xref: /titanic_50/usr/src/lib/pam_modules/ldap/ldap_acct_mgmt.c (revision 47789246278f5a31cca77e9dff187c916ada68ac)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include "ldap_headers.h"
30 
31 /*ARGSUSED*/
32 static void
ldap_cleanup(pam_handle_t * pamh,void * data,int pam_status)33 ldap_cleanup(
34 	pam_handle_t *pamh,
35 	void *data,
36 	int pam_status)
37 {
38 	free((ldap_authtok_data *)data);
39 }
40 
41 /*
42  * warn_user_passwd_will_expire	- warn the user when the password will
43  *					  expire.
44  */
45 
46 static void
warn_user_passwd_will_expire(pam_handle_t * pamh,int sec_until_expired)47 warn_user_passwd_will_expire(
48 	pam_handle_t *pamh,
49 	int sec_until_expired)
50 {
51 	char	messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
52 	int	days = 0, hours = 0;
53 	int	seconds_d = 0, seconds_h = 0;
54 
55 	days = sec_until_expired / 86400;
56 	seconds_d = sec_until_expired % 86400;
57 	hours = (days * 24) + seconds_d / 3600;
58 	seconds_h = seconds_d % 3600;
59 
60 	if (sec_until_expired <= (86400 * 2)) {
61 		if (seconds_d <= 3600 && days == 0)
62 			(void) snprintf(messages[0], sizeof (messages[0]),
63 			    dgettext(TEXT_DOMAIN,
64 			    "Your password will expire within one hour."));
65 		else
66 			(void) snprintf(messages[0], sizeof (messages[0]),
67 			    dgettext(TEXT_DOMAIN,
68 				"Your password will expire in %d hours."),
69 				(seconds_h == 0) ? hours : hours + 1);
70 	} else {
71 			(void) snprintf(messages[0], sizeof (messages[0]),
72 			    dgettext(TEXT_DOMAIN,
73 				"Your password will expire in %d days."),
74 				(seconds_d == 0) ? days : days + 1);
75 	}
76 
77 	(void) __pam_display_msg(pamh, PAM_TEXT_INFO, 1, messages, NULL);
78 }
79 
80 /*
81  * display_acct_unlock_time - Display the time left for the account to
82  * get auto unlocked after the maximum login failures has reached.
83  */
84 static void
display_acct_unlock_time(pam_handle_t * pamh,int sec_b4_unlock)85 display_acct_unlock_time(pam_handle_t *pamh, int sec_b4_unlock)
86 {
87 	char	messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
88 	int	days = 0, hours = 0;
89 	int	seconds_d = 0, seconds_h = 0;
90 
91 	/* Account is locked forever */
92 	if (sec_b4_unlock == -1) {
93 		(void) snprintf(messages[0], sizeof (messages[0]),
94 		dgettext(TEXT_DOMAIN,
95 		"Your account is locked, please contact administrator."));
96 		(void) __pam_display_msg(pamh, PAM_TEXT_INFO, 1,
97 			messages, NULL);
98 		return;
99 	}
100 
101 	days = sec_b4_unlock / 86400;
102 	seconds_d = sec_b4_unlock % 86400;
103 	hours = (days * 24) + seconds_d / 3600;
104 	seconds_h = seconds_d % 3600;
105 
106 	if (sec_b4_unlock <= (86400 * 2)) {
107 		if (seconds_d <= 3600 && days == 0)
108 			(void) snprintf(messages[0], sizeof (messages[0]),
109 				dgettext(TEXT_DOMAIN,
110 				"Your account is locked and will be unlocked"
111 				" within one hour."));
112 		else
113 			(void) snprintf(messages[0], sizeof (messages[0]),
114 				dgettext(TEXT_DOMAIN,
115 				"Your account is locked and will be unlocked"
116 				" in %d hours."),
117 				(seconds_h == 0) ? hours : hours + 1);
118 	} else {
119 		(void) snprintf(messages[0], sizeof (messages[0]),
120 			dgettext(TEXT_DOMAIN,
121 			"Your account is locked and will be unlocked"
122 			" in %d days."),
123 			(seconds_d == 0) ? days : days + 1);
124 	}
125 
126 	(void) __pam_display_msg(pamh, PAM_TEXT_INFO, 1, messages, NULL);
127 }
128 
129 /*
130  * warn_user_passwd_expired - warn the user that the password has expired
131  */
132 static void
warn_user_passwd_expired(pam_handle_t * pamh,int grace)133 warn_user_passwd_expired(pam_handle_t *pamh, int grace)
134 {
135 	char	messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
136 
137 	if (grace)
138 		(void) snprintf(messages[0], sizeof (messages[0]),
139 			dgettext(TEXT_DOMAIN,
140 			"Your password has expired. "
141 			"Number of grace logins allowed are %d."),
142 			grace);
143 	else
144 		(void) snprintf(messages[0], sizeof (messages[0]),
145 			dgettext(TEXT_DOMAIN,
146 			"Your password has expired."));
147 
148 	(void) __pam_display_msg(pamh, PAM_TEXT_INFO, 1, messages, NULL);
149 }
150 
151 /*
152  * display_passwd_reset_msg - tell user that password has been reset by
153  * administrator
154  */
155 static void
display_passwd_reset_msg(pam_handle_t * pamh)156 display_passwd_reset_msg(pam_handle_t *pamh)
157 {
158 	char	messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
159 
160 	(void) snprintf(messages[0], sizeof (messages[0]),
161 			dgettext(TEXT_DOMAIN,
162 			"Your password has been reset by administrator."));
163 
164 	(void) __pam_display_msg(pamh, PAM_TEXT_INFO, 1, messages, NULL);
165 }
166 
167 /*
168  * Retreives account management related attributes for the user using
169  * default binding and does local account checks .
170  *
171  * Return Value: PAM_SUCCESS - If account is valid, seconds param will have
172  *				seconds left for password to expire
173  *		 PAM_ACCT_EXPIRED - If account is inactive
174  *		 PAM_NEW_AUTHTOK_REQD - Password is reset by admin
175  *		 PAM_AUTHTOK_EXPIRED - User password has expired, grace
176  *				param will have no. of grace logins allowed
177  *		 PAM_MAXTRIES - If maximum failure of wrong password has reached
178  *				seconds param will have no. of seconds for the
179  *				account to get unlocked
180  *		 PAM_AUTH_ERR - Failure return code
181  */
182 static int
get_account_mgmt(char * user,int * seconds,int * grace)183 get_account_mgmt(char *user, int *seconds, int *grace)
184 {
185 	int rc	= PAM_AUTH_ERR;
186 	AcctUsableResponse_t	acctResp;
187 
188 	(void *)memset((void*)&acctResp, 0, sizeof (acctResp));
189 	/* get the values for local account checking */
190 	if ((rc = __ns_ldap_getAcctMgmt(user, &acctResp))
191 		!= NS_LDAP_SUCCESS) {
192 		syslog(LOG_DEBUG,
193 			"__ns_ldap_getAcctMgmt() failed for %s with error %d",
194 				user, rc);
195 		return (PAM_AUTH_ERR);
196 	}
197 
198 	if (acctResp.choice == 0) {
199 		/* should be able to login */
200 		*seconds =
201 			acctResp.AcctUsableResp.seconds_before_expiry;
202 		return (PAM_SUCCESS);
203 	} else if (acctResp.choice == 1) {
204 		/* cannot login */
205 		if (acctResp.AcctUsableResp.more_info.inactive)
206 			/* entry inactive */
207 			return (PAM_ACCT_EXPIRED);
208 		if (acctResp.AcctUsableResp.more_info.reset)
209 			/* password reset by administrator */
210 			return (PAM_NEW_AUTHTOK_REQD);
211 		if (acctResp.AcctUsableResp.more_info.expired) {
212 			/*
213 			 * password expired, check for grace logins.
214 			 */
215 			*grace =
216 				acctResp.AcctUsableResp.more_info.rem_grace;
217 			return (PAM_AUTHTOK_EXPIRED);
218 		}
219 		if (acctResp.AcctUsableResp.more_info.sec_b4_unlock) {
220 			/* max failures reached, seconds before unlock */
221 			*seconds =
222 				acctResp.AcctUsableResp.more_info.sec_b4_unlock;
223 			return (PAM_MAXTRIES);
224 		}
225 	}
226 	return (PAM_AUTH_ERR);
227 }
228 
229 /*
230  * pam_sm_acct_mgmt	main account managment routine.
231  *			This routine relies on the LDAP
232  *			directory server to provide the
233  * 			password aging and account lockout
234  * 			information. This is done by first
235  *			trying to authenticate the user and
236  *			then checking the password status
237  *			returned.
238  *
239  *			Returns: module error or specific
240  *			error on failure.
241  */
242 
243 int
pam_sm_acct_mgmt(pam_handle_t * pamh,int flags,int argc,const char ** argv)244 pam_sm_acct_mgmt(
245 	pam_handle_t *pamh,
246 	int	flags,
247 	int	argc,
248 	const char **argv)
249 {
250 
251 	char			*user = NULL;
252 	int			result = PAM_AUTH_ERR;
253 	int			debug = 0;
254 	int			i;
255 	char			*password = NULL;
256 	ns_cred_t		*credp = NULL;
257 	int			nowarn = 0;
258 	int			seconds = 0, grace = 0;
259 	ldap_authtok_data	*status;
260 
261 	for (i = 0; i < argc; i++) {
262 		if (strcmp(argv[i], "debug") == 0)
263 			debug = 1;
264 		else if (strcasecmp(argv[i], "nowarn") == 0) {
265 			nowarn = 1;
266 			flags = flags | PAM_SILENT;
267 		}
268 		else
269 			syslog(LOG_DEBUG,
270 				"pam_ldap pam_sm_acct_mgmt: "
271 				"illegal option %s",
272 				argv[i]);
273 	}
274 
275 	if ((result = pam_get_item(pamh, PAM_USER, (void **)&user))
276 							!= PAM_SUCCESS)
277 		goto out;
278 
279 	if (debug)
280 		syslog(LOG_DEBUG,
281 			"ldap pam_sm_acct_mgmt(%s), flags = %x %s",
282 			(user)?user:"no-user", flags,
283 			(nowarn)? ", nowarn": "");
284 
285 	if (user == NULL) {
286 		result = PAM_USER_UNKNOWN;
287 		goto out;
288 	}
289 
290 	/* retrieve the password from the PAM handle */
291 	result = pam_get_item(pamh, PAM_AUTHTOK, (void **) &password);
292 	if (password == NULL) {
293 		if (debug)
294 			syslog(LOG_DEBUG, "ldap pam_sm_acct_mgmt: "
295 			    "no password for user %s", user);
296 		/* Do local account checking */
297 		result = get_account_mgmt(user, &seconds, &grace);
298 	} else {
299 		/* Try to authenticate to get password management info */
300 		result = authenticate(&credp, user,
301 				password, &seconds);
302 	}
303 
304 	/*
305 	 * process the password management info.
306 	 * If user needs to change the password immediately,
307 	 * just return the rc.
308 	 * Otherwise, reset rc to the appropriate PAM error or
309 	 * warn the user about password expiration.
310 	 */
311 	if (result == PAM_MAXTRIES) {
312 		/* exceed retry limit, denied access to account */
313 		if (!(flags & PAM_SILENT))
314 			display_acct_unlock_time(pamh, seconds);
315 		result = PAM_PERM_DENIED;
316 	} else if (result == PAM_ACCT_EXPIRED)
317 		/* account is inactivated */
318 		result = PAM_ACCT_EXPIRED;
319 	else if (result == PAM_AUTHTOK_EXPIRED) {
320 		if (!(flags & PAM_SILENT))
321 			warn_user_passwd_expired(pamh, grace);
322 		/* password expired, check for grace logins */
323 		if (grace > 0)
324 			result = PAM_SUCCESS;
325 		else
326 			result = PAM_AUTHTOK_EXPIRED;
327 	} else if (result == PAM_NEW_AUTHTOK_REQD) {
328 		/* password has been reset by administrator */
329 		if (!(flags & PAM_SILENT))
330 			display_passwd_reset_msg(pamh);
331 		result = PAM_NEW_AUTHTOK_REQD;
332 	} else if (result == PAM_SUCCESS) {
333 		/*
334 		 * warn the user if the password
335 		 * is about to expire.
336 		 */
337 		if (!(flags & PAM_SILENT) &&
338 			seconds > 0)
339 			warn_user_passwd_will_expire(pamh,
340 				seconds);
341 
342 	}
343 
344 out:
345 	if (credp != NULL)
346 		(void) __ns_ldap_freeCred(&credp);
347 
348 	/* store the password aging status in the pam handle */
349 	if (result != PAM_SUCCESS) {
350 		int pam_res;
351 		ldap_authtok_data *authtok_data;
352 
353 		pam_res = pam_get_data(
354 			pamh, LDAP_AUTHTOK_DATA, (const void **)&authtok_data);
355 
356 		if ((status = (ldap_authtok_data *)calloc
357 			(1, sizeof (ldap_authtok_data))) == NULL) {
358 			return (PAM_BUF_ERR);
359 		}
360 
361 		if (pam_res == PAM_SUCCESS)
362 			(void) memcpy(status, authtok_data,
363 				sizeof (ldap_authtok_data));
364 
365 		status->age_status = result;
366 		if (pam_set_data(pamh, LDAP_AUTHTOK_DATA, status, ldap_cleanup)
367 							!= PAM_SUCCESS) {
368 			free(status);
369 			return (PAM_SERVICE_ERR);
370 		}
371 	}
372 
373 	return (result);
374 }
375