Retire pam_wheel(8) (which has been disconnected for quite a while) and
pam_ftp(8).
This commit is contained in:
Dag-Erling Smørgrav
parent
20fc95cbdd
commit
008c1ace7b
@ -1,31 +0,0 @@
|
||||
# Copyright 2001 Mark R V Murray
|
||||
# All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions
|
||||
# are met:
|
||||
# 1. Redistributions of source code must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
# 2. Redistributions in binary form must reproduce the above copyright
|
||||
# notice, this list of conditions and the following disclaimer in the
|
||||
# documentation and/or other materials provided with the distribution.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
# SUCH DAMAGE.
|
||||
#
|
||||
# $FreeBSD$
|
||||
|
||||
LIB= pam_ftp
|
||||
SRCS= pam_ftp.c
|
||||
MAN= pam_ftp.8
|
||||
|
||||
.include <bsd.lib.mk>
|
||||
@ -1,100 +0,0 @@
|
||||
.\" Copyright (c) 2001 Mark R V Murray
|
||||
.\" All rights reserved.
|
||||
.\"
|
||||
.\" Redistribution and use in source and binary forms, with or without
|
||||
.\" modification, are permitted provided that the following conditions
|
||||
.\" are met:
|
||||
.\" 1. Redistributions of source code must retain the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer.
|
||||
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer in the
|
||||
.\" documentation and/or other materials provided with the distribution.
|
||||
.\"
|
||||
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
.\" SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $FreeBSD$
|
||||
.\"
|
||||
.Dd July 8, 2001
|
||||
.Dt PAM_FTP 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm pam_ftp
|
||||
.Nd FTP PAM module
|
||||
.Sh SYNOPSIS
|
||||
.Op Ar service-name
|
||||
.Ar module-type
|
||||
.Ar control-flag
|
||||
.Pa pam_ftp
|
||||
.Op Ar options
|
||||
.Sh DESCRIPTION
|
||||
The FTP authentication service module for PAM,
|
||||
.Nm
|
||||
provides functionality for only one PAM category:
|
||||
authentication.
|
||||
In terms of the
|
||||
.Ar module-type
|
||||
parameter, this is the
|
||||
.Dq Li auth
|
||||
feature.
|
||||
It also provides a null function for session management.
|
||||
.Ss FTP Authentication Module
|
||||
The FTP authentication component
|
||||
.Pq Fn pam_sm_authenticate ,
|
||||
authenticates the anonymous user
|
||||
(usually
|
||||
.Dq anonymous
|
||||
or
|
||||
.Dq ftp )
|
||||
usually by simply requesting an email address as a password.
|
||||
The supplied email address is broken up
|
||||
into its username and host parts,
|
||||
and these are assigned to the
|
||||
.Dv PAM_RUSER
|
||||
and
|
||||
.Dv PAM_RHOST
|
||||
facilities respectively.
|
||||
.Pp
|
||||
This module is intended for the
|
||||
.Xr ftpd 8
|
||||
service.
|
||||
.Pp
|
||||
The following options may be passed to the authentication module:
|
||||
.Bl -tag -width ".Cm no_warn"
|
||||
.It Cm debug
|
||||
.Xr syslog 3
|
||||
debugging information at
|
||||
.Dv LOG_DEBUG
|
||||
level.
|
||||
.It Cm no_warn
|
||||
suppress warning messages to the user.
|
||||
These messages include
|
||||
reasons why the user's
|
||||
authentication attempt was declined.
|
||||
.It Cm no_anon
|
||||
Disallow anonymous access.
|
||||
.It Cm ignore
|
||||
Ignore the password supplied,
|
||||
and do not use its constituent parts
|
||||
(username and hostname)
|
||||
as
|
||||
.Dv PAM_RUSER
|
||||
and
|
||||
.Dv PAM_RHOST
|
||||
respectively.
|
||||
.El
|
||||
.Sh SEE ALSO
|
||||
.Xr ftp 1 ,
|
||||
.Xr syslog 3 ,
|
||||
.Xr pam.conf 5 ,
|
||||
.Xr ftpd 8 ,
|
||||
.Xr pam 8
|
||||
@ -1,204 +0,0 @@
|
||||
/*-
|
||||
* Copyright (c) 2001 Mark R V Murray
|
||||
* All rights reserved.
|
||||
* Copyright (c) 2001 Networks Associates Technology, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Portions of this software were developed for the FreeBSD Project by
|
||||
* ThinkSec AS and NAI Labs, the Security Research Division of Network
|
||||
* Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
|
||||
* ("CBOSS"), as part of the DARPA CHATS research program.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the author may not be used to endorse or promote
|
||||
* products derived from this software without specific prior written
|
||||
* permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <sys/cdefs.h>
|
||||
__FBSDID("$FreeBSD$");
|
||||
|
||||
#define PROMPT "Password required for %s."
|
||||
#define GUEST_PROMPT "Guest login ok, send your e-mail address as password."
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <syslog.h>
|
||||
#include <stdarg.h>
|
||||
#include <string.h>
|
||||
|
||||
#define PAM_SM_AUTH
|
||||
|
||||
#include <security/pam_appl.h>
|
||||
#include <security/pam_modules.h>
|
||||
#include <security/pam_mod_misc.h>
|
||||
|
||||
enum {
|
||||
PAM_OPT_NO_ANON = PAM_OPT_STD_MAX,
|
||||
PAM_OPT_IGNORE,
|
||||
PAM_OPT_USERS
|
||||
};
|
||||
|
||||
static struct opttab other_options[] = {
|
||||
{ "no_anon", PAM_OPT_NO_ANON },
|
||||
{ "ignore", PAM_OPT_IGNORE },
|
||||
{ "users", PAM_OPT_USERS },
|
||||
{ NULL, 0 }
|
||||
};
|
||||
|
||||
static const char *anonusers[] = {"ftp", "anonymous", NULL};
|
||||
|
||||
/* Check if *user is in supplied *list or *anonusers[] list.
|
||||
* Place username in *userret
|
||||
* Return 1 if listed 0 otherwise
|
||||
*/
|
||||
static int
|
||||
lookup(const char *user, char *list, const char **userret)
|
||||
{
|
||||
int anon, i;
|
||||
char *item, *context, *locallist;
|
||||
|
||||
anon = 0;
|
||||
*userret = user; /* this is the default */
|
||||
if (list) {
|
||||
*userret = NULL;
|
||||
locallist = list;
|
||||
while ((item = strtok_r(locallist, ",", &context))) {
|
||||
if (*userret == NULL)
|
||||
*userret = item;
|
||||
if (strcmp(user, item) == 0) {
|
||||
anon = 1;
|
||||
break;
|
||||
}
|
||||
locallist = NULL;
|
||||
}
|
||||
}
|
||||
else {
|
||||
for (i = 0; anonusers[i] != NULL; i++) {
|
||||
if (strcmp(anonusers[i], user) == 0) {
|
||||
*userret = anonusers[0];
|
||||
anon = 1;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
return anon;
|
||||
}
|
||||
|
||||
/* Check if the user name is 'ftp' or 'anonymous'.
|
||||
* If this is the case, set the PAM_RUSER to the entered email address
|
||||
* and succeed, otherwise fail.
|
||||
*/
|
||||
PAM_EXTERN int
|
||||
pam_sm_authenticate(pam_handle_t * pamh, int flags __unused,
|
||||
int argc, const char *argv[])
|
||||
{
|
||||
struct options options;
|
||||
int retval, anon;
|
||||
char *users, *context, *token, *p;
|
||||
const char *user, *prompt;
|
||||
|
||||
pam_std_option(&options, other_options, argc, argv);
|
||||
|
||||
PAM_LOG("Options processed");
|
||||
|
||||
retval = pam_get_user(pamh, &user, NULL);
|
||||
if (retval != PAM_SUCCESS || user == NULL)
|
||||
return (PAM_USER_UNKNOWN);
|
||||
|
||||
PAM_LOG("Got user: %s", user);
|
||||
|
||||
users = NULL;
|
||||
if (pam_test_option(&options, PAM_OPT_USERS, &users))
|
||||
PAM_LOG("Got extra anonymous users: %s", users);
|
||||
|
||||
anon = 0;
|
||||
if (!pam_test_option(&options, PAM_OPT_NO_ANON, NULL))
|
||||
anon = lookup(user, users, &user);
|
||||
|
||||
PAM_LOG("Done user: %s", user);
|
||||
|
||||
if (anon) {
|
||||
retval = pam_set_item(pamh, PAM_USER, (const void *)user);
|
||||
if (retval != PAM_SUCCESS)
|
||||
return (retval);
|
||||
prompt = GUEST_PROMPT;
|
||||
PAM_LOG("Doing anonymous");
|
||||
}
|
||||
else {
|
||||
prompt = PROMPT;
|
||||
PAM_LOG("Doing non-anonymous");
|
||||
}
|
||||
|
||||
retval = pam_prompt(pamh, PAM_PROMPT_ECHO_OFF, &token, "%s", prompt);
|
||||
if (retval != PAM_SUCCESS)
|
||||
return (PAM_AUTHINFO_UNAVAIL);
|
||||
|
||||
PAM_LOG("Got password");
|
||||
|
||||
if (anon) {
|
||||
if (!pam_test_option(&options, PAM_OPT_IGNORE, NULL)) {
|
||||
p = strtok_r(token, "@", &context);
|
||||
if (p != NULL) {
|
||||
pam_set_item(pamh, PAM_RUSER, p);
|
||||
PAM_LOG("Got ruser: %s", p);
|
||||
if (retval == PAM_SUCCESS) {
|
||||
/* XXX XXX XXX */
|
||||
p = strtok_r(NULL, "@", &context);
|
||||
if (p != NULL) {
|
||||
pam_set_item(pamh, PAM_RHOST, p);
|
||||
PAM_LOG("Got rhost: %s", p);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
else {
|
||||
PAM_LOG("Ignoring supplied password structure");
|
||||
}
|
||||
|
||||
PAM_LOG("Done anonymous");
|
||||
|
||||
retval = PAM_SUCCESS;
|
||||
}
|
||||
else {
|
||||
pam_set_item(pamh, PAM_AUTHTOK, token);
|
||||
|
||||
PAM_VERBOSE_ERROR("Anonymous module reject");
|
||||
|
||||
PAM_LOG("Done non-anonymous");
|
||||
|
||||
retval = PAM_AUTH_ERR;
|
||||
}
|
||||
|
||||
return (retval);
|
||||
}
|
||||
|
||||
PAM_EXTERN int
|
||||
pam_sm_setcred(pam_handle_t * pamh __unused, int flags __unused,
|
||||
int argc __unused, const char *argv[] __unused)
|
||||
{
|
||||
|
||||
return (PAM_SUCCESS);
|
||||
}
|
||||
|
||||
PAM_MODULE_ENTRY("pam_ftp");
|
||||
@ -1,31 +0,0 @@
|
||||
# Copyright 2001 Mark R V Murray
|
||||
# All rights reserved.
|
||||
#
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
# modification, are permitted provided that the following conditions
|
||||
# are met:
|
||||
# 1. Redistributions of source code must retain the above copyright
|
||||
# notice, this list of conditions and the following disclaimer.
|
||||
# 2. Redistributions in binary form must reproduce the above copyright
|
||||
# notice, this list of conditions and the following disclaimer in the
|
||||
# documentation and/or other materials provided with the distribution.
|
||||
#
|
||||
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
# SUCH DAMAGE.
|
||||
#
|
||||
# $FreeBSD$
|
||||
|
||||
LIB= pam_wheel
|
||||
SRCS= pam_wheel.c
|
||||
MAN= pam_wheel.8
|
||||
|
||||
.include <bsd.lib.mk>
|
||||
@ -1,123 +0,0 @@
|
||||
.\" Copyright (c) 2001 Mark R V Murray
|
||||
.\" All rights reserved.
|
||||
.\"
|
||||
.\" Redistribution and use in source and binary forms, with or without
|
||||
.\" modification, are permitted provided that the following conditions
|
||||
.\" are met:
|
||||
.\" 1. Redistributions of source code must retain the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer.
|
||||
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||||
.\" notice, this list of conditions and the following disclaimer in the
|
||||
.\" documentation and/or other materials provided with the distribution.
|
||||
.\"
|
||||
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
.\" SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $FreeBSD$
|
||||
.\"
|
||||
.Dd July 8, 2001
|
||||
.Dt PAM_WHEEL 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
.Nm pam_wheel
|
||||
.Nd Wheel PAM module
|
||||
.Sh SYNOPSIS
|
||||
.Op Ar service-name
|
||||
.Ar module-type
|
||||
.Ar control-flag
|
||||
.Pa pam_wheel
|
||||
.Op Ar options
|
||||
.Sh DESCRIPTION
|
||||
The Wheel authentication service module for PAM,
|
||||
.Nm
|
||||
provides functionality for only one PAM category:
|
||||
authentication.
|
||||
In terms of the
|
||||
.Ar module-type
|
||||
parameter, this is the
|
||||
.Dq Li auth
|
||||
feature.
|
||||
It also provides a null function for session management.
|
||||
.Ss Wheel Authentication Module
|
||||
The Wheel authentication component
|
||||
.Pq Fn pam_sm_authenticate ,
|
||||
permit authentication to members of a group,
|
||||
which defaults to
|
||||
.Dq Li wheel .
|
||||
.Pp
|
||||
The following options may be passed to the authentication module:
|
||||
.Bl -tag -width ".Cm exempt_if_empty"
|
||||
.It Cm debug
|
||||
.Xr syslog 3
|
||||
debugging information at
|
||||
.Dv LOG_DEBUG
|
||||
level.
|
||||
.It Cm no_warn
|
||||
suppress warning messages to the user.
|
||||
These messages include
|
||||
reasons why the user's
|
||||
authentication attempt was declined.
|
||||
.It Cm auth_as_self
|
||||
check for
|
||||
.Dq Li wheel
|
||||
membership against
|
||||
the current login name
|
||||
(given by
|
||||
.Xr getlogin 2 ) .
|
||||
.It Cm trust
|
||||
return
|
||||
.Dv PAM_SUCCESS
|
||||
instead of
|
||||
.Dv PAM_IGNORE
|
||||
if the user is a member of the group (default is
|
||||
.Dq Li wheel ) .
|
||||
.It Cm deny
|
||||
invert the operation
|
||||
if the user is a member of the
|
||||
(default
|
||||
.Dq Li wheel )
|
||||
group.
|
||||
Returns failure instead of success.
|
||||
Mainly of use with the
|
||||
.Cm group Ns = Ns Ar foo
|
||||
option.
|
||||
.It Cm group Ns = Ns Ar foo
|
||||
checking for membership of group
|
||||
.Ar foo
|
||||
instead of the default group
|
||||
.Dq Li wheel .
|
||||
.It Cm noroot_ok
|
||||
return
|
||||
.Dv PAM_SUCCESS
|
||||
instead of
|
||||
.Dv PAM_IGNORE
|
||||
if the user is authenticating
|
||||
to a user
|
||||
that is not the superuser.
|
||||
.It Cm exempt_if_empty
|
||||
return
|
||||
.Dv PAM_IGNORE
|
||||
if the specified group (default group of
|
||||
.Dq Li wheel )
|
||||
is empty, providing traditional
|
||||
.Bx
|
||||
.Xr su 8
|
||||
semantics permitting any user to
|
||||
.Dq su
|
||||
if the wheel group is empty.
|
||||
.El
|
||||
.Sh SEE ALSO
|
||||
.Xr getlogin 2 ,
|
||||
.Xr syslog 3 ,
|
||||
.Xr group 5 ,
|
||||
.Xr pam.conf 5 ,
|
||||
.Xr pam 8
|
||||
@ -1,168 +0,0 @@
|
||||
/*-
|
||||
* Copyright (c) 2001 Mark R V Murray
|
||||
* All rights reserved.
|
||||
* Copyright (c) 2001 Networks Associates Technology, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Portions of this software were developed for the FreeBSD Project by
|
||||
* ThinkSec AS and NAI Labs, the Security Research Division of Network
|
||||
* Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
|
||||
* ("CBOSS"), as part of the DARPA CHATS research program.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the author may not be used to endorse or promote
|
||||
* products derived from this software without specific prior written
|
||||
* permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include <sys/cdefs.h>
|
||||
__FBSDID("$FreeBSD$");
|
||||
|
||||
#define _BSD_SOURCE
|
||||
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
#include <syslog.h>
|
||||
#include <stdarg.h>
|
||||
#include <sys/types.h>
|
||||
#include <pwd.h>
|
||||
#include <grp.h>
|
||||
|
||||
#define PAM_SM_AUTH
|
||||
|
||||
#include <security/pam_appl.h>
|
||||
#include <security/pam_modules.h>
|
||||
#include <security/pam_mod_misc.h>
|
||||
|
||||
|
||||
/* Is member in list? */
|
||||
static int
|
||||
in_list(char *const *list, const char *member)
|
||||
{
|
||||
for (; *list; list++)
|
||||
if (strcmp(*list, member) == 0)
|
||||
return 1;
|
||||
return 0;
|
||||
}
|
||||
|
||||
PAM_EXTERN int
|
||||
pam_sm_authenticate(pam_handle_t * pamh, int flags __unused,
|
||||
int argc __unused, const char *argv[] __unused)
|
||||
{
|
||||
struct passwd *pwd;
|
||||
struct group *grp;
|
||||
int retval;
|
||||
uid_t tuid;
|
||||
const char *user, *targetuser;
|
||||
const char *use_group;
|
||||
|
||||
retval = pam_get_user(pamh, &targetuser, NULL);
|
||||
if (retval != PAM_SUCCESS)
|
||||
return (retval);
|
||||
pwd = getpwnam(targetuser);
|
||||
if (pwd != NULL)
|
||||
tuid = pwd->pw_uid;
|
||||
else
|
||||
return (PAM_AUTH_ERR);
|
||||
|
||||
PAM_LOG("Got target user: %s uid: %d", targetuser, tuid);
|
||||
|
||||
if (openpam_get_option(pamh, "auth_as_self")) {
|
||||
pwd = getpwnam(getlogin());
|
||||
user = strdup(pwd->pw_name);
|
||||
}
|
||||
else {
|
||||
user = targetuser;
|
||||
pwd = getpwnam(user);
|
||||
}
|
||||
if (pwd == NULL)
|
||||
return (PAM_AUTH_ERR);
|
||||
|
||||
PAM_LOG("Got user: %s", user);
|
||||
PAM_LOG("User's primary uid, gid: %d, %d", pwd->pw_uid, pwd->pw_gid);
|
||||
|
||||
/* Ignore if already uid 0 */
|
||||
if (pwd->pw_uid == 0)
|
||||
return (PAM_IGNORE);
|
||||
|
||||
PAM_LOG("Not superuser");
|
||||
|
||||
/* If authenticating as something non-superuser, return OK */
|
||||
if (openpam_get_option(pamh, "noroot_ok"))
|
||||
if (tuid != 0)
|
||||
return (PAM_SUCCESS);
|
||||
|
||||
PAM_LOG("Checking group");
|
||||
|
||||
if ((use_group = openpam_get_option(pamh, "group")) == NULL) {
|
||||
if ((grp = getgrnam("wheel")) == NULL)
|
||||
grp = getgrgid(0);
|
||||
}
|
||||
else
|
||||
grp = getgrnam(use_group);
|
||||
|
||||
if (grp == NULL || grp->gr_mem == NULL) {
|
||||
if (openpam_get_option(pamh, "deny"))
|
||||
return (PAM_IGNORE);
|
||||
else {
|
||||
PAM_VERBOSE_ERROR("Permission denied");
|
||||
return (PAM_AUTH_ERR);
|
||||
}
|
||||
}
|
||||
|
||||
PAM_LOG("Got group: %s", grp->gr_name);
|
||||
|
||||
/* If the group is empty, see if we exempt empty groups. */
|
||||
if (*(grp->gr_mem) == NULL) {
|
||||
if (openpam_get_option(pamh, "exempt_if_empty"))
|
||||
return (PAM_IGNORE);
|
||||
}
|
||||
|
||||
if (pwd->pw_gid == grp->gr_gid || in_list(grp->gr_mem, pwd->pw_name)) {
|
||||
if (openpam_get_option(pamh, "deny")) {
|
||||
PAM_VERBOSE_ERROR("Member of group %s; denied",
|
||||
grp->gr_name);
|
||||
return (PAM_PERM_DENIED);
|
||||
}
|
||||
if (openpam_get_option(pamh, "trust"))
|
||||
return (PAM_SUCCESS);
|
||||
return (PAM_IGNORE);
|
||||
}
|
||||
|
||||
if (openpam_get_option(pamh, "deny"))
|
||||
return (PAM_SUCCESS);
|
||||
|
||||
PAM_VERBOSE_ERROR("Not member of group %s; denied", grp->gr_name);
|
||||
|
||||
return (PAM_PERM_DENIED);
|
||||
}
|
||||
|
||||
PAM_EXTERN int
|
||||
pam_sm_setcred(pam_handle_t * pamh __unused, int flags __unused,
|
||||
int argc __unused, const char *argv[] __unused)
|
||||
{
|
||||
|
||||
return (PAM_SUCCESS);
|
||||
}
|
||||
|
||||
PAM_MODULE_ENTRY("pam_wheel");
|
||||
Loading…
Reference in New Issue
Block a user