ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-04-03 12:30:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

PAM improvements

Browse Source 
--HG--
branch : private-rez
extra : convert_revision : c8f9300c5d598fe6003fcf19c831f5982620ec98
This commit is contained in:
Matt Johnston 2004-09-14 12:51:16 +00:00
parent fa26b59b0c
commit 099c9a3232
4 changed files with 44 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
options.h
View File

@ -110,12 +110,18 @@ etc) slower (perhaps by 50%). Recommended for most small systems. */
#define MOTD_FILENAME "/etc/motd"
#endif
/* Authentication types to enable, at least one required.
/* Authentication Types - at least one required.
RFC Draft requires pubkey auth, and recommends password */
/* PAM auth is quite simple, and only works for PAM modules which just do a
* simple "Login: " "Password: " (or something like that - if your module is
* similar but not quite like that, edit the strings in svr-authpam.c).
* Basically, it's useful for systems like OS X where standard password crypts
* don't work, but there's and interface via a PAM module. You'll need to
* configure with --enable-pam as well, since it's off by default. And you
* should only enable either PASSWORD _or_ PAM auth, not both. */
/*#define ENABLE_SVR_PASSWORD_AUTH*/
/* Only set PAM auth if you aren't using SVR_PASSWORD_AUTH. Also, you'll need
* to make sure PAM libraries etc are installed. To the client, PAM auth looks
* just like password auth. */
#define ENABLE_SVR_PAM_AUTH
#define ENABLE_SVR_PUBKEY_AUTH

2
svr-auth.c
View File

@ -55,7 +55,7 @@ static void authclear() {
#ifdef ENABLE_SVR_PUBKEY_AUTH
ses.authstate.authtypes |= AUTH_TYPE_PUBKEY;
#endif
#if defined(ENABLE_SVR_PUBKEY_AUTH) || defined(ENABLE_SVR_PAM_AUTH)
#if defined(ENABLE_SVR_PASSWORD_AUTH) || defined(ENABLE_SVR_PAM_AUTH)
if (!svr_opts.noauthpass) {
ses.authstate.authtypes |= AUTH_TYPE_PASSWORD;
}

52
svr-authpam.c
View File

@ -1,7 +1,8 @@
/*
* Dropbear - a SSH2 server
* Dropbear SSH
*
* Copyright (c) 2002,2003 Matt Johnston
* Copyright (c) 2004 Martin Carlsson
* Portions (c) 2004 Matt Johnston
* All rights reserved.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
@ -22,7 +23,7 @@
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE. */
/* Validates a user password */
/* Validates a user password using PAM */
#include "includes.h"
#include "session.h"
@ -51,9 +52,19 @@ pamConvFunc(int num_msg,
int rc = PAM_SUCCESS;
struct pam_response* resp = NULL;
struct UserDataS* userDatap = (struct UserDataS*) appdata_ptr;
const char* message = (*msg)->msg;
TRACE(("enter pamConvFunc"));
if (num_msg != 1) {
/* If you're getting here - Dropbear probably can't support your pam
* modules. This whole file is a bit of a hack around lack of
* asynchronocity in PAM anyway */
dropbear_log(LOG_INFO, "pamConvFunc() called with >1 messages: not supported.");
return PAM_CONV_ERR;
}
TRACE(("msg_style is %d", (*msg)->msg_style));
if (message) {
TRACE(("message is '%s'", message));
@ -71,11 +82,14 @@ pamConvFunc(int num_msg,
break;
}
/* XXX leak */
/* This looks leaky, but the PAM module-writer docs
* assure us that the caller will free it... */
resp = (struct pam_response*) m_malloc(sizeof(struct pam_response));
/* XXX leak */
resp->resp = (char*) m_strdup(userDatap->passwd);
resp->resp_retcode = 0;
memset(resp, 0, sizeof(struct pam_response));
/* Safe to just use the direct pointer (no strdup) since
* it shouldn't be getting munged at all */
resp->resp = userDatap->passwd;
(*respp) = resp;
break;
@ -90,24 +104,18 @@ pamConvFunc(int num_msg,
break;
}
/* XXX leak */
/* This looks leaky, but the PAM module-writer docs
* assure us that the caller will free it... */
resp = (struct pam_response*) m_malloc(sizeof(struct pam_response));
/* XXX leak */
resp->resp = (char*) m_strdup(userDatap->user);
memset(resp, 0, sizeof(struct pam_response));
/* Safe to just use the direct pointer (no strdup) since
* it shouldn't be getting munged at all */
resp->resp = userDatap->user;
TRACE(("userDatap->user='%s'", userDatap->user));
resp->resp_retcode = 0;
(*respp) = resp;
break;
case PAM_ERROR_MSG:
case PAM_TEXT_INFO:
case PAM_RADIO_TYPE:
case PAM_BINARY_PROMPT:
TRACE(("Unhandled message type"));
rc = PAM_CONV_ERR;
break;
default:
TRACE(("Unknown message type"));
rc = PAM_CONV_ERR;
@ -120,7 +128,9 @@ pamConvFunc(int num_msg,
}
/* Process a password auth request, sending success or failure messages as
* appropriate. To the client it looks like it's doing normal password auth (as opposed to keyboard-interactive or something), so the pam module has to be fairly standard (ie just "what's your username, what's your password, OK").
* appropriate. To the client it looks like it's doing normal password auth (as
* opposed to keyboard-interactive or something), so the pam module has to be
* fairly standard (ie just "what's your username, what's your password, OK").
*
* Keyboard interactive would be a lot nicer, but since PAM is synchronous, it
* gets very messy trying to send the interactive challenges, and read the

4
svr-runopts.c
View File

@ -59,7 +59,7 @@ static void printhelp(const char * progname) {
"-m Don't display the motd on login\n"
#endif
"-w Disallow root logins\n"
#ifdef ENABLE_SVR_PASSWORD_AUTH
#if defined(ENABLE_SVR_PASSWORD_AUTH) || defined(ENABLE_SVR_PAM_AUTH)
"-s Disable password logins\n"
"-g Disable password logins for root\n"
#endif
@ -183,7 +183,7 @@ void svr_getopts(int argc, char ** argv) {
case 'w':
svr_opts.norootlogin = 1;
break;
#ifdef ENABLE_SVR_PASSWORD_AUTH
#if defined(ENABLE_SVR_PASSWORD_AUTH) || defined(ENABLE_SVR_PAM_AUTH)
case 's':
svr_opts.noauthpass = 1;
break;