2 * Copyright 2000, International Business Machines Corporation and others.
5 * This software has been released under the terms of the IBM Public
6 * License. For details, see the LICENSE file in the top-level source
7 * directory or online at http://www.openafs.org/dl/license10.html
10 #include <afsconfig.h>
11 #include <afs/param.h>
15 #ifdef HAVE_SYS_WAIT_H
19 #include <afs/sys_prototypes.h>
20 #include <afs/kautils.h>
22 #include <security/pam_appl.h>
23 #include <security/pam_modules.h>
25 #include "afs_message.h"
26 #include "afs_pam_msg.h"
29 #define RET(x) { retcode = (x); goto out; }
32 pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc,
35 int retcode = PAM_SUCCESS;
36 int errcode = PAM_SUCCESS;
39 int logmask = LOG_UPTO(LOG_INFO);
41 int use_first_pass = 0;
42 int try_first_pass = 0;
44 uid_t ignore_uid_id = 0;
45 char my_password_buf[256];
46 char *cell_ptr = NULL;
48 * these options are added to handle stupid apps, which won't call
51 int refresh_token = 0;
57 int got_authtok = 0; /* got PAM_AUTHTOK upon entry */
58 PAM_CONST char *user = NULL, *password = NULL;
59 afs_int32 password_expires = -1;
60 char *torch_password = NULL;
62 PAM_CONST struct pam_conv *pam_convp = NULL;
64 struct passwd *upwd = NULL;
68 struct sigaction newAction, origAction;
69 #if !(defined(AFS_LINUX20_ENV) || defined(AFS_FBSD_ENV) || defined(AFS_DFBSD_ENV) || defined(AFS_NBSD_ENV))
70 char upwd_buf[2048]; /* size is a guess. */
71 struct passwd unix_pwd;
76 openlog(pam_afs_ident, LOG_CONS | LOG_PID, LOG_AUTH);
78 origmask = setlogmask(logmask);
81 * Parse the user options. Log an error for any unknown options.
83 for (i = 0; i < argc; i++) {
84 if (strcasecmp(argv[i], "debug") == 0) {
85 logmask |= LOG_MASK(LOG_DEBUG);
86 (void)setlogmask(logmask);
87 } else if (strcasecmp(argv[i], "nowarn") == 0) {
89 } else if (strcasecmp(argv[i], "use_first_pass") == 0) {
91 } else if (strcasecmp(argv[i], "try_first_pass") == 0) {
93 } else if (strcasecmp(argv[i], "ignore_root") == 0) {
96 } else if (strcasecmp(argv[i], "ignore_uid") == 0) {
99 pam_afs_syslog(LOG_ERR, PAMAFS_IGNOREUID,
100 "ignore_uid missing argument");
104 ignore_uid_id = (uid_t) strtol(argv[i], (char **)NULL, 10);
105 if (ignore_uid_id > IGNORE_MAX) {
107 pam_afs_syslog(LOG_ERR, PAMAFS_IGNOREUID, argv[i]);
110 } else if (strcasecmp(argv[i], "cell") == 0) {
113 pam_afs_syslog(LOG_ERR, PAMAFS_OTHERCELL,
114 "cell missing argument");
116 cell_ptr = (char *)argv[i];
117 pam_afs_syslog(LOG_INFO, PAMAFS_OTHERCELL, cell_ptr);
119 } else if (strcasecmp(argv[i], "refresh_token") == 0) {
121 } else if (strcasecmp(argv[i], "set_token") == 0) {
123 } else if (strcasecmp(argv[i], "dont_fork") == 0) {
127 pam_afs_syslog(LOG_ERR, PAMAFS_CONFLICTOPT, "dont_fork");
128 } else if (strcasecmp(argv[i], "use_klog") == 0) {
132 pam_afs_syslog(LOG_ERR, PAMAFS_CONFLICTOPT, "use_klog");
133 } else if (strcasecmp(argv[i], "setenv_password_expires") == 0) {
136 pam_afs_syslog(LOG_ERR, PAMAFS_UNKNOWNOPT, argv[i]);
140 /* Later we use try_first_pass to see if we can try again. */
141 /* If use_first_pass is true we don't want to ever try again, */
142 /* so turn that flag off right now. */
146 if (logmask & LOG_MASK(LOG_DEBUG))
147 pam_afs_syslog(LOG_DEBUG, PAMAFS_OPTIONS, nowarn, use_first_pass,
148 try_first_pass, ignore_uid, ignore_uid_id,
149 refresh_token, set_token, dont_fork, use_klog);
151 /* Try to get the user-interaction info, if available. */
152 errcode = pam_get_item(pamh, PAM_CONV, (PAM_CONST void **)&pam_convp);
153 if (errcode != PAM_SUCCESS) {
154 pam_afs_syslog(LOG_WARNING, PAMAFS_NO_USER_INT);
158 /* Who are we trying to authenticate here? */
160 pam_get_user(pamh, &user,
161 "login: ")) != PAM_SUCCESS) {
162 pam_afs_syslog(LOG_ERR, PAMAFS_NOUSER, errcode);
163 RET(PAM_USER_UNKNOWN);
166 if (logmask & LOG_MASK(LOG_DEBUG))
167 pam_afs_syslog(LOG_DEBUG, PAMAFS_USERNAMEDEBUG, user);
170 * If the user has a "local" (or via nss, possibly nss_dce) pwent,
171 * and its uid==0, and "ignore_root" was given in pam.conf,
174 /* enhanced: use "ignore_uid <number>" to specify the largest uid
175 * which should be ignored by this module
177 #if defined(AFS_HPUX_ENV) || defined(AFS_DARWIN100_ENV) || defined(AFS_SUN5_ENV)
178 #if defined(AFS_HPUX110_ENV) || defined(AFS_DARWIN100_ENV) || defined(AFS_SUN5_ENV)
179 i = getpwnam_r(user, &unix_pwd, upwd_buf, sizeof(upwd_buf), &upwd);
180 #else /* AFS_HPUX110_ENV */
181 i = getpwnam_r(user, &unix_pwd, upwd_buf, sizeof(upwd_buf));
182 if (i == 0) /* getpwnam_r success */
184 #endif /* else AFS_HPUX110_ENV */
185 if (ignore_uid && i == 0 && upwd && upwd->pw_uid <= ignore_uid_id) {
186 pam_afs_syslog(LOG_INFO, PAMAFS_IGNORINGROOT, user);
190 #if defined(AFS_LINUX20_ENV) || defined(AFS_FBSD_ENV) || defined(AFS_DFBSD_ENV) || defined(AFS_NBSD_ENV)
191 upwd = getpwnam(user);
193 upwd = getpwnam_r(user, &unix_pwd, upwd_buf, sizeof(upwd_buf));
195 if (ignore_uid && upwd != NULL && upwd->pw_uid <= ignore_uid_id) {
196 pam_afs_syslog(LOG_INFO, PAMAFS_IGNORINGROOT, user);
200 errcode = pam_get_item(pamh, PAM_AUTHTOK, (PAM_CONST void **)&password);
201 if (errcode != PAM_SUCCESS || password == NULL) {
202 if (use_first_pass) {
203 pam_afs_syslog(LOG_ERR, PAMAFS_PASSWD_REQ, user);
206 password = NULL; /* In case it isn't already NULL */
207 if (logmask & LOG_MASK(LOG_DEBUG))
208 pam_afs_syslog(LOG_DEBUG, PAMAFS_NOFIRSTPASS, user);
209 } else if (password[0] == '\0') {
210 /* Actually we *did* get one but it was empty. */
211 pam_afs_syslog(LOG_INFO, PAMAFS_NILPASSWORD, user);
212 RET(PAM_NEW_AUTHTOK_REQD);
214 if (logmask & LOG_MASK(LOG_DEBUG))
215 pam_afs_syslog(LOG_DEBUG, PAMAFS_GOTPASS, user);
218 if (!(use_first_pass || try_first_pass)) {
223 if (password == NULL) {
224 char *prompt_password;
227 RET(PAM_AUTH_ERR); /* shouldn't happen */
229 try_first_pass = 0; /* we come back if try_first_pass==1 below */
231 if (pam_convp == NULL || pam_convp->conv == NULL) {
232 pam_afs_syslog(LOG_ERR, PAMAFS_CANNOT_PROMPT);
236 errcode = pam_afs_prompt(pam_convp, &prompt_password, 0, PAMAFS_PWD_PROMPT);
237 if (errcode != PAM_SUCCESS || prompt_password == NULL) {
238 pam_afs_syslog(LOG_ERR, PAMAFS_GETPASS_FAILED);
241 if (prompt_password[0] == '\0') {
242 pam_afs_syslog(LOG_INFO, PAMAFS_NILPASSWORD, user);
243 RET(PAM_NEW_AUTHTOK_REQD);
247 * We aren't going to free the password later (we will wipe it,
248 * though), because the storage for it if we get it from other
249 * paths may belong to someone else. Since we do need to free
250 * this storage, copy it to a buffer that won't need to be freed
251 * later, and free this storage now.
254 strncpy(my_password_buf, prompt_password, sizeof(my_password_buf));
255 my_password_buf[sizeof(my_password_buf) - 1] = '\0';
256 memset(prompt_password, 0, strlen(prompt_password));
257 free(prompt_password);
258 password = torch_password = my_password_buf;
262 /* Be sure to allocate a PAG here if we should set a token,
263 * All of the remaining stuff to authenticate the user and to
264 * get a token is done in a child process - if not suppressed by the config,
266 * But dont get a PAG if the refresh_token option was set
267 * We have to do this in such a way because some
268 * apps (such as screensavers) wont call setcred but authenticate :-(
270 if (!refresh_token) {
272 #ifdef AFS_KERBEROS_ENV
275 if (logmask & LOG_MASK(LOG_DEBUG))
276 syslog(LOG_DEBUG, "New PAG created in pam_authenticate()");
280 /* Prepare for fork(): set SIGCHLD signal handler to default */
281 sigemptyset(&newAction.sa_mask);
282 newAction.sa_handler = SIG_DFL;
283 newAction.sa_flags = 0;
284 code = sigaction(SIGCHLD, &newAction, &origAction);
286 pam_afs_syslog(LOG_ERR, PAMAFS_PAMERROR, errno);
290 /* Fork a process and let it verify authentication. So that any
291 * memory/sockets allocated will get cleaned up when the child
292 * exits: defect 11686.
294 if (use_klog) { /* used by kdm 2.x */
295 if (refresh_token || set_token) {
296 i = do_klog(user, password, NULL, cell_ptr);
298 i = do_klog(user, password, "00:00:01", cell_ptr);
299 ktc_ForgetAllTokens();
301 if (logmask & LOG_MASK(LOG_DEBUG))
302 syslog(LOG_DEBUG, "do_klog returned %d", i);
305 if (logmask & LOG_MASK(LOG_DEBUG))
306 syslog(LOG_DEBUG, "forking ...");
308 if (cpid <= 0) { /* The child process */
309 if (logmask & LOG_MASK(LOG_DEBUG))
310 syslog(LOG_DEBUG, "in child");
311 if (refresh_token || set_token)
312 code = ka_UserAuthenticateGeneral(KA_USERAUTH_VERSION, (char *)user, /* kerberos name */
314 cell_ptr, /* realm */
315 (char *)password, /* password */
316 0, /* default lifetime */
317 &password_expires, 0, /* spare 2 */
319 /* error string */ );
321 code = ka_VerifyUserPassword(KA_USERAUTH_VERSION, (char *)user, /* kerberos name */
323 cell_ptr, /* realm */
324 (char *)password, /* password */
326 &reason /* error string */ );
328 pam_afs_syslog(LOG_ERR, PAMAFS_LOGIN_FAILED, user,
334 if (logmask & LOG_MASK(LOG_DEBUG))
335 syslog(LOG_DEBUG, "child: auth_ok=%d", auth_ok);
340 if (logmask & LOG_MASK(LOG_DEBUG))
341 syslog(LOG_DEBUG, "in parent, waiting ...");
342 rcpid = waitpid(cpid, &status, 0);
343 } while ((rcpid == -1) && (errno == EINTR));
345 if ((rcpid == cpid) && WIFEXITED(status)) {
346 auth_ok = WEXITSTATUS(status);
350 if (logmask & LOG_MASK(LOG_DEBUG))
351 syslog(LOG_DEBUG, "parent: auth_ok=%d", auth_ok);
354 /* Restore old signal handler */
355 code = sigaction(SIGCHLD, &origAction, NULL);
357 pam_afs_syslog(LOG_ERR, PAMAFS_PAMERROR, errno);
359 } else { /* dont_fork, used by httpd */
360 if (logmask & LOG_MASK(LOG_DEBUG))
361 syslog(LOG_DEBUG, "dont_fork");
362 if (refresh_token || set_token)
363 code = ka_UserAuthenticateGeneral(KA_USERAUTH_VERSION, (char *)user, /* kerberos name */
365 cell_ptr, /* realm */
366 (char *)password, /* password */
367 0, /* default lifetime */
368 &password_expires, 0, /* spare 2 */
369 &reason /* error string */ );
371 code = ka_VerifyUserPassword(KA_USERAUTH_VERSION, (char *)user, /* kerberos name */
373 cell_ptr, /* realm */
374 (char *)password, /* password */
376 &reason /* error string */ );
377 if (logmask & LOG_MASK(LOG_DEBUG))
378 syslog(LOG_DEBUG, "dont_fork, code = %d", code);
380 pam_afs_syslog(LOG_ERR, PAMAFS_LOGIN_FAILED, user, reason);
385 if (logmask & LOG_MASK(LOG_DEBUG))
386 syslog(LOG_DEBUG, "dont_fork: auth_ok=%d", auth_ok);
389 if (!auth_ok && try_first_pass) {
394 /* We don't care if this fails; all we can do is try. */
395 /* It is not reasonable to store the password only if it was correct
396 * because it could satisfy another module that is called in the chain
400 torch_password = NULL;
401 (void)pam_set_item(pamh, PAM_AUTHTOK, password);
404 if (logmask & LOG_MASK(LOG_DEBUG))
405 syslog(LOG_DEBUG, "leaving auth: auth_ok=%d", auth_ok);
407 RET(PAM_USER_UNKNOWN);
408 RET(auth_ok ? PAM_SUCCESS : PAM_AUTH_ERR);
412 /* we store the password in the data portion */
413 char *tmp = strdup(password);
414 (void)pam_set_data(pamh, pam_afs_lh, tmp, lc_cleanup);
416 memset(torch_password, 0, strlen(torch_password));
418 (void)setlogmask(origmask);