Added login.conf support.
This commit is contained in:
David Nugent
parent
b867e699aa
commit
80b3b7342f
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=25099
@ -1,5 +1,5 @@
|
||||
# From: @(#)Makefile 8.1 (Berkeley) 6/4/93
|
||||
# $Id$
|
||||
# $Id: Makefile,v 1.6 1997/02/22 14:22:22 peter Exp $
|
||||
|
||||
PROG= rshd
|
||||
SRCS= rshd.c
|
||||
@ -13,4 +13,9 @@ LDADD= -lkrb -ldes
|
||||
DISTRIBUTION= krb
|
||||
.endif
|
||||
|
||||
# For login_cap handling
|
||||
CFLAGS+=-DLOGIN_CAP
|
||||
DPADD+= ${LIBUTIL}
|
||||
LDADD+= -lutil
|
||||
|
||||
.include <bsd.prog.mk>
|
||||
|
||||
@ -30,7 +30,7 @@
|
||||
.\" SUCH DAMAGE.
|
||||
.\"
|
||||
.\" @(#)rshd.8 8.1 (Berkeley) 6/4/93
|
||||
.\" $Id$
|
||||
.\" $Id: rshd.8,v 1.7 1997/02/22 14:22:22 peter Exp $
|
||||
.\"
|
||||
.Dd June 4, 1993
|
||||
.Dt RSHD 8
|
||||
@ -133,6 +133,12 @@ If the file
|
||||
.Pa /etc/nologin
|
||||
exists and the user is not the superuser,
|
||||
the connection is closed.
|
||||
The name of the nologin file may be overridden
|
||||
using the nologin= capability in login.conf
|
||||
according to the local user's login class,
|
||||
which may also be used to restrict rsh access by
|
||||
login time (times.allow and times.deny capabilities)
|
||||
and remote host (hosts.allow and hosts.deny capabilities).
|
||||
.It
|
||||
A null byte is returned on the initial socket
|
||||
and the command line is passed to the normal login
|
||||
@ -181,6 +187,9 @@ The
|
||||
command to the home directory failed.
|
||||
.It Sy Permission denied.
|
||||
The authentication procedure described above failed.
|
||||
.It Sy Logins not available right now.
|
||||
Rsh was attempted outside the allowed hours defined in
|
||||
login.conf for the local user's login class.
|
||||
.It Sy Can't make pipe.
|
||||
The pipe needed for the
|
||||
.Em stderr ,
|
||||
@ -202,12 +211,12 @@ and is not preceded by a flag byte.
|
||||
.Xr rcmd 3 ,
|
||||
.Xr ruserok 3 ,
|
||||
.Xr hosts 5 ,
|
||||
.Xr login.conf 5 ,
|
||||
.Xr nologin 5 ,
|
||||
.Xr services 5 ,
|
||||
.Xr named 8 ,
|
||||
.Xr rlogind 8 ,
|
||||
.Xr syslogd 8 .
|
||||
|
||||
.Sh FILES
|
||||
.Bl -tag -width /etc/hosts -compact
|
||||
.It Pa /etc/hosts
|
||||
@ -215,7 +224,6 @@ and is not preceded by a flag byte.
|
||||
.It Pa $HOME/.rhosts
|
||||
.It Pa /etc/nologin
|
||||
.El
|
||||
|
||||
.Sh BUGS
|
||||
The authentication procedure used here assumes the integrity
|
||||
of each client machine and the connecting medium. This is
|
||||
|
||||
@ -30,7 +30,7 @@
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: rshd.c,v 1.14 1997/03/28 15:48:17 imp Exp $
|
||||
* $Id: rshd.c,v 1.15 1997/03/29 12:35:06 peter Exp $
|
||||
*/
|
||||
|
||||
#ifndef lint
|
||||
@ -72,6 +72,9 @@ static char sccsid[] = "@(#)rshd.c 8.2 (Berkeley) 4/6/94";
|
||||
#include <string.h>
|
||||
#include <syslog.h>
|
||||
#include <unistd.h>
|
||||
#ifdef LOGIN_CAP
|
||||
#include <login_cap.h>
|
||||
#endif
|
||||
|
||||
int keepalive = 1;
|
||||
int check_all;
|
||||
@ -205,6 +208,9 @@ doit(fromp)
|
||||
char cmdbuf[NCARGS+1], locuser[16], remuser[16];
|
||||
char remotehost[2 * MAXHOSTNAMELEN + 1];
|
||||
char fromhost[2 * MAXHOSTNAMELEN + 1];
|
||||
#ifdef LOGIN_CAP
|
||||
login_cap_t *lc;
|
||||
#endif
|
||||
|
||||
#ifdef KERBEROS
|
||||
AUTH_DAT *kdata = (AUTH_DAT *) NULL;
|
||||
@ -441,7 +447,20 @@ doit(fromp)
|
||||
errorstr = "Login incorrect.\n";
|
||||
goto fail;
|
||||
}
|
||||
#ifdef LOGIN_CAP
|
||||
lc = login_getclass(pwd);
|
||||
#endif
|
||||
if (chdir(pwd->pw_dir) < 0) {
|
||||
#ifdef LOGIN_CAP
|
||||
if (chdir("/") < 0 ||
|
||||
login_getcapbool(lc, "requirehome", !!pwd->pw_uid)) {
|
||||
syslog(LOG_INFO|LOG_AUTH,
|
||||
"%s@%s as %s: no home directory. cmd='%.80s'",
|
||||
remuser, hostname, locuser, cmdbuf);
|
||||
error("No remote home directory.\n");
|
||||
exit(0);
|
||||
}
|
||||
#else
|
||||
(void) chdir("/");
|
||||
#ifdef notdef
|
||||
syslog(LOG_INFO|LOG_AUTH,
|
||||
@ -450,6 +469,8 @@ doit(fromp)
|
||||
error("No remote directory.\n");
|
||||
exit(1);
|
||||
#endif
|
||||
#endif
|
||||
pwd->pw_dir = "/";
|
||||
}
|
||||
|
||||
#ifdef KERBEROS
|
||||
@ -491,6 +512,27 @@ doit(fromp)
|
||||
error("Logins currently disabled.\n");
|
||||
exit(1);
|
||||
}
|
||||
#ifdef LOGIN_CAP
|
||||
if (lc != NULL) {
|
||||
char remote_ip[MAXHOSTNAMELEN];
|
||||
|
||||
strncpy(remote_ip, inet_ntoa(fromp->sin_addr),
|
||||
sizeof(remote_ip) - 1);
|
||||
remote_ip[sizeof(remote_ip) - 1] = 0;
|
||||
if (!auth_hostok(lc, fromhost, remote_ip)) {
|
||||
syslog(LOG_INFO|LOG_AUTH,
|
||||
"%s@%s as %s: permission denied (%s). cmd='%.80s'",
|
||||
remuser, hostname, locuser, __rcmd_errstr,
|
||||
cmdbuf);
|
||||
error("Permission denied.\n");
|
||||
exit(1);
|
||||
}
|
||||
if (!auth_timeok(lc, time(NULL))) {
|
||||
error("Logins not available right now\n");
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
#endif /* !LOGIN_CAP */
|
||||
#if BSD > 43
|
||||
/* before fork, while we're session leader */
|
||||
if (setlogin(pwd->pw_name) < 0)
|
||||
@ -670,9 +712,6 @@ doit(fromp)
|
||||
}
|
||||
if (*pwd->pw_shell == '\0')
|
||||
pwd->pw_shell = _PATH_BSHELL;
|
||||
(void) setgid((gid_t)pwd->pw_gid);
|
||||
initgroups(pwd->pw_name, pwd->pw_gid);
|
||||
(void) setuid((uid_t)pwd->pw_uid);
|
||||
environ = envinit;
|
||||
strncat(homedir, pwd->pw_dir, sizeof(homedir)-6);
|
||||
strcat(path, _PATH_DEFPATH);
|
||||
@ -683,6 +722,17 @@ doit(fromp)
|
||||
cp++;
|
||||
else
|
||||
cp = pwd->pw_shell;
|
||||
#ifdef LOGIN_CAP
|
||||
if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETALL) != 0) {
|
||||
syslog(LOG_ERR, "setusercontext: %m");
|
||||
exit(1);
|
||||
}
|
||||
login_close(lc);
|
||||
#else
|
||||
(void) setgid((gid_t)pwd->pw_gid);
|
||||
initgroups(pwd->pw_name, pwd->pw_gid);
|
||||
(void) setuid((uid_t)pwd->pw_uid);
|
||||
#endif
|
||||
endpwent();
|
||||
if (log_success || pwd->pw_uid == 0) {
|
||||
#ifdef KERBEROS
|
||||
|
||||
Loading…
Reference in New Issue
Block a user