xref: /freebsd/crypto/openssh/auth-krb5.c (revision 6b3455a7665208c366849f0b2b3bc916fb97516e)
1 /*
2  *    Kerberos v5 authentication and ticket-passing routines.
3  *
4  * $xFreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp$
5  */
6 /*
7  * Copyright (c) 2002 Daniel Kouril.  All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 #include "includes.h"
31 RCSID("$OpenBSD: auth-krb5.c,v 1.15 2003/11/21 11:57:02 djm Exp $");
32 RCSID("$FreeBSD$");
33 
34 #include "ssh.h"
35 #include "ssh1.h"
36 #include "packet.h"
37 #include "xmalloc.h"
38 #include "log.h"
39 #include "servconf.h"
40 #include "uidswap.h"
41 #include "auth.h"
42 
43 #ifdef KRB5
44 #include <krb5.h>
45 
46 extern ServerOptions	 options;
47 
48 static int
49 krb5_init(void *context)
50 {
51 	Authctxt *authctxt = (Authctxt *)context;
52 	krb5_error_code problem;
53 
54 	if (authctxt->krb5_ctx == NULL) {
55 		problem = krb5_init_context(&authctxt->krb5_ctx);
56 		if (problem)
57 			return (problem);
58 #ifdef KRB5_INIT_ETS
59 		krb5_init_ets(authctxt->krb5_ctx);
60 #endif
61 	}
62 	return (0);
63 }
64 
65 int
66 auth_krb5_password(Authctxt *authctxt, const char *password)
67 {
68 #ifndef HEIMDAL
69 	krb5_creds creds;
70 	krb5_principal server;
71 	char ccname[40];
72 	int tmpfd;
73 #endif
74 	krb5_error_code problem;
75 	krb5_ccache ccache = NULL;
76 	int len;
77 
78 	if (!authctxt->valid)
79 		return (0);
80 
81 	temporarily_use_uid(authctxt->pw);
82 
83 	problem = krb5_init(authctxt);
84 	if (problem)
85 		goto out;
86 
87 	problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
88 		    &authctxt->krb5_user);
89 	if (problem)
90 		goto out;
91 
92 #ifdef HEIMDAL
93 	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops, &ccache);
94 	if (problem)
95 		goto out;
96 
97 	problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
98 		authctxt->krb5_user);
99 	if (problem)
100 		goto out;
101 
102 	restore_uid();
103 
104 	problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
105 	    ccache, password, 1, NULL);
106 
107 	temporarily_use_uid(authctxt->pw);
108 
109 	if (problem)
110 		goto out;
111 
112 	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops,
113 	    &authctxt->krb5_fwd_ccache);
114 	if (problem)
115 		goto out;
116 
117 	problem = krb5_cc_copy_cache(authctxt->krb5_ctx, ccache,
118 	    authctxt->krb5_fwd_ccache);
119 	krb5_cc_destroy(authctxt->krb5_ctx, ccache);
120 	ccache = NULL;
121 	if (problem)
122 		goto out;
123 
124 #else
125 	problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
126 	    authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
127 	if (problem)
128 		goto out;
129 
130 	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
131 	    KRB5_NT_SRV_HST, &server);
132 	if (problem)
133 		goto out;
134 
135 	restore_uid();
136 	problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
137 	    NULL, NULL, NULL);
138 	krb5_free_principal(authctxt->krb5_ctx, server);
139 	temporarily_use_uid(authctxt->pw);
140 	if (problem)
141 		goto out;
142 
143 	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
144 			  authctxt->pw->pw_name)) {
145 		problem = -1;
146 		goto out;
147 	}
148 
149 	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
150 
151 	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
152 		logit("mkstemp(): %.100s", strerror(errno));
153 		problem = errno;
154 		goto out;
155 	}
156 
157 	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
158 		logit("fchmod(): %.100s", strerror(errno));
159 		close(tmpfd);
160 		problem = errno;
161 		goto out;
162 	}
163 	close(tmpfd);
164 
165 	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
166 	if (problem)
167 		goto out;
168 
169 	problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
170 				     authctxt->krb5_user);
171 	if (problem)
172 		goto out;
173 
174 	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
175 				 &creds);
176 	if (problem)
177 		goto out;
178 #endif
179 
180 	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
181 
182 	len = strlen(authctxt->krb5_ticket_file) + 6;
183 	authctxt->krb5_ccname = xmalloc(len);
184 	snprintf(authctxt->krb5_ccname, len, "FILE:%s",
185 	    authctxt->krb5_ticket_file);
186 
187  out:
188 	restore_uid();
189 
190 	if (problem) {
191 		if (ccache)
192 			krb5_cc_destroy(authctxt->krb5_ctx, ccache);
193 
194 		if (authctxt->krb5_ctx != NULL && problem!=-1)
195 			debug("Kerberos password authentication failed: %s",
196 			    krb5_get_err_text(authctxt->krb5_ctx, problem));
197 		else
198 			debug("Kerberos password authentication failed: %d",
199 			    problem);
200 
201 		krb5_cleanup_proc(authctxt);
202 
203 		if (options.kerberos_or_local_passwd)
204 			return (-1);
205 		else
206 			return (0);
207 	}
208 	return (1);
209 }
210 
211 void
212 krb5_cleanup_proc(Authctxt *authctxt)
213 {
214 	debug("krb5_cleanup_proc called");
215 	if (authctxt->krb5_fwd_ccache) {
216 		krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
217 		authctxt->krb5_fwd_ccache = NULL;
218 	}
219 	if (authctxt->krb5_user) {
220 		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
221 		authctxt->krb5_user = NULL;
222 	}
223 	if (authctxt->krb5_ctx) {
224 		krb5_free_context(authctxt->krb5_ctx);
225 		authctxt->krb5_ctx = NULL;
226 	}
227 }
228 
229 #endif /* KRB5 */
230