xref: /freebsd/lib/libpam/modules/pam_unix/pam_unix.c (revision 884a2a699669ec61e2366e3e358342dbc94be24a)
1 /*-
2  * Copyright 1998 Juniper Networks, Inc.
3  * All rights reserved.
4  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
5  * All rights reserved.
6  *
7  * Portions of this software was developed for the FreeBSD Project by
8  * ThinkSec AS and NAI Labs, the Security Research Division of Network
9  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
10  * ("CBOSS"), as part of the DARPA CHATS research program.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. The name of the author may not be used to endorse or promote
21  *    products derived from this software without specific prior written
22  *    permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include <sys/param.h>
41 #include <sys/socket.h>
42 #include <sys/time.h>
43 #include <netinet/in.h>
44 #include <arpa/inet.h>
45 
46 #include <login_cap.h>
47 #include <netdb.h>
48 #include <pwd.h>
49 #include <stdlib.h>
50 #include <string.h>
51 #include <stdio.h>
52 #include <syslog.h>
53 #include <time.h>
54 #include <unistd.h>
55 
56 #include <libutil.h>
57 
58 #ifdef YP
59 #include <ypclnt.h>
60 #endif
61 
62 #define PAM_SM_AUTH
63 #define PAM_SM_ACCOUNT
64 #define	PAM_SM_PASSWORD
65 
66 #include <security/pam_appl.h>
67 #include <security/pam_modules.h>
68 #include <security/pam_mod_misc.h>
69 
70 #define PASSWORD_HASH		"md5"
71 #define DEFAULT_WARN		(2L * 7L * 86400L)  /* Two weeks */
72 #define	SALTSIZE		32
73 
74 #define	LOCKED_PREFIX		"*LOCKED*"
75 #define	LOCKED_PREFIX_LEN	(sizeof(LOCKED_PREFIX) - 1)
76 
77 static void makesalt(char []);
78 
79 static char password_hash[] =		PASSWORD_HASH;
80 
81 #define PAM_OPT_LOCAL_PASS	"local_pass"
82 #define PAM_OPT_NIS_PASS	"nis_pass"
83 
84 char *tempname = NULL;
85 
86 /*
87  * authentication management
88  */
89 PAM_EXTERN int
90 pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
91     int argc __unused, const char *argv[] __unused)
92 {
93 	login_cap_t *lc;
94 	struct passwd *pwd;
95 	int retval;
96 	const char *pass, *user, *realpw, *prompt;
97 
98 	if (openpam_get_option(pamh, PAM_OPT_AUTH_AS_SELF)) {
99 		pwd = getpwnam(getlogin());
100 	} else {
101 		retval = pam_get_user(pamh, &user, NULL);
102 		if (retval != PAM_SUCCESS)
103 			return (retval);
104 		pwd = getpwnam(user);
105 	}
106 
107 	PAM_LOG("Got user: %s", user);
108 
109 	if (pwd != NULL) {
110 		PAM_LOG("Doing real authentication");
111 		realpw = pwd->pw_passwd;
112 		if (realpw[0] == '\0') {
113 			if (!(flags & PAM_DISALLOW_NULL_AUTHTOK) &&
114 			    openpam_get_option(pamh, PAM_OPT_NULLOK))
115 				return (PAM_SUCCESS);
116 			realpw = "*";
117 		}
118 		lc = login_getpwclass(pwd);
119 	} else {
120 		PAM_LOG("Doing dummy authentication");
121 		realpw = "*";
122 		lc = login_getclass(NULL);
123 	}
124 	prompt = login_getcapstr(lc, "passwd_prompt", NULL, NULL);
125 	retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, prompt);
126 	login_close(lc);
127 	if (retval != PAM_SUCCESS)
128 		return (retval);
129 	PAM_LOG("Got password");
130 	if (strcmp(crypt(pass, realpw), realpw) == 0)
131 		return (PAM_SUCCESS);
132 
133 	PAM_VERBOSE_ERROR("UNIX authentication refused");
134 	return (PAM_AUTH_ERR);
135 }
136 
137 PAM_EXTERN int
138 pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
139     int argc __unused, const char *argv[] __unused)
140 {
141 
142 	return (PAM_SUCCESS);
143 }
144 
145 /*
146  * account management
147  */
148 PAM_EXTERN int
149 pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused,
150     int argc __unused, const char *argv[] __unused)
151 {
152 	struct addrinfo hints, *res;
153 	struct passwd *pwd;
154 	struct timeval tp;
155 	login_cap_t *lc;
156 	time_t warntime;
157 	int retval;
158 	const char *user;
159 	const void *rhost, *tty;
160 	char rhostip[MAXHOSTNAMELEN] = "";
161 
162 	retval = pam_get_user(pamh, &user, NULL);
163 	if (retval != PAM_SUCCESS)
164 		return (retval);
165 
166 	if (user == NULL || (pwd = getpwnam(user)) == NULL)
167 		return (PAM_SERVICE_ERR);
168 
169 	PAM_LOG("Got user: %s", user);
170 
171 	retval = pam_get_item(pamh, PAM_RHOST, &rhost);
172 	if (retval != PAM_SUCCESS)
173 		return (retval);
174 
175 	retval = pam_get_item(pamh, PAM_TTY, &tty);
176 	if (retval != PAM_SUCCESS)
177 		return (retval);
178 
179 	if (*pwd->pw_passwd == '\0' &&
180 	    (flags & PAM_DISALLOW_NULL_AUTHTOK) != 0)
181 		return (PAM_NEW_AUTHTOK_REQD);
182 
183 	if (strncmp(pwd->pw_passwd, LOCKED_PREFIX, LOCKED_PREFIX_LEN) == 0)
184 		return (PAM_AUTH_ERR);
185 
186 	lc = login_getpwclass(pwd);
187 	if (lc == NULL) {
188 		PAM_LOG("Unable to get login class for user %s", user);
189 		return (PAM_SERVICE_ERR);
190 	}
191 
192 	PAM_LOG("Got login_cap");
193 
194 	if (pwd->pw_change || pwd->pw_expire)
195 		gettimeofday(&tp, NULL);
196 
197 	/*
198 	 * Check pw_expire before pw_change - no point in letting the
199 	 * user change the password on an expired account.
200 	 */
201 
202 	if (pwd->pw_expire) {
203 		warntime = login_getcaptime(lc, "warnexpire",
204 		    DEFAULT_WARN, DEFAULT_WARN);
205 		if (tp.tv_sec >= pwd->pw_expire) {
206 			login_close(lc);
207 			return (PAM_ACCT_EXPIRED);
208 		} else if (pwd->pw_expire - tp.tv_sec < warntime &&
209 		    (flags & PAM_SILENT) == 0) {
210 			pam_error(pamh, "Warning: your account expires on %s",
211 			    ctime(&pwd->pw_expire));
212 		}
213 	}
214 
215 	retval = PAM_SUCCESS;
216 	if (pwd->pw_change) {
217 		warntime = login_getcaptime(lc, "warnpassword",
218 		    DEFAULT_WARN, DEFAULT_WARN);
219 		if (tp.tv_sec >= pwd->pw_change) {
220 			retval = PAM_NEW_AUTHTOK_REQD;
221 		} else if (pwd->pw_change - tp.tv_sec < warntime &&
222 		    (flags & PAM_SILENT) == 0) {
223 			pam_error(pamh, "Warning: your password expires on %s",
224 			    ctime(&pwd->pw_change));
225 		}
226 	}
227 
228 	/*
229 	 * From here on, we must leave retval untouched (unless we
230 	 * know we're going to fail), because we need to remember
231 	 * whether we're supposed to return PAM_SUCCESS or
232 	 * PAM_NEW_AUTHTOK_REQD.
233 	 */
234 
235 	if (rhost && *(const char *)rhost != '\0') {
236 		memset(&hints, 0, sizeof(hints));
237 		hints.ai_family = AF_UNSPEC;
238 		if (getaddrinfo(rhost, NULL, &hints, &res) == 0) {
239 			getnameinfo(res->ai_addr, res->ai_addrlen,
240 			    rhostip, sizeof(rhostip), NULL, 0,
241 			    NI_NUMERICHOST);
242 		}
243 		if (res != NULL)
244 			freeaddrinfo(res);
245 	}
246 
247 	/*
248 	 * Check host / tty / time-of-day restrictions
249 	 */
250 
251 	if (!auth_hostok(lc, rhost, rhostip) ||
252 	    !auth_ttyok(lc, tty) ||
253 	    !auth_timeok(lc, time(NULL)))
254 		retval = PAM_AUTH_ERR;
255 
256 	login_close(lc);
257 
258 	return (retval);
259 }
260 
261 /*
262  * password management
263  *
264  * standard Unix and NIS password changing
265  */
266 PAM_EXTERN int
267 pam_sm_chauthtok(pam_handle_t *pamh, int flags,
268     int argc __unused, const char *argv[] __unused)
269 {
270 #ifdef YP
271 	struct ypclnt *ypclnt;
272 	const void *yp_domain, *yp_server;
273 #endif
274 	char salt[SALTSIZE + 1];
275 	login_cap_t *lc;
276 	struct passwd *pwd, *old_pwd;
277 	const char *user, *old_pass, *new_pass;
278 	char *encrypted;
279 	time_t passwordtime;
280 	int pfd, tfd, retval;
281 
282 	if (openpam_get_option(pamh, PAM_OPT_AUTH_AS_SELF))
283 		pwd = getpwnam(getlogin());
284 	else {
285 		retval = pam_get_user(pamh, &user, NULL);
286 		if (retval != PAM_SUCCESS)
287 			return (retval);
288 		pwd = getpwnam(user);
289 	}
290 
291 	if (pwd == NULL)
292 		return (PAM_AUTHTOK_RECOVERY_ERR);
293 
294 	PAM_LOG("Got user: %s", user);
295 
296 	if (flags & PAM_PRELIM_CHECK) {
297 
298 		PAM_LOG("PRELIM round");
299 
300 		if (getuid() == 0 &&
301 		    (pwd->pw_fields & _PWF_SOURCE) == _PWF_FILES)
302 			/* root doesn't need the old password */
303 			return (pam_set_item(pamh, PAM_OLDAUTHTOK, ""));
304 #ifdef YP
305 		if (getuid() == 0 &&
306 		    (pwd->pw_fields & _PWF_SOURCE) == _PWF_NIS) {
307 
308 			yp_domain = yp_server = NULL;
309 			(void)pam_get_data(pamh, "yp_domain", &yp_domain);
310 			(void)pam_get_data(pamh, "yp_server", &yp_server);
311 
312 			ypclnt = ypclnt_new(yp_domain, "passwd.byname", yp_server);
313 			if (ypclnt == NULL)
314 				return (PAM_BUF_ERR);
315 
316 			if (ypclnt_connect(ypclnt) == -1) {
317 				ypclnt_free(ypclnt);
318 				return (PAM_SERVICE_ERR);
319 			}
320 
321 			retval = ypclnt_havepasswdd(ypclnt);
322 			ypclnt_free(ypclnt);
323 			if (retval == 1)
324 				return (pam_set_item(pamh, PAM_OLDAUTHTOK, ""));
325 			else if (retval == -1)
326 				return (PAM_SERVICE_ERR);
327 		}
328 #endif
329 		if (pwd->pw_passwd[0] == '\0'
330 		    && openpam_get_option(pamh, PAM_OPT_NULLOK)) {
331 			/*
332 			 * No password case. XXX Are we giving too much away
333 			 * by not prompting for a password?
334 			 * XXX check PAM_DISALLOW_NULL_AUTHTOK
335 			 */
336 			old_pass = "";
337 		} else {
338 			retval = pam_get_authtok(pamh,
339 			    PAM_OLDAUTHTOK, &old_pass, NULL);
340 			if (retval != PAM_SUCCESS)
341 				return (retval);
342 		}
343 		PAM_LOG("Got old password");
344 		/* always encrypt first */
345 		encrypted = crypt(old_pass, pwd->pw_passwd);
346 		if (old_pass[0] == '\0' &&
347 		    !openpam_get_option(pamh, PAM_OPT_NULLOK))
348 			return (PAM_PERM_DENIED);
349 		if (strcmp(encrypted, pwd->pw_passwd) != 0)
350 			return (PAM_PERM_DENIED);
351 	}
352 	else if (flags & PAM_UPDATE_AUTHTOK) {
353 		PAM_LOG("UPDATE round");
354 
355 		retval = pam_get_authtok(pamh,
356 		    PAM_OLDAUTHTOK, &old_pass, NULL);
357 		if (retval != PAM_SUCCESS)
358 			return (retval);
359 		PAM_LOG("Got old password");
360 
361 		/* get new password */
362 		for (;;) {
363 			retval = pam_get_authtok(pamh,
364 			    PAM_AUTHTOK, &new_pass, NULL);
365 			if (retval != PAM_TRY_AGAIN)
366 				break;
367 			pam_error(pamh, "Mismatch; try again, EOF to quit.");
368 		}
369 		PAM_LOG("Got new password");
370 		if (retval != PAM_SUCCESS) {
371 			PAM_VERBOSE_ERROR("Unable to get new password");
372 			return (retval);
373 		}
374 
375 		if (getuid() != 0 && new_pass[0] == '\0' &&
376 		    !openpam_get_option(pamh, PAM_OPT_NULLOK))
377 			return (PAM_PERM_DENIED);
378 
379 		if ((old_pwd = pw_dup(pwd)) == NULL)
380 			return (PAM_BUF_ERR);
381 
382 		lc = login_getclass(pwd->pw_class);
383 		if (login_setcryptfmt(lc, password_hash, NULL) == NULL)
384 			openpam_log(PAM_LOG_ERROR,
385 			    "can't set password cipher, relying on default");
386 
387 		/* set password expiry date */
388 		pwd->pw_change = 0;
389 		passwordtime = login_getcaptime(lc, "passwordtime", 0, 0);
390 		if (passwordtime > 0)
391 			pwd->pw_change = time(NULL) + passwordtime;
392 
393 		login_close(lc);
394 		makesalt(salt);
395 		pwd->pw_passwd = crypt(new_pass, salt);
396 #ifdef YP
397 		switch (old_pwd->pw_fields & _PWF_SOURCE) {
398 		case _PWF_FILES:
399 #endif
400 			retval = PAM_SERVICE_ERR;
401 			if (pw_init(NULL, NULL))
402 				openpam_log(PAM_LOG_ERROR, "pw_init() failed");
403 			else if ((pfd = pw_lock()) == -1)
404 				openpam_log(PAM_LOG_ERROR, "pw_lock() failed");
405 			else if ((tfd = pw_tmp(-1)) == -1)
406 				openpam_log(PAM_LOG_ERROR, "pw_tmp() failed");
407 			else if (pw_copy(pfd, tfd, pwd, old_pwd) == -1)
408 				openpam_log(PAM_LOG_ERROR, "pw_copy() failed");
409 			else if (pw_mkdb(pwd->pw_name) == -1)
410 				openpam_log(PAM_LOG_ERROR, "pw_mkdb() failed");
411 			else
412 				retval = PAM_SUCCESS;
413 			pw_fini();
414 #ifdef YP
415 			break;
416 		case _PWF_NIS:
417 			yp_domain = yp_server = NULL;
418 			(void)pam_get_data(pamh, "yp_domain", &yp_domain);
419 			(void)pam_get_data(pamh, "yp_server", &yp_server);
420 			ypclnt = ypclnt_new(yp_domain,
421 			    "passwd.byname", yp_server);
422 			if (ypclnt == NULL) {
423 				retval = PAM_BUF_ERR;
424 			} else if (ypclnt_connect(ypclnt) == -1 ||
425 			    ypclnt_passwd(ypclnt, pwd, old_pass) == -1) {
426 				openpam_log(PAM_LOG_ERROR, "%s", ypclnt->error);
427 				retval = PAM_SERVICE_ERR;
428 			} else {
429 				retval = PAM_SUCCESS;
430 			}
431 			ypclnt_free(ypclnt);
432 			break;
433 		default:
434 			openpam_log(PAM_LOG_ERROR, "unsupported source 0x%x",
435 			    pwd->pw_fields & _PWF_SOURCE);
436 			retval = PAM_SERVICE_ERR;
437 		}
438 #endif
439 		free(old_pwd);
440 	}
441 	else {
442 		/* Very bad juju */
443 		retval = PAM_ABORT;
444 		PAM_LOG("Illegal 'flags'");
445 	}
446 
447 	return (retval);
448 }
449 
450 /* Mostly stolen from passwd(1)'s local_passwd.c - markm */
451 
452 static unsigned char itoa64[] =		/* 0 ... 63 => ascii - 64 */
453 	"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
454 
455 static void
456 to64(char *s, long v, int n)
457 {
458 	while (--n >= 0) {
459 		*s++ = itoa64[v&0x3f];
460 		v >>= 6;
461 	}
462 }
463 
464 /* Salt suitable for traditional DES and MD5 */
465 void
466 makesalt(char salt[SALTSIZE])
467 {
468 	int i;
469 
470 	/* These are not really random numbers, they are just
471 	 * numbers that change to thwart construction of a
472 	 * dictionary. This is exposed to the public.
473 	 */
474 	for (i = 0; i < SALTSIZE; i += 4)
475 		to64(&salt[i], arc4random(), 4);
476 	salt[SALTSIZE] = '\0';
477 }
478 
479 PAM_MODULE_ENTRY("pam_unix");
480