From 5ca12d8332f82afd5df9df7a9894d291a5e1c884 Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Tue, 24 Jul 2018 20:19:05 +0800 Subject: [PATCH 1/5] avoid extended regex features to avoid caring about sed -r vs -E --- ifndef_wrapper.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ifndef_wrapper.sh b/ifndef_wrapper.sh index e2545d4..37a208d 100755 --- a/ifndef_wrapper.sh +++ b/ifndef_wrapper.sh @@ -2,6 +2,6 @@ # Wrap all "#define X Y" with a #ifndef X...#endif" -sed -E 's/^( *#define ([^ ]+) .*)/#ifndef \2\ +sed 's/^\( *#define \([^ ][^ ]*\) .*\)/#ifndef \2\ \1\ #endif/' From 1ae4237920c3bd7f2fa6958d2a390f6693852285 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Perrad?= Date: Wed, 28 Feb 2018 15:10:14 +0100 Subject: [PATCH 2/5] fix #endif (#59) --- svr-auth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/svr-auth.c b/svr-auth.c index 64d97aa..c19c090 100644 --- a/svr-auth.c +++ b/svr-auth.c @@ -312,7 +312,7 @@ static int checkusername(const char *username, unsigned int userlen) { return DROPBEAR_FAILURE; } } -#endif HAVE_GETGROUPLIST +#endif /* HAVE_GETGROUPLIST */ TRACE(("shell is %s", ses.authstate.pw_shell)) From a0972e0ac6396bcddf528f7dff5f63451afb861f Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Thu, 1 Mar 2018 22:12:30 +0800 Subject: [PATCH 3/5] mention localoptions.h being build directory, fix underscore in CHANGES --- CHANGES | 4 ++-- INSTALL | 2 ++ default_options.h | 4 ++-- options.h | 1 + 4 files changed, 7 insertions(+), 4 deletions(-) diff --git a/CHANGES b/CHANGES index 106c694..74b843a 100644 --- a/CHANGES +++ b/CHANGES @@ -2,12 +2,12 @@ > > > Configuration/compatibility changes IMPORTANT - Custom configuration is now specified in local_options.h rather than options.h + Custom configuration is now specified in localoptions.h rather than options.h Available options and defaults can be seen in default_options.h To migrate your configuration, compare your customised options.h against the upstream options.h from your relevant version. Any customised options should - be put in localoptions.h + be put in localoptions.h in the build directory. - "configure --enable-static" should now be used instead of "make STATIC=1" This will avoid 'hardened build' flags that conflict with static binaries diff --git a/INSTALL b/INSTALL index ce0637f..7dc4444 100644 --- a/INSTALL +++ b/INSTALL @@ -3,6 +3,8 @@ Basic Dropbear build instructions: - Edit localoptions.h to set which features you want. Available options are described in default_options.h, these will be overridden by anything set in localoptions.h + localoptions.h should be located in the build directory if you are + building out of tree. - If using a Mercurial or Git checkout, "autoconf; autoheader" diff --git a/default_options.h b/default_options.h index 3b75eb8..86fb25a 100644 --- a/default_options.h +++ b/default_options.h @@ -6,8 +6,8 @@ default_options.h documents compile-time options, and provides default values. Local customisation should be added to localoptions.h which is -used if it exists. Options defined there will override any options in this -file. +used if it exists in the build directory. Options defined there will override +any options in this file. Options can also be defined with -DDROPBEAR_XXX=[0,1] in Makefile CFLAGS diff --git a/options.h b/options.h index 7d6087c..c12cfc9 100644 --- a/options.h +++ b/options.h @@ -5,6 +5,7 @@ > > > Don't edit this file any more! < < < Local compile-time configuration should be defined in localoptions.h +in the build directory. See default_options.h.in for a description of the available options. */ From 90f04384eeb0a80b9f5ee19823702a612ba1653d Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Thu, 23 Aug 2018 22:10:07 +0800 Subject: [PATCH 4/5] fix error message to say localoptions.h --- sysoptions.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sysoptions.h b/sysoptions.h index 1666a1e..3f5c5e6 100644 --- a/sysoptions.h +++ b/sysoptions.h @@ -225,7 +225,7 @@ If you test it please contact the Dropbear author */ #define DROPBEAR_ZLIB_MEM_LEVEL 8 #if (DROPBEAR_SVR_PASSWORD_AUTH) && (DROPBEAR_SVR_PAM_AUTH) -#error "You can't turn on PASSWORD and PAM auth both at once. Fix it in options.h" +#error "You can't turn on PASSWORD and PAM auth both at once. Fix it in localoptions.h" #endif /* PAM requires ./configure --enable-pam */ From 52adbb34c32d3e2e1bcdb941e20a6f81138b8248 Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Thu, 23 Aug 2018 23:43:12 +0800 Subject: [PATCH 5/5] Wait to fail invalid usernames --- auth.h | 6 +++--- svr-auth.c | 19 +++++-------------- svr-authpam.c | 26 ++++++++++++++++++++++---- svr-authpasswd.c | 27 ++++++++++++++------------- svr-authpubkey.c | 11 ++++++++++- 5 files changed, 54 insertions(+), 35 deletions(-) diff --git a/auth.h b/auth.h index da498f5..98f5468 100644 --- a/auth.h +++ b/auth.h @@ -37,9 +37,9 @@ void recv_msg_userauth_request(void); void send_msg_userauth_failure(int partial, int incrfail); void send_msg_userauth_success(void); void send_msg_userauth_banner(const buffer *msg); -void svr_auth_password(void); -void svr_auth_pubkey(void); -void svr_auth_pam(void); +void svr_auth_password(int valid_user); +void svr_auth_pubkey(int valid_user); +void svr_auth_pam(int valid_user); #if DROPBEAR_SVR_PUBKEY_OPTIONS_BUILT int svr_pubkey_allows_agentfwd(void); diff --git a/svr-auth.c b/svr-auth.c index c19c090..edde86b 100644 --- a/svr-auth.c +++ b/svr-auth.c @@ -149,10 +149,8 @@ void recv_msg_userauth_request() { if (methodlen == AUTH_METHOD_PASSWORD_LEN && strncmp(methodname, AUTH_METHOD_PASSWORD, AUTH_METHOD_PASSWORD_LEN) == 0) { - if (valid_user) { - svr_auth_password(); - goto out; - } + svr_auth_password(valid_user); + goto out; } } #endif @@ -164,10 +162,8 @@ void recv_msg_userauth_request() { if (methodlen == AUTH_METHOD_PASSWORD_LEN && strncmp(methodname, AUTH_METHOD_PASSWORD, AUTH_METHOD_PASSWORD_LEN) == 0) { - if (valid_user) { - svr_auth_pam(); - goto out; - } + svr_auth_pam(valid_user); + goto out; } } #endif @@ -177,12 +173,7 @@ void recv_msg_userauth_request() { if (methodlen == AUTH_METHOD_PUBKEY_LEN && strncmp(methodname, AUTH_METHOD_PUBKEY, AUTH_METHOD_PUBKEY_LEN) == 0) { - if (valid_user) { - svr_auth_pubkey(); - } else { - /* pubkey has no failure delay */ - send_msg_userauth_failure(0, 0); - } + svr_auth_pubkey(valid_user); goto out; } #endif diff --git a/svr-authpam.c b/svr-authpam.c index 05e4f3e..d201bc9 100644 --- a/svr-authpam.c +++ b/svr-authpam.c @@ -178,13 +178,14 @@ pamConvFunc(int num_msg, * Keyboard interactive would be a lot nicer, but since PAM is synchronous, it * gets very messy trying to send the interactive challenges, and read the * interactive responses, over the network. */ -void svr_auth_pam() { +void svr_auth_pam(int valid_user) { struct UserDataS userData = {NULL, NULL}; struct pam_conv pamConv = { pamConvFunc, &userData /* submitted to pamvConvFunc as appdata_ptr */ }; + const char* printable_user = NULL; pam_handle_t* pamHandlep = NULL; @@ -204,12 +205,23 @@ void svr_auth_pam() { password = buf_getstring(ses.payload, &passwordlen); + /* We run the PAM conversation regardless of whether the username is valid + in case the conversation function has an inherent delay. + Use ses.authstate.username rather than ses.authstate.pw_name. + After PAM succeeds we then check the valid_user flag too */ + /* used to pass data to the PAM conversation function - don't bother with * strdup() etc since these are touched only by our own conversation * function (above) which takes care of it */ - userData.user = ses.authstate.pw_name; + userData.user = ses.authstate.username; userData.passwd = password; + if (ses.authstate.pw_name) { + printable_user = ses.authstate.pw_name; + } else { + printable_user = ""; + } + /* Init pam */ if ((rc = pam_start("sshd", NULL, &pamConv, &pamHandlep)) != PAM_SUCCESS) { dropbear_log(LOG_WARNING, "pam_start() failed, rc=%d, %s", @@ -242,7 +254,7 @@ void svr_auth_pam() { rc, pam_strerror(pamHandlep, rc)); dropbear_log(LOG_WARNING, "Bad PAM password attempt for '%s' from %s", - ses.authstate.pw_name, + printable_user, svr_ses.addrstring); send_msg_userauth_failure(0, 1); goto cleanup; @@ -253,12 +265,18 @@ void svr_auth_pam() { rc, pam_strerror(pamHandlep, rc)); dropbear_log(LOG_WARNING, "Bad PAM password attempt for '%s' from %s", - ses.authstate.pw_name, + printable_user, svr_ses.addrstring); send_msg_userauth_failure(0, 1); goto cleanup; } + if (!valid_user) { + /* PAM auth succeeded but the username isn't allowed in for another reason + (checkusername() failed) */ + send_msg_userauth_failure(0, 1); + } + /* successful authentication */ dropbear_log(LOG_NOTICE, "PAM password auth succeeded for '%s' from %s", ses.authstate.pw_name, diff --git a/svr-authpasswd.c b/svr-authpasswd.c index bdee2aa..69c7d8a 100644 --- a/svr-authpasswd.c +++ b/svr-authpasswd.c @@ -48,22 +48,14 @@ static int constant_time_strcmp(const char* a, const char* b) { /* Process a password auth request, sending success or failure messages as * appropriate */ -void svr_auth_password() { +void svr_auth_password(int valid_user) { char * passwdcrypt = NULL; /* the crypt from /etc/passwd or /etc/shadow */ char * testcrypt = NULL; /* crypt generated from the user's password sent */ - char * password; + char * password = NULL; unsigned int passwordlen; - unsigned int changepw; - passwdcrypt = ses.authstate.pw_passwd; - -#ifdef DEBUG_HACKCRYPT - /* debugging crypt for non-root testing with shadows */ - passwdcrypt = DEBUG_HACKCRYPT; -#endif - /* check if client wants to change password */ changepw = buf_getbool(ses.payload); if (changepw) { @@ -73,12 +65,21 @@ void svr_auth_password() { } password = buf_getstring(ses.payload, &passwordlen); - - /* the first bytes of passwdcrypt are the salt */ - testcrypt = crypt(password, passwdcrypt); + if (valid_user) { + /* the first bytes of passwdcrypt are the salt */ + passwdcrypt = ses.authstate.pw_passwd; + testcrypt = crypt(password, passwdcrypt); + } m_burn(password, passwordlen); m_free(password); + /* After we have got the payload contents we can exit if the username + is invalid. Invalid users have already been logged. */ + if (!valid_user) { + send_msg_userauth_failure(0, 1); + return; + } + if (testcrypt == NULL) { /* crypt() with an invalid salt like "!!" */ dropbear_log(LOG_WARNING, "User account '%s' is locked", diff --git a/svr-authpubkey.c b/svr-authpubkey.c index aa6087c..ff481c8 100644 --- a/svr-authpubkey.c +++ b/svr-authpubkey.c @@ -79,7 +79,7 @@ static int checkfileperm(char * filename); /* process a pubkey auth request, sending success or failure message as * appropriate */ -void svr_auth_pubkey() { +void svr_auth_pubkey(int valid_user) { unsigned char testkey; /* whether we're just checking if a key is usable */ char* algo = NULL; /* pubkey algo */ @@ -102,6 +102,15 @@ void svr_auth_pubkey() { keybloblen = buf_getint(ses.payload); keyblob = buf_getptr(ses.payload, keybloblen); + if (!valid_user) { + /* Return failure once we have read the contents of the packet + required to validate a public key. + Avoids blind user enumeration though it isn't possible to prevent + testing for user existence if the public key is known */ + send_msg_userauth_failure(0, 0); + goto out; + } + /* check if the key is valid */ if (checkpubkey(algo, algolen, keyblob, keybloblen) == DROPBEAR_FAILURE) { send_msg_userauth_failure(0, 0);