Home | History | Annotate | Download | only in dropbear 
      1 /*
      2  * Dropbear SSH
      3  *
      4  * Copyright (c) 2004 Martin Carlsson
      5  * Portions (c) 2004 Matt Johnston
      6  * All rights reserved.
      7  *
      8  * Permission is hereby granted, free of charge, to any person obtaining a copy
      9  * of this software and associated documentation files (the "Software"), to deal
     10  * in the Software without restriction, including without limitation the rights
     11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     12  * copies of the Software, and to permit persons to whom the Software is
     13  * furnished to do so, subject to the following conditions:
     14  *
     15  * The above copyright notice and this permission notice shall be included in
     16  * all copies or substantial portions of the Software.
     17  *
     18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
     21  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     24  * SOFTWARE. */
     25 
     26 /* Validates a user password using PAM */
     27 
     28 #include "includes.h"
     29 #include "session.h"
     30 #include "buffer.h"
     31 #include "dbutil.h"
     32 #include "auth.h"
     33 
     34 #ifdef ENABLE_SVR_PAM_AUTH
     35 
     36 #if defined(HAVE_SECURITY_PAM_APPL_H)
     37 #include <security/pam_appl.h>
     38 #elif defined (HAVE_PAM_PAM_APPL_H)
     39 #include <pam/pam_appl.h>
     40 #endif
     41 
     42 struct UserDataS {
     43 	char* user;
     44 	char* passwd;
     45 };
     46 
     47 /* PAM conversation function - for now we only handle one message */
     48 int
     49 pamConvFunc(int num_msg,
     50 		const struct pam_message **msg,
     51 		struct pam_response **respp,
     52 		void *appdata_ptr) {
     53 
     54 	int rc = PAM_SUCCESS;
     55 	struct pam_response* resp = NULL;
     56 	struct UserDataS* userDatap = (struct UserDataS*) appdata_ptr;
     57 	unsigned int msg_len = 0;
     58 	unsigned int i = 0;
     59 
     60 	const char* message = (*msg)->msg;
     61 
     62 	/* make a copy we can strip */
     63 	char * compare_message = m_strdup(message);
     64 
     65 	TRACE(("enter pamConvFunc"))
     66 
     67 	if (num_msg != 1) {
     68 		/* If you're getting here - Dropbear probably can't support your pam
     69 		 * modules. This whole file is a bit of a hack around lack of
     70 		 * asynchronocity in PAM anyway. */
     71 		dropbear_log(LOG_INFO, "pamConvFunc() called with >1 messages: not supported.");
     72 		return PAM_CONV_ERR;
     73 	}
     74 
     75 	TRACE(("msg_style is %d", (*msg)->msg_style))
     76 	if (compare_message) {
     77 		TRACE(("message is '%s'", compare_message))
     78 	} else {
     79 		TRACE(("null message"))
     80 	}
     81 
     82 
     83 	/* Make the string lowercase. */
     84 	msg_len = strlen(compare_message);
     85 	for (i = 0; i < msg_len; i++) {
     86 		compare_message[i] = tolower(compare_message[i]);
     87 	}
     88 
     89 	/* If the string ends with ": ", remove the space.
     90 	   ie "login: " vs "login:" */
     91 	if (msg_len > 2
     92 			&& compare_message[msg_len-2] == ':'
     93 			&& compare_message[msg_len-1] == ' ') {
     94 		compare_message[msg_len-1] = '\0';
     95 	}
     96 
     97 	switch((*msg)->msg_style) {
     98 
     99 		case PAM_PROMPT_ECHO_OFF:
    100 
    101 			if (!(strcmp(compare_message, "password:") == 0)) {
    102 				/* We don't recognise the prompt as asking for a password,
    103 				   so can't handle it. Add more above as required for
    104 				   different pam modules/implementations */
    105 				dropbear_log(LOG_NOTICE, "PAM unknown prompt %s (no echo)",
    106 						compare_message);
    107 				rc = PAM_CONV_ERR;
    108 				break;
    109 			}
    110 
    111 			/* You have to read the PAM module-writers' docs (do we look like
    112 			 * module writers? no.) to find out that the module will
    113 			 * free the pam_response and its resp element - ie we _must_ malloc
    114 			 * it here */
    115 			resp = (struct pam_response*) m_malloc(sizeof(struct pam_response));
    116 			memset(resp, 0, sizeof(struct pam_response));
    117 
    118 			resp->resp = m_strdup(userDatap->passwd);
    119 			m_burn(userDatap->passwd, strlen(userDatap->passwd));
    120 			(*respp) = resp;
    121 			break;
    122 
    123 
    124 		case PAM_PROMPT_ECHO_ON:
    125 
    126 			if (!((strcmp(compare_message, "login:" ) == 0)
    127 				|| (strcmp(compare_message, "please enter username:") == 0))) {
    128 				/* We don't recognise the prompt as asking for a username,
    129 				   so can't handle it. Add more above as required for
    130 				   different pam modules/implementations */
    131 				dropbear_log(LOG_NOTICE, "PAM unknown prompt %s (with echo)",
    132 						compare_message);
    133 				rc = PAM_CONV_ERR;
    134 				break;
    135 			}
    136 
    137 			/* You have to read the PAM module-writers' docs (do we look like
    138 			 * module writers? no.) to find out that the module will
    139 			 * free the pam_response and its resp element - ie we _must_ malloc
    140 			 * it here */
    141 			resp = (struct pam_response*) m_malloc(sizeof(struct pam_response));
    142 			memset(resp, 0, sizeof(struct pam_response));
    143 
    144 			resp->resp = m_strdup(userDatap->user);
    145 			TRACE(("userDatap->user='%s'", userDatap->user))
    146 			(*respp) = resp;
    147 			break;
    148 
    149 		default:
    150 			TRACE(("Unknown message type"))
    151 			rc = PAM_CONV_ERR;
    152 			break;
    153 	}
    154 
    155 	m_free(compare_message);
    156 	TRACE(("leave pamConvFunc, rc %d", rc))
    157 
    158 	return rc;
    159 }
    160 
    161 /* Process a password auth request, sending success or failure messages as
    162  * appropriate. To the client it looks like it's doing normal password auth (as
    163  * opposed to keyboard-interactive or something), so the pam module has to be
    164  * fairly standard (ie just "what's your username, what's your password, OK").
    165  *
    166  * Keyboard interactive would be a lot nicer, but since PAM is synchronous, it
    167  * gets very messy trying to send the interactive challenges, and read the
    168  * interactive responses, over the network. */
    169 void svr_auth_pam() {
    170 
    171 	struct UserDataS userData = {NULL, NULL};
    172 	struct pam_conv pamConv = {
    173 		pamConvFunc,
    174 		&userData /* submitted to pamvConvFunc as appdata_ptr */
    175 	};
    176 
    177 	pam_handle_t* pamHandlep = NULL;
    178 
    179 	unsigned char * password = NULL;
    180 	unsigned int passwordlen;
    181 
    182 	int rc = PAM_SUCCESS;
    183 	unsigned char changepw;
    184 
    185 	/* check if client wants to change password */
    186 	changepw = buf_getbool(ses.payload);
    187 	if (changepw) {
    188 		/* not implemented by this server */
    189 		send_msg_userauth_failure(0, 1);
    190 		goto cleanup;
    191 	}
    192 
    193 	password = buf_getstring(ses.payload, &passwordlen);
    194 
    195 	/* used to pass data to the PAM conversation function - don't bother with
    196 	 * strdup() etc since these are touched only by our own conversation
    197 	 * function (above) which takes care of it */
    198 	userData.user = ses.authstate.printableuser;
    199 	userData.passwd = password;
    200 
    201 	/* Init pam */
    202 	if ((rc = pam_start("sshd", NULL, &pamConv, &pamHandlep)) != PAM_SUCCESS) {
    203 		dropbear_log(LOG_WARNING, "pam_start() failed, rc=%d, %s\n",
    204 				rc, pam_strerror(pamHandlep, rc));
    205 		goto cleanup;
    206 	}
    207 
    208 	/* just to set it to something */
    209 	if ((rc = pam_set_item(pamHandlep, PAM_TTY, "ssh") != PAM_SUCCESS)) {
    210 		dropbear_log(LOG_WARNING, "pam_set_item() failed, rc=%d, %s\n",
    211 				rc, pam_strerror(pamHandlep, rc));
    212 		goto cleanup;
    213 	}
    214 
    215 	(void) pam_fail_delay(pamHandlep, 0 /* musec_delay */);
    216 
    217 	/* (void) pam_set_item(pamHandlep, PAM_FAIL_DELAY, (void*) pamDelayFunc); */
    218 
    219 	if ((rc = pam_authenticate(pamHandlep, 0)) != PAM_SUCCESS) {
    220 		dropbear_log(LOG_WARNING, "pam_authenticate() failed, rc=%d, %s\n",
    221 				rc, pam_strerror(pamHandlep, rc));
    222 		dropbear_log(LOG_WARNING,
    223 				"bad PAM password attempt for '%s' from %s",
    224 				ses.authstate.printableuser,
    225 				svr_ses.addrstring);
    226 		send_msg_userauth_failure(0, 1);
    227 		goto cleanup;
    228 	}
    229 
    230 	if ((rc = pam_acct_mgmt(pamHandlep, 0)) != PAM_SUCCESS) {
    231 		dropbear_log(LOG_WARNING, "pam_acct_mgmt() failed, rc=%d, %s\n",
    232 				rc, pam_strerror(pamHandlep, rc));
    233 		dropbear_log(LOG_WARNING,
    234 				"bad PAM password attempt for '%s' from %s",
    235 				ses.authstate.printableuser,
    236 				svr_ses.addrstring);
    237 		send_msg_userauth_failure(0, 1);
    238 		goto cleanup;
    239 	}
    240 
    241 	/* successful authentication */
    242 	dropbear_log(LOG_NOTICE, "PAM password auth succeeded for '%s' from %s",
    243 			ses.authstate.printableuser,
    244 			svr_ses.addrstring);
    245 	send_msg_userauth_success();
    246 
    247 cleanup:
    248 	if (password != NULL) {
    249 		m_burn(password, passwordlen);
    250 		m_free(password);
    251 	}
    252 	if (pamHandlep != NULL) {
    253 		TRACE(("pam_end"))
    254 		(void) pam_end(pamHandlep, 0 /* pam_status */);
    255 	}
    256 }
    257 
    258 #endif /* ENABLE_SVR_PAM_AUTH */
    259