19a10bb17SJohn Polstra /*- 29a10bb17SJohn Polstra * Copyright 1998 Juniper Networks, Inc. 39a10bb17SJohn Polstra * All rights reserved. 4111ccd25SDag-Erling Smørgrav * Copyright (c) 2001,2002 Networks Associates Technology, Inc. 58d3978c1SDag-Erling Smørgrav * All rights reserved. 68d3978c1SDag-Erling Smørgrav * 78d3978c1SDag-Erling Smørgrav * Portions of this software were developed for the FreeBSD Project by 88d3978c1SDag-Erling Smørgrav * ThinkSec AS and NAI Labs, the Security Research Division of Network 98d3978c1SDag-Erling Smørgrav * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 108d3978c1SDag-Erling Smørgrav * ("CBOSS"), as part of the DARPA CHATS research program. 119a10bb17SJohn Polstra * 129a10bb17SJohn Polstra * Redistribution and use in source and binary forms, with or without 139a10bb17SJohn Polstra * modification, are permitted provided that the following conditions 149a10bb17SJohn Polstra * are met: 159a10bb17SJohn Polstra * 1. Redistributions of source code must retain the above copyright 169a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer. 179a10bb17SJohn Polstra * 2. Redistributions in binary form must reproduce the above copyright 189a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer in the 199a10bb17SJohn Polstra * documentation and/or other materials provided with the distribution. 208d3978c1SDag-Erling Smørgrav * 3. The name of the author may not be used to endorse or promote 218d3978c1SDag-Erling Smørgrav * products derived from this software without specific prior written 228d3978c1SDag-Erling Smørgrav * permission. 239a10bb17SJohn Polstra * 249a10bb17SJohn Polstra * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 259a10bb17SJohn Polstra * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 269a10bb17SJohn Polstra * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 279a10bb17SJohn Polstra * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 289a10bb17SJohn Polstra * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 299a10bb17SJohn Polstra * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 309a10bb17SJohn Polstra * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 319a10bb17SJohn Polstra * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 329a10bb17SJohn Polstra * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 339a10bb17SJohn Polstra * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 349a10bb17SJohn Polstra * SUCH DAMAGE. 359a10bb17SJohn Polstra */ 369a10bb17SJohn Polstra 37ceaf33f5SMatthew Dillon #include <sys/cdefs.h> 38ceaf33f5SMatthew Dillon __FBSDID("$FreeBSD$"); 39ceaf33f5SMatthew Dillon 409a10bb17SJohn Polstra #include <sys/param.h> 419a10bb17SJohn Polstra 429a10bb17SJohn Polstra #include <pwd.h> 439a10bb17SJohn Polstra #include <stdlib.h> 449a10bb17SJohn Polstra #include <string.h> 459a10bb17SJohn Polstra #include <syslog.h> 469a10bb17SJohn Polstra #include <taclib.h> 479a10bb17SJohn Polstra #include <unistd.h> 489a10bb17SJohn Polstra 499a10bb17SJohn Polstra #define PAM_SM_AUTH 508d3978c1SDag-Erling Smørgrav 518c66575dSDag-Erling Smørgrav #include <security/pam_appl.h> 529a10bb17SJohn Polstra #include <security/pam_modules.h> 538c66575dSDag-Erling Smørgrav #include <security/pam_mod_misc.h> 549a10bb17SJohn Polstra 55545aa471SDag-Erling Smørgrav #define PAM_OPT_CONF "conf" 56545aa471SDag-Erling Smørgrav #define PAM_OPT_TEMPLATE_USER "template_user" 579a10bb17SJohn Polstra 589a10bb17SJohn Polstra typedef int (*set_func)(struct tac_handle *, const char *); 599a10bb17SJohn Polstra 609a10bb17SJohn Polstra static int do_item(pam_handle_t *, struct tac_handle *, int, 619a10bb17SJohn Polstra set_func, const char *); 629a10bb17SJohn Polstra static char *get_msg(struct tac_handle *); 639a10bb17SJohn Polstra static int set_msg(struct tac_handle *, const char *); 649a10bb17SJohn Polstra 659a10bb17SJohn Polstra static int 669a10bb17SJohn Polstra do_item(pam_handle_t *pamh, struct tac_handle *tach, int item, 679a10bb17SJohn Polstra set_func func, const char *funcname) 689a10bb17SJohn Polstra { 699a10bb17SJohn Polstra int retval; 709a10bb17SJohn Polstra const void *value; 719a10bb17SJohn Polstra 721642eb1aSMark Murray retval = pam_get_item(pamh, item, &value); 731642eb1aSMark Murray if (retval != PAM_SUCCESS) 749a10bb17SJohn Polstra return retval; 759a10bb17SJohn Polstra if (value != NULL && (*func)(tach, (const char *)value) == -1) { 769a10bb17SJohn Polstra syslog(LOG_CRIT, "%s: %s", funcname, tac_strerror(tach)); 779a10bb17SJohn Polstra tac_close(tach); 789a10bb17SJohn Polstra return PAM_SERVICE_ERR; 799a10bb17SJohn Polstra } 809a10bb17SJohn Polstra return PAM_SUCCESS; 819a10bb17SJohn Polstra } 829a10bb17SJohn Polstra 839a10bb17SJohn Polstra static char * 849a10bb17SJohn Polstra get_msg(struct tac_handle *tach) 859a10bb17SJohn Polstra { 869a10bb17SJohn Polstra char *msg; 879a10bb17SJohn Polstra 881642eb1aSMark Murray msg = tac_get_msg(tach); 891642eb1aSMark Murray if (msg == NULL) { 909a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_get_msg: %s", tac_strerror(tach)); 919a10bb17SJohn Polstra tac_close(tach); 929a10bb17SJohn Polstra return NULL; 939a10bb17SJohn Polstra } 949a10bb17SJohn Polstra return msg; 959a10bb17SJohn Polstra } 969a10bb17SJohn Polstra 979a10bb17SJohn Polstra static int 989a10bb17SJohn Polstra set_msg(struct tac_handle *tach, const char *msg) 999a10bb17SJohn Polstra { 1009a10bb17SJohn Polstra if (tac_set_msg(tach, msg) == -1) { 1019a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_set_msg: %s", tac_strerror(tach)); 1029a10bb17SJohn Polstra tac_close(tach); 1039a10bb17SJohn Polstra return -1; 1049a10bb17SJohn Polstra } 1059a10bb17SJohn Polstra return 0; 1069a10bb17SJohn Polstra } 1079a10bb17SJohn Polstra 1089a10bb17SJohn Polstra PAM_EXTERN int 10924fe7ba0SDag-Erling Smørgrav pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, 110545aa471SDag-Erling Smørgrav int argc __unused, const char *argv[] __unused) 1119a10bb17SJohn Polstra { 1129a10bb17SJohn Polstra int retval; 1139a10bb17SJohn Polstra struct tac_handle *tach; 114545aa471SDag-Erling Smørgrav const char *conf_file, *template_user; 1159a10bb17SJohn Polstra 116545aa471SDag-Erling Smørgrav conf_file = openpam_get_option(pamh, PAM_OPT_CONF); 117545aa471SDag-Erling Smørgrav template_user = openpam_get_option(pamh, PAM_OPT_TEMPLATE_USER); 1181642eb1aSMark Murray 1191642eb1aSMark Murray tach = tac_open(); 1201642eb1aSMark Murray if (tach == NULL) { 1219a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_open failed"); 12224fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 1239a10bb17SJohn Polstra } 1249a10bb17SJohn Polstra if (tac_config(tach, conf_file) == -1) { 1259a10bb17SJohn Polstra syslog(LOG_ALERT, "tac_config: %s", tac_strerror(tach)); 1269a10bb17SJohn Polstra tac_close(tach); 12724fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 1289a10bb17SJohn Polstra } 1299a10bb17SJohn Polstra if (tac_create_authen(tach, TAC_AUTHEN_LOGIN, TAC_AUTHEN_TYPE_ASCII, 1309a10bb17SJohn Polstra TAC_AUTHEN_SVC_LOGIN) == -1) { 1319a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_create_authen: %s", tac_strerror(tach)); 1329a10bb17SJohn Polstra tac_close(tach); 13324fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 1349a10bb17SJohn Polstra } 1351642eb1aSMark Murray 1361642eb1aSMark Murray PAM_LOG("Done tac_open() ... tac_close()"); 1371642eb1aSMark Murray 1381642eb1aSMark Murray retval = do_item(pamh, tach, PAM_USER, tac_set_user, "tac_set_user"); 1391642eb1aSMark Murray if (retval != PAM_SUCCESS) 14024fe7ba0SDag-Erling Smørgrav return (retval); 1411642eb1aSMark Murray 1421642eb1aSMark Murray PAM_LOG("Done user"); 1431642eb1aSMark Murray 1441642eb1aSMark Murray retval = do_item(pamh, tach, PAM_TTY, tac_set_port, "tac_set_port"); 1451642eb1aSMark Murray if (retval != PAM_SUCCESS) 14624fe7ba0SDag-Erling Smørgrav return (retval); 1471642eb1aSMark Murray 1481642eb1aSMark Murray PAM_LOG("Done tty"); 1491642eb1aSMark Murray 1501642eb1aSMark Murray retval = do_item(pamh, tach, PAM_RHOST, tac_set_rem_addr, 1511642eb1aSMark Murray "tac_set_rem_addr"); 1521642eb1aSMark Murray if (retval != PAM_SUCCESS) 15324fe7ba0SDag-Erling Smørgrav return (retval); 1541642eb1aSMark Murray 1559a10bb17SJohn Polstra for (;;) { 1569a10bb17SJohn Polstra char *srvr_msg; 1579a10bb17SJohn Polstra size_t msg_len; 1589a10bb17SJohn Polstra const char *user_msg; 1599a10bb17SJohn Polstra char *data_msg; 1609a10bb17SJohn Polstra int sflags; 1619a10bb17SJohn Polstra int status; 1629a10bb17SJohn Polstra 1631642eb1aSMark Murray sflags = tac_send_authen(tach); 1641642eb1aSMark Murray if (sflags == -1) { 1659a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_send_authen: %s", 1669a10bb17SJohn Polstra tac_strerror(tach)); 1679a10bb17SJohn Polstra tac_close(tach); 16824fe7ba0SDag-Erling Smørgrav return (PAM_AUTHINFO_UNAVAIL); 1699a10bb17SJohn Polstra } 1709a10bb17SJohn Polstra status = TAC_AUTHEN_STATUS(sflags); 171545aa471SDag-Erling Smørgrav openpam_set_option(pamh, PAM_OPT_ECHO_PASS, 172545aa471SDag-Erling Smørgrav TAC_AUTHEN_NOECHO(sflags) ? NULL : ""); 1739a10bb17SJohn Polstra switch (status) { 1749a10bb17SJohn Polstra 1759a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_PASS: 1769a10bb17SJohn Polstra tac_close(tach); 1779a10bb17SJohn Polstra if (template_user != NULL) { 1789a10bb17SJohn Polstra const void *item; 1799a10bb17SJohn Polstra const char *user; 1809a10bb17SJohn Polstra 1811642eb1aSMark Murray PAM_LOG("Trying template user: %s", 1821642eb1aSMark Murray template_user); 1831642eb1aSMark Murray 1849a10bb17SJohn Polstra /* 1859a10bb17SJohn Polstra * If the given user name doesn't exist in 1869a10bb17SJohn Polstra * the local password database, change it 1879a10bb17SJohn Polstra * to the value given in the "template_user" 1889a10bb17SJohn Polstra * option. 1899a10bb17SJohn Polstra */ 1909a10bb17SJohn Polstra retval = pam_get_item(pamh, PAM_USER, &item); 1919a10bb17SJohn Polstra if (retval != PAM_SUCCESS) 19224fe7ba0SDag-Erling Smørgrav return (retval); 1939a10bb17SJohn Polstra user = (const char *)item; 1941642eb1aSMark Murray if (getpwnam(user) == NULL) { 1959a10bb17SJohn Polstra pam_set_item(pamh, PAM_USER, 1969a10bb17SJohn Polstra template_user); 1971642eb1aSMark Murray PAM_LOG("Using template user"); 1989a10bb17SJohn Polstra } 1991642eb1aSMark Murray } 20024fe7ba0SDag-Erling Smørgrav return (PAM_SUCCESS); 2019a10bb17SJohn Polstra 2029a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_FAIL: 2039a10bb17SJohn Polstra tac_close(tach); 20465550d9bSMark Murray PAM_VERBOSE_ERROR("TACACS+ authentication failed"); 20524fe7ba0SDag-Erling Smørgrav return (PAM_AUTH_ERR); 2069a10bb17SJohn Polstra 2079a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETUSER: 2089a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETPASS: 2099a10bb17SJohn Polstra if ((srvr_msg = get_msg(tach)) == NULL) 21024fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 2119a10bb17SJohn Polstra if (status == TAC_AUTHEN_STATUS_GETUSER) 2129a10bb17SJohn Polstra retval = pam_get_user(pamh, &user_msg, 213111ccd25SDag-Erling Smørgrav *srvr_msg ? srvr_msg : NULL); 2149a10bb17SJohn Polstra else if (status == TAC_AUTHEN_STATUS_GETPASS) 215111ccd25SDag-Erling Smørgrav retval = pam_get_authtok(pamh, 216111ccd25SDag-Erling Smørgrav PAM_AUTHTOK, &user_msg, 217111ccd25SDag-Erling Smørgrav *srvr_msg ? srvr_msg : "Password:"); 2189a10bb17SJohn Polstra free(srvr_msg); 2199a10bb17SJohn Polstra if (retval != PAM_SUCCESS) { 2209a10bb17SJohn Polstra /* XXX - send a TACACS+ abort packet */ 2219a10bb17SJohn Polstra tac_close(tach); 22224fe7ba0SDag-Erling Smørgrav return (retval); 2239a10bb17SJohn Polstra } 2249a10bb17SJohn Polstra if (set_msg(tach, user_msg) == -1) 22524fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 2269a10bb17SJohn Polstra break; 2279a10bb17SJohn Polstra 2289a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETDATA: 2299a10bb17SJohn Polstra if ((srvr_msg = get_msg(tach)) == NULL) 23024fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 2319a10bb17SJohn Polstra retval = pam_prompt(pamh, 232545aa471SDag-Erling Smørgrav openpam_get_option(pamh, PAM_OPT_ECHO_PASS) ? 233545aa471SDag-Erling Smørgrav PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF, 234111ccd25SDag-Erling Smørgrav &data_msg, "%s", *srvr_msg ? srvr_msg : "Data:"); 2359a10bb17SJohn Polstra free(srvr_msg); 2369a10bb17SJohn Polstra if (retval != PAM_SUCCESS) { 2379a10bb17SJohn Polstra /* XXX - send a TACACS+ abort packet */ 2389a10bb17SJohn Polstra tac_close(tach); 23924fe7ba0SDag-Erling Smørgrav return (retval); 2409a10bb17SJohn Polstra } 2419a10bb17SJohn Polstra retval = set_msg(tach, data_msg); 2429a10bb17SJohn Polstra memset(data_msg, 0, strlen(data_msg)); 2439a10bb17SJohn Polstra free(data_msg); 2449a10bb17SJohn Polstra if (retval == -1) 24524fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 2469a10bb17SJohn Polstra break; 2479a10bb17SJohn Polstra 2489a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_ERROR: 2499a10bb17SJohn Polstra srvr_msg = (char *)tac_get_data(tach, &msg_len); 2509a10bb17SJohn Polstra if (srvr_msg != NULL && msg_len != 0) { 2519a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_send_authen:" 2529a10bb17SJohn Polstra " server detected error: %s", srvr_msg); 2539a10bb17SJohn Polstra free(srvr_msg); 2541642eb1aSMark Murray } 2551642eb1aSMark Murray else 2569a10bb17SJohn Polstra syslog(LOG_CRIT, 2579a10bb17SJohn Polstra "tac_send_authen: server detected error"); 2589a10bb17SJohn Polstra tac_close(tach); 25924fe7ba0SDag-Erling Smørgrav return (PAM_AUTHINFO_UNAVAIL); 2609a10bb17SJohn Polstra break; 2619a10bb17SJohn Polstra 2629a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_RESTART: 2639a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_FOLLOW: 2649a10bb17SJohn Polstra default: 2659a10bb17SJohn Polstra syslog(LOG_CRIT, 2669a10bb17SJohn Polstra "tac_send_authen: unexpected status %#x", status); 2679a10bb17SJohn Polstra tac_close(tach); 26824fe7ba0SDag-Erling Smørgrav return (PAM_AUTHINFO_UNAVAIL); 2699a10bb17SJohn Polstra } 2709a10bb17SJohn Polstra } 2719a10bb17SJohn Polstra } 2729a10bb17SJohn Polstra 2739a10bb17SJohn Polstra PAM_EXTERN int 27424fe7ba0SDag-Erling Smørgrav pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, 27524fe7ba0SDag-Erling Smørgrav int argc __unused, const char *argv[] __unused) 2769a10bb17SJohn Polstra { 2778d3978c1SDag-Erling Smørgrav 27824fe7ba0SDag-Erling Smørgrav return (PAM_IGNORE); 2799a10bb17SJohn Polstra } 2809294327dSJohn Polstra 2819294327dSJohn Polstra PAM_MODULE_ENTRY("pam_tacplus"); 282