1 /* $OpenBSD: auth-rsa.c,v 1.80 2011/05/23 03:30:07 djm Exp $ */ 2 /* 3 * Author: Tatu Ylonen <ylo (at) cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo (at) cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * RSA-based authentication. This code determines whether to admit a login 7 * based on RSA authentication. This file also contains functions to check 8 * validity of the host key. 9 * 10 * As far as I am concerned, the code I have written for this software 11 * can be used freely for any purpose. Any derived versions of this 12 * software must be clearly marked as such, and if the derived work is 13 * incompatible with the protocol description in the RFC file, it must be 14 * called by a name other than "ssh" or "Secure Shell". 15 */ 16 17 #include "includes.h" 18 19 #include <sys/types.h> 20 #include <sys/stat.h> 21 22 #include <openssl/rsa.h> 23 #include <openssl/md5.h> 24 25 #include <pwd.h> 26 #include <stdio.h> 27 #include <stdarg.h> 28 #include <string.h> 29 30 #include "xmalloc.h" 31 #include "rsa.h" 32 #include "packet.h" 33 #include "ssh1.h" 34 #include "uidswap.h" 35 #include "match.h" 36 #include "buffer.h" 37 #include "pathnames.h" 38 #include "log.h" 39 #include "servconf.h" 40 #include "key.h" 41 #include "auth-options.h" 42 #include "hostfile.h" 43 #include "auth.h" 44 #ifdef GSSAPI 45 #include "ssh-gss.h" 46 #endif 47 #include "monitor_wrap.h" 48 #include "ssh.h" 49 #include "misc.h" 50 51 /* import */ 52 extern ServerOptions options; 53 54 /* 55 * Session identifier that is used to bind key exchange and authentication 56 * responses to a particular session. 57 */ 58 extern u_char session_id[16]; 59 60 /* 61 * The .ssh/authorized_keys file contains public keys, one per line, in the 62 * following format: 63 * options bits e n comment 64 * where bits, e and n are decimal numbers, 65 * and comment is any string of characters up to newline. The maximum 66 * length of a line is SSH_MAX_PUBKEY_BYTES characters. See sshd(8) for a 67 * description of the options. 68 */ 69 70 BIGNUM * 71 auth_rsa_generate_challenge(Key *key) 72 { 73 BIGNUM *challenge; 74 BN_CTX *ctx; 75 76 if ((challenge = BN_new()) == NULL) 77 fatal("auth_rsa_generate_challenge: BN_new() failed"); 78 /* Generate a random challenge. */ 79 if (BN_rand(challenge, 256, 0, 0) == 0) 80 fatal("auth_rsa_generate_challenge: BN_rand failed"); 81 if ((ctx = BN_CTX_new()) == NULL) 82 fatal("auth_rsa_generate_challenge: BN_CTX_new failed"); 83 if (BN_mod(challenge, challenge, key->rsa->n, ctx) == 0) 84 fatal("auth_rsa_generate_challenge: BN_mod failed"); 85 BN_CTX_free(ctx); 86 87 return challenge; 88 } 89 90 int 91 auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16]) 92 { 93 u_char buf[32], mdbuf[16]; 94 MD5_CTX md; 95 int len; 96 97 /* don't allow short keys */ 98 if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { 99 error("auth_rsa_verify_response: RSA modulus too small: %d < minimum %d bits", 100 BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE); 101 return (0); 102 } 103 104 /* The response is MD5 of decrypted challenge plus session id. */ 105 len = BN_num_bytes(challenge); 106 if (len <= 0 || len > 32) 107 fatal("auth_rsa_verify_response: bad challenge length %d", len); 108 memset(buf, 0, 32); 109 BN_bn2bin(challenge, buf + 32 - len); 110 MD5_Init(&md); 111 MD5_Update(&md, buf, 32); 112 MD5_Update(&md, session_id, 16); 113 MD5_Final(mdbuf, &md); 114 115 /* Verify that the response is the original challenge. */ 116 if (timingsafe_bcmp(response, mdbuf, 16) != 0) { 117 /* Wrong answer. */ 118 return (0); 119 } 120 /* Correct answer. */ 121 return (1); 122 } 123 124 /* 125 * Performs the RSA authentication challenge-response dialog with the client, 126 * and returns true (non-zero) if the client gave the correct answer to 127 * our challenge; returns zero if the client gives a wrong answer. 128 */ 129 130 int 131 auth_rsa_challenge_dialog(Key *key) 132 { 133 BIGNUM *challenge, *encrypted_challenge; 134 u_char response[16]; 135 int i, success; 136 137 if ((encrypted_challenge = BN_new()) == NULL) 138 fatal("auth_rsa_challenge_dialog: BN_new() failed"); 139 140 challenge = PRIVSEP(auth_rsa_generate_challenge(key)); 141 142 /* Encrypt the challenge with the public key. */ 143 rsa_public_encrypt(encrypted_challenge, challenge, key->rsa); 144 145 /* Send the encrypted challenge to the client. */ 146 packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE); 147 packet_put_bignum(encrypted_challenge); 148 packet_send(); 149 BN_clear_free(encrypted_challenge); 150 packet_write_wait(); 151 152 /* Wait for a response. */ 153 packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE); 154 for (i = 0; i < 16; i++) 155 response[i] = (u_char)packet_get_char(); 156 packet_check_eom(); 157 158 success = PRIVSEP(auth_rsa_verify_response(key, challenge, response)); 159 BN_clear_free(challenge); 160 return (success); 161 } 162 163 static int 164 rsa_key_allowed_in_file(struct passwd *pw, char *file, 165 const BIGNUM *client_n, Key **rkey) 166 { 167 char line[SSH_MAX_PUBKEY_BYTES]; 168 int allowed = 0; 169 u_int bits; 170 FILE *f; 171 u_long linenum = 0; 172 Key *key; 173 174 debug("trying public RSA key file %s", file); 175 if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL) 176 return 0; 177 178 /* 179 * Go though the accepted keys, looking for the current key. If 180 * found, perform a challenge-response dialog to verify that the 181 * user really has the corresponding private key. 182 */ 183 key = key_new(KEY_RSA1); 184 while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { 185 char *cp; 186 char *key_options; 187 int keybits; 188 189 /* Skip leading whitespace, empty and comment lines. */ 190 for (cp = line; *cp == ' ' || *cp == '\t'; cp++) 191 ; 192 if (!*cp || *cp == '\n' || *cp == '#') 193 continue; 194 195 /* 196 * Check if there are options for this key, and if so, 197 * save their starting address and skip the option part 198 * for now. If there are no options, set the starting 199 * address to NULL. 200 */ 201 if (*cp < '0' || *cp > '9') { 202 int quoted = 0; 203 key_options = cp; 204 for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { 205 if (*cp == '\\' && cp[1] == '"') 206 cp++; /* Skip both */ 207 else if (*cp == '"') 208 quoted = !quoted; 209 } 210 } else 211 key_options = NULL; 212 213 /* Parse the key from the line. */ 214 if (hostfile_read_key(&cp, &bits, key) == 0) { 215 debug("%.100s, line %lu: non ssh1 key syntax", 216 file, linenum); 217 continue; 218 } 219 /* cp now points to the comment part. */ 220 221 /* 222 * Check if the we have found the desired key (identified 223 * by its modulus). 224 */ 225 if (BN_cmp(key->rsa->n, client_n) != 0) 226 continue; 227 228 /* check the real bits */ 229 keybits = BN_num_bits(key->rsa->n); 230 if (keybits < 0 || bits != (u_int)keybits) 231 logit("Warning: %s, line %lu: keysize mismatch: " 232 "actual %d vs. announced %d.", 233 file, linenum, BN_num_bits(key->rsa->n), bits); 234 235 /* Never accept a revoked key */ 236 if (auth_key_is_revoked(key)) 237 break; 238 239 /* We have found the desired key. */ 240 /* 241 * If our options do not allow this key to be used, 242 * do not send challenge. 243 */ 244 if (!auth_parse_options(pw, key_options, file, linenum)) 245 continue; 246 if (key_is_cert_authority) 247 continue; 248 /* break out, this key is allowed */ 249 allowed = 1; 250 break; 251 } 252 253 /* Close the file. */ 254 fclose(f); 255 256 /* return key if allowed */ 257 if (allowed && rkey != NULL) 258 *rkey = key; 259 else 260 key_free(key); 261 262 return allowed; 263 } 264 265 /* 266 * check if there's user key matching client_n, 267 * return key if login is allowed, NULL otherwise 268 */ 269 270 int 271 auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) 272 { 273 char *file; 274 u_int i, allowed = 0; 275 276 temporarily_use_uid(pw); 277 278 for (i = 0; !allowed && i < options.num_authkeys_files; i++) { 279 file = expand_authorized_keys( 280 options.authorized_keys_files[i], pw); 281 allowed = rsa_key_allowed_in_file(pw, file, client_n, rkey); 282 xfree(file); 283 } 284 285 restore_uid(); 286 287 return allowed; 288 } 289 290 /* 291 * Performs the RSA authentication dialog with the client. This returns 292 * 0 if the client could not be authenticated, and 1 if authentication was 293 * successful. This may exit if there is a serious protocol violation. 294 */ 295 int 296 auth_rsa(Authctxt *authctxt, BIGNUM *client_n) 297 { 298 Key *key; 299 char *fp; 300 struct passwd *pw = authctxt->pw; 301 302 /* no user given */ 303 if (!authctxt->valid) 304 return 0; 305 306 if (!PRIVSEP(auth_rsa_key_allowed(pw, client_n, &key))) { 307 auth_clear_options(); 308 return (0); 309 } 310 311 /* Perform the challenge-response dialog for this key. */ 312 if (!auth_rsa_challenge_dialog(key)) { 313 /* Wrong response. */ 314 verbose("Wrong response to RSA authentication challenge."); 315 packet_send_debug("Wrong response to RSA authentication challenge."); 316 /* 317 * Break out of the loop. Otherwise we might send 318 * another challenge and break the protocol. 319 */ 320 key_free(key); 321 return (0); 322 } 323 /* 324 * Correct response. The client has been successfully 325 * authenticated. Note that we have not yet processed the 326 * options; this will be reset if the options cause the 327 * authentication to be rejected. 328 */ 329 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); 330 verbose("Found matching %s key: %s", 331 key_type(key), fp); 332 xfree(fp); 333 key_free(key); 334 335 packet_send_debug("RSA authentication accepted."); 336 return (1); 337 } 338
