xref: /freebsd/lib/libpam/modules/pam_unix/pam_unix.c (revision ae83180158c4c937f170e31eff311b18c0286a93)
1 /*-
2  * Copyright 1998 Juniper Networks, Inc.
3  * All rights reserved.
4  * Copyright (c) 2002 Networks Associates Technology, Inc.
5  * All rights reserved.
6  *
7  * Portions of this software was developed for the FreeBSD Project by
8  * ThinkSec AS and NAI Labs, the Security Research Division of Network
9  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
10  * ("CBOSS"), as part of the DARPA CHATS research program.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. The name of the author may not be used to endorse or promote
21  *    products derived from this software without specific prior written
22  *    permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include <sys/param.h>
41 #include <sys/socket.h>
42 #include <sys/time.h>
43 #include <netinet/in.h>
44 #include <arpa/inet.h>
45 
46 #include <login_cap.h>
47 #include <netdb.h>
48 #include <pwd.h>
49 #include <stdlib.h>
50 #include <string.h>
51 #include <stdio.h>
52 #include <syslog.h>
53 #include <unistd.h>
54 
55 #include <libutil.h>
56 
57 #ifdef YP
58 #include <ypclnt.h>
59 #endif
60 
61 #define PAM_SM_AUTH
62 #define PAM_SM_ACCOUNT
63 #define	PAM_SM_PASSWORD
64 
65 #include <security/pam_appl.h>
66 #include <security/pam_modules.h>
67 #include <security/pam_mod_misc.h>
68 
69 #define PASSWORD_HASH		"md5"
70 #define DEFAULT_WARN		(2L * 7L * 86400L)  /* Two weeks */
71 #define	SALTSIZE		32
72 
73 static void makesalt(char []);
74 
75 static char password_hash[] =		PASSWORD_HASH;
76 
77 enum {
78 	PAM_OPT_AUTH_AS_SELF	= PAM_OPT_STD_MAX,
79 	PAM_OPT_NULLOK,
80 	PAM_OPT_LOCAL_PASS,
81 	PAM_OPT_NIS_PASS
82 };
83 
84 static struct opttab other_options[] = {
85 	{ "auth_as_self",	PAM_OPT_AUTH_AS_SELF },
86 	{ "nullok",		PAM_OPT_NULLOK },
87 	{ "local_pass",		PAM_OPT_LOCAL_PASS },
88 	{ "nis_pass",		PAM_OPT_NIS_PASS },
89 	{ NULL, 0 }
90 };
91 
92 char *tempname = NULL;
93 
94 /*
95  * authentication management
96  */
97 PAM_EXTERN int
98 pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
99     int argc, const char *argv[])
100 {
101 	login_cap_t *lc;
102 	struct options options;
103 	struct passwd *pwd;
104 	int retval;
105 	const char *pass, *user, *realpw, *prompt;
106 
107 	pam_std_option(&options, other_options, argc, argv);
108 
109 	PAM_LOG("Options processed");
110 
111 	if (pam_test_option(&options, PAM_OPT_AUTH_AS_SELF, NULL)) {
112 		pwd = getpwnam(getlogin());
113 	} else {
114 		retval = pam_get_user(pamh, &user, NULL);
115 		if (retval != PAM_SUCCESS)
116 			return (retval);
117 		pwd = getpwnam(user);
118 	}
119 
120 	PAM_LOG("Got user: %s", user);
121 
122 	if (pwd != NULL) {
123 		PAM_LOG("Doing real authentication");
124 		realpw = pwd->pw_passwd;
125 		if (realpw[0] == '\0') {
126 			if (!(flags & PAM_DISALLOW_NULL_AUTHTOK) &&
127 			    pam_test_option(&options, PAM_OPT_NULLOK, NULL))
128 				return (PAM_SUCCESS);
129 			realpw = "*";
130 		}
131 		lc = login_getpwclass(pwd);
132 	} else {
133 		PAM_LOG("Doing dummy authentication");
134 		realpw = "*";
135 		lc = login_getclass(NULL);
136 	}
137 	prompt = login_getcapstr(lc, "passwd_prompt", NULL, NULL);
138 	retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, prompt);
139 	login_close(lc);
140 	if (retval != PAM_SUCCESS)
141 		return (retval);
142 	PAM_LOG("Got password");
143 	if (strcmp(crypt(pass, realpw), realpw) == 0)
144 		return (PAM_SUCCESS);
145 
146 	PAM_VERBOSE_ERROR("UNIX authentication refused");
147 	return (PAM_AUTH_ERR);
148 }
149 
150 PAM_EXTERN int
151 pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
152     int argc __unused, const char *argv[] __unused)
153 {
154 
155 	return (PAM_SUCCESS);
156 }
157 
158 /*
159  * account management
160  */
161 PAM_EXTERN int
162 pam_sm_acct_mgmt(pam_handle_t *pamh, int flags __unused,
163     int argc, const char *argv[])
164 {
165 	struct addrinfo hints, *res;
166 	struct options options;
167 	struct passwd *pwd;
168 	struct timeval tp;
169 	login_cap_t *lc;
170 	time_t warntime;
171 	int retval;
172 	const char *rhost, *tty, *user;
173 	char rhostip[MAXHOSTNAMELEN];
174 
175 	pam_std_option(&options, other_options, argc, argv);
176 
177 	PAM_LOG("Options processed");
178 
179 	retval = pam_get_user(pamh, &user, NULL);
180 	if (retval != PAM_SUCCESS)
181 		return (retval);
182 
183 	if (user == NULL || (pwd = getpwnam(user)) == NULL)
184 		return (PAM_SERVICE_ERR);
185 
186 	PAM_LOG("Got user: %s", user);
187 
188 	retval = pam_get_item(pamh, PAM_RHOST, (const void **)&rhost);
189 	if (retval != PAM_SUCCESS)
190 		return (retval);
191 
192 	retval = pam_get_item(pamh, PAM_TTY, (const void **)&tty);
193 	if (retval != PAM_SUCCESS)
194 		return (retval);
195 
196 	if (*pwd->pw_passwd == '\0' &&
197 	    (flags & PAM_DISALLOW_NULL_AUTHTOK) != 0)
198 		return (PAM_NEW_AUTHTOK_REQD);
199 
200 	lc = login_getpwclass(pwd);
201 	if (lc == NULL) {
202 		PAM_LOG("Unable to get login class for user %s", user);
203 		return (PAM_SERVICE_ERR);
204 	}
205 
206 	PAM_LOG("Got login_cap");
207 
208 	if (pwd->pw_change || pwd->pw_expire)
209 		gettimeofday(&tp, NULL);
210 
211 	/*
212 	 * Check pw_expire before pw_change - no point in letting the
213 	 * user change the password on an expired account.
214 	 */
215 
216 	if (pwd->pw_expire) {
217 		warntime = login_getcaptime(lc, "warnexpire",
218 		    DEFAULT_WARN, DEFAULT_WARN);
219 		if (tp.tv_sec >= pwd->pw_expire) {
220 			login_close(lc);
221 			return (PAM_ACCT_EXPIRED);
222 		} else if (pwd->pw_expire - tp.tv_sec < warntime &&
223 		    (flags & PAM_SILENT) == 0) {
224 			pam_error(pamh, "Warning: your account expires on %s",
225 			    ctime(&pwd->pw_expire));
226 		}
227 	}
228 
229 	retval = PAM_SUCCESS;
230 	if (pwd->pw_change) {
231 		warntime = login_getcaptime(lc, "warnpassword",
232 		    DEFAULT_WARN, DEFAULT_WARN);
233 		if (tp.tv_sec >= pwd->pw_change) {
234 			retval = PAM_NEW_AUTHTOK_REQD;
235 		} else if (pwd->pw_change - tp.tv_sec < warntime &&
236 		    (flags & PAM_SILENT) == 0) {
237 			pam_error(pamh, "Warning: your password expires on %s",
238 			    ctime(&pwd->pw_change));
239 		}
240 	}
241 
242 	/*
243 	 * From here on, we must leave retval untouched (unless we
244 	 * know we're going to fail), because we need to remember
245 	 * whether we're supposed to return PAM_SUCCESS or
246 	 * PAM_NEW_AUTHTOK_REQD.
247 	 */
248 
249 	if (rhost) {
250 		memset(&hints, 0, sizeof(hints));
251 		hints.ai_family = AF_UNSPEC;
252 		if (getaddrinfo(rhost, NULL, &hints, &res) == 0) {
253 			getnameinfo(res->ai_addr, res->ai_addrlen,
254 			    rhostip, sizeof(rhostip), NULL, 0,
255 			    NI_NUMERICHOST|NI_WITHSCOPEID);
256 		}
257 		if (res != NULL)
258 			freeaddrinfo(res);
259 	}
260 
261 	/*
262 	 * Check host / tty / time-of-day restrictions
263 	 */
264 
265 	if (!auth_hostok(lc, rhost, rhostip) ||
266 	    !auth_ttyok(lc, tty) ||
267 	    !auth_timeok(lc, time(NULL)))
268 		retval = PAM_AUTH_ERR;
269 
270 	login_close(lc);
271 
272 	return (retval);
273 }
274 
275 /*
276  * password management
277  *
278  * standard Unix and NIS password changing
279  */
280 PAM_EXTERN int
281 pam_sm_chauthtok(pam_handle_t *pamh, int flags,
282     int argc, const char *argv[])
283 {
284 #ifdef YP
285 	struct ypclnt *ypclnt;
286 	const char *yp_domain, *yp_server;
287 #endif
288 	struct options options;
289 	char salt[SALTSIZE + 1];
290 	login_cap_t * lc;
291 	struct passwd *pwd, *old_pwd;
292 	const char *user, *old_pass, *new_pass;
293 	char *encrypted;
294 	int pfd, tfd, retval;
295 
296 	pam_std_option(&options, other_options, argc, argv);
297 
298 	PAM_LOG("Options processed");
299 
300 	if (pam_test_option(&options, PAM_OPT_AUTH_AS_SELF, NULL))
301 		pwd = getpwnam(getlogin());
302 	else {
303 		retval = pam_get_user(pamh, &user, NULL);
304 		if (retval != PAM_SUCCESS)
305 			return (retval);
306 		pwd = getpwnam(user);
307 	}
308 
309 	if (pwd == NULL)
310 		return (PAM_AUTHTOK_RECOVERY_ERR);
311 
312 	PAM_LOG("Got user: %s", user);
313 
314 	if (flags & PAM_PRELIM_CHECK) {
315 
316 		PAM_LOG("PRELIM round");
317 
318 		if (getuid() == 0 &&
319 		    (pwd->pw_fields & _PWF_SOURCE) == _PWF_FILES)
320 			/* root doesn't need the old password */
321 			return (pam_set_item(pamh, PAM_OLDAUTHTOK, ""));
322 
323 		if (pwd->pw_passwd[0] == '\0'
324 		    && pam_test_option(&options, PAM_OPT_NULLOK, NULL)) {
325 			/*
326 			 * No password case. XXX Are we giving too much away
327 			 * by not prompting for a password?
328 			 * XXX check PAM_DISALLOW_NULL_AUTHTOK
329 			 */
330 			old_pass = "";
331 		} else {
332 			retval = pam_get_authtok(pamh,
333 			    PAM_OLDAUTHTOK, &old_pass, NULL);
334 			if (retval != PAM_SUCCESS)
335 				return (retval);
336 		}
337 		PAM_LOG("Got old password");
338 		/* always encrypt first */
339 		encrypted = crypt(old_pass, pwd->pw_passwd);
340 		if ((old_pass[0] == '\0' && pwd->pw_passwd[0] != '\0') ||
341 		    strcmp(encrypted, pwd->pw_passwd) != 0)
342 			return (PAM_PERM_DENIED);
343 	}
344 	else if (flags & PAM_UPDATE_AUTHTOK) {
345 		PAM_LOG("UPDATE round");
346 
347 		retval = pam_get_authtok(pamh,
348 		    PAM_OLDAUTHTOK, &old_pass, NULL);
349 		if (retval != PAM_SUCCESS)
350 			return (retval);
351 		PAM_LOG("Got old password");
352 
353 		/* get new password */
354 		for (;;) {
355 			retval = pam_get_authtok(pamh,
356 			    PAM_AUTHTOK, &new_pass, NULL);
357 			if (retval != PAM_TRY_AGAIN)
358 				break;
359 			pam_error(pamh, "Mismatch; try again, EOF to quit.");
360 		}
361 		PAM_LOG("Got new password");
362 		if (retval != PAM_SUCCESS) {
363 			PAM_VERBOSE_ERROR("Unable to get new password");
364 			return (retval);
365 		}
366 
367 		if ((old_pwd = pw_dup(pwd)) == NULL)
368 			return (PAM_BUF_ERR);
369 
370 		pwd->pw_change = 0;
371 		lc = login_getclass(NULL);
372 		if (login_setcryptfmt(lc, password_hash, NULL) == NULL)
373 			openpam_log(PAM_LOG_ERROR,
374 			    "can't set password cipher, relying on default");
375 		login_close(lc);
376 		makesalt(salt);
377 		pwd->pw_passwd = crypt(new_pass, salt);
378 #ifdef YP
379 		switch (old_pwd->pw_fields & _PWF_SOURCE) {
380 		case _PWF_FILES:
381 #endif
382 			retval = PAM_SERVICE_ERR;
383 			if (pw_init(NULL, NULL))
384 				openpam_log(PAM_LOG_ERROR, "pw_init() failed");
385 			else if ((pfd = pw_lock()) == -1)
386 				openpam_log(PAM_LOG_ERROR, "pw_lock() failed");
387 			else if ((tfd = pw_tmp(-1)) == -1)
388 				openpam_log(PAM_LOG_ERROR, "pw_tmp() failed");
389 			else if (pw_copy(pfd, tfd, pwd, old_pwd) == -1)
390 				openpam_log(PAM_LOG_ERROR, "pw_copy() failed");
391 			else if (pw_mkdb(pwd->pw_name) == -1)
392 				openpam_log(PAM_LOG_ERROR, "pw_mkdb() failed");
393 			else
394 				retval = PAM_SUCCESS;
395 			pw_fini();
396 #ifdef YP
397 			break;
398 		case _PWF_NIS:
399 			yp_domain = yp_server = NULL;
400 			(void)pam_get_data(pamh,
401 			    "yp_domain", (const void **)&yp_domain);
402 			(void)pam_get_data(pamh,
403 			    "yp_server", (const void **)&yp_server);
404 			ypclnt = ypclnt_new(yp_domain,
405 			    "passwd.byname", yp_server);
406 			if (ypclnt == NULL) {
407 				retval = PAM_BUF_ERR;
408 			} else if (ypclnt_connect(ypclnt) == -1 ||
409 			    ypclnt_passwd(ypclnt, pwd, old_pass) == -1) {
410 				openpam_log(PAM_LOG_ERROR, "%s", ypclnt->error);
411 				retval = PAM_SERVICE_ERR;
412 			} else {
413 				retval = PAM_SUCCESS;
414 			}
415 			ypclnt_free(ypclnt);
416 			break;
417 		default:
418 			openpam_log(PAM_LOG_ERROR, "unsupported source 0x%x",
419 			    pwd->pw_fields & _PWF_SOURCE);
420 			retval = PAM_SERVICE_ERR;
421 		}
422 #endif
423 		free(old_pwd);
424 	}
425 	else {
426 		/* Very bad juju */
427 		retval = PAM_ABORT;
428 		PAM_LOG("Illegal 'flags'");
429 	}
430 
431 	return (retval);
432 }
433 
434 /* Mostly stolen from passwd(1)'s local_passwd.c - markm */
435 
436 static unsigned char itoa64[] =		/* 0 ... 63 => ascii - 64 */
437 	"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
438 
439 static void
440 to64(char *s, long v, int n)
441 {
442 	while (--n >= 0) {
443 		*s++ = itoa64[v&0x3f];
444 		v >>= 6;
445 	}
446 }
447 
448 /* Salt suitable for traditional DES and MD5 */
449 void
450 makesalt(char salt[SALTSIZE])
451 {
452 	int i;
453 
454 	/* These are not really random numbers, they are just
455 	 * numbers that change to thwart construction of a
456 	 * dictionary. This is exposed to the public.
457 	 */
458 	for (i = 0; i < SALTSIZE; i += 4)
459 		to64(&salt[i], arc4random(), 4);
460 	salt[SALTSIZE] = '\0';
461 }
462 
463 PAM_MODULE_ENTRY("pam_unix");
464