1 /* 2 * Copyright (c) 2000 Markus Friedl. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 23 * 24 * $OpenBSD: auth.h,v 1.15 2001/04/12 19:15:24 markus Exp $ 25 * $FreeBSD$ 26 */ 27 #ifndef AUTH_H 28 #define AUTH_H 29 30 #include <openssl/rsa.h> 31 32 #ifdef HAVE_LOGIN_CAP 33 #include <login_cap.h> 34 #endif 35 #ifdef BSD_AUTH 36 #include <bsd_auth.h> 37 #endif 38 39 typedef struct Authctxt Authctxt; 40 struct Authctxt { 41 int success; 42 int postponed; 43 int valid; 44 int attempt; 45 int failures; 46 char *user; 47 char *service; 48 struct passwd *pw; 49 char *style; 50 #ifdef BSD_AUTH 51 auth_session_t *as; 52 #endif 53 }; 54 55 /* 56 * Tries to authenticate the user using the .rhosts file. Returns true if 57 * authentication succeeds. If ignore_rhosts is non-zero, this will not 58 * consider .rhosts and .shosts (/etc/hosts.equiv will still be used). 59 */ 60 int auth_rhosts(struct passwd * pw, const char *client_user); 61 62 /* extended interface similar to auth_rhosts() */ 63 int 64 auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, 65 const char *ipaddr); 66 67 /* 68 * Tries to authenticate the user using the .rhosts file and the host using 69 * its host key. Returns true if authentication succeeds. 70 */ 71 int 72 auth_rhosts_rsa(struct passwd * pw, const char *client_user, RSA* client_host_key); 73 74 /* 75 * Tries to authenticate the user using password. Returns true if 76 * authentication succeeds. 77 */ 78 int auth_password(Authctxt *authctxt, const char *password); 79 80 /* 81 * Performs the RSA authentication dialog with the client. This returns 0 if 82 * the client could not be authenticated, and 1 if authentication was 83 * successful. This may exit if there is a serious protocol violation. 84 */ 85 int auth_rsa(struct passwd * pw, BIGNUM * client_n); 86 87 /* 88 * Parses an RSA key (number of bits, e, n) from a string. Moves the pointer 89 * over the key. Skips any whitespace at the beginning and at end. 90 */ 91 int auth_rsa_read_key(char **cpp, u_int *bitsp, BIGNUM * e, BIGNUM * n); 92 93 /* 94 * Performs the RSA authentication challenge-response dialog with the client, 95 * and returns true (non-zero) if the client gave the correct answer to our 96 * challenge; returns zero if the client gives a wrong answer. 97 */ 98 int auth_rsa_challenge_dialog(RSA *pk); 99 100 #ifdef KRB4 101 #include <krb.h> 102 #endif /* KRB4 */ 103 #ifdef KRB5 104 #include <krb5.h> 105 int auth_krb5(); /* XXX Doplnit prototypy */ 106 int auth_krb5_tgt(); 107 int krb5_init(); 108 void krb5_cleanup_proc(void *ignore); 109 int auth_krb5_password(struct passwd *pw, const char *password); 110 #endif /* KRB5 */ 111 112 #ifdef KRB4 113 #include <krb.h> 114 /* 115 * Performs Kerberos v4 mutual authentication with the client. This returns 0 116 * if the client could not be authenticated, and 1 if authentication was 117 * successful. This may exit if there is a serious protocol violation. 118 */ 119 int auth_krb4(const char *server_user, KTEXT auth, char **client); 120 int krb4_init(uid_t uid); 121 void krb4_cleanup_proc(void *ignore); 122 int auth_krb4_password(struct passwd * pw, const char *password); 123 124 #ifdef AFS 125 #include <kafs.h> 126 127 /* Accept passed Kerberos v4 ticket-granting ticket and AFS tokens. */ 128 int auth_kerberos_tgt(struct passwd * pw, const char *string); 129 int auth_afs_token(struct passwd * pw, const char *token_string); 130 #endif /* AFS */ 131 132 #endif /* KRB4 */ 133 134 void do_authentication(void); 135 void do_authentication2(void); 136 137 Authctxt *authctxt_new(void); 138 void auth_log(Authctxt *authctxt, int authenticated, char *method, char *info); 139 void userauth_finish(Authctxt *authctxt, int authenticated, char *method); 140 int auth_root_allowed(char *method); 141 142 int auth2_challenge(Authctxt *authctxt, char *devs); 143 144 int allowed_user(struct passwd * pw); 145 146 char *get_challenge(Authctxt *authctxt, char *devs); 147 int verify_response(Authctxt *authctxt, char *response); 148 149 struct passwd * auth_get_user(void); 150 151 #define AUTH_FAIL_MAX 6 152 #define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2) 153 #define AUTH_FAIL_MSG "Too many authentication failures for %.100s" 154 155 #endif 156