_get_user(pamh, &user, NULL);
98		if (retval != PAM_SUCCESS)
99			return (retval);
100		pwd = getpwnam(user);
101	}
102
103	PAM_LOG("Got user: %s", user);
104
105	if (pwd != NULL) {
106		PAM_LOG("Doing real authentication");
107		realpw = pwd->pw_passwd;
108		if (realpw[0] == '\0') {
109			if (!(flags & PAM_DISALLOW_NULL_AUTHTOK) &&
110			    openpam_get_option(pamh, PAM_OPT_NULLOK))
111				return (PAM_SUCCESS);
112			realpw = "*";
113		}
114		lc = login_getpwclass(pwd);
115	} else {
116		PAM_LOG("Doing dummy authentication");
117		realpw = "*";
118		lc = login_getclass(NULL);
119	}
120	prompt = login_getcapstr(lc, "passwd_prompt", NULL, NULL);
121	retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, prompt);
122	login_close(lc);
123	if (retval != PAM_SUCCESS)
124		return (retval);
125	PAM_LOG("Got password");
126	if (strcmp(crypt(pass, realpw), realpw) == 0)
127		return (PAM_SUCCESS);
128
129	PAM_VERBOSE_ERROR("UNIX authentication refused");
130	return (PAM_AUTH_ERR);
131}
132
133PAM_EXTERN int
134pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
135    int argc __unused, const char *argv[] __unused)
136{
137
138	return (PAM_SUCCESS);
139}
140
141/*
142 * account management
143 */
144PAM_EXTERN int
145pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused,
146    int argc __unused, const char *argv[] __unused)
147{
148	struct addrinfo hints, *res;
149	struct passwd *pwd;
150	struct timeval tp;
151	login_cap_t *lc;
152	time_t warntime;
153	int retval;
154	const char *user;
155	const void *rhost, *tty;
156	char rhostip[MAXHOSTNAMELEN] = "";
157
158	retval = pam_get_user(pamh, &user, NULL);
159	if (retval != PAM_SUCCESS)
160		return (retval);
161
162	if (user == NULL || (pwd = getpwnam(user)) == NULL)
163		return (PAM_SERVICE_ERR);
164
165	PAM_LOG("Got user: %s", user);
166
167	retval = pam_get_item(pamh, PAM_RHOST, &rhost);
168	if (retval != PAM_SUCCESS)
169		return (retval);
170
171	retval = pam_get_item(pamh, PAM_TTY, &tty);
172	if (retval != PAM_SUCCESS)
173		return (retval);
174
175	if (*pwd->pw_passwd == '\0' &&
176	    (flags & PAM_DISALLOW_NULL_AUTHTOK) != 0)
177		return (PAM_NEW_AUTHTOK_REQD);
178
179	lc = login_getpwclass(pwd);
180	if (lc == NULL) {
181		PAM_LOG("Unable to get login class for user %s", user);
182		return (PAM_SERVICE_ERR);
183	}
184
185	PAM_LOG("Got login_cap");
186
187	if (pwd->pw_change || pwd->pw_expire)
188		gettimeofday(&tp, NULL);
189
190	/*
191	 * Check pw_expire before pw_change - no point in letting the
192	 * user change the password on an expired account.
193	 */
194
195	if (pwd->pw_expire) {
196		warntime = login_getcaptime(lc, "warnexpire",
197		    DEFAULT_WARN, DEFAULT_WARN);
198		if (tp.tv_sec >= pwd->pw_expire) {
199			login_close(lc);
200			return (PAM_ACCT_EXPIRED);
201		} else if (pwd->pw_expire - tp.tv_sec < warntime &&
202		    (flags & PAM_SILENT) == 0) {
203			pam_error(pamh, "Warning: your account expires on %s",
204			    ctime(&pwd->pw_expire));
205		}
206	}
207
208	retval = PAM_SUCCESS;
209	if (pwd->pw_change) {
210		warntime = login_getcaptime(lc, "warnpassword",
211		    DEFAULT_WARN, DEFAULT_WARN);
212		if (tp.tv_sec >= pwd->pw_change) {
213			retval = PAM_NEW_AUTHTOK_REQD;
214		} else if (pwd->pw_change - tp.tv_sec < warntime &&
215		    (flags & PAM_SILENT) == 0) {
216			pam_error(pamh, "Warning: your password expires on %s",
217			    ctime(&pwd->pw_change));
218		}
219	}
220
221	/*
222	 * From here on, we must leave retval untouched (unless we
223	 * know we're going to fail), because we need to remember
224	 * whether we're supposed to return PAM_SUCCESS or
225	 * PAM_NEW_AUTHTOK_REQD.
226	 */
227
228	if (rhost && *(const char *)rhost != '\0') {
229		memset(&hints, 0, sizeof(hints));
230		hints.ai_family = AF_UNSPEC;
231		if (getaddrinfo(rhost, NULL, &hints, &res) == 0) {
232			getnameinfo(res->ai_addr, res->ai_addrlen,
233			    rhostip, sizeof(rhostip), NULL, 0,
234			    NI_NUMERICHOST|NI_WITHSCOPEID);
235		}
236		if (res != NULL)
237			freeaddrinfo(res);
238	}
239
240	/*
241	 * Check host / tty / time-of-day restrictions
242	 */
243
244	if (!auth_hostok(lc, rhost, rhostip) ||
245	    !auth_ttyok(lc, tty) ||
246	    !auth_timeok(lc, time(NULL)))
247		retval = PAM_AUTH_ERR;
248
249	login_close(lc);
250
251	return (retval);
252}
253
254/*
255 * password management
256 *
257 * standard Unix and NIS password changing
258 */
259PAM_EXTERN int
260pam_sm_chauthtok(pam_handle_t *pamh, int flags,
261    int argc __unused, const char *argv[] __unused)
262{
263#ifdef YP
264	struct ypclnt *ypclnt;
265	void *yp_domain, *yp_server;
266#endif
267	char salt[SALTSIZE + 1];
268	login_cap_t * lc;
269	struct passwd *pwd, *old_pwd;
270	const char *user, *old_pass, *new_pass;
271	char *encrypted;
272	int pfd, tfd, retval;
273
274	if (openpam_get_option(pamh, PAM_OPT_AUTH_AS_SELF))
275		pwd = getpwnam(getlogin());
276	else {
277		retval = pam_get_user(pamh, &user, NULL);
278		if (retval != PAM_SUCCESS)
279			return (retval);
280		pwd = getpwnam(user);
281	}
282
283	if (pwd == NULL)
284		return (PAM_AUTHTOK_RECOVERY_ERR);
285
286	PAM_LOG("Got user: %s", user);
287
288	if (flags & PAM_PRELIM_CHECK) {
289
290		PAM_LOG("PRELIM round");
291
292		if (getuid() == 0 &&
293		    (pwd->pw_fields & _PWF_SOURCE) == _PWF_FILES)
294			/* root doesn't need the old password */
295			return (pam_set_item(pamh, PAM_OLDAUTHTOK, ""));
296#ifdef YP
297		if (getuid() == 0 &&
298		    (pwd->pw_fields & _PWF_SOURCE) == _PWF_NIS) {
299
300			yp_domain = yp_server = NULL;
301			(void)pam_get_data(pamh, "yp_domain", &yp_domain);
302			(void)pam_get_data(pamh, "yp_server", &yp_server);
303
304			ypclnt = ypclnt_new(yp_domain, "passwd.byname", yp_server);
305			if (ypclnt == NULL)
306				return (PAM_BUF_ERR);
307
308			if (ypclnt_connect(ypclnt) == -1) {
309				ypclnt_free(ypclnt);
310				return (PAM_SERVICE_ERR);
311			}
312
313			retval = ypclnt_havepasswdd(ypclnt);
314			ypclnt_free(ypclnt);
315			if (retval == 1)
316				return (pam_set_item(pamh, PAM_OLDAUTHTOK, ""));
317			else if (retval == -1)
318				return (PAM_SERVICE_ERR);
319		}
320#endif
321		if (pwd->pw_passwd[0] == '\0'
322		    && openpam_get_option(pamh, PAM_OPT_NULLOK)) {
323			/*
324			 * No password case. XXX Are we giving too much away
325			 * by not prompting for a password?
326			 * XXX check PAM_DISALLOW_NULL_AUTHTOK
327			 */
328			old_pass = "";
329		} else {
330			retval = pam_get_authtok(pamh,
331			    PAM_OLDAUTHTOK, &old_pass, NULL);
332			if (retval != PAM_SUCCESS)
333				return (retval);
334		}
335		PAM_LOG("Got old password");
336		/* always encrypt first */
337		encrypted = crypt(old_pass, pwd->pw_passwd);
338		if (old_pass[0] == '\0' &&
339		    !openpam_get_option(pamh, PAM_OPT_NULLOK))
340			return (PAM_PERM_DENIED);
341		if (strcmp(encrypted, pwd->pw_passwd) != 0)
342			return (PAM_PERM_DENIED);
343	}
344	else if (flags & PAM_UPDATE_AUTHTOK) {
345		PAM_LOG("UPDATE round");
346
347		retval = pam_get_authtok(pamh,
348		    PAM_OLDAUTHTOK, &old_pass, NULL);
349		if (retval != PAM_SUCCESS)
350			return (retval);
351		PAM_LOG("Got old password");
352
353		/* get new password */
354		for (;;) {
355			retval = pam_get_authtok(pamh,
356			    PAM_AUTHTOK, &new_pass, NULL);
357			if (retval != PAM_TRY_AGAIN)
358				break;
359			pam_error(pamh, "Mismatch; try again, EOF to quit.");
360		}
361		PAM_LOG("Got new password");
362		if (retval != PAM_SUCCESS) {
363			PAM_VERBOSE_ERROR("Unable to get new password");
364			return (retval);
365		}
366
367		if (getuid() != 0 && new_pass[0] == '\0' &&
368		    !openpam_get_option(pamh, PAM_OPT_NULLOK))
369			return (PAM_PERM_DENIED);
370
371		if ((old_pwd = pw_dup(pwd)) == NULL)
372			return (PAM_BUF_ERR);
373
374		pwd->pw_change = 0;
375		lc = login_getclass(NULL);
376		if (login_setcryptfmt(lc, password_hash, NULL) == NULL)
377			openpam_log(PAM_LOG_ERROR,
378			    "can't set password cipher, relying on default");
379		login_close(lc);
380		makesalt(salt);
381		pwd->pw_passwd = crypt(new_pass, salt);
382#ifdef YP
383		switch (old_pwd->pw_fields & _PWF_SOURCE) {
384		case _PWF_FILES:
385#endif
386			retval = PAM_SERVICE_ERR;
387			if (pw_init(NULL, NULL))
388				openpam_log(PAM_LOG_ERROR, "pw_init() failed");
389			else if ((pfd = pw_lock()) == -1)
390				openpam_log(PAM_LOG_ERROR, "pw_lock() failed");
391			else if ((tfd = pw_tmp(-1)) == -1)
392				openpam_log(PAM_LOG_ERROR, "pw_tmp() failed");
393			else if (pw_copy(pfd, tfd, pwd, old_pwd) == -1)
394				openpam_log(PAM_LOG_ERROR, "pw_copy() failed");
395			else if (pw_mkdb(pwd->pw_name) == -1)
396				openpam_log(PAM_LOG_ERROR, "pw_mkdb() failed");
397			else
398				retval = PAM_SUCCESS;
399			pw_fini();
400#ifdef YP
401			break;
402		case _PWF_NIS:
403			yp_domain = yp_server = NULL;
404			(void)pam_get_data(pamh, "yp_domain", &yp_domain);
405			(void)pam_get_data(pamh, "yp_server", &yp_server);
406			ypclnt = ypclnt_new(yp_domain,
407			    "passwd.byname", yp_server);
408			if (ypclnt == NULL) {
409				retval = PAM_BUF_ERR;
410			} else if (ypclnt_connect(ypclnt) == -1 ||
411			    ypclnt_passwd(ypclnt, pwd, old_pass) == -1) {
412				openpam_log(PAM_LOG_ERROR, "%s", ypclnt->error);
413				retval = PAM_SERVICE_ERR;
414			} else {
415				retval = PAM_SUCCESS;
416			}
417			ypclnt_free(ypclnt);
418			break;
419		default:
420			openpam_log(PAM_LOG_ERROR, "unsupported source 0x%x",
421			    pwd->pw_fields & _PWF_SOURCE);
422			retval = PAM_SERVICE_ERR;
423		}
424#endif
425		free(old_pwd);
426	}
427	else {
428		/* Very bad juju */
429		retval = PAM_ABORT;
430		PAM_LOG("Illegal 'flags'");
431	}
432
433	return (retval);
434}
435
436/* Mostly stolen from passwd(1)'s local_passwd.c - markm */
437
438static unsigned char itoa64[] =		/* 0 ... 63 => ascii - 64 */
439	"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
440
441static void
442to64(char *s, long v, int n)
443{
444	while (--n >= 0) {
445		*s++ = itoa64[v&0x3f];
446		v >>= 6;
447	}
448}
449
450/* Salt suitable for traditional DES and MD5 */
451void
452makesalt(char salt[SALTSIZE])
453{
454	int i;
455
456	/* These are not really random numbers, they are just
457	 * numbers that change to thwart construction of a
458	 * dictionary. This is exposed to the public.
459	 */
460	for (i = 0; i < SALTSIZE; i += 4)
461		to64(&salt[i], arc4random(), 4);
462	salt[SALTSIZE] = '\0';
463}
464
465PAM_MODULE_ENTRY("pam_unix");
466