1 /* 2 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * All rights reserved 5 * Rhosts authentication. This file contains code to check whether to admit 6 * the login based on rhosts authentication. This file also processes 7 * /etc/hosts.equiv. 8 * 9 * As far as I am concerned, the code I have written for this software 10 * can be used freely for any purpose. Any derived versions of this 11 * software must be clearly marked as such, and if the derived work is 12 * incompatible with the protocol description in the RFC file, it must be 13 * called by a name other than "ssh" or "Secure Shell". 14 */ 15 16 #include "includes.h" 17 RCSID("$OpenBSD: auth-rhosts.c,v 1.27 2002/03/04 12:43:06 markus Exp $"); 18 19 #include "packet.h" 20 #include "uidswap.h" 21 #include "pathnames.h" 22 #include "log.h" 23 #include "servconf.h" 24 #include "canohost.h" 25 #include "auth.h" 26 27 /* import */ 28 extern ServerOptions options; 29 30 /* 31 * This function processes an rhosts-style file (.rhosts, .shosts, or 32 * /etc/hosts.equiv). This returns true if authentication can be granted 33 * based on the file, and returns zero otherwise. 34 */ 35 36 static int 37 check_rhosts_file(const char *filename, const char *hostname, 38 const char *ipaddr, const char *client_user, 39 const char *server_user) 40 { 41 FILE *f; 42 char buf[1024]; /* Must not be larger than host, user, dummy below. */ 43 44 /* Open the .rhosts file, deny if unreadable */ 45 f = fopen(filename, "r"); 46 if (!f) 47 return 0; 48 49 while (fgets(buf, sizeof(buf), f)) { 50 /* All three must be at least as big as buf to avoid overflows. */ 51 char hostbuf[1024], userbuf[1024], dummy[1024], *host, *user, *cp; 52 int negated; 53 54 for (cp = buf; *cp == ' ' || *cp == '\t'; cp++) 55 ; 56 if (*cp == '#' || *cp == '\n' || !*cp) 57 continue; 58 59 /* 60 * NO_PLUS is supported at least on OSF/1. We skip it (we 61 * don't ever support the plus syntax). 62 */ 63 if (strncmp(cp, "NO_PLUS", 7) == 0) 64 continue; 65 66 /* 67 * This should be safe because each buffer is as big as the 68 * whole string, and thus cannot be overwritten. 69 */ 70 switch (sscanf(buf, "%s %s %s", hostbuf, userbuf, dummy)) { 71 case 0: 72 packet_send_debug("Found empty line in %.100s.", filename); 73 continue; 74 case 1: 75 /* Host name only. */ 76 strlcpy(userbuf, server_user, sizeof(userbuf)); 77 break; 78 case 2: 79 /* Got both host and user name. */ 80 break; 81 case 3: 82 packet_send_debug("Found garbage in %.100s.", filename); 83 continue; 84 default: 85 /* Weird... */ 86 continue; 87 } 88 89 host = hostbuf; 90 user = userbuf; 91 negated = 0; 92 93 /* Process negated host names, or positive netgroups. */ 94 if (host[0] == '-') { 95 negated = 1; 96 host++; 97 } else if (host[0] == '+') 98 host++; 99 100 if (user[0] == '-') { 101 negated = 1; 102 user++; 103 } else if (user[0] == '+') 104 user++; 105 106 /* Check for empty host/user names (particularly '+'). */ 107 if (!host[0] || !user[0]) { 108 /* We come here if either was '+' or '-'. */ 109 packet_send_debug("Ignoring wild host/user names in %.100s.", 110 filename); 111 continue; 112 } 113 /* Verify that host name matches. */ 114 if (host[0] == '@') { 115 if (!innetgr(host + 1, hostname, NULL, NULL) && 116 !innetgr(host + 1, ipaddr, NULL, NULL)) 117 continue; 118 } else if (strcasecmp(host, hostname) && strcmp(host, ipaddr) != 0) 119 continue; /* Different hostname. */ 120 121 /* Verify that user name matches. */ 122 if (user[0] == '@') { 123 if (!innetgr(user + 1, NULL, client_user, NULL)) 124 continue; 125 } else if (strcmp(user, client_user) != 0) 126 continue; /* Different username. */ 127 128 /* Found the user and host. */ 129 fclose(f); 130 131 /* If the entry was negated, deny access. */ 132 if (negated) { 133 packet_send_debug("Matched negative entry in %.100s.", 134 filename); 135 return 0; 136 } 137 /* Accept authentication. */ 138 return 1; 139 } 140 141 /* Authentication using this file denied. */ 142 fclose(f); 143 return 0; 144 } 145 146 /* 147 * Tries to authenticate the user using the .shosts or .rhosts file. Returns 148 * true if authentication succeeds. If ignore_rhosts is true, only 149 * /etc/hosts.equiv will be considered (.rhosts and .shosts are ignored). 150 */ 151 152 int 153 auth_rhosts(struct passwd *pw, const char *client_user) 154 { 155 const char *hostname, *ipaddr; 156 int ret; 157 158 hostname = get_canonical_hostname(options.verify_reverse_mapping); 159 ipaddr = get_remote_ipaddr(); 160 ret = auth_rhosts2(pw, client_user, hostname, ipaddr); 161 return ret; 162 } 163 164 int 165 auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, 166 const char *ipaddr) 167 { 168 char buf[1024]; 169 struct stat st; 170 static const char *rhosts_files[] = {".shosts", ".rhosts", NULL}; 171 u_int rhosts_file_index; 172 173 debug2("auth_rhosts2: clientuser %s hostname %s ipaddr %s", 174 client_user, hostname, ipaddr); 175 176 /* no user given */ 177 if (pw == NULL) 178 return 0; 179 180 /* Switch to the user's uid. */ 181 temporarily_use_uid(pw); 182 /* 183 * Quick check: if the user has no .shosts or .rhosts files, return 184 * failure immediately without doing costly lookups from name 185 * servers. 186 */ 187 for (rhosts_file_index = 0; rhosts_files[rhosts_file_index]; 188 rhosts_file_index++) { 189 /* Check users .rhosts or .shosts. */ 190 snprintf(buf, sizeof buf, "%.500s/%.100s", 191 pw->pw_dir, rhosts_files[rhosts_file_index]); 192 if (stat(buf, &st) >= 0) 193 break; 194 } 195 /* Switch back to privileged uid. */ 196 restore_uid(); 197 198 /* Deny if The user has no .shosts or .rhosts file and there are no system-wide files. */ 199 if (!rhosts_files[rhosts_file_index] && 200 stat(_PATH_RHOSTS_EQUIV, &st) < 0 && 201 stat(_PATH_SSH_HOSTS_EQUIV, &st) < 0) 202 return 0; 203 204 /* If not logging in as superuser, try /etc/hosts.equiv and shosts.equiv. */ 205 if (pw->pw_uid != 0) { 206 if (check_rhosts_file(_PATH_RHOSTS_EQUIV, hostname, ipaddr, 207 client_user, pw->pw_name)) { 208 packet_send_debug("Accepted for %.100s [%.100s] by /etc/hosts.equiv.", 209 hostname, ipaddr); 210 return 1; 211 } 212 if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr, 213 client_user, pw->pw_name)) { 214 packet_send_debug("Accepted for %.100s [%.100s] by %.100s.", 215 hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV); 216 return 1; 217 } 218 } 219 /* 220 * Check that the home directory is owned by root or the user, and is 221 * not group or world writable. 222 */ 223 if (stat(pw->pw_dir, &st) < 0) { 224 log("Rhosts authentication refused for %.100s: no home directory %.200s", 225 pw->pw_name, pw->pw_dir); 226 packet_send_debug("Rhosts authentication refused for %.100s: no home directory %.200s", 227 pw->pw_name, pw->pw_dir); 228 return 0; 229 } 230 if (options.strict_modes && 231 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || 232 (st.st_mode & 022) != 0)) { 233 log("Rhosts authentication refused for %.100s: bad ownership or modes for home directory.", 234 pw->pw_name); 235 packet_send_debug("Rhosts authentication refused for %.100s: bad ownership or modes for home directory.", 236 pw->pw_name); 237 return 0; 238 } 239 /* Temporarily use the user's uid. */ 240 temporarily_use_uid(pw); 241 242 /* Check all .rhosts files (currently .shosts and .rhosts). */ 243 for (rhosts_file_index = 0; rhosts_files[rhosts_file_index]; 244 rhosts_file_index++) { 245 /* Check users .rhosts or .shosts. */ 246 snprintf(buf, sizeof buf, "%.500s/%.100s", 247 pw->pw_dir, rhosts_files[rhosts_file_index]); 248 if (stat(buf, &st) < 0) 249 continue; 250 251 /* 252 * Make sure that the file is either owned by the user or by 253 * root, and make sure it is not writable by anyone but the 254 * owner. This is to help avoid novices accidentally 255 * allowing access to their account by anyone. 256 */ 257 if (options.strict_modes && 258 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || 259 (st.st_mode & 022) != 0)) { 260 log("Rhosts authentication refused for %.100s: bad modes for %.200s", 261 pw->pw_name, buf); 262 packet_send_debug("Bad file modes for %.200s", buf); 263 continue; 264 } 265 /* Check if we have been configured to ignore .rhosts and .shosts files. */ 266 if (options.ignore_rhosts) { 267 packet_send_debug("Server has been configured to ignore %.100s.", 268 rhosts_files[rhosts_file_index]); 269 continue; 270 } 271 /* Check if authentication is permitted by the file. */ 272 if (check_rhosts_file(buf, hostname, ipaddr, client_user, pw->pw_name)) { 273 packet_send_debug("Accepted by %.100s.", 274 rhosts_files[rhosts_file_index]); 275 /* Restore the privileged uid. */ 276 restore_uid(); 277 return 1; 278 } 279 } 280 281 /* Restore the privileged uid. */ 282 restore_uid(); 283 return 0; 284 } 285