1 /* 2 * Copyright (c) 1980, 1987, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from software contributed to Berkeley by 6 * Bob Toxen. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. All advertising materials mentioning features or use of this software 17 * must display the following acknowledgement: 18 * This product includes software developed by the University of 19 * California, Berkeley and its contributors. 20 * 4. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 */ 36 37 #ifndef lint 38 static const char copyright[] = 39 "@(#) Copyright (c) 1980, 1987, 1993\n\ 40 The Regents of the University of California. All rights reserved.\n"; 41 #endif /* not lint */ 42 43 #ifndef lint 44 #if 0 45 static char sccsid[] = "@(#)lock.c 8.1 (Berkeley) 6/6/93"; 46 #endif 47 static const char rcsid[] = 48 "$FreeBSD$"; 49 #endif /* not lint */ 50 51 /* 52 * Lock a terminal up until the given key is entered, until the root 53 * password is entered, or the given interval times out. 54 * 55 * Timeout interval is by default TIMEOUT, it can be changed with 56 * an argument of the form -time where time is in minutes 57 */ 58 59 #include <sys/param.h> 60 #include <sys/stat.h> 61 #include <sys/time.h> 62 #include <sys/signal.h> 63 #include <err.h> 64 #include <ctype.h> 65 #include <pwd.h> 66 #include <sgtty.h> 67 #include <stdio.h> 68 #include <stdlib.h> 69 #include <string.h> 70 #include <syslog.h> 71 #include <unistd.h> 72 #include <varargs.h> 73 74 #define TIMEOUT 15 75 76 void quit __P((int)), bye __P((int)), hi __P((int)); 77 static void usage __P((void)); 78 79 struct timeval timeout; 80 struct timeval zerotime; 81 struct sgttyb tty, ntty; 82 long nexttime; /* keep the timeout time */ 83 int no_timeout; /* lock terminal forever */ 84 85 /*ARGSUSED*/ 86 int 87 main(argc, argv) 88 int argc; 89 char **argv; 90 { 91 struct passwd *pw; 92 struct timeval timval; 93 time_t timval_sec; 94 struct itimerval ntimer, otimer; 95 struct tm *timp; 96 int ch, failures, sectimeout, usemine; 97 char *ap, *mypw, *ttynam, *tzn; 98 char hostname[MAXHOSTNAMELEN], s[BUFSIZ], s1[BUFSIZ]; 99 100 openlog("lock", LOG_ODELAY, LOG_AUTH); 101 102 sectimeout = TIMEOUT; 103 mypw = NULL; 104 usemine = 0; 105 no_timeout = 0; 106 while ((ch = getopt(argc, argv, "npt:")) != -1) 107 switch((char)ch) { 108 case 't': 109 if ((sectimeout = atoi(optarg)) <= 0) 110 errx(1, "illegal timeout value"); 111 break; 112 case 'p': 113 usemine = 1; 114 if (!(pw = getpwuid(getuid()))) 115 errx(1, "unknown uid %d", getuid()); 116 mypw = strdup(pw->pw_passwd); 117 break; 118 case 'n': 119 no_timeout = 1; 120 break; 121 case '?': 122 default: 123 usage(); 124 } 125 timeout.tv_sec = sectimeout * 60; 126 127 setuid(getuid()); /* discard privs */ 128 129 if (ioctl(0, TIOCGETP, &tty)) /* get information for header */ 130 exit(1); 131 gethostname(hostname, sizeof(hostname)); 132 if (!(ttynam = ttyname(0))) 133 errx(1, "not a terminal?"); 134 if (gettimeofday(&timval, (struct timezone *)NULL)) 135 err(1, "gettimeofday"); 136 nexttime = timval.tv_sec + (sectimeout * 60); 137 timval_sec = timval.tv_sec; 138 timp = localtime(&timval_sec); 139 ap = asctime(timp); 140 tzn = timp->tm_zone; 141 142 (void)signal(SIGINT, quit); 143 (void)signal(SIGQUIT, quit); 144 ntty = tty; ntty.sg_flags &= ~ECHO; 145 (void)ioctl(0, TIOCSETP, &ntty); 146 147 if (!mypw) { 148 /* get key and check again */ 149 (void)printf("Key: "); 150 if (!fgets(s, sizeof(s), stdin) || *s == '\n') 151 quit(0); 152 (void)printf("\nAgain: "); 153 /* 154 * Don't need EOF test here, if we get EOF, then s1 != s 155 * and the right things will happen. 156 */ 157 (void)fgets(s1, sizeof(s1), stdin); 158 (void)putchar('\n'); 159 if (strcmp(s1, s)) { 160 (void)printf("\07lock: passwords didn't match.\n"); 161 ioctl(0, TIOCSETP, &tty); 162 exit(1); 163 } 164 s[0] = '\0'; 165 mypw = s1; 166 } 167 168 /* set signal handlers */ 169 (void)signal(SIGINT, hi); 170 (void)signal(SIGQUIT, hi); 171 (void)signal(SIGTSTP, hi); 172 (void)signal(SIGALRM, bye); 173 174 ntimer.it_interval = zerotime; 175 ntimer.it_value = timeout; 176 if (!no_timeout) 177 setitimer(ITIMER_REAL, &ntimer, &otimer); 178 179 /* header info */ 180 if (no_timeout) { 181 (void)printf("lock: %s on %s. no timeout\ntime now is %.20s%s%s", 182 ttynam, hostname, ap, tzn, ap + 19); 183 } else { 184 (void)printf("lock: %s on %s. timeout in %d minutes\ntime now is %.20s%s%s", 185 ttynam, hostname, sectimeout, ap, tzn, ap + 19); 186 } 187 failures = 0; 188 189 for (;;) { 190 (void)printf("Key: "); 191 if (!fgets(s, sizeof(s), stdin)) { 192 clearerr(stdin); 193 hi(0); 194 continue; 195 } 196 if (usemine) { 197 s[strlen(s) - 1] = '\0'; 198 if (!strcmp(mypw, crypt(s, mypw))) 199 break; 200 } 201 else if (!strcmp(s, s1)) 202 break; 203 (void)printf("\07\n"); 204 failures++; 205 if (getuid() == 0) 206 syslog(LOG_NOTICE, "%d ROOT UNLOCK FAILURE%s (%s on %s)", 207 failures, failures > 1 ? "S": "", ttynam, hostname); 208 if (ioctl(0, TIOCGETP, &ntty)) 209 exit(1); 210 sleep(1); /* to discourage guessing */ 211 } 212 if (getuid() == 0) 213 syslog(LOG_NOTICE, "ROOT UNLOCK ON hostname %s port %s", 214 hostname, ttynam); 215 quit(0); 216 return(0); /* not reached */ 217 } 218 219 220 static void 221 usage() 222 { 223 (void)fprintf(stderr, "usage: lock [-n] [-p] [-t timeout]\n"); 224 exit(1); 225 } 226 227 void 228 hi(int signo __unused) 229 { 230 struct timeval timval; 231 232 if (!gettimeofday(&timval, (struct timezone *)NULL)) { 233 (void)printf("lock: type in the unlock key. "); 234 if (no_timeout) { 235 (void)putchar('\n'); 236 } else { 237 (void)printf("timeout in %ld:%ld minutes\n", 238 (nexttime - timval.tv_sec) / 60, 239 (nexttime - timval.tv_sec) % 60); 240 } 241 } 242 } 243 244 void 245 quit(int signo __unused) 246 { 247 (void)putchar('\n'); 248 (void)ioctl(0, TIOCSETP, &tty); 249 exit(0); 250 } 251 252 void 253 bye(int signo __unused) 254 { 255 if (!no_timeout) { 256 (void)ioctl(0, TIOCSETP, &tty); 257 (void)printf("lock: timeout\n"); 258 exit(1); 259 } 260 } 261