Commit Graph

46 Commits

Author SHA1 Message Date
Mark Murray
6481307030 Gut out (by default unused) cruft, and tidy up warnings. 2002-06-26 17:09:08 +00:00
Dag-Erling Smørgrav
57b7631cb8 PAMify.
Sponsored by:	DARPA, NAI Labs
2002-05-08 00:43:46 +00:00
Dag-Erling Smørgrav
c53d09b102 YA patch I forgot to commit last night. 2002-03-06 15:23:18 +00:00
Warner Losh
af842d6b76 o const poison a few prototypes to avoid gcc3 warnings
o s/err/error/ in a couple places to avoid shadowing warnings
2002-02-07 05:07:04 +00:00
Warner Losh
b32909785b o __P removal
o new style definitions/declarations
o declare null_conv static and its arguments __unused
2002-02-07 04:58:29 +00:00
Kris Kennaway
af9ad34d31 Mark a function as __printf0like(). This exposes a warning which requires
some code changes to fix but should be possible.

MFC after:	1 week
2002-02-04 01:37:59 +00:00
Brian Somers
7bc6d0158f Fix the type of the NULL arg to execl()
Idea from: Theo de Raadt <deraadt@openbsd.org>
2001-07-09 09:24:06 +00:00
Mark Murray
3a6235e555 Replacement of the old error() routine with errx(3) was premature.
There are protocol issues to deal with.

Bring back this routine (renamed to avoid a library conflict in libssh)
and overhaul it for more 21st Century style coding.

Pointed out by:	bde
2001-04-29 17:50:29 +00:00
Mark Murray
c0264d438b Grrr. Fix a line that was fatfingered out during the cleanup.
Submitted by:	bde
Pointy hat:	markm
2001-04-29 09:03:52 +00:00
Mark Murray
8490ea92d6 Clean up the error handling code a bit. There is no need to "roll our
own" error() routine when errx() is available. This resolves a conflict
when linking statically.
2001-04-28 07:43:01 +00:00
Mark Murray
5bc9d93db3 Add full PAM support for account management and sessions.
The PAM_FAIL_CHECK and PAM_END macros in su.c came from the util-linux
package's PAM patches to the BSD login.c

Submitted by:	"David J. MacKenzie" <djm@web.us.uu.net>
2001-03-27 19:40:51 +00:00
Jeroen Ruigrok van der Werven
2fa72ea7d4 Fix typo: compatability -> compatibility.
Compatability is not an existing english word.
2001-02-06 12:05:58 +00:00
Ruslan Ermilov
114c43dcf8 Whitespace-only to sync with -stable. 2000-12-07 15:09:48 +00:00
Ruslan Ermilov
6f1214d918 Removed broken PAM support from rshd(8) and rlogind(8). rshd does
not allocate a pty(4) so it is not suitable at all for interactive
PAM modules.  rlogind calls login(1) which is already PAM enabled.

Approved by:	markm
2000-10-12 07:18:20 +00:00
Brian S. Dean
f2b5eea7aa Plug the hole where rshd would bypass a proper .rhosts check if the
password was empty.

Reviewed by:	Warner Losh <imp@freebsd.org>
2000-07-05 17:47:17 +00:00
Jeroen Ruigrok van der Werven
2e79759062 Remove dead debug code.
This also removes a dependency/reference on COMPAT_43.
2000-04-29 12:02:00 +00:00
Yoshinobu Inoue
e3be4d7b7e sync iruserok() extension API with other BSDs
Some of rcmd related function is need to be updated to
  support IPv6. Some of them are already updated as standard
  document. But there is also several de-facto functions and
  they are not listed in standard documents.
  They are,

    iruserok()  (used by rlogind, rshd)
    ruserok()   (used by kerberos, etc)

  KAME package updated those functions in original way.

    iruserok_af()
    ruserok_af()

  But recently there was discussion on IETF IPng mailing
  list about how to sync those API, and it is decided,

    -Those function is not standard and not documented.
    -But let BSDs sync their API as de-facto.

  And after some discussion, it is announced that

    -add update to iruserok() as iruserok_sa()
    -no ruserok() API change(it is only updated internaly)

So I sync those API before 4.0 is released.
The changes are,
   -prototype changes
   -ruserok() internal update (use iruserok_sa() inside)
   -removal of ruserok_af()
   -change iruserok_af() as static functioin, and also prefix the name with __.
   -add iruserok_sa() (Just call __iruserok_af() inside)
   -adding flag AI_ALL to getipnodebyaddr() called from __icheckhost().
    This is necessary to support IPv4 communication via AF_INET6 socket
    could be correctly authenticated via iruserok_sa()
   -irusreok_af() call is replaced to iruserok_sa() call
    in rlogind, and rshd.

Approved by: jkh
2000-02-01 15:55:56 +00:00
Yoshinobu Inoue
1f2ba8fcb7 Fix rshd coredump when AF_INET socket is used.
Confirmed by: F. Heinrichmeyer <fritz.heinrichmeyer@fernuni-hagen.de>
2000-01-28 20:02:02 +00:00
Yoshinobu Inoue
0cac72f42c several tcp apps IPv6 update
-inetd
 -rshd
 -rlogind
 -telnetd
 -rsh
 -rlogin

Reviewed by: freebsd-arch, cvs-committers
Obtained from: KAME project
2000-01-25 14:52:10 +00:00
Mark Murray
6c9134c067 Fix for new Kerberos4. Make a fist cut at PAM-ising while I'm here. 1999-09-19 22:05:32 +00:00
Peter Wemm
7f3dea244c $Id$ -> $FreeBSD$ 1999-08-28 00:22:10 +00:00
Brian Somers
9e9a43bdec Ensure that things returned by gethostname() and
friends are terminated and allow for a maximum
host name length of MAXHOSTNAMELEN - 1.
Put parenthesis around sizeof args.
Make some variables static.
Fix telnetd -u (broken by my last commit)

Prompted by: bde
1999-04-07 08:27:45 +00:00
Brian Somers
32af26a501 Use realhostname() rather than various combinations of
gethostbyaddr() & gethostbyname().

Remove brokeness in ftpd for hosts of MAXHOSTNAMELEN length.
1999-04-06 23:06:00 +00:00
Peter Wemm
5328c7eb7e As previously threatened, clean up the rshd -a option and make it default
on rshd and rlogind.  However, note that:
1: rshd used to drop a connection with -a if the hostname != ip address.
   This is unneeded, because iruserok() does it's own checking.
   It was also wrong if .rhosts had an explicit IP address in it,
   connections would be dropped from that host solely because the DNS was
   mismatched even though it was explicitly intended to work by IP address.
2: rlogind and rshd check the hostname mappings by default now because that
   is what goes into the utmp/wtmp and logs.  If the hostname != ip address,
   then it uses the IP address for logging/utmp/wtmp purposes.  There isn't
   much point logging ficticious hostnames.
3: rshd -a is now accepted (but ignored) for compatability.  If you really
   want to make life miserable for people with bad reverse DNS, use tcpd in
   paranoid mode (which is questionable anyway, given DNS ttl tweaking).
1998-12-16 07:20:45 +00:00
David Greenman
45166d95d1 Added a -D option to turn on TCP_NODELAY. 1998-12-01 23:27:24 +00:00
Robert Nordier
c898c25b02 Replace _exit() with exit()
Pointed out by: Nathan Torkington <gnat@prometheus.frii.com> PR 5585
1998-05-05 00:28:51 +00:00
Philippe Charnier
a40772799f No \n in syslog() strings. Add man page to Xrefs. Change null byte to NUL byte. 1997-12-02 12:30:04 +00:00
Mark Murray
0934db4674 Changes for the new KTH Kerberos4.
Also make -Wall a bit quieter
1997-09-28 08:38:04 +00:00
Wolfram Schneider
506a9d513c Rshd print to much information if a user does not exists. 1997-07-18 21:04:19 +00:00
David Nugent
5d0bfe39ec login_getclass() -> login_getpwclass(). 1997-05-10 19:02:03 +00:00
David Nugent
80b3b7342f Added login.conf support. 1997-04-23 03:06:47 +00:00
Peter Wemm
f0ccf9018b Be a bit more careful about what port number we are using for the
second socket.  If we're going to check for reserved ports, we should
do it properly.
1997-03-29 12:35:06 +00:00
Warner Losh
91477cc4d7 compare return value from getopt against -1 rather than EOF, per the final
posix standard on the topic.
1997-03-28 15:48:21 +00:00
Peter Wemm
9e522f7a18 Revert $FreeBSD$ to $Id$ 1997-02-22 14:22:49 +00:00
Warner Losh
2631d5a8d1 Some patches for source routed packets from OpenBSD.
Rev 1.13 deraadt:
	do not warn about valid options; invalid options correctly quit
Rev 1.12 deraadt:
	need not clear options since bad ones cause exit;
	provos@ws1.physnet.uni-hamburg.de
Rev 1.11 deraadt:
	IPOPT_LSRR/IPOPT_SSRR must exit() due to tcp sequencing; pointed
	out by provos@wserver.physnet.uni-hamburg.de. also another 1-char
	buffer overflow.

Reviewed by:	Peter Wemm
Obtained from:	OpenSBD
1997-02-09 04:16:27 +00:00
Joerg Wunsch
28f9fdc1ae Make even more copies of hostnames obtained by inet_ntoa(). iruserok()
could still clobber the static storage, yielding an error message with
a wrong hostname.
1997-01-27 15:38:46 +00:00
Jordan K. Hubbard
1130b656e5 Make the long-awaited change from $Id$ to $FreeBSD$
This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore.  This update would have been
insane otherwise.
1997-01-14 07:20:47 +00:00
Marc G. Fournier
268fa61dc1 Fixes:
When an rsh is denied by rshd because the client is lacking appropriate
.rhosts permission, an error message is formatted for syslog which contains
the client's hostname.  The hostname portion of the message relies on a pointer
to a field within gethostbyname()'s internal struct hostent which changes state
between when the pointer is initialized and when it is dereferenced to create th
e
message.

Submitted by: skynyrd@opus.cts.cwu.edu
1996-10-22 21:11:49 +00:00
Wolfram Schneider
148531ef1e add forgotten $Id$ 1996-09-22 21:56:57 +00:00
Paul Traina
39ea627d62 Fix some compilation warnings. 1996-09-21 18:01:23 +00:00
Mark Murray
bbff7ca556 #include <kerberosIV/des.h> -> #include <des.h> 1996-02-11 09:18:18 +00:00
Mark Murray
5bf1814b0e Rename des_set_key -> des_set_key_krb. (libdes conflict) 1996-02-03 11:51:19 +00:00
Andrey A. Chernov
cd0106ae43 Add missing & in des_set_key argument 1995-11-19 15:20:48 +00:00
Peter Wemm
b048c73588 Move the setlogin() call a little earlier.. It was being done in the child
process - which would be no longer allowed if the setlogin() changes go
through.  Now the parent (the session leader, when started by inetd) does it.
1995-11-12 18:31:23 +00:00
Mike Pritchard
ae532ecb79 Check for expired passwords before allowing access to the system. 1995-08-28 21:30:59 +00:00
Rodney W. Grimes
ea022d1687 BSD 4.4 Lite Libexec Sources 1994-05-27 12:39:25 +00:00