pam_unix.c revision 96201 
1/*-
2 * Copyright 1998 Juniper Networks, Inc.
3 * All rights reserved.
4 * Copyright (c) 2002 Networks Associates Technology, Inc.
5 * All rights reserved.
6 *
7 * Portions of this software was developed for the FreeBSD Project by
8 * ThinkSec AS and NAI Labs, the Security Research Division of Network
9 * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
10 * ("CBOSS"), as part of the DARPA CHATS research program.
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 *    notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 *    notice, this list of conditions and the following disclaimer in the
19 *    documentation and/or other materials provided with the distribution.
20 * 3. The name of the author may not be used to endorse or promote
21 *    products derived from this software without specific prior written
22 *    permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37#include <sys/cdefs.h>
38__FBSDID("$FreeBSD: head/lib/libpam/modules/pam_unix/pam_unix.c 96201 2002-05-08 00:54:29Z des $");
39
40#include <sys/param.h>
41#include <sys/socket.h>
42#include <sys/time.h>
43#include <netinet/in.h>
44#include <arpa/inet.h>
45
46#include <login_cap.h>
47#include <netdb.h>
48#include <pwd.h>
49#include <stdlib.h>
50#include <string.h>
51#include <stdio.h>
52#include <syslog.h>
53#include <unistd.h>
54
55#include <libutil.h>
56
57#ifdef YP
58#include <ypclnt.h>
59#endif
60
61#define PAM_SM_AUTH
62#define PAM_SM_ACCOUNT
63#define	PAM_SM_PASSWORD
64
65#include <security/pam_appl.h>
66#include <security/pam_modules.h>
67#include <security/pam_mod_misc.h>
68
69#define PASSWORD_HASH		"md5"
70#define DEFAULT_WARN		(2L * 7L * 86400L)  /* Two weeks */
71#define	SALTSIZE		32
72
73static void makesalt(char []);
74
75static char password_hash[] =		PASSWORD_HASH;
76
77enum {
78	PAM_OPT_AUTH_AS_SELF	= PAM_OPT_STD_MAX,
79	PAM_OPT_NULLOK,
80	PAM_OPT_LOCAL_PASS,
81	PAM_OPT_NIS_PASS
82};
83
84static struct opttab other_options[] = {
85	{ "auth_as_self",	PAM_OPT_AUTH_AS_SELF },
86	{ "nullok",		PAM_OPT_NULLOK },
87	{ "local_pass",		PAM_OPT_LOCAL_PASS },
88	{ "nis_pass",		PAM_OPT_NIS_PASS },
89	{ NULL, 0 }
90};
91
92char *tempname = NULL;
93
94/*
95 * authentication management
96 */
97PAM_EXTERN int
98pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
99    int argc, const char *argv[])
100{
101	login_cap_t *lc;
102	struct options options;
103	struct passwd *pwd;
104	int retval;
105	const char *pass, *user, *realpw, *prompt;
106
107	pam_std_option(&options, other_options, argc, argv);
108
109	PAM_LOG("Options processed");
110
111	if (pam_test_option(&options, PAM_OPT_AUTH_AS_SELF, NULL)) {
112		pwd = getpwnam(getlogin());
113	} else {
114		retval = pam_get_user(pamh, &user, NULL);
115		if (retval != PAM_SUCCESS)
116			return (retval);
117		pwd = getpwnam(user);
118	}
119
120	PAM_LOG("Got user: %s", user);
121
122	if (pwd != NULL) {
123		PAM_LOG("Doing real authentication");
124		realpw = pwd->pw_passwd;
125		if (realpw[0] == '\0') {
126			if (!(flags & PAM_DISALLOW_NULL_AUTHTOK) &&
127			    pam_test_option(&options, PAM_OPT_NULLOK, NULL))
128				return (PAM_SUCCESS);
129			realpw = "*";
130		}
131		lc = login_getpwclass(pwd);
132	} else {
133		PAM_LOG("Doing dummy authentication");
134		realpw = "*";
135		lc = login_getclass(NULL);
136	}
137	prompt = login_getcapstr(lc, "passwd_prompt", NULL, NULL);
138	retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, prompt);
139	login_close(lc);
140	if (retval != PAM_SUCCESS)
141		return (retval);
142	PAM_LOG("Got password");
143	if (strcmp(crypt(pass, realpw), realpw) == 0)
144		return (PAM_SUCCESS);
145
146	PAM_VERBOSE_ERROR("UNIX authentication refused");
147	return (PAM_AUTH_ERR);
148}
149
150PAM_EXTERN int
151pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
152    int argc __unused, const char *argv[] __unused)
153{
154
155	return (PAM_SUCCESS);
156}
157
158/*
159 * account management
160 */
161PAM_EXTERN int
162pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused,
163    int argc, const char *argv[])
164{
165	struct addrinfo hints, *res;
166	struct options options;
167	struct passwd *pwd;
168	struct timeval tp;
169	login_cap_t *lc;
170	time_t warntime;
171	int retval;
172	const char *rhost, *tty, *user;
173	char rhostip[MAXHOSTNAMELEN];
174
175	pam_std_option(&options, other_options, argc, argv);
176
177	PAM_LOG("Options processed");
178
179	retval = pam_get_user(pamh, &user, NULL);
180	if (retval != PAM_SUCCESS)
181		return (retval);
182
183	if (user == NULL || (pwd = getpwnam(user)) == NULL)
184		return (PAM_SERVICE_ERR);
185
186	PAM_LOG("Got user: %s", user);
187
188	retval = pam_get_item(pamh, PAM_RHOST, (const void **)&rhost);
189	if (retval != PAM_SUCCESS)
190		return (retval);
191
192	retval = pam_get_item(pamh, PAM_TTY, (const void **)&tty);
193	if (retval != PAM_SUCCESS)
194		return (retval);
195
196	if (*pwd->pw_passwd == '\0' &&
197	    (flags & PAM_DISALLOW_NULL_AUTHTOK) != 0)
198		return (PAM_NEW_AUTHTOK_REQD);
199
200	lc = login_getpwclass(pwd);
201	if (lc == NULL) {
202		PAM_LOG("Unable to get login class for user %s", user);
203		return (PAM_SERVICE_ERR);
204	}
205
206	PAM_LOG("Got login_cap");
207
208	if (pwd->pw_change || pwd->pw_expire)
209		gettimeofday(&tp, NULL);
210
211	/*
212	 * Check pw_expire before pw_change - no point in letting the
213	 * user change the password on an expired account.
214	 */
215
216	if (pwd->pw_expire) {
217		warntime = login_getcaptime(lc, "warnexpire",
218		    DEFAULT_WARN, DEFAULT_WARN);
219		if (tp.tv_sec >= pwd->pw_expire) {
220			login_close(lc);
221			return (PAM_ACCT_EXPIRED);
222		} else if (pwd->pw_expire - tp.tv_sec < warntime &&
223		    (flags & PAM_SILENT) == 0) {
224			pam_error(pamh, "Warning: your account expires on %s",
225			    ctime(&pwd->pw_expire));
226		}
227	}
228
229	retval = PAM_SUCCESS;
230	if (pwd->pw_change) {
231		warntime = login_getcaptime(lc, "warnpassword",
232		    DEFAULT_WARN, DEFAULT_WARN);
233		if (tp.tv_sec >= pwd->pw_change) {
234			retval = PAM_NEW_AUTHTOK_REQD;
235		} else if (pwd->pw_change - tp.tv_sec < warntime &&
236		    (flags & PAM_SILENT) == 0) {
237			pam_error(pamh, "Warning: your password expires on %s",
238			    ctime(&pwd->pw_change));
239		}
240	}
241
242	/*
243	 * From here on, we must leave retval untouched (unless we
244	 * know we're going to fail), because we need to remember
245	 * whether we're supposed to return PAM_SUCCESS or
246	 * PAM_NEW_AUTHTOK_REQD.
247	 */
248
249	if (rhost) {
250		memset(&hints, 0, sizeof(hints));
251		hints.ai_family = AF_UNSPEC;
252		if (getaddrinfo(rhost, NULL, &hints, &res) == 0) {
253			getnameinfo(res->ai_addr, res->ai_addrlen,
254			    rhostip, sizeof(rhostip), NULL, 0,
255			    NI_NUMERICHOST|NI_WITHSCOPEID);
256		}
257		if (res != NULL)
258			freeaddrinfo(res);
259	}
260
261	/*
262	 * Check host / tty / time-of-day restrictions
263	 */
264
265	if (!auth_hostok(lc, rhost, rhostip) ||
266	    !auth_ttyok(lc, tty) ||
267	    !auth_timeok(lc, time(NULL)))
268		retval = PAM_AUTH_ERR;
269
270	login_close(lc);
271
272	return (retval);
273}
274
275/*
276 * password management
277 *
278 * standard Unix and NIS password changing
279 */
280PAM_EXTERN int
281pam_sm_chauthtok(pam_handle_t *pamh, int flags,
282    int argc, const char *argv[])
283{
284#ifdef YP
285	struct ypclnt *ypclnt;
286	const char *yp_domain, *yp_server;
287#endif
288	struct options options;
289	char salt[SALTSIZE + 1];
290	login_cap_t * lc;
291	struct passwd *pwd, *old_pwd;
292	const char *user, *old_pass, *new_pass;
293	char *encrypted;
294	int pfd, tfd, retval;
295
296	pam_std_option(&options, other_options, argc, argv);
297
298	PAM_LOG("Options processed");
299
300	if (pam_test_option(&options, PAM_OPT_AUTH_AS_SELF, NULL))
301		pwd = getpwnam(getlogin());
302	else {
303		retval = pam_get_user(pamh, &user, NULL);
304		if (retval != PAM_SUCCESS)
305			return (retval);
306		pwd = getpwnam(user);
307	}
308
309	if (pwd == NULL)
310		return (PAM_AUTHTOK_RECOVERY_ERR);
311
312	PAM_LOG("Got user: %s", user);
313
314	if (flags & PAM_PRELIM_CHECK) {
315
316		PAM_LOG("PRELIM round");
317
318		if (getuid() == 0 &&
319		    (pwd->pw_fields & _PWF_SOURCE) == _PWF_FILES)
320			/* root doesn't need the old password */
321			return (pam_set_item(pamh, PAM_OLDAUTHTOK, ""));
322
323		if (pwd->pw_passwd[0] == '\0'
324		    && pam_test_option(&options, PAM_OPT_NULLOK, NULL)) {
325			/*
326			 * No password case. XXX Are we giving too much away
327			 * by not prompting for a password?
328			 * XXX check PAM_DISALLOW_NULL_AUTHTOK
329			 */
330			old_pass = "";
331		} else {
332			retval = pam_get_authtok(pamh,
333			    PAM_OLDAUTHTOK, &old_pass, NULL);
334			if (retval != PAM_SUCCESS)
335				return (retval);
336		}
337		PAM_LOG("Got old password");
338		/* always encrypt first */
339		encrypted = crypt(old_pass, pwd->pw_passwd);
340		if ((old_pass[0] == '\0' && pwd->pw_passwd[0] != '\0') ||
341		    strcmp(encrypted, pwd->pw_passwd) != 0)
342			return (PAM_PERM_DENIED);
343	}
344	else if (flags & PAM_UPDATE_AUTHTOK) {
345		PAM_LOG("UPDATE round");
346
347		retval = pam_get_authtok(pamh,
348		    PAM_OLDAUTHTOK, &old_pass, NULL);
349		if (retval != PAM_SUCCESS)
350			return (retval);
351		PAM_LOG("Got old password");
352
353		/* get new password */
354		for (;;) {
355			retval = pam_get_authtok(pamh,
356			    PAM_AUTHTOK, &new_pass, NULL);
357			if (retval != PAM_TRY_AGAIN)
358				break;
359			pam_error(pamh, "Mismatch; try again, EOF to quit.");
360		}
361		PAM_LOG("Got new password");
362		if (retval != PAM_SUCCESS) {
363			PAM_VERBOSE_ERROR("Unable to get new password");
364			return (retval);
365		}
366
367		if ((old_pwd = pw_dup(pwd)) == NULL)
368			return (PAM_BUF_ERR);
369
370		pwd->pw_change = 0;
371		lc = login_getclass(NULL);
372		if (login_setcryptfmt(lc, password_hash, NULL) == NULL)
373			openpam_log(PAM_LOG_ERROR,
374			    "can't set password cipher, relying on default");
375		login_close(lc);
376		makesalt(salt);
377		pwd->pw_passwd = crypt(new_pass, salt);
378#ifdef YP
379		switch (old_pwd->pw_fields & _PWF_SOURCE) {
380		case _PWF_FILES:
381#endif
382			retval = PAM_SERVICE_ERR;
383			if (pw_init(NULL, NULL))
384				openpam_log(PAM_LOG_ERROR, "pw_init() failed");
385			else if ((pfd = pw_lock()) == -1)
386				openpam_log(PAM_LOG_ERROR, "pw_lock() failed");
387			else if ((tfd = pw_tmp(-1)) == -1)
388				openpam_log(PAM_LOG_ERROR, "pw_tmp() failed");
389			else if (pw_copy(pfd, tfd, pwd, old_pwd) == -1)
390				openpam_log(PAM_LOG_ERROR, "pw_copy() failed");
391			else if (pw_mkdb(pwd->pw_name) == -1)
392				openpam_log(PAM_LOG_ERROR, "pw_mkdb() failed");
393			else
394				retval = PAM_SUCCESS;
395			pw_fini();
396#ifdef YP
397			break;
398		case _PWF_NIS:
399			yp_domain = yp_server = NULL;
400			(void)pam_get_data(pamh,
401			    "yp_domain", (const void **)&yp_domain);
402			(void)pam_get_data(pamh,
403			    "yp_server", (const void **)&yp_server);
404			ypclnt = ypclnt_new(yp_domain,
405			    "passwd.byname", yp_server);
406			if (ypclnt == NULL) {
407				retval = PAM_BUF_ERR;
408			} else if (ypclnt_connect(ypclnt) == -1 ||
409			    ypclnt_passwd(ypclnt, pwd, old_pass) == -1) {
410				openpam_log(PAM_LOG_ERROR, "%s", ypclnt->error);
411				retval = PAM_SERVICE_ERR;
412			} else {
413				retval = PAM_SUCCESS;
414			}
415			ypclnt_free(ypclnt);
416			break;
417		default:
418			openpam_log(PAM_LOG_ERROR, "unsupported source 0x%x",
419			    pwd->pw_fields & _PWF_SOURCE);
420			retval = PAM_SERVICE_ERR;
421		}
422#endif
423	}
424	else {
425		/* Very bad juju */
426		retval = PAM_ABORT;
427		PAM_LOG("Illegal 'flags'");
428	}
429
430	free(old_pwd);
431	return (retval);
432}
433
434/* Mostly stolen from passwd(1)'s local_passwd.c - markm */
435
436static unsigned char itoa64[] =		/* 0 ... 63 => ascii - 64 */
437	"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
438
439static void
440to64(char *s, long v, int n)
441{
442	while (--n >= 0) {
443		*s++ = itoa64[v&0x3f];
444		v >>= 6;
445	}
446}
447
448/* Salt suitable for traditional DES and MD5 */
449void
450makesalt(char salt[SALTSIZE])
451{
452	int i;
453
454	/* These are not really random numbers, they are just
455	 * numbers that change to thwart construction of a
456	 * dictionary. This is exposed to the public.
457	 */
458	for (i = 0; i < SALTSIZE; i += 4)
459		to64(&salt[i], arc4random(), 4);
460	salt[SALTSIZE] = '\0';
461}
462
463PAM_MODULE_ENTRY("pam_unix");
464