1/*	$NetBSD: pam_passwd.c,v 1.5 2010/03/02 16:19:13 gdt Exp $	*/
2
3/*-
4 * Copyright (c) 2002 Networks Associates Technologies, Inc.
5 * All rights reserved.
6 *
7 * This software was developed for the FreeBSD Project by ThinkSec AS and
8 * NAI Labs, the Security Research Division of Network Associates, Inc.
9 * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
10 * DARPA CHATS research program.
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 *    notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 *    notice, this list of conditions and the following disclaimer in the
19 *    documentation and/or other materials provided with the distribution.
20 * 3. The name of the author may not be used to endorse or promote
21 *    products derived from this software without specific prior written
22 *    permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37#include <sys/cdefs.h>
38#ifdef __FreeBSD__
39__FBSDID("$FreeBSD: src/usr.bin/passwd/passwd.c,v 1.23 2003/04/18 21:27:09 nectar Exp $");
40#else
41__RCSID("$NetBSD: pam_passwd.c,v 1.5 2010/03/02 16:19:13 gdt Exp $");
42#endif
43
44#include <sys/param.h>
45
46#include <err.h>
47#include <pwd.h>
48#include <stdio.h>
49#include <stdlib.h>
50#include <syslog.h>
51#include <unistd.h>
52
53#include "extern.h"
54
55#include <security/pam_appl.h>
56#include <security/openpam.h>
57
58static pam_handle_t *pamh;
59static struct pam_conv pamc = {
60	openpam_ttyconv,
61	NULL
62};
63
64#define	pam_check(msg)							\
65do {									\
66	if (pam_err != PAM_SUCCESS) {					\
67		warnx("%s: %s", (msg), pam_strerror(pamh, pam_err));	\
68		goto end;						\
69	}								\
70} while (/*CONSTCOND*/0)
71
72void
73pwpam_process(const char *username, int argc, char **argv)
74{
75	int ch, pam_err;
76	char hostname[MAXHOSTNAMELEN + 1];
77
78	/* details about the invoking user for logging */
79	const uid_t i_uid = getuid();
80	const struct passwd *const i_pwd = getpwuid(i_uid);
81	const char *const i_username = (i_pwd && i_pwd->pw_name)
82		? i_pwd->pw_name : "(null)";
83
84	while ((ch = getopt(argc, argv, "")) != -1) {
85		switch (ch) {
86		default:
87			usage();
88			/* NOTREACHED */
89		}
90	}
91
92	argc -= optind;
93	argv += optind;
94
95	switch (argc) {
96	case 0:
97		/* username already provided */
98		break;
99	case 1:
100		username = argv[0];
101		break;
102	default:
103		usage();
104		/* NOTREACHED */
105	}
106
107	(void)printf("Changing password for %s.\n", username);
108
109	/* initialize PAM -- always use the program name "passwd" */
110	pam_err = pam_start("passwd", username, &pamc, &pamh);
111	if (pam_err != PAM_SUCCESS)
112		errx(1, "unable to start PAM session: %s",
113		    pam_strerror(NULL, pam_err));
114
115	pam_err = pam_set_item(pamh, PAM_TTY, ttyname(STDERR_FILENO));
116	pam_check("unable to set TTY");
117
118	(void)gethostname(hostname, sizeof hostname);
119	pam_err = pam_set_item(pamh, PAM_RHOST, hostname);
120	pam_check("unable to set RHOST");
121
122	pam_err = pam_set_item(pamh, PAM_RUSER, getlogin());
123	pam_check("unable to set RUSER");
124
125	/* set new password */
126	pam_err = pam_chauthtok(pamh, 0);
127	if (pam_err != PAM_SUCCESS) {
128		if (pam_err == PAM_PERM_DENIED) {
129			syslog(LOG_AUTH | LOG_NOTICE,
130			       "user %s (UID %lu) failed to change the "
131			       "PAM authentication token of user %s: %s",
132			       i_username, (unsigned long)i_uid, username,
133			       pam_strerror(pamh, pam_err));
134		}
135		printf("Unable to change auth token: %s\n",
136		    pam_strerror(pamh, pam_err));
137	} else {
138		syslog(LOG_AUTH | LOG_INFO,
139		       "user %s (UID %lu) successfully changed the "
140		       "PAM authentication token of user %s",
141		       i_username, (unsigned long)i_uid, username);
142	}
143
144 end:
145	pam_end(pamh, pam_err);
146	if (pam_err == PAM_SUCCESS)
147		return;
148	exit(1);
149}
150