1 /*- 2 * Copyright (c) 1991, 1993 3 * Dave Safford. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 * 29 */ 30 31 #include <sys/cdefs.h> 32 33 __FBSDID("$FreeBSD$"); 34 35 #ifdef SRA 36 #ifdef ENCRYPTION 37 #include <sys/types.h> 38 #include <arpa/telnet.h> 39 #include <pwd.h> 40 #include <stdio.h> 41 #include <stdlib.h> 42 #include <string.h> 43 #include <syslog.h> 44 #include <ttyent.h> 45 46 #ifndef NOPAM 47 #include <security/pam_appl.h> 48 #else 49 #include <unistd.h> 50 #endif 51 52 #include "auth.h" 53 #include "misc.h" 54 #include "encrypt.h" 55 #include "pk.h" 56 57 char pka[HEXKEYBYTES+1], ska[HEXKEYBYTES+1], pkb[HEXKEYBYTES+1]; 58 char *user, *pass, *xuser, *xpass; 59 DesData ck; 60 IdeaData ik; 61 62 extern int auth_debug_mode; 63 extern char line[]; 64 65 static int sra_valid = 0; 66 static int passwd_sent = 0; 67 68 static unsigned char str_data[1024] = { IAC, SB, TELOPT_AUTHENTICATION, 0, 69 AUTHTYPE_SRA, }; 70 71 #define SRA_KEY 0 72 #define SRA_USER 1 73 #define SRA_CONTINUE 2 74 #define SRA_PASS 3 75 #define SRA_ACCEPT 4 76 #define SRA_REJECT 5 77 78 static int check_user(char *, char *); 79 80 /* support routine to send out authentication message */ 81 static int 82 Data(Authenticator *ap, int type, void *d, int c) 83 { 84 unsigned char *p = str_data + 4; 85 unsigned char *cd = (unsigned char *)d; 86 87 if (c == -1) 88 c = strlen((char *)cd); 89 90 if (auth_debug_mode) { 91 printf("%s:%d: [%d] (%d)", 92 str_data[3] == TELQUAL_IS ? ">>>IS" : ">>>REPLY", 93 str_data[3], 94 type, c); 95 printd(d, c); 96 printf("\r\n"); 97 } 98 *p++ = ap->type; 99 *p++ = ap->way; 100 *p++ = type; 101 while (c-- > 0) { 102 if ((*p++ = *cd++) == IAC) 103 *p++ = IAC; 104 } 105 *p++ = IAC; 106 *p++ = SE; 107 if (str_data[3] == TELQUAL_IS) 108 printsub('>', &str_data[2], p - (&str_data[2])); 109 return(net_write(str_data, p - str_data)); 110 } 111 112 int 113 sra_init(Authenticator *ap __unused, int server) 114 { 115 if (server) 116 str_data[3] = TELQUAL_REPLY; 117 else 118 str_data[3] = TELQUAL_IS; 119 120 user = (char *)malloc(256); 121 xuser = (char *)malloc(513); 122 pass = (char *)malloc(256); 123 xpass = (char *)malloc(513); 124 125 if (user == NULL || xuser == NULL || pass == NULL || xpass == 126 NULL) 127 return 0; /* malloc failed */ 128 129 passwd_sent = 0; 130 131 genkeys(pka,ska); 132 return(1); 133 } 134 135 /* client received a go-ahead for sra */ 136 int 137 sra_send(Authenticator *ap) 138 { 139 /* send PKA */ 140 141 if (auth_debug_mode) 142 printf("Sent PKA to server.\r\n" ); 143 printf("Trying SRA secure login:\r\n"); 144 if (!Data(ap, SRA_KEY, (void *)pka, HEXKEYBYTES)) { 145 if (auth_debug_mode) 146 printf("Not enough room for authentication data\r\n"); 147 return(0); 148 } 149 150 return(1); 151 } 152 153 /* server received an IS -- could be SRA KEY, USER, or PASS */ 154 void 155 sra_is(Authenticator *ap, unsigned char *data, int cnt) 156 { 157 int valid; 158 Session_Key skey; 159 160 if (cnt-- < 1) 161 goto bad; 162 switch (*data++) { 163 164 case SRA_KEY: 165 if (cnt < HEXKEYBYTES) { 166 Data(ap, SRA_REJECT, (void *)0, 0); 167 auth_finished(ap, AUTH_USER); 168 if (auth_debug_mode) { 169 printf("SRA user rejected for bad PKB\r\n"); 170 } 171 return; 172 } 173 if (auth_debug_mode) 174 printf("Sent pka\r\n"); 175 if (!Data(ap, SRA_KEY, (void *)pka, HEXKEYBYTES)) { 176 if (auth_debug_mode) 177 printf("Not enough room\r\n"); 178 return; 179 } 180 memcpy(pkb,data,HEXKEYBYTES); 181 pkb[HEXKEYBYTES] = '\0'; 182 common_key(ska,pkb,&ik,&ck); 183 return; 184 185 case SRA_USER: 186 /* decode KAB(u) */ 187 if (cnt > 512) /* Attempted buffer overflow */ 188 break; 189 memcpy(xuser,data,cnt); 190 xuser[cnt] = '\0'; 191 pk_decode(xuser,user,&ck); 192 auth_encrypt_user(user); 193 Data(ap, SRA_CONTINUE, (void *)0, 0); 194 195 return; 196 197 case SRA_PASS: 198 if (cnt > 512) /* Attempted buffer overflow */ 199 break; 200 /* decode KAB(P) */ 201 memcpy(xpass,data,cnt); 202 xpass[cnt] = '\0'; 203 pk_decode(xpass,pass,&ck); 204 205 /* check user's password */ 206 valid = check_user(user,pass); 207 208 if(valid) { 209 Data(ap, SRA_ACCEPT, (void *)0, 0); 210 skey.data = ck; 211 skey.type = SK_DES; 212 skey.length = 8; 213 encrypt_session_key(&skey, 1); 214 215 sra_valid = 1; 216 auth_finished(ap, AUTH_VALID); 217 if (auth_debug_mode) { 218 printf("SRA user accepted\r\n"); 219 } 220 } 221 else { 222 Data(ap, SRA_CONTINUE, (void *)0, 0); 223 /* 224 Data(ap, SRA_REJECT, (void *)0, 0); 225 sra_valid = 0; 226 auth_finished(ap, AUTH_REJECT); 227 */ 228 if (auth_debug_mode) { 229 printf("SRA user failed\r\n"); 230 } 231 } 232 return; 233 234 default: 235 if (auth_debug_mode) 236 printf("Unknown SRA option %d\r\n", data[-1]); 237 } 238 bad: 239 Data(ap, SRA_REJECT, 0, 0); 240 sra_valid = 0; 241 auth_finished(ap, AUTH_REJECT); 242 } 243 244 /* client received REPLY -- could be SRA KEY, CONTINUE, ACCEPT, or REJECT */ 245 void 246 sra_reply(Authenticator *ap, unsigned char *data, int cnt) 247 { 248 char uprompt[256],tuser[256]; 249 Session_Key skey; 250 size_t i; 251 252 if (cnt-- < 1) 253 return; 254 switch (*data++) { 255 256 case SRA_KEY: 257 /* calculate common key */ 258 if (cnt < HEXKEYBYTES) { 259 if (auth_debug_mode) { 260 printf("SRA user rejected for bad PKB\r\n"); 261 } 262 return; 263 } 264 memcpy(pkb,data,HEXKEYBYTES); 265 pkb[HEXKEYBYTES] = '\0'; 266 267 common_key(ska,pkb,&ik,&ck); 268 269 enc_user: 270 271 /* encode user */ 272 memset(tuser,0,sizeof(tuser)); 273 sprintf(uprompt,"User (%s): ",UserNameRequested); 274 telnet_gets(uprompt,tuser,255,1); 275 if (tuser[0] == '\n' || tuser[0] == '\r' ) 276 strcpy(user,UserNameRequested); 277 else { 278 /* telnet_gets leaves the newline on */ 279 for(i=0;i<sizeof(tuser);i++) { 280 if (tuser[i] == '\n') { 281 tuser[i] = '\0'; 282 break; 283 } 284 } 285 strcpy(user,tuser); 286 } 287 pk_encode(user,xuser,&ck); 288 289 /* send it off */ 290 if (auth_debug_mode) 291 printf("Sent KAB(U)\r\n"); 292 if (!Data(ap, SRA_USER, (void *)xuser, strlen(xuser))) { 293 if (auth_debug_mode) 294 printf("Not enough room\r\n"); 295 return; 296 } 297 break; 298 299 case SRA_CONTINUE: 300 if (passwd_sent) { 301 passwd_sent = 0; 302 printf("[ SRA login failed ]\r\n"); 303 goto enc_user; 304 } 305 /* encode password */ 306 memset(pass,0,sizeof(pass)); 307 telnet_gets("Password: ",pass,255,0); 308 pk_encode(pass,xpass,&ck); 309 /* send it off */ 310 if (auth_debug_mode) 311 printf("Sent KAB(P)\r\n"); 312 if (!Data(ap, SRA_PASS, (void *)xpass, strlen(xpass))) { 313 if (auth_debug_mode) 314 printf("Not enough room\r\n"); 315 return; 316 } 317 passwd_sent = 1; 318 break; 319 320 case SRA_REJECT: 321 printf("[ SRA refuses authentication ]\r\n"); 322 printf("Trying plaintext login:\r\n"); 323 auth_finished(0,AUTH_REJECT); 324 return; 325 326 case SRA_ACCEPT: 327 printf("[ SRA accepts you ]\r\n"); 328 skey.data = ck; 329 skey.type = SK_DES; 330 skey.length = 8; 331 encrypt_session_key(&skey, 0); 332 333 auth_finished(ap, AUTH_VALID); 334 return; 335 default: 336 if (auth_debug_mode) 337 printf("Unknown SRA option %d\r\n", data[-1]); 338 return; 339 } 340 } 341 342 int 343 sra_status(Authenticator *ap __unused, char *name, int level) 344 { 345 if (level < AUTH_USER) 346 return(level); 347 if (UserNameRequested && sra_valid) { 348 strcpy(name, UserNameRequested); 349 return(AUTH_VALID); 350 } else 351 return(AUTH_USER); 352 } 353 354 #define BUMP(buf, len) while (*(buf)) {++(buf), --(len);} 355 #define ADDC(buf, len, c) if ((len) > 0) {*(buf)++ = (c); --(len);} 356 357 void 358 sra_printsub(unsigned char *data, int cnt, unsigned char *buf, int buflen) 359 { 360 char lbuf[32]; 361 int i; 362 363 buf[buflen-1] = '\0'; /* make sure its NULL terminated */ 364 buflen -= 1; 365 366 switch(data[3]) { 367 368 case SRA_CONTINUE: 369 strncpy((char *)buf, " CONTINUE ", buflen); 370 goto common; 371 372 case SRA_REJECT: /* Rejected (reason might follow) */ 373 strncpy((char *)buf, " REJECT ", buflen); 374 goto common; 375 376 case SRA_ACCEPT: /* Accepted (name might follow) */ 377 strncpy((char *)buf, " ACCEPT ", buflen); 378 379 common: 380 BUMP(buf, buflen); 381 if (cnt <= 4) 382 break; 383 ADDC(buf, buflen, '"'); 384 for (i = 4; i < cnt; i++) 385 ADDC(buf, buflen, data[i]); 386 ADDC(buf, buflen, '"'); 387 ADDC(buf, buflen, '\0'); 388 break; 389 390 case SRA_KEY: /* Authentication data follows */ 391 strncpy((char *)buf, " KEY ", buflen); 392 goto common2; 393 394 case SRA_USER: 395 strncpy((char *)buf, " USER ", buflen); 396 goto common2; 397 398 case SRA_PASS: 399 strncpy((char *)buf, " PASS ", buflen); 400 goto common2; 401 402 default: 403 sprintf(lbuf, " %d (unknown)", data[3]); 404 strncpy((char *)buf, lbuf, buflen); 405 common2: 406 BUMP(buf, buflen); 407 for (i = 4; i < cnt; i++) { 408 sprintf(lbuf, " %d", data[i]); 409 strncpy((char *)buf, lbuf, buflen); 410 BUMP(buf, buflen); 411 } 412 break; 413 } 414 } 415 416 static int 417 isroot(const char *usr) 418 { 419 struct passwd *pwd; 420 421 if ((pwd=getpwnam(usr))==NULL) 422 return 0; 423 return (!pwd->pw_uid); 424 } 425 426 static int 427 rootterm(char *ttyn) 428 { 429 struct ttyent *t; 430 431 return ((t = getttynam(ttyn)) && t->ty_status & TTY_SECURE); 432 } 433 434 #ifdef NOPAM 435 static int 436 check_user(char *name, char *cred) 437 { 438 char *cp; 439 char *xpasswd, *salt; 440 441 if (isroot(name) && !rootterm(line)) 442 { 443 crypt("AA","*"); /* Waste some time to simulate success */ 444 return(0); 445 } 446 447 if (pw = sgetpwnam(name)) { 448 if (pw->pw_shell == NULL) { 449 pw = (struct passwd *) NULL; 450 return(0); 451 } 452 453 salt = pw->pw_passwd; 454 xpasswd = crypt(cred, salt); 455 /* The strcmp does not catch null passwords! */ 456 if (pw == NULL || *pw->pw_passwd == '\0' || 457 strcmp(xpasswd, pw->pw_passwd)) { 458 pw = (struct passwd *) NULL; 459 return(0); 460 } 461 return(1); 462 } 463 return(0); 464 } 465 #else 466 467 /* 468 * The following is stolen from ftpd, which stole it from the imap-uw 469 * PAM module and login.c. It is needed because we can't really 470 * "converse" with the user, having already gone to the trouble of 471 * getting their username and password through an encrypted channel. 472 */ 473 474 #define COPY_STRING(s) (s ? strdup(s):NULL) 475 476 struct cred_t { 477 const char *uname; 478 const char *pass; 479 }; 480 typedef struct cred_t cred_t; 481 482 static int 483 auth_conv(int num_msg, const struct pam_message **msg, struct pam_response **resp, void *appdata) 484 { 485 int i; 486 cred_t *cred = (cred_t *) appdata; 487 struct pam_response *reply = 488 malloc(sizeof(struct pam_response) * num_msg); 489 490 if (reply == NULL) 491 return PAM_BUF_ERR; 492 493 for (i = 0; i < num_msg; i++) { 494 switch (msg[i]->msg_style) { 495 case PAM_PROMPT_ECHO_ON: /* assume want user name */ 496 reply[i].resp_retcode = PAM_SUCCESS; 497 reply[i].resp = COPY_STRING(cred->uname); 498 /* PAM frees resp. */ 499 break; 500 case PAM_PROMPT_ECHO_OFF: /* assume want password */ 501 reply[i].resp_retcode = PAM_SUCCESS; 502 reply[i].resp = COPY_STRING(cred->pass); 503 /* PAM frees resp. */ 504 break; 505 case PAM_TEXT_INFO: 506 case PAM_ERROR_MSG: 507 reply[i].resp_retcode = PAM_SUCCESS; 508 reply[i].resp = NULL; 509 break; 510 default: /* unknown message style */ 511 free(reply); 512 return PAM_CONV_ERR; 513 } 514 } 515 516 *resp = reply; 517 return PAM_SUCCESS; 518 } 519 520 /* 521 * The PAM version as a side effect may put a new username in *name. 522 */ 523 static int 524 check_user(char *name, char *cred) 525 { 526 pam_handle_t *pamh = NULL; 527 const void *item; 528 int rval; 529 int e; 530 cred_t auth_cred = { name, cred }; 531 struct pam_conv conv = { &auth_conv, &auth_cred }; 532 533 e = pam_start("telnetd", name, &conv, &pamh); 534 if (e != PAM_SUCCESS) { 535 syslog(LOG_ERR, "pam_start: %s", pam_strerror(pamh, e)); 536 return 0; 537 } 538 539 #if 0 /* Where can we find this value? */ 540 e = pam_set_item(pamh, PAM_RHOST, remotehost); 541 if (e != PAM_SUCCESS) { 542 syslog(LOG_ERR, "pam_set_item(PAM_RHOST): %s", 543 pam_strerror(pamh, e)); 544 return 0; 545 } 546 #endif 547 548 e = pam_authenticate(pamh, 0); 549 switch (e) { 550 case PAM_SUCCESS: 551 /* 552 * With PAM we support the concept of a "template" 553 * user. The user enters a login name which is 554 * authenticated by PAM, usually via a remote service 555 * such as RADIUS or TACACS+. If authentication 556 * succeeds, a different but related "template" name 557 * is used for setting the credentials, shell, and 558 * home directory. The name the user enters need only 559 * exist on the remote authentication server, but the 560 * template name must be present in the local password 561 * database. 562 * 563 * This is supported by two various mechanisms in the 564 * individual modules. However, from the application's 565 * point of view, the template user is always passed 566 * back as a changed value of the PAM_USER item. 567 */ 568 if ((e = pam_get_item(pamh, PAM_USER, &item)) == 569 PAM_SUCCESS) { 570 strcpy(name, item); 571 } else 572 syslog(LOG_ERR, "Couldn't get PAM_USER: %s", 573 pam_strerror(pamh, e)); 574 if (isroot(name) && !rootterm(line)) 575 rval = 0; 576 else 577 rval = 1; 578 break; 579 580 case PAM_AUTH_ERR: 581 case PAM_USER_UNKNOWN: 582 case PAM_MAXTRIES: 583 rval = 0; 584 break; 585 586 default: 587 syslog(LOG_ERR, "auth_pam: %s", pam_strerror(pamh, e)); 588 rval = 0; 589 break; 590 } 591 592 if ((e = pam_end(pamh, e)) != PAM_SUCCESS) { 593 syslog(LOG_ERR, "pam_end: %s", pam_strerror(pamh, e)); 594 rval = 0; 595 } 596 return rval; 597 } 598 599 #endif 600 601 #endif /* ENCRYPTION */ 602 #endif /* SRA */ 603