1 /* 2 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * All rights reserved 5 * Rhosts authentication. This file contains code to check whether to admit 6 * the login based on rhosts authentication. This file also processes 7 * /etc/hosts.equiv. 8 * 9 * As far as I am concerned, the code I have written for this software 10 * can be used freely for any purpose. Any derived versions of this 11 * software must be clearly marked as such, and if the derived work is 12 * incompatible with the protocol description in the RFC file, it must be 13 * called by a name other than "ssh" or "Secure Shell". 14 */ 15 16 #include "includes.h" 17 RCSID("$OpenBSD: auth-rhosts.c,v 1.33 2005/07/17 07:17:54 djm Exp $"); 18 19 #include "packet.h" 20 #include "uidswap.h" 21 #include "pathnames.h" 22 #include "log.h" 23 #include "servconf.h" 24 #include "canohost.h" 25 #include "auth.h" 26 27 /* import */ 28 extern ServerOptions options; 29 extern int use_privsep; 30 31 /* 32 * This function processes an rhosts-style file (.rhosts, .shosts, or 33 * /etc/hosts.equiv). This returns true if authentication can be granted 34 * based on the file, and returns zero otherwise. 35 */ 36 37 static int 38 check_rhosts_file(const char *filename, const char *hostname, 39 const char *ipaddr, const char *client_user, 40 const char *server_user) 41 { 42 FILE *f; 43 char buf[1024]; /* Must not be larger than host, user, dummy below. */ 44 45 /* Open the .rhosts file, deny if unreadable */ 46 f = fopen(filename, "r"); 47 if (!f) 48 return 0; 49 50 while (fgets(buf, sizeof(buf), f)) { 51 /* All three must be at least as big as buf to avoid overflows. */ 52 char hostbuf[1024], userbuf[1024], dummy[1024], *host, *user, *cp; 53 int negated; 54 55 for (cp = buf; *cp == ' ' || *cp == '\t'; cp++) 56 ; 57 if (*cp == '#' || *cp == '\n' || !*cp) 58 continue; 59 60 /* 61 * NO_PLUS is supported at least on OSF/1. We skip it (we 62 * don't ever support the plus syntax). 63 */ 64 if (strncmp(cp, "NO_PLUS", 7) == 0) 65 continue; 66 67 /* 68 * This should be safe because each buffer is as big as the 69 * whole string, and thus cannot be overwritten. 70 */ 71 switch (sscanf(buf, "%1023s %1023s %1023s", hostbuf, userbuf, 72 dummy)) { 73 case 0: 74 auth_debug_add("Found empty line in %.100s.", filename); 75 continue; 76 case 1: 77 /* Host name only. */ 78 strlcpy(userbuf, server_user, sizeof(userbuf)); 79 break; 80 case 2: 81 /* Got both host and user name. */ 82 break; 83 case 3: 84 auth_debug_add("Found garbage in %.100s.", filename); 85 continue; 86 default: 87 /* Weird... */ 88 continue; 89 } 90 91 host = hostbuf; 92 user = userbuf; 93 negated = 0; 94 95 /* Process negated host names, or positive netgroups. */ 96 if (host[0] == '-') { 97 negated = 1; 98 host++; 99 } else if (host[0] == '+') 100 host++; 101 102 if (user[0] == '-') { 103 negated = 1; 104 user++; 105 } else if (user[0] == '+') 106 user++; 107 108 /* Check for empty host/user names (particularly '+'). */ 109 if (!host[0] || !user[0]) { 110 /* We come here if either was '+' or '-'. */ 111 auth_debug_add("Ignoring wild host/user names in %.100s.", 112 filename); 113 continue; 114 } 115 /* Verify that host name matches. */ 116 if (host[0] == '@') { 117 if (!innetgr(host + 1, hostname, NULL, NULL) && 118 !innetgr(host + 1, ipaddr, NULL, NULL)) 119 continue; 120 } else if (strcasecmp(host, hostname) && strcmp(host, ipaddr) != 0) 121 continue; /* Different hostname. */ 122 123 /* Verify that user name matches. */ 124 if (user[0] == '@') { 125 if (!innetgr(user + 1, NULL, client_user, NULL)) 126 continue; 127 } else if (strcmp(user, client_user) != 0) 128 continue; /* Different username. */ 129 130 /* Found the user and host. */ 131 fclose(f); 132 133 /* If the entry was negated, deny access. */ 134 if (negated) { 135 auth_debug_add("Matched negative entry in %.100s.", 136 filename); 137 return 0; 138 } 139 /* Accept authentication. */ 140 return 1; 141 } 142 143 /* Authentication using this file denied. */ 144 fclose(f); 145 return 0; 146 } 147 148 /* 149 * Tries to authenticate the user using the .shosts or .rhosts file. Returns 150 * true if authentication succeeds. If ignore_rhosts is true, only 151 * /etc/hosts.equiv will be considered (.rhosts and .shosts are ignored). 152 */ 153 154 int 155 auth_rhosts(struct passwd *pw, const char *client_user) 156 { 157 const char *hostname, *ipaddr; 158 159 hostname = get_canonical_hostname(options.use_dns); 160 ipaddr = get_remote_ipaddr(); 161 return auth_rhosts2(pw, client_user, hostname, ipaddr); 162 } 163 164 static int 165 auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostname, 166 const char *ipaddr) 167 { 168 char buf[1024]; 169 struct stat st; 170 static const char *rhosts_files[] = {".shosts", ".rhosts", NULL}; 171 u_int rhosts_file_index; 172 173 debug2("auth_rhosts2: clientuser %s hostname %s ipaddr %s", 174 client_user, hostname, ipaddr); 175 176 /* Switch to the user's uid. */ 177 temporarily_use_uid(pw); 178 /* 179 * Quick check: if the user has no .shosts or .rhosts files, return 180 * failure immediately without doing costly lookups from name 181 * servers. 182 */ 183 for (rhosts_file_index = 0; rhosts_files[rhosts_file_index]; 184 rhosts_file_index++) { 185 /* Check users .rhosts or .shosts. */ 186 snprintf(buf, sizeof buf, "%.500s/%.100s", 187 pw->pw_dir, rhosts_files[rhosts_file_index]); 188 if (stat(buf, &st) >= 0) 189 break; 190 } 191 /* Switch back to privileged uid. */ 192 restore_uid(); 193 194 /* Deny if The user has no .shosts or .rhosts file and there are no system-wide files. */ 195 if (!rhosts_files[rhosts_file_index] && 196 stat(_PATH_RHOSTS_EQUIV, &st) < 0 && 197 stat(_PATH_SSH_HOSTS_EQUIV, &st) < 0) 198 return 0; 199 200 /* If not logging in as superuser, try /etc/hosts.equiv and shosts.equiv. */ 201 if (pw->pw_uid != 0) { 202 if (check_rhosts_file(_PATH_RHOSTS_EQUIV, hostname, ipaddr, 203 client_user, pw->pw_name)) { 204 auth_debug_add("Accepted for %.100s [%.100s] by /etc/hosts.equiv.", 205 hostname, ipaddr); 206 return 1; 207 } 208 if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr, 209 client_user, pw->pw_name)) { 210 auth_debug_add("Accepted for %.100s [%.100s] by %.100s.", 211 hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV); 212 return 1; 213 } 214 } 215 /* 216 * Check that the home directory is owned by root or the user, and is 217 * not group or world writable. 218 */ 219 if (stat(pw->pw_dir, &st) < 0) { 220 logit("Rhosts authentication refused for %.100s: " 221 "no home directory %.200s", pw->pw_name, pw->pw_dir); 222 auth_debug_add("Rhosts authentication refused for %.100s: " 223 "no home directory %.200s", pw->pw_name, pw->pw_dir); 224 return 0; 225 } 226 if (options.strict_modes && 227 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || 228 (st.st_mode & 022) != 0)) { 229 logit("Rhosts authentication refused for %.100s: " 230 "bad ownership or modes for home directory.", pw->pw_name); 231 auth_debug_add("Rhosts authentication refused for %.100s: " 232 "bad ownership or modes for home directory.", pw->pw_name); 233 return 0; 234 } 235 /* Temporarily use the user's uid. */ 236 temporarily_use_uid(pw); 237 238 /* Check all .rhosts files (currently .shosts and .rhosts). */ 239 for (rhosts_file_index = 0; rhosts_files[rhosts_file_index]; 240 rhosts_file_index++) { 241 /* Check users .rhosts or .shosts. */ 242 snprintf(buf, sizeof buf, "%.500s/%.100s", 243 pw->pw_dir, rhosts_files[rhosts_file_index]); 244 if (stat(buf, &st) < 0) 245 continue; 246 247 /* 248 * Make sure that the file is either owned by the user or by 249 * root, and make sure it is not writable by anyone but the 250 * owner. This is to help avoid novices accidentally 251 * allowing access to their account by anyone. 252 */ 253 if (options.strict_modes && 254 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || 255 (st.st_mode & 022) != 0)) { 256 logit("Rhosts authentication refused for %.100s: bad modes for %.200s", 257 pw->pw_name, buf); 258 auth_debug_add("Bad file modes for %.200s", buf); 259 continue; 260 } 261 /* Check if we have been configured to ignore .rhosts and .shosts files. */ 262 if (options.ignore_rhosts) { 263 auth_debug_add("Server has been configured to ignore %.100s.", 264 rhosts_files[rhosts_file_index]); 265 continue; 266 } 267 /* Check if authentication is permitted by the file. */ 268 if (check_rhosts_file(buf, hostname, ipaddr, client_user, pw->pw_name)) { 269 auth_debug_add("Accepted by %.100s.", 270 rhosts_files[rhosts_file_index]); 271 /* Restore the privileged uid. */ 272 restore_uid(); 273 auth_debug_add("Accepted host %s ip %s client_user %s server_user %s", 274 hostname, ipaddr, client_user, pw->pw_name); 275 return 1; 276 } 277 } 278 279 /* Restore the privileged uid. */ 280 restore_uid(); 281 return 0; 282 } 283 284 int 285 auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, 286 const char *ipaddr) 287 { 288 int ret; 289 290 auth_debug_reset(); 291 ret = auth_rhosts2_raw(pw, client_user, hostname, ipaddr); 292 if (!use_privsep) 293 auth_debug_send(); 294 return ret; 295 } 296