19a10bb17SJohn Polstra /*- 29a10bb17SJohn Polstra * Copyright 1998 Juniper Networks, Inc. 39a10bb17SJohn Polstra * All rights reserved. 49a10bb17SJohn Polstra * 59a10bb17SJohn Polstra * Redistribution and use in source and binary forms, with or without 69a10bb17SJohn Polstra * modification, are permitted provided that the following conditions 79a10bb17SJohn Polstra * are met: 89a10bb17SJohn Polstra * 1. Redistributions of source code must retain the above copyright 99a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer. 109a10bb17SJohn Polstra * 2. Redistributions in binary form must reproduce the above copyright 119a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer in the 129a10bb17SJohn Polstra * documentation and/or other materials provided with the distribution. 139a10bb17SJohn Polstra * 149a10bb17SJohn Polstra * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 159a10bb17SJohn Polstra * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 169a10bb17SJohn Polstra * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 179a10bb17SJohn Polstra * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 189a10bb17SJohn Polstra * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 199a10bb17SJohn Polstra * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 209a10bb17SJohn Polstra * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 219a10bb17SJohn Polstra * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 229a10bb17SJohn Polstra * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 239a10bb17SJohn Polstra * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 249a10bb17SJohn Polstra * SUCH DAMAGE. 259a10bb17SJohn Polstra * 269a10bb17SJohn Polstra * $FreeBSD$ 279a10bb17SJohn Polstra */ 289a10bb17SJohn Polstra 299a10bb17SJohn Polstra #include <sys/types.h> 309a10bb17SJohn Polstra #include <pwd.h> 319a10bb17SJohn Polstra #include <stdlib.h> 329a10bb17SJohn Polstra #include <string.h> 339a10bb17SJohn Polstra #include <unistd.h> 349a10bb17SJohn Polstra 359a10bb17SJohn Polstra #define PAM_SM_AUTH 369a10bb17SJohn Polstra #include <security/pam_modules.h> 379a10bb17SJohn Polstra 389a10bb17SJohn Polstra #include "pam_mod_misc.h" 399a10bb17SJohn Polstra 409a10bb17SJohn Polstra #define PASSWORD_PROMPT "Password:" 419a10bb17SJohn Polstra 429a10bb17SJohn Polstra PAM_EXTERN int 439a10bb17SJohn Polstra pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, 449a10bb17SJohn Polstra const char **argv) 459a10bb17SJohn Polstra { 469a10bb17SJohn Polstra int retval; 479a10bb17SJohn Polstra const char *user; 489a10bb17SJohn Polstra const char *password; 499a10bb17SJohn Polstra struct passwd *pwd; 509a10bb17SJohn Polstra char *encrypted; 519a10bb17SJohn Polstra int options; 529a10bb17SJohn Polstra int i; 539a10bb17SJohn Polstra 549a10bb17SJohn Polstra options = 0; 559a10bb17SJohn Polstra for (i = 0; i < argc; i++) 569a10bb17SJohn Polstra pam_std_option(&options, argv[i]); 579a10bb17SJohn Polstra if ((retval = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) 589a10bb17SJohn Polstra return retval; 599a10bb17SJohn Polstra if ((retval = pam_get_pass(pamh, &password, PASSWORD_PROMPT, 609a10bb17SJohn Polstra options)) != PAM_SUCCESS) 619a10bb17SJohn Polstra return retval; 629a10bb17SJohn Polstra if ((pwd = getpwnam(user)) != NULL) { 639a10bb17SJohn Polstra encrypted = crypt(password, pwd->pw_passwd); 649a10bb17SJohn Polstra if (password[0] == '\0' && pwd->pw_passwd != '\0') 659a10bb17SJohn Polstra encrypted = ":"; 669a10bb17SJohn Polstra 679a10bb17SJohn Polstra retval = strcmp(encrypted, pwd->pw_passwd) == 0 ? 689a10bb17SJohn Polstra PAM_SUCCESS : PAM_AUTH_ERR; 699a10bb17SJohn Polstra } else { 709a10bb17SJohn Polstra /* 719a10bb17SJohn Polstra * User unknown. Encrypt anyway so that it takes the 729a10bb17SJohn Polstra * same amount of time. 739a10bb17SJohn Polstra */ 749a10bb17SJohn Polstra crypt(password, "xx"); 759a10bb17SJohn Polstra retval = PAM_AUTH_ERR; 769a10bb17SJohn Polstra } 779a10bb17SJohn Polstra /* 789a10bb17SJohn Polstra * The PAM infrastructure will obliterate the cleartext 799a10bb17SJohn Polstra * password before returning to the application. 809a10bb17SJohn Polstra */ 819a10bb17SJohn Polstra return retval; 829a10bb17SJohn Polstra } 839a10bb17SJohn Polstra 849a10bb17SJohn Polstra PAM_EXTERN int 859a10bb17SJohn Polstra pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv) 869a10bb17SJohn Polstra { 879a10bb17SJohn Polstra return PAM_SUCCESS; 889a10bb17SJohn Polstra } 89