pam_unix.c revision 174837 
1/*-
2 * Copyright 1998 Juniper Networks, Inc.
3 * All rights reserved.
4 * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
5 * All rights reserved.
6 *
7 * Portions of this software was developed for the FreeBSD Project by
8 * ThinkSec AS and NAI Labs, the Security Research Division of Network
9 * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
10 * ("CBOSS"), as part of the DARPA CHATS research program.
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 *    notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 *    notice, this list of conditions and the following disclaimer in the
19 *    documentation and/or other materials provided with the distribution.
20 * 3. The name of the author may not be used to endorse or promote
21 *    products derived from this software without specific prior written
22 *    permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37#include <sys/cdefs.h>
38__FBSDID("$FreeBSD: head/lib/libpam/modules/pam_unix/pam_unix.c 174837 2007-12-21 12:00:16Z des $");
39
40#include <sys/param.h>
41#include <sys/socket.h>
42#include <sys/time.h>
43#include <netinet/in.h>
44#include <arpa/inet.h>
45
46#include <login_cap.h>
47#include <netdb.h>
48#include <pwd.h>
49#include <stdlib.h>
50#include <string.h>
51#include <stdio.h>
52#include <syslog.h>
53#include <unistd.h>
54
55#include <libutil.h>
56
57#ifdef YP
58#include <ypclnt.h>
59#endif
60
61#define PAM_SM_AUTH
62#define PAM_SM_ACCOUNT
63#define	PAM_SM_PASSWORD
64
65#include <security/pam_appl.h>
66#include <security/pam_modules.h>
67#include <security/pam_mod_misc.h>
68
69#define PASSWORD_HASH		"md5"
70#define DEFAULT_WARN		(2L * 7L * 86400L)  /* Two weeks */
71#define	SALTSIZE		32
72
73#define	LOCKED_PREFIX		"*LOCKED*"
74#define	LOCKED_PREFIX_LEN	(sizeof(LOCKED_PREFIX) - 1)
75
76static void makesalt(char []);
77
78static char password_hash[] =		PASSWORD_HASH;
79
80#define PAM_OPT_LOCAL_PASS	"local_pass"
81#define PAM_OPT_NIS_PASS	"nis_pass"
82
83char *tempname = NULL;
84
85/*
86 * authentication management
87 */
88PAM_EXTERN int
89pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
90    int argc __unused, const char *argv[] __unused)
91{
92	login_cap_t *lc;
93	struct passwd *pwd;
94	int retval;
95	const char *pass, *user, *realpw, *prompt;
96
97	if (openpam_get_option(pamh, PAM_OPT_AUTH_AS_SELF)) {
98		pwd = getpwnam(getlogin());
99	} else {
100		retval = pam_get_user(pamh, &user, NULL);
101		if (retval != PAM_SUCCESS)
102			return (retval);
103		pwd = getpwnam(user);
104	}
105
106	PAM_LOG("Got user: %s", user);
107
108	if (pwd != NULL) {
109		PAM_LOG("Doing real authentication");
110		realpw = pwd->pw_passwd;
111		if (realpw[0] == '\0') {
112			if (!(flags & PAM_DISALLOW_NULL_AUTHTOK) &&
113			    openpam_get_option(pamh, PAM_OPT_NULLOK))
114				return (PAM_SUCCESS);
115			realpw = "*";
116		}
117		lc = login_getpwclass(pwd);
118	} else {
119		PAM_LOG("Doing dummy authentication");
120		realpw = "*";
121		lc = login_getclass(NULL);
122	}
123	prompt = login_getcapstr(lc, "passwd_prompt", NULL, NULL);
124	retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, prompt);
125	login_close(lc);
126	if (retval != PAM_SUCCESS)
127		return (retval);
128	PAM_LOG("Got password");
129	if (strcmp(crypt(pass, realpw), realpw) == 0)
130		return (PAM_SUCCESS);
131
132	PAM_VERBOSE_ERROR("UNIX authentication refused");
133	return (PAM_AUTH_ERR);
134}
135
136PAM_EXTERN int
137pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
138    int argc __unused, const char *argv[] __unused)
139{
140
141	return (PAM_SUCCESS);
142}
143
144/*
145 * account management
146 */
147PAM_EXTERN int
148pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused,
149    int argc __unused, const char *argv[] __unused)
150{
151	struct addrinfo hints, *res;
152	struct passwd *pwd;
153	struct timeval tp;
154	login_cap_t *lc;
155	time_t warntime;
156	int retval;
157	const char *user;
158	const void *rhost, *tty;
159	char rhostip[MAXHOSTNAMELEN] = "";
160
161	retval = pam_get_user(pamh, &user, NULL);
162	if (retval != PAM_SUCCESS)
163		return (retval);
164
165	if (user == NULL || (pwd = getpwnam(user)) == NULL)
166		return (PAM_SERVICE_ERR);
167
168	PAM_LOG("Got user: %s", user);
169
170	retval = pam_get_item(pamh, PAM_RHOST, &rhost);
171	if (retval != PAM_SUCCESS)
172		return (retval);
173
174	retval = pam_get_item(pamh, PAM_TTY, &tty);
175	if (retval != PAM_SUCCESS)
176		return (retval);
177
178	if (*pwd->pw_passwd == '\0' &&
179	    (flags & PAM_DISALLOW_NULL_AUTHTOK) != 0)
180		return (PAM_NEW_AUTHTOK_REQD);
181
182	if (strncmp(pwd->pw_passwd, LOCKED_PREFIX, LOCKED_PREFIX_LEN) == 0)
183		return (PAM_AUTH_ERR);
184
185	lc = login_getpwclass(pwd);
186	if (lc == NULL) {
187		PAM_LOG("Unable to get login class for user %s", user);
188		return (PAM_SERVICE_ERR);
189	}
190
191	PAM_LOG("Got login_cap");
192
193	if (pwd->pw_change || pwd->pw_expire)
194		gettimeofday(&tp, NULL);
195
196	/*
197	 * Check pw_expire before pw_change - no point in letting the
198	 * user change the password on an expired account.
199	 */
200
201	if (pwd->pw_expire) {
202		warntime = login_getcaptime(lc, "warnexpire",
203		    DEFAULT_WARN, DEFAULT_WARN);
204		if (tp.tv_sec >= pwd->pw_expire) {
205			login_close(lc);
206			return (PAM_ACCT_EXPIRED);
207		} else if (pwd->pw_expire - tp.tv_sec < warntime &&
208		    (flags & PAM_SILENT) == 0) {
209			pam_error(pamh, "Warning: your account expires on %s",
210			    ctime(&pwd->pw_expire));
211		}
212	}
213
214	retval = PAM_SUCCESS;
215	if (pwd->pw_change) {
216		warntime = login_getcaptime(lc, "warnpassword",
217		    DEFAULT_WARN, DEFAULT_WARN);
218		if (tp.tv_sec >= pwd->pw_change) {
219			retval = PAM_NEW_AUTHTOK_REQD;
220		} else if (pwd->pw_change - tp.tv_sec < warntime &&
221		    (flags & PAM_SILENT) == 0) {
222			pam_error(pamh, "Warning: your password expires on %s",
223			    ctime(&pwd->pw_change));
224		}
225	}
226
227	/*
228	 * From here on, we must leave retval untouched (unless we
229	 * know we're going to fail), because we need to remember
230	 * whether we're supposed to return PAM_SUCCESS or
231	 * PAM_NEW_AUTHTOK_REQD.
232	 */
233
234	if (rhost && *(const char *)rhost != '\0') {
235		memset(&hints, 0, sizeof(hints));
236		hints.ai_family = AF_UNSPEC;
237		if (getaddrinfo(rhost, NULL, &hints, &res) == 0) {
238			getnameinfo(res->ai_addr, res->ai_addrlen,
239			    rhostip, sizeof(rhostip), NULL, 0,
240			    NI_NUMERICHOST);
241		}
242		if (res != NULL)
243			freeaddrinfo(res);
244	}
245
246	/*
247	 * Check host / tty / time-of-day restrictions
248	 */
249
250	if (!auth_hostok(lc, rhost, rhostip) ||
251	    !auth_ttyok(lc, tty) ||
252	    !auth_timeok(lc, time(NULL)))
253		retval = PAM_AUTH_ERR;
254
255	login_close(lc);
256
257	return (retval);
258}
259
260/*
261 * password management
262 *
263 * standard Unix and NIS password changing
264 */
265PAM_EXTERN int
266pam_sm_chauthtok(pam_handle_t *pamh, int flags,
267    int argc __unused, const char *argv[] __unused)
268{
269#ifdef YP
270	struct ypclnt *ypclnt;
271	const void *yp_domain, *yp_server;
272#endif
273	char salt[SALTSIZE + 1];
274	login_cap_t * lc;
275	struct passwd *pwd, *old_pwd;
276	const char *user, *old_pass, *new_pass;
277	char *encrypted;
278	int pfd, tfd, retval;
279
280	if (openpam_get_option(pamh, PAM_OPT_AUTH_AS_SELF))
281		pwd = getpwnam(getlogin());
282	else {
283		retval = pam_get_user(pamh, &user, NULL);
284		if (retval != PAM_SUCCESS)
285			return (retval);
286		pwd = getpwnam(user);
287	}
288
289	if (pwd == NULL)
290		return (PAM_AUTHTOK_RECOVERY_ERR);
291
292	PAM_LOG("Got user: %s", user);
293
294	if (flags & PAM_PRELIM_CHECK) {
295
296		PAM_LOG("PRELIM round");
297
298		if (getuid() == 0 &&
299		    (pwd->pw_fields & _PWF_SOURCE) == _PWF_FILES)
300			/* root doesn't need the old password */
301			return (pam_set_item(pamh, PAM_OLDAUTHTOK, ""));
302#ifdef YP
303		if (getuid() == 0 &&
304		    (pwd->pw_fields & _PWF_SOURCE) == _PWF_NIS) {
305
306			yp_domain = yp_server = NULL;
307			(void)pam_get_data(pamh, "yp_domain", &yp_domain);
308			(void)pam_get_data(pamh, "yp_server", &yp_server);
309
310			ypclnt = ypclnt_new(yp_domain, "passwd.byname", yp_server);
311			if (ypclnt == NULL)
312				return (PAM_BUF_ERR);
313
314			if (ypclnt_connect(ypclnt) == -1) {
315				ypclnt_free(ypclnt);
316				return (PAM_SERVICE_ERR);
317			}
318
319			retval = ypclnt_havepasswdd(ypclnt);
320			ypclnt_free(ypclnt);
321			if (retval == 1)
322				return (pam_set_item(pamh, PAM_OLDAUTHTOK, ""));
323			else if (retval == -1)
324				return (PAM_SERVICE_ERR);
325		}
326#endif
327		if (pwd->pw_passwd[0] == '\0'
328		    && openpam_get_option(pamh, PAM_OPT_NULLOK)) {
329			/*
330			 * No password case. XXX Are we giving too much away
331			 * by not prompting for a password?
332			 * XXX check PAM_DISALLOW_NULL_AUTHTOK
333			 */
334			old_pass = "";
335		} else {
336			retval = pam_get_authtok(pamh,
337			    PAM_OLDAUTHTOK, &old_pass, NULL);
338			if (retval != PAM_SUCCESS)
339				return (retval);
340		}
341		PAM_LOG("Got old password");
342		/* always encrypt first */
343		encrypted = crypt(old_pass, pwd->pw_passwd);
344		if (old_pass[0] == '\0' &&
345		    !openpam_get_option(pamh, PAM_OPT_NULLOK))
346			return (PAM_PERM_DENIED);
347		if (strcmp(encrypted, pwd->pw_passwd) != 0)
348			return (PAM_PERM_DENIED);
349	}
350	else if (flags & PAM_UPDATE_AUTHTOK) {
351		PAM_LOG("UPDATE round");
352
353		retval = pam_get_authtok(pamh,
354		    PAM_OLDAUTHTOK, &old_pass, NULL);
355		if (retval != PAM_SUCCESS)
356			return (retval);
357		PAM_LOG("Got old password");
358
359		/* get new password */
360		for (;;) {
361			retval = pam_get_authtok(pamh,
362			    PAM_AUTHTOK, &new_pass, NULL);
363			if (retval != PAM_TRY_AGAIN)
364				break;
365			pam_error(pamh, "Mismatch; try again, EOF to quit.");
366		}
367		PAM_LOG("Got new password");
368		if (retval != PAM_SUCCESS) {
369			PAM_VERBOSE_ERROR("Unable to get new password");
370			return (retval);
371		}
372
373		if (getuid() != 0 && new_pass[0] == '\0' &&
374		    !openpam_get_option(pamh, PAM_OPT_NULLOK))
375			return (PAM_PERM_DENIED);
376
377		if ((old_pwd = pw_dup(pwd)) == NULL)
378			return (PAM_BUF_ERR);
379
380		pwd->pw_change = 0;
381		lc = login_getclass(pwd->pw_class);
382		if (login_setcryptfmt(lc, password_hash, NULL) == NULL)
383			openpam_log(PAM_LOG_ERROR,
384			    "can't set password cipher, relying on default");
385		login_close(lc);
386		makesalt(salt);
387		pwd->pw_passwd = crypt(new_pass, salt);
388#ifdef YP
389		switch (old_pwd->pw_fields & _PWF_SOURCE) {
390		case _PWF_FILES:
391#endif
392			retval = PAM_SERVICE_ERR;
393			if (pw_init(NULL, NULL))
394				openpam_log(PAM_LOG_ERROR, "pw_init() failed");
395			else if ((pfd = pw_lock()) == -1)
396				openpam_log(PAM_LOG_ERROR, "pw_lock() failed");
397			else if ((tfd = pw_tmp(-1)) == -1)
398				openpam_log(PAM_LOG_ERROR, "pw_tmp() failed");
399			else if (pw_copy(pfd, tfd, pwd, old_pwd) == -1)
400				openpam_log(PAM_LOG_ERROR, "pw_copy() failed");
401			else if (pw_mkdb(pwd->pw_name) == -1)
402				openpam_log(PAM_LOG_ERROR, "pw_mkdb() failed");
403			else
404				retval = PAM_SUCCESS;
405			pw_fini();
406#ifdef YP
407			break;
408		case _PWF_NIS:
409			yp_domain = yp_server = NULL;
410			(void)pam_get_data(pamh, "yp_domain", &yp_domain);
411			(void)pam_get_data(pamh, "yp_server", &yp_server);
412			ypclnt = ypclnt_new(yp_domain,
413			    "passwd.byname", yp_server);
414			if (ypclnt == NULL) {
415				retval = PAM_BUF_ERR;
416			} else if (ypclnt_connect(ypclnt) == -1 ||
417			    ypclnt_passwd(ypclnt, pwd, old_pass) == -1) {
418				openpam_log(PAM_LOG_ERROR, "%s", ypclnt->error);
419				retval = PAM_SERVICE_ERR;
420			} else {
421				retval = PAM_SUCCESS;
422			}
423			ypclnt_free(ypclnt);
424			break;
425		default:
426			openpam_log(PAM_LOG_ERROR, "unsupported source 0x%x",
427			    pwd->pw_fields & _PWF_SOURCE);
428			retval = PAM_SERVICE_ERR;
429		}
430#endif
431		free(old_pwd);
432	}
433	else {
434		/* Very bad juju */
435		retval = PAM_ABORT;
436		PAM_LOG("Illegal 'flags'");
437	}
438
439	return (retval);
440}
441
442/* Mostly stolen from passwd(1)'s local_passwd.c - markm */
443
444static unsigned char itoa64[] =		/* 0 ... 63 => ascii - 64 */
445	"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
446
447static void
448to64(char *s, long v, int n)
449{
450	while (--n >= 0) {
451		*s++ = itoa64[v&0x3f];
452		v >>= 6;
453	}
454}
455
456/* Salt suitable for traditional DES and MD5 */
457void
458makesalt(char salt[SALTSIZE])
459{
460	int i;
461
462	/* These are not really random numbers, they are just
463	 * numbers that change to thwart construction of a
464	 * dictionary. This is exposed to the public.
465	 */
466	for (i = 0; i < SALTSIZE; i += 4)
467		to64(&salt[i], arc4random(), 4);
468	salt[SALTSIZE] = '\0';
469}
470
471PAM_MODULE_ENTRY("pam_unix");
472