ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-04-22 07:05:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

- Test for pam_fail_delay() function in configure

Browse Source 
- Recognise "username:" as a PAM prompt
- Add some randomness to the auth-failure delay
- Fix wrongly committed options.h/debug.h

--HG--
extra : convert_revision : f242f0e66fb0ea5d3b374995d2f548d37dd8f3a3
This commit is contained in:
Matt Johnston 2009-09-08 14:53:53 +00:00
parent 4dfb834f7c
commit 52551cb771
5 changed files with 21 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
configure.in
View File

@ -146,6 +146,7 @@ AC_ARG_ENABLE(pam,
if test "x$enableval" = "xyes"; then if test "x$enableval" = "xyes"; then
AC_CHECK_LIB(pam, pam_authenticate, , AC_MSG_ERROR([*** PAM missing - install first or check config.log ***])) AC_CHECK_LIB(pam, pam_authenticate, , AC_MSG_ERROR([*** PAM missing - install first or check config.log ***]))
AC_MSG_NOTICE(Enabling PAM) AC_MSG_NOTICE(Enabling PAM)
AC_CHECK_FUNCS(pam_fail_delay)
else else
AC_DEFINE(DISABLE_PAM,, Use PAM) AC_DEFINE(DISABLE_PAM,, Use PAM)
AC_MSG_NOTICE(Disabling PAM) AC_MSG_NOTICE(Disabling PAM)

2
debug.h
View File

@ -39,7 +39,7 @@
* Caution: Don't use this in an unfriendly environment (ie unfirewalled), * Caution: Don't use this in an unfriendly environment (ie unfirewalled),
* since the printing may not sanitise strings etc. This will add a reasonable * since the printing may not sanitise strings etc. This will add a reasonable
* amount to your executable size. */ * amount to your executable size. */
#define DEBUG_TRACE /*#define DEBUG_TRACE */
/* All functions writing to the cleartext payload buffer call /* All functions writing to the cleartext payload buffer call
* CHECKCLEARTOWRITE() before writing. This is only really useful if you're * CHECKCLEARTOWRITE() before writing. This is only really useful if you're

4
options.h
View File

@ -167,9 +167,9 @@ much traffic. */
* but there's an interface via a PAM module - don't bother using it otherwise. * but there's an interface via a PAM module - don't bother using it otherwise.
* You can't enable both PASSWORD and PAM. */ * You can't enable both PASSWORD and PAM. */
/*#define ENABLE_SVR_PASSWORD_AUTH*/ #define ENABLE_SVR_PASSWORD_AUTH
/* PAM requires ./configure --enable-pam */ /* PAM requires ./configure --enable-pam */
#define ENABLE_SVR_PAM_AUTH /*#define ENABLE_SVR_PAM_AUTH*/
#define ENABLE_SVR_PUBKEY_AUTH #define ENABLE_SVR_PUBKEY_AUTH
/* Whether to take public key options in /* Whether to take public key options in

8
svr-auth.c
View File

@ -33,6 +33,7 @@
#include "packet.h" #include "packet.h"
#include "auth.h" #include "auth.h"
#include "runopts.h" #include "runopts.h"
#include "random.h"
static void authclear(); static void authclear();
static int checkusername(unsigned char *username, unsigned int userlen); static int checkusername(unsigned char *username, unsigned int userlen);
@ -337,7 +338,12 @@ void send_msg_userauth_failure(int partial, int incrfail) {
encrypt_packet(); encrypt_packet();
if (incrfail) { if (incrfail) {
usleep(300000); /* XXX improve this */ unsigned int delay;
genrandom((unsigned char*)&delay, sizeof(delay));
/* We delay for 300ms +- 50ms, 0.1ms granularity */
delay = 250000 + (delay % 1000)*100;
usleep(delay);
dropbear_log(LOG_INFO, "delay is %d", delay);
ses.authstate.failcount++; ses.authstate.failcount++;
} }

14
svr-authpam.c
View File

@ -102,7 +102,7 @@ pamConvFunc(int num_msg,
/* We don't recognise the prompt as asking for a password, /* We don't recognise the prompt as asking for a password,
so can't handle it. Add more above as required for so can't handle it. Add more above as required for
different pam modules/implementations */ different pam modules/implementations */
dropbear_log(LOG_NOTICE, "PAM unknown prompt %s (no echo)", dropbear_log(LOG_NOTICE, "PAM unknown prompt '%s' (no echo)",
compare_message); compare_message);
rc = PAM_CONV_ERR; rc = PAM_CONV_ERR;
break; break;
@ -123,12 +123,15 @@ pamConvFunc(int num_msg,
case PAM_PROMPT_ECHO_ON: case PAM_PROMPT_ECHO_ON:
if (!((strcmp(compare_message, "login:" ) == 0) if (!(
|| (strcmp(compare_message, "please enter username:") == 0))) { (strcmp(compare_message, "login:" ) == 0)
|| (strcmp(compare_message, "please enter username:") == 0)
|| (strcmp(compare_message, "username:") == 0)
)) {
/* We don't recognise the prompt as asking for a username, /* We don't recognise the prompt as asking for a username,
so can't handle it. Add more above as required for so can't handle it. Add more above as required for
different pam modules/implementations */ different pam modules/implementations */
dropbear_log(LOG_NOTICE, "PAM unknown prompt %s (with echo)", dropbear_log(LOG_NOTICE, "PAM unknown prompt '%s' (with echo)",
compare_message); compare_message);
rc = PAM_CONV_ERR; rc = PAM_CONV_ERR;
break; break;
@ -212,7 +215,10 @@ void svr_auth_pam() {
goto cleanup; goto cleanup;
} }
#ifdef HAVE_PAM_FAIL_DELAY
/* We have our own random delay code already, disable PAM's */
(void) pam_fail_delay(pamHandlep, 0 /* musec_delay */); (void) pam_fail_delay(pamHandlep, 0 /* musec_delay */);
#endif
/* (void) pam_set_item(pamHandlep, PAM_FAIL_DELAY, (void*) pamDelayFunc); */ /* (void) pam_set_item(pamHandlep, PAM_FAIL_DELAY, (void*) pamDelayFunc); */