freebsd-nq/crypto/openssh/auth-krb5.c

222 lines
5.6 KiB
C
Raw Normal View History

/*
* Kerberos v5 authentication and ticket-passing routines.
*
* $xFreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp$
*/
/*
* Copyright (c) 2002 Daniel Kouril. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "includes.h"
2004-02-26 10:52:33 +00:00
RCSID("$OpenBSD: auth-krb5.c,v 1.15 2003/11/21 11:57:02 djm Exp $");
2002-10-29 10:16:02 +00:00
RCSID("$FreeBSD$");
2002-03-18 10:09:43 +00:00
#include "ssh.h"
#include "ssh1.h"
#include "packet.h"
#include "xmalloc.h"
2002-03-18 10:09:43 +00:00
#include "log.h"
#include "servconf.h"
#include "uidswap.h"
#include "auth.h"
#ifdef KRB5
2002-03-18 10:09:43 +00:00
#include <krb5.h>
2002-03-18 10:09:43 +00:00
extern ServerOptions options;
2002-03-18 10:09:43 +00:00
static int
krb5_init(void *context)
{
2002-03-18 10:09:43 +00:00
Authctxt *authctxt = (Authctxt *)context;
krb5_error_code problem;
2002-03-18 10:09:43 +00:00
if (authctxt->krb5_ctx == NULL) {
problem = krb5_init_context(&authctxt->krb5_ctx);
if (problem)
return (problem);
krb5_init_ets(authctxt->krb5_ctx);
}
return (0);
}
int
2002-03-18 10:09:43 +00:00
auth_krb5_password(Authctxt *authctxt, const char *password)
{
2002-06-27 22:42:11 +00:00
#ifndef HEIMDAL
krb5_creds creds;
krb5_principal server;
char ccname[40];
int tmpfd;
2004-02-26 10:52:33 +00:00
#endif
2002-03-18 10:09:43 +00:00
krb5_error_code problem;
krb5_ccache ccache = NULL;
2002-03-18 10:09:43 +00:00
2004-02-26 10:52:33 +00:00
if (!authctxt->valid)
2002-03-18 10:09:43 +00:00
return (0);
temporarily_use_uid(authctxt->pw);
problem = krb5_init(authctxt);
if (problem)
goto out;
problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
&authctxt->krb5_user);
if (problem)
goto out;
2002-06-27 22:42:11 +00:00
#ifdef HEIMDAL
problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops, &ccache);
2002-03-18 10:09:43 +00:00
if (problem)
goto out;
problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
authctxt->krb5_user);
2002-03-18 10:09:43 +00:00
if (problem)
goto out;
restore_uid();
2004-02-26 10:52:33 +00:00
2002-03-18 10:09:43 +00:00
problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
ccache, password, 1, NULL);
2004-02-26 10:52:33 +00:00
2002-03-18 10:09:43 +00:00
temporarily_use_uid(authctxt->pw);
if (problem)
goto out;
2004-02-26 10:52:33 +00:00
problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops,
&authctxt->krb5_fwd_ccache);
if (problem)
goto out;
problem = krb5_cc_copy_cache(authctxt->krb5_ctx, ccache,
authctxt->krb5_fwd_ccache);
krb5_cc_destroy(authctxt->krb5_ctx, ccache);
ccache = NULL;
if (problem)
goto out;
2002-03-18 10:09:43 +00:00
2002-06-27 22:42:11 +00:00
#else
problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
if (problem)
goto out;
problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
KRB5_NT_SRV_HST, &server);
if (problem)
goto out;
restore_uid();
problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
NULL, NULL, NULL);
krb5_free_principal(authctxt->krb5_ctx, server);
temporarily_use_uid(authctxt->pw);
if (problem)
goto out;
2004-02-26 10:52:33 +00:00
if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
2002-06-27 22:42:11 +00:00
authctxt->pw->pw_name)) {
problem = -1;
goto out;
2004-02-26 10:52:33 +00:00
}
2002-06-27 22:42:11 +00:00
snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
2004-02-26 10:52:33 +00:00
2002-06-27 22:42:11 +00:00
if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
logit("mkstemp(): %.100s", strerror(errno));
2002-06-27 22:42:11 +00:00
problem = errno;
goto out;
}
2004-02-26 10:52:33 +00:00
2002-06-27 22:42:11 +00:00
if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
logit("fchmod(): %.100s", strerror(errno));
2002-06-27 22:42:11 +00:00
close(tmpfd);
problem = errno;
goto out;
}
close(tmpfd);
problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
if (problem)
goto out;
problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
authctxt->krb5_user);
if (problem)
goto out;
2004-02-26 10:52:33 +00:00
2002-06-27 22:42:11 +00:00
problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
&creds);
if (problem)
goto out;
2004-02-26 10:52:33 +00:00
#endif
2002-06-27 22:42:11 +00:00
2002-03-18 10:09:43 +00:00
authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
out:
restore_uid();
if (problem) {
if (ccache)
krb5_cc_destroy(authctxt->krb5_ctx, ccache);
2002-06-27 22:42:11 +00:00
if (authctxt->krb5_ctx != NULL && problem!=-1)
2002-03-18 10:09:43 +00:00
debug("Kerberos password authentication failed: %s",
krb5_get_err_text(authctxt->krb5_ctx, problem));
else
debug("Kerberos password authentication failed: %d",
problem);
krb5_cleanup_proc(authctxt);
if (options.kerberos_or_local_passwd)
return (-1);
else
return (0);
}
return (1);
}
void
2004-02-26 10:52:33 +00:00
krb5_cleanup_proc(Authctxt *authctxt)
{
2002-03-18 10:09:43 +00:00
debug("krb5_cleanup_proc called");
if (authctxt->krb5_fwd_ccache) {
krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
authctxt->krb5_fwd_ccache = NULL;
}
if (authctxt->krb5_user) {
krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
authctxt->krb5_user = NULL;
}
if (authctxt->krb5_ctx) {
krb5_free_context(authctxt->krb5_ctx);
authctxt->krb5_ctx = NULL;
}
}
2002-03-18 10:09:43 +00:00
#endif /* KRB5 */