login.c revision 190474
1/*- 2 * Copyright (c) 1980, 1987, 1988, 1991, 1993, 1994 3 * The Regents of the University of California. All rights reserved. 4 * Copyright (c) 2002 Networks Associates Technologies, Inc. 5 * All rights reserved. 6 * 7 * Portions of this software were developed for the FreeBSD Project by 8 * ThinkSec AS and NAI Labs, the Security Research Division of Network 9 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 10 * ("CBOSS"), as part of the DARPA CHATS research program. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. All advertising materials mentioning features or use of this software 21 * must display the following acknowledgement: 22 * This product includes software developed by the University of 23 * California, Berkeley and its contributors. 24 * 4. Neither the name of the University nor the names of its contributors 25 * may be used to endorse or promote products derived from this software 26 * without specific prior written permission. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 29 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 30 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 31 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 32 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 36 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 37 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 38 * SUCH DAMAGE. 39 */ 40 41#if 0 42#ifndef lint 43static char sccsid[] = "@(#)login.c 8.4 (Berkeley) 4/2/94"; 44#endif 45#endif 46 47#include <sys/cdefs.h> 48__FBSDID("$FreeBSD: head/usr.bin/login/login.c 190474 2009-03-27 19:13:36Z ed $"); 49 50/* 51 * login [ name ] 52 * login -h hostname (for telnetd, etc.) 53 * login -f name (for pre-authenticated login: datakit, xterm, etc.) 54 */ 55 56#include <sys/copyright.h> 57#include <sys/param.h> 58#include <sys/file.h> 59#include <sys/stat.h> 60#include <sys/time.h> 61#include <sys/resource.h> 62#include <sys/wait.h> 63 64#include <err.h> 65#include <errno.h> 66#include <grp.h> 67#include <libutil.h> 68#include <login_cap.h> 69#include <pwd.h> 70#include <setjmp.h> 71#include <signal.h> 72#include <stdio.h> 73#include <stdlib.h> 74#include <string.h> 75#include <syslog.h> 76#include <ttyent.h> 77#include <unistd.h> 78 79#include <security/pam_appl.h> 80#include <security/openpam.h> 81 82#include "login.h" 83#include "pathnames.h" 84 85static int auth_pam(void); 86static void bail(int, int); 87static int export(const char *); 88static void export_pam_environment(void); 89static int motd(const char *); 90static void badlogin(char *); 91static char *getloginname(void); 92static void pam_syslog(const char *); 93static void pam_cleanup(void); 94static void refused(const char *, const char *, int); 95static const char *stypeof(char *); 96static void sigint(int); 97static void timedout(int); 98static void usage(void); 99 100#define TTYGRPNAME "tty" /* group to own ttys */ 101#define DEFAULT_BACKOFF 3 102#define DEFAULT_RETRIES 10 103#define DEFAULT_PROMPT "login: " 104#define DEFAULT_PASSWD_PROMPT "Password:" 105#define TERM_UNKNOWN "su" 106#define DEFAULT_WARN (2L * 7L * 86400L) /* Two weeks */ 107#define NO_SLEEP_EXIT 0 108#define SLEEP_EXIT 5 109 110/* 111 * This bounds the time given to login. Not a define so it can 112 * be patched on machines where it's too small. 113 */ 114static u_int timeout = 300; 115 116/* Buffer for signal handling of timeout */ 117static jmp_buf timeout_buf; 118 119struct passwd *pwd; 120static int failures; 121 122static char *envinit[1]; /* empty environment list */ 123 124/* 125 * Command line flags and arguments 126 */ 127static int fflag; /* -f: do not perform authentication */ 128static int hflag; /* -h: login from remote host */ 129static char *hostname; /* hostname from command line */ 130static int pflag; /* -p: preserve environment */ 131 132/* 133 * User name 134 */ 135static char *username; /* user name */ 136static char *olduser; /* previous user name */ 137 138/* 139 * Prompts 140 */ 141static char default_prompt[] = DEFAULT_PROMPT; 142static const char *prompt; 143static char default_passwd_prompt[] = DEFAULT_PASSWD_PROMPT; 144static const char *passwd_prompt; 145 146static char *tty; 147 148/* 149 * PAM data 150 */ 151static pam_handle_t *pamh = NULL; 152static struct pam_conv pamc = { openpam_ttyconv, NULL }; 153static int pam_err; 154static int pam_silent = PAM_SILENT; 155static int pam_cred_established; 156static int pam_session_established; 157 158int 159main(int argc, char *argv[]) 160{ 161 struct group *gr; 162 struct stat st; 163 int retries, backoff; 164 int ask, ch, cnt, quietlog, rootlogin, rval; 165 uid_t uid, euid; 166 gid_t egid; 167 char *term; 168 char *p, *ttyn; 169 char tname[sizeof(_PATH_TTY) + 10]; 170 char *arg0; 171 const char *tp; 172 const char *shell = NULL; 173 login_cap_t *lc = NULL; 174 login_cap_t *lc_user = NULL; 175 pid_t pid; 176#ifdef USE_BSM_AUDIT 177 char auditsuccess = 1; 178#endif 179 180 (void)signal(SIGQUIT, SIG_IGN); 181 (void)signal(SIGINT, SIG_IGN); 182 (void)signal(SIGHUP, SIG_IGN); 183 if (setjmp(timeout_buf)) { 184 if (failures) 185 badlogin(username); 186 (void)fprintf(stderr, "Login timed out after %d seconds\n", 187 timeout); 188 bail(NO_SLEEP_EXIT, 0); 189 } 190 (void)signal(SIGALRM, timedout); 191 (void)alarm(timeout); 192 (void)setpriority(PRIO_PROCESS, 0, 0); 193 194 openlog("login", LOG_ODELAY, LOG_AUTH); 195 196 uid = getuid(); 197 euid = geteuid(); 198 egid = getegid(); 199 200 while ((ch = getopt(argc, argv, "fh:p")) != -1) 201 switch (ch) { 202 case 'f': 203 fflag = 1; 204 break; 205 case 'h': 206 if (uid != 0) 207 errx(1, "-h option: %s", strerror(EPERM)); 208 if (strlen(optarg) >= MAXHOSTNAMELEN) 209 errx(1, "-h option: %s: exceeds maximum " 210 "hostname size", optarg); 211 hflag = 1; 212 hostname = optarg; 213 break; 214 case 'p': 215 pflag = 1; 216 break; 217 case '?': 218 default: 219 if (uid == 0) 220 syslog(LOG_ERR, "invalid flag %c", ch); 221 usage(); 222 } 223 argc -= optind; 224 argv += optind; 225 226 if (argc > 0) { 227 username = strdup(*argv); 228 if (username == NULL) 229 err(1, "strdup()"); 230 ask = 0; 231 } else { 232 ask = 1; 233 } 234 235 setproctitle("-%s", getprogname()); 236 237 for (cnt = getdtablesize(); cnt > 2; cnt--) 238 (void)close(cnt); 239 240 /* 241 * Get current TTY 242 */ 243 ttyn = ttyname(STDIN_FILENO); 244 if (ttyn == NULL || *ttyn == '\0') { 245 (void)snprintf(tname, sizeof(tname), "%s??", _PATH_TTY); 246 ttyn = tname; 247 } 248 if (strncmp(ttyn, _PATH_DEV, sizeof _PATH_DEV - 1) == 0) 249 tty = ttyn + sizeof _PATH_DEV - 1; 250 else 251 tty = ttyn; 252 253 /* 254 * Get "login-retries" & "login-backoff" from default class 255 */ 256 lc = login_getclass(NULL); 257 prompt = login_getcapstr(lc, "login_prompt", 258 default_prompt, default_prompt); 259 passwd_prompt = login_getcapstr(lc, "passwd_prompt", 260 default_passwd_prompt, default_passwd_prompt); 261 retries = login_getcapnum(lc, "login-retries", 262 DEFAULT_RETRIES, DEFAULT_RETRIES); 263 backoff = login_getcapnum(lc, "login-backoff", 264 DEFAULT_BACKOFF, DEFAULT_BACKOFF); 265 login_close(lc); 266 lc = NULL; 267 268 /* 269 * Try to authenticate the user until we succeed or time out. 270 */ 271 for (cnt = 0;; ask = 1) { 272 if (ask) { 273 fflag = 0; 274 if (olduser != NULL) 275 free(olduser); 276 olduser = username; 277 username = getloginname(); 278 } 279 rootlogin = 0; 280 281 /* 282 * Note if trying multiple user names; log failures for 283 * previous user name, but don't bother logging one failure 284 * for nonexistent name (mistyped username). 285 */ 286 if (failures && strcmp(olduser, username) != 0) { 287 if (failures > (pwd ? 0 : 1)) 288 badlogin(olduser); 289 } 290 291 /* 292 * Load the PAM policy and set some variables 293 */ 294 pam_err = pam_start("login", username, &pamc, &pamh); 295 if (pam_err != PAM_SUCCESS) { 296 pam_syslog("pam_start()"); 297#ifdef USE_BSM_AUDIT 298 au_login_fail("PAM Error", 1); 299#endif 300 bail(NO_SLEEP_EXIT, 1); 301 } 302 pam_err = pam_set_item(pamh, PAM_TTY, tty); 303 if (pam_err != PAM_SUCCESS) { 304 pam_syslog("pam_set_item(PAM_TTY)"); 305#ifdef USE_BSM_AUDIT 306 au_login_fail("PAM Error", 1); 307#endif 308 bail(NO_SLEEP_EXIT, 1); 309 } 310 pam_err = pam_set_item(pamh, PAM_RHOST, hostname); 311 if (pam_err != PAM_SUCCESS) { 312 pam_syslog("pam_set_item(PAM_RHOST)"); 313#ifdef USE_BSM_AUDIT 314 au_login_fail("PAM Error", 1); 315#endif 316 bail(NO_SLEEP_EXIT, 1); 317 } 318 319 pwd = getpwnam(username); 320 if (pwd != NULL && pwd->pw_uid == 0) 321 rootlogin = 1; 322 323 /* 324 * If the -f option was specified and the caller is 325 * root or the caller isn't changing their uid, don't 326 * authenticate. 327 */ 328 if (pwd != NULL && fflag && 329 (uid == (uid_t)0 || uid == (uid_t)pwd->pw_uid)) { 330 /* already authenticated */ 331 rval = 0; 332#ifdef USE_BSM_AUDIT 333 auditsuccess = 0; /* opened a terminal window only */ 334#endif 335 } else { 336 fflag = 0; 337 (void)setpriority(PRIO_PROCESS, 0, -4); 338 rval = auth_pam(); 339 (void)setpriority(PRIO_PROCESS, 0, 0); 340 } 341 342 if (pwd && rval == 0) 343 break; 344 345 pam_cleanup(); 346 347 /* 348 * We are not exiting here, but this corresponds to a failed 349 * login event, so set exitstatus to 1. 350 */ 351#ifdef USE_BSM_AUDIT 352 au_login_fail("Login incorrect", 1); 353#endif 354 355 (void)printf("Login incorrect\n"); 356 failures++; 357 358 pwd = NULL; 359 360 /* 361 * Allow up to 'retry' (10) attempts, but start 362 * backing off after 'backoff' (3) attempts. 363 */ 364 if (++cnt > backoff) { 365 if (cnt >= retries) { 366 badlogin(username); 367 bail(SLEEP_EXIT, 1); 368 } 369 sleep((u_int)((cnt - backoff) * 5)); 370 } 371 } 372 373 /* committed to login -- turn off timeout */ 374 (void)alarm((u_int)0); 375 (void)signal(SIGHUP, SIG_DFL); 376 377 endpwent(); 378 379#ifdef USE_BSM_AUDIT 380 /* Audit successful login. */ 381 if (auditsuccess) 382 au_login_success(); 383#endif 384 385 /* 386 * Establish the login class. 387 */ 388 lc = login_getpwclass(pwd); 389 lc_user = login_getuserclass(pwd); 390 391 if (!(quietlog = login_getcapbool(lc_user, "hushlogin", 0))) 392 quietlog = login_getcapbool(lc, "hushlogin", 0); 393 394 /* 395 * Switching needed for NFS with root access disabled. 396 * 397 * XXX: This change fails to modify the additional groups for the 398 * process, and as such, may restrict rights normally granted 399 * through those groups. 400 */ 401 (void)setegid(pwd->pw_gid); 402 (void)seteuid(rootlogin ? 0 : pwd->pw_uid); 403 if (!*pwd->pw_dir || chdir(pwd->pw_dir) < 0) { 404 if (login_getcapbool(lc, "requirehome", 0)) 405 refused("Home directory not available", "HOMEDIR", 1); 406 if (chdir("/") < 0) 407 refused("Cannot find root directory", "ROOTDIR", 1); 408 if (!quietlog || *pwd->pw_dir) 409 printf("No home directory.\nLogging in with home = \"/\".\n"); 410 pwd->pw_dir = strdup("/"); 411 if (pwd->pw_dir == NULL) { 412 syslog(LOG_NOTICE, "strdup(): %m"); 413 bail(SLEEP_EXIT, 1); 414 } 415 } 416 (void)seteuid(euid); 417 (void)setegid(egid); 418 if (!quietlog) { 419 quietlog = access(_PATH_HUSHLOGIN, F_OK) == 0; 420 if (!quietlog) 421 pam_silent = 0; 422 } 423 424 shell = login_getcapstr(lc, "shell", pwd->pw_shell, pwd->pw_shell); 425 if (*pwd->pw_shell == '\0') 426 pwd->pw_shell = strdup(_PATH_BSHELL); 427 if (pwd->pw_shell == NULL) { 428 syslog(LOG_NOTICE, "strdup(): %m"); 429 bail(SLEEP_EXIT, 1); 430 } 431 if (*shell == '\0') /* Not overridden */ 432 shell = pwd->pw_shell; 433 if ((shell = strdup(shell)) == NULL) { 434 syslog(LOG_NOTICE, "strdup(): %m"); 435 bail(SLEEP_EXIT, 1); 436 } 437 438 /* 439 * Set device protections, depending on what terminal the 440 * user is logged in. This feature is used on Suns to give 441 * console users better privacy. 442 */ 443 login_fbtab(tty, pwd->pw_uid, pwd->pw_gid); 444 445 /* 446 * Clear flags of the tty. None should be set, and when the 447 * user sets them otherwise, this can cause the chown to fail. 448 * Since it isn't clear that flags are useful on character 449 * devices, we just clear them. 450 * 451 * We don't log in the case of EOPNOTSUPP because dev might be 452 * on NFS, which doesn't support chflags. 453 * 454 * We don't log in the EROFS because that means that /dev is on 455 * a read only file system and we assume that the permissions there 456 * are sane. 457 */ 458 if (ttyn != tname && chflags(ttyn, 0)) 459 if (errno != EOPNOTSUPP && errno != EROFS) 460 syslog(LOG_ERR, "chflags(%s): %m", ttyn); 461 if (ttyn != tname && chown(ttyn, pwd->pw_uid, 462 (gr = getgrnam(TTYGRPNAME)) ? gr->gr_gid : pwd->pw_gid)) 463 if (errno != EROFS) 464 syslog(LOG_ERR, "chown(%s): %m", ttyn); 465 466 /* 467 * Exclude cons/vt/ptys only, assume dialup otherwise 468 * TODO: Make dialup tty determination a library call 469 * for consistency (finger etc.) 470 */ 471 if (hflag && isdialuptty(tty)) 472 syslog(LOG_INFO, "DIALUP %s, %s", tty, pwd->pw_name); 473 474#ifdef LOGALL 475 /* 476 * Syslog each successful login, so we don't have to watch 477 * hundreds of wtmp or lastlogin files. 478 */ 479 if (hflag) 480 syslog(LOG_INFO, "login from %s on %s as %s", 481 hostname, tty, pwd->pw_name); 482 else 483 syslog(LOG_INFO, "login on %s as %s", 484 tty, pwd->pw_name); 485#endif 486 487 /* 488 * If fflag is on, assume caller/authenticator has logged root 489 * login. 490 */ 491 if (rootlogin && fflag == 0) { 492 if (hflag) 493 syslog(LOG_NOTICE, "ROOT LOGIN (%s) ON %s FROM %s", 494 username, tty, hostname); 495 else 496 syslog(LOG_NOTICE, "ROOT LOGIN (%s) ON %s", 497 username, tty); 498 } 499 500 /* 501 * Destroy environment unless user has requested its 502 * preservation - but preserve TERM in all cases 503 */ 504 term = getenv("TERM"); 505 if (!pflag) 506 environ = envinit; 507 if (term != NULL) 508 setenv("TERM", term, 0); 509 510 /* 511 * PAM modules might add supplementary groups during pam_setcred(). 512 */ 513 if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) != 0) { 514 syslog(LOG_ERR, "setusercontext() failed - exiting"); 515 bail(NO_SLEEP_EXIT, 1); 516 } 517 518 pam_err = pam_setcred(pamh, pam_silent|PAM_ESTABLISH_CRED); 519 if (pam_err != PAM_SUCCESS) { 520 pam_syslog("pam_setcred()"); 521 bail(NO_SLEEP_EXIT, 1); 522 } 523 pam_cred_established = 1; 524 525 pam_err = pam_open_session(pamh, pam_silent); 526 if (pam_err != PAM_SUCCESS) { 527 pam_syslog("pam_open_session()"); 528 bail(NO_SLEEP_EXIT, 1); 529 } 530 pam_session_established = 1; 531 532 /* 533 * We must fork() before setuid() because we need to call 534 * pam_close_session() as root. 535 */ 536 pid = fork(); 537 if (pid < 0) { 538 err(1, "fork"); 539 } else if (pid != 0) { 540 /* 541 * Parent: wait for child to finish, then clean up 542 * session. 543 */ 544 int status; 545 setproctitle("-%s [pam]", getprogname()); 546 waitpid(pid, &status, 0); 547 bail(NO_SLEEP_EXIT, 0); 548 } 549 550 /* 551 * NOTICE: We are now in the child process! 552 */ 553 554 /* 555 * Add any environment variables the PAM modules may have set. 556 */ 557 export_pam_environment(); 558 559 /* 560 * We're done with PAM now; our parent will deal with the rest. 561 */ 562 pam_end(pamh, 0); 563 pamh = NULL; 564 565 /* 566 * We don't need to be root anymore, so set the login name and 567 * the UID. 568 */ 569 if (setlogin(username) != 0) { 570 syslog(LOG_ERR, "setlogin(%s): %m - exiting", username); 571 bail(NO_SLEEP_EXIT, 1); 572 } 573 if (setusercontext(lc, pwd, pwd->pw_uid, 574 LOGIN_SETALL & ~(LOGIN_SETLOGIN|LOGIN_SETGROUP)) != 0) { 575 syslog(LOG_ERR, "setusercontext() failed - exiting"); 576 exit(1); 577 } 578 579 (void)setenv("SHELL", pwd->pw_shell, 1); 580 (void)setenv("HOME", pwd->pw_dir, 1); 581 /* Overwrite "term" from login.conf(5) for any known TERM */ 582 if (term == NULL && (tp = stypeof(tty)) != NULL) 583 (void)setenv("TERM", tp, 1); 584 else 585 (void)setenv("TERM", TERM_UNKNOWN, 0); 586 (void)setenv("LOGNAME", username, 1); 587 (void)setenv("USER", username, 1); 588 (void)setenv("PATH", rootlogin ? _PATH_STDPATH : _PATH_DEFPATH, 0); 589 590 if (!quietlog) { 591 const char *cw; 592 593 cw = login_getcapstr(lc, "copyright", NULL, NULL); 594 if (cw == NULL || motd(cw) == -1) 595 (void)printf("%s", copyright); 596 597 (void)printf("\n"); 598 599 cw = login_getcapstr(lc, "welcome", NULL, NULL); 600 if (cw != NULL && access(cw, F_OK) == 0) 601 motd(cw); 602 else 603 motd(_PATH_MOTDFILE); 604 605 if (login_getcapbool(lc_user, "nocheckmail", 0) == 0 && 606 login_getcapbool(lc, "nocheckmail", 0) == 0) { 607 char *cx; 608 609 /* $MAIL may have been set by class. */ 610 cx = getenv("MAIL"); 611 if (cx == NULL) { 612 asprintf(&cx, "%s/%s", 613 _PATH_MAILDIR, pwd->pw_name); 614 } 615 if (cx && stat(cx, &st) == 0 && st.st_size != 0) 616 (void)printf("You have %smail.\n", 617 (st.st_mtime > st.st_atime) ? "new " : ""); 618 if (getenv("MAIL") == NULL) 619 free(cx); 620 } 621 } 622 623 login_close(lc_user); 624 login_close(lc); 625 626 (void)signal(SIGALRM, SIG_DFL); 627 (void)signal(SIGQUIT, SIG_DFL); 628 (void)signal(SIGINT, SIG_DFL); 629 (void)signal(SIGTSTP, SIG_IGN); 630 631 /* 632 * Login shells have a leading '-' in front of argv[0] 633 */ 634 p = strrchr(pwd->pw_shell, '/'); 635 if (asprintf(&arg0, "-%s", p ? p + 1 : pwd->pw_shell) >= MAXPATHLEN) { 636 syslog(LOG_ERR, "user: %s: shell exceeds maximum pathname size", 637 username); 638 errx(1, "shell exceeds maximum pathname size"); 639 } else if (arg0 == NULL) { 640 err(1, "asprintf()"); 641 } 642 643 execlp(shell, arg0, (char *)0); 644 err(1, "%s", shell); 645 646 /* 647 * That's it, folks! 648 */ 649} 650 651/* 652 * Attempt to authenticate the user using PAM. Returns 0 if the user is 653 * authenticated, or 1 if not authenticated. If some sort of PAM system 654 * error occurs (e.g., the "/etc/pam.conf" file is missing) then this 655 * function returns -1. This can be used as an indication that we should 656 * fall back to a different authentication mechanism. 657 */ 658static int 659auth_pam(void) 660{ 661 const char *tmpl_user; 662 const void *item; 663 int rval; 664 665 pam_err = pam_authenticate(pamh, pam_silent); 666 switch (pam_err) { 667 668 case PAM_SUCCESS: 669 /* 670 * With PAM we support the concept of a "template" 671 * user. The user enters a login name which is 672 * authenticated by PAM, usually via a remote service 673 * such as RADIUS or TACACS+. If authentication 674 * succeeds, a different but related "template" name 675 * is used for setting the credentials, shell, and 676 * home directory. The name the user enters need only 677 * exist on the remote authentication server, but the 678 * template name must be present in the local password 679 * database. 680 * 681 * This is supported by two various mechanisms in the 682 * individual modules. However, from the application's 683 * point of view, the template user is always passed 684 * back as a changed value of the PAM_USER item. 685 */ 686 pam_err = pam_get_item(pamh, PAM_USER, &item); 687 if (pam_err == PAM_SUCCESS) { 688 tmpl_user = (const char *)item; 689 if (strcmp(username, tmpl_user) != 0) 690 pwd = getpwnam(tmpl_user); 691 } else { 692 pam_syslog("pam_get_item(PAM_USER)"); 693 } 694 rval = 0; 695 break; 696 697 case PAM_AUTH_ERR: 698 case PAM_USER_UNKNOWN: 699 case PAM_MAXTRIES: 700 rval = 1; 701 break; 702 703 default: 704 pam_syslog("pam_authenticate()"); 705 rval = -1; 706 break; 707 } 708 709 if (rval == 0) { 710 pam_err = pam_acct_mgmt(pamh, pam_silent); 711 switch (pam_err) { 712 case PAM_SUCCESS: 713 break; 714 case PAM_NEW_AUTHTOK_REQD: 715 pam_err = pam_chauthtok(pamh, 716 pam_silent|PAM_CHANGE_EXPIRED_AUTHTOK); 717 if (pam_err != PAM_SUCCESS) { 718 pam_syslog("pam_chauthtok()"); 719 rval = 1; 720 } 721 break; 722 default: 723 pam_syslog("pam_acct_mgmt()"); 724 rval = 1; 725 break; 726 } 727 } 728 729 if (rval != 0) { 730 pam_end(pamh, pam_err); 731 pamh = NULL; 732 } 733 return (rval); 734} 735 736/* 737 * Export any environment variables PAM modules may have set 738 */ 739static void 740export_pam_environment() 741{ 742 char **pam_env; 743 char **pp; 744 745 pam_env = pam_getenvlist(pamh); 746 if (pam_env != NULL) { 747 for (pp = pam_env; *pp != NULL; pp++) { 748 (void)export(*pp); 749 free(*pp); 750 } 751 } 752} 753 754/* 755 * Perform sanity checks on an environment variable: 756 * - Make sure there is an '=' in the string. 757 * - Make sure the string doesn't run on too long. 758 * - Do not export certain variables. This list was taken from the 759 * Solaris pam_putenv(3) man page. 760 * Then export it. 761 */ 762static int 763export(const char *s) 764{ 765 static const char *noexport[] = { 766 "SHELL", "HOME", "LOGNAME", "MAIL", "CDPATH", 767 "IFS", "PATH", NULL 768 }; 769 char *p; 770 const char **pp; 771 size_t n; 772 773 if (strlen(s) > 1024 || (p = strchr(s, '=')) == NULL) 774 return (0); 775 if (strncmp(s, "LD_", 3) == 0) 776 return (0); 777 for (pp = noexport; *pp != NULL; pp++) { 778 n = strlen(*pp); 779 if (s[n] == '=' && strncmp(s, *pp, n) == 0) 780 return (0); 781 } 782 *p = '\0'; 783 (void)setenv(s, p + 1, 1); 784 *p = '='; 785 return (1); 786} 787 788static void 789usage() 790{ 791 792 (void)fprintf(stderr, "usage: login [-fp] [-h hostname] [username]\n"); 793 exit(1); 794} 795 796/* 797 * Prompt user and read login name from stdin. 798 */ 799static char * 800getloginname() 801{ 802 char *nbuf, *p; 803 int ch; 804 805 nbuf = malloc(MAXLOGNAME); 806 if (nbuf == NULL) 807 err(1, "malloc()"); 808 do { 809 (void)printf("%s", prompt); 810 for (p = nbuf; (ch = getchar()) != '\n'; ) { 811 if (ch == EOF) { 812 badlogin(username); 813 bail(NO_SLEEP_EXIT, 0); 814 } 815 if (p < nbuf + MAXLOGNAME - 1) 816 *p++ = ch; 817 } 818 } while (p == nbuf); 819 820 *p = '\0'; 821 if (nbuf[0] == '-') { 822 pam_silent = 0; 823 memmove(nbuf, nbuf + 1, strlen(nbuf)); 824 } else { 825 pam_silent = PAM_SILENT; 826 } 827 return nbuf; 828} 829 830/* 831 * SIGINT handler for motd(). 832 */ 833static volatile int motdinterrupt; 834static void 835sigint(int signo __unused) 836{ 837 motdinterrupt = 1; 838} 839 840/* 841 * Display the contents of a file (such as /etc/motd). 842 */ 843static int 844motd(const char *motdfile) 845{ 846 sig_t oldint; 847 FILE *f; 848 int ch; 849 850 if ((f = fopen(motdfile, "r")) == NULL) 851 return (-1); 852 motdinterrupt = 0; 853 oldint = signal(SIGINT, sigint); 854 while ((ch = fgetc(f)) != EOF && !motdinterrupt) 855 putchar(ch); 856 signal(SIGINT, oldint); 857 if (ch != EOF || ferror(f)) { 858 fclose(f); 859 return (-1); 860 } 861 fclose(f); 862 return (0); 863} 864 865/* 866 * SIGALRM handler, to enforce login prompt timeout. 867 * 868 * XXX This can potentially confuse the hell out of PAM. We should 869 * XXX instead implement a conversation function that returns 870 * XXX PAM_CONV_ERR when interrupted by a signal, and have the signal 871 * XXX handler just set a flag. 872 */ 873static void 874timedout(int signo __unused) 875{ 876 877 longjmp(timeout_buf, signo); 878} 879 880static void 881badlogin(char *name) 882{ 883 884 if (failures == 0) 885 return; 886 if (hflag) { 887 syslog(LOG_NOTICE, "%d LOGIN FAILURE%s FROM %s", 888 failures, failures > 1 ? "S" : "", hostname); 889 syslog(LOG_AUTHPRIV|LOG_NOTICE, 890 "%d LOGIN FAILURE%s FROM %s, %s", 891 failures, failures > 1 ? "S" : "", hostname, name); 892 } else { 893 syslog(LOG_NOTICE, "%d LOGIN FAILURE%s ON %s", 894 failures, failures > 1 ? "S" : "", tty); 895 syslog(LOG_AUTHPRIV|LOG_NOTICE, 896 "%d LOGIN FAILURE%s ON %s, %s", 897 failures, failures > 1 ? "S" : "", tty, name); 898 } 899 failures = 0; 900} 901 902const char * 903stypeof(char *ttyid) 904{ 905 struct ttyent *t; 906 907 if (ttyid != NULL && *ttyid != '\0') { 908 t = getttynam(ttyid); 909 if (t != NULL && t->ty_type != NULL) 910 return (t->ty_type); 911 } 912 return (NULL); 913} 914 915static void 916refused(const char *msg, const char *rtype, int lout) 917{ 918 919 if (msg != NULL) 920 printf("%s.\n", msg); 921 if (hflag) 922 syslog(LOG_NOTICE, "LOGIN %s REFUSED (%s) FROM %s ON TTY %s", 923 pwd->pw_name, rtype, hostname, tty); 924 else 925 syslog(LOG_NOTICE, "LOGIN %s REFUSED (%s) ON TTY %s", 926 pwd->pw_name, rtype, tty); 927 if (lout) 928 bail(SLEEP_EXIT, 1); 929} 930 931/* 932 * Log a PAM error 933 */ 934static void 935pam_syslog(const char *msg) 936{ 937 syslog(LOG_ERR, "%s: %s", msg, pam_strerror(pamh, pam_err)); 938} 939 940/* 941 * Shut down PAM 942 */ 943static void 944pam_cleanup() 945{ 946 947 if (pamh != NULL) { 948 if (pam_session_established) { 949 pam_err = pam_close_session(pamh, 0); 950 if (pam_err != PAM_SUCCESS) 951 pam_syslog("pam_close_session()"); 952 } 953 pam_session_established = 0; 954 if (pam_cred_established) { 955 pam_err = pam_setcred(pamh, pam_silent|PAM_DELETE_CRED); 956 if (pam_err != PAM_SUCCESS) 957 pam_syslog("pam_setcred()"); 958 } 959 pam_cred_established = 0; 960 pam_end(pamh, pam_err); 961 pamh = NULL; 962 } 963} 964 965/* 966 * Exit, optionally after sleeping a few seconds 967 */ 968void 969bail(int sec, int eval) 970{ 971 972 pam_cleanup(); 973#ifdef USE_BSM_AUDIT 974 if (pwd != NULL) 975 audit_logout(); 976#endif 977 (void)sleep(sec); 978 exit(eval); 979} 980