xref: /freebsd/usr.bin/login/login.c (revision 8673ed156552bd8add414f536a5043a66927087c)
1 /*-
2  * Copyright (c) 1980, 1987, 1988, 1991, 1993, 1994
3  *	The Regents of the University of California.  All rights reserved.
4  * Copyright (c) 2002 Networks Associates Technologies, Inc.
5  * All rights reserved.
6  *
7  * Portions of this software were developed for the FreeBSD Project by
8  * ThinkSec AS and NAI Labs, the Security Research Division of Network
9  * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
10  * ("CBOSS"), as part of the DARPA CHATS research program.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *	This product includes software developed by the University of
23  *	California, Berkeley and its contributors.
24  * 4. Neither the name of the University nor the names of its contributors
25  *    may be used to endorse or promote products derived from this software
26  *    without specific prior written permission.
27  *
28  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
29  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
32  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38  * SUCH DAMAGE.
39  */
40 
41 #if 0
42 #ifndef lint
43 static char sccsid[] = "@(#)login.c	8.4 (Berkeley) 4/2/94";
44 #endif
45 #endif
46 
47 #include <sys/cdefs.h>
48 __FBSDID("$FreeBSD$");
49 
50 /*
51  * login [ name ]
52  * login -h hostname	(for telnetd, etc.)
53  * login -f name	(for pre-authenticated login: datakit, xterm, etc.)
54  */
55 
56 #include <sys/copyright.h>
57 #include <sys/param.h>
58 #include <sys/file.h>
59 #include <sys/stat.h>
60 #include <sys/time.h>
61 #include <sys/resource.h>
62 #include <sys/wait.h>
63 
64 #include <err.h>
65 #include <errno.h>
66 #include <grp.h>
67 #include <libutil.h>
68 #include <login_cap.h>
69 #include <pwd.h>
70 #include <setjmp.h>
71 #include <signal.h>
72 #include <stdio.h>
73 #include <stdlib.h>
74 #include <string.h>
75 #include <syslog.h>
76 #include <ttyent.h>
77 #include <unistd.h>
78 
79 #include <security/pam_appl.h>
80 #include <security/openpam.h>
81 
82 #include "login.h"
83 #include "pathnames.h"
84 
85 static int		 auth_pam(void);
86 static void		 bail(int, int);
87 static int		 export(const char *);
88 static void		 export_pam_environment(void);
89 static int		 motd(const char *);
90 static void		 badlogin(char *);
91 static char		*getloginname(void);
92 static void		 pam_syslog(const char *);
93 static void		 pam_cleanup(void);
94 static void		 refused(const char *, const char *, int);
95 static const char	*stypeof(char *);
96 static void		 sigint(int);
97 static void		 timedout(int);
98 static void		 usage(void);
99 
100 #define	TTYGRPNAME		"tty"			/* group to own ttys */
101 #define	DEFAULT_BACKOFF		3
102 #define	DEFAULT_RETRIES		10
103 #define	DEFAULT_PROMPT		"login: "
104 #define	DEFAULT_PASSWD_PROMPT	"Password:"
105 #define	TERM_UNKNOWN		"su"
106 #define	DEFAULT_WARN		(2L * 7L * 86400L)	/* Two weeks */
107 #define NO_SLEEP_EXIT		0
108 #define SLEEP_EXIT		5
109 
110 /*
111  * This bounds the time given to login.  Not a define so it can
112  * be patched on machines where it's too small.
113  */
114 static u_int		timeout = 300;
115 
116 /* Buffer for signal handling of timeout */
117 static jmp_buf		 timeout_buf;
118 
119 struct passwd		*pwd;
120 static int		 failures;
121 
122 static char		*envinit[1];	/* empty environment list */
123 
124 /*
125  * Command line flags and arguments
126  */
127 static int		 fflag;		/* -f: do not perform authentication */
128 static int		 hflag;		/* -h: login from remote host */
129 static char		*hostname;	/* hostname from command line */
130 static int		 pflag;		/* -p: preserve environment */
131 
132 /*
133  * User name
134  */
135 static char		*username;	/* user name */
136 static char		*olduser;	/* previous user name */
137 
138 /*
139  * Prompts
140  */
141 static char		 default_prompt[] = DEFAULT_PROMPT;
142 static const char	*prompt;
143 static char		 default_passwd_prompt[] = DEFAULT_PASSWD_PROMPT;
144 static const char	*passwd_prompt;
145 
146 static char		*tty;
147 
148 /*
149  * PAM data
150  */
151 static pam_handle_t	*pamh = NULL;
152 static struct pam_conv	 pamc = { openpam_ttyconv, NULL };
153 static int		 pam_err;
154 static int		 pam_silent = PAM_SILENT;
155 static int		 pam_cred_established;
156 static int		 pam_session_established;
157 
158 int
159 main(int argc, char *argv[])
160 {
161 	struct group *gr;
162 	struct stat st;
163 	int retries, backoff;
164 	int ask, ch, cnt, quietlog, rootlogin, rval;
165 	uid_t uid, euid;
166 	gid_t egid;
167 	char *term;
168 	char *p, *ttyn;
169 	char tname[sizeof(_PATH_TTY) + 10];
170 	char *arg0;
171 	const char *tp;
172 	const char *shell = NULL;
173 	login_cap_t *lc = NULL;
174 	login_cap_t *lc_user = NULL;
175 	pid_t pid;
176 #ifdef USE_BSM_AUDIT
177 	char auditsuccess = 1;
178 #endif
179 
180 	(void)signal(SIGQUIT, SIG_IGN);
181 	(void)signal(SIGINT, SIG_IGN);
182 	(void)signal(SIGHUP, SIG_IGN);
183 	if (setjmp(timeout_buf)) {
184 		if (failures)
185 			badlogin(username);
186 		(void)fprintf(stderr, "Login timed out after %d seconds\n",
187 		    timeout);
188 		bail(NO_SLEEP_EXIT, 0);
189 	}
190 	(void)signal(SIGALRM, timedout);
191 	(void)alarm(timeout);
192 	(void)setpriority(PRIO_PROCESS, 0, 0);
193 
194 	openlog("login", LOG_ODELAY, LOG_AUTH);
195 
196 	uid = getuid();
197 	euid = geteuid();
198 	egid = getegid();
199 
200 	while ((ch = getopt(argc, argv, "fh:p")) != -1)
201 		switch (ch) {
202 		case 'f':
203 			fflag = 1;
204 			break;
205 		case 'h':
206 			if (uid != 0)
207 				errx(1, "-h option: %s", strerror(EPERM));
208 			if (strlen(optarg) >= MAXHOSTNAMELEN)
209 				errx(1, "-h option: %s: exceeds maximum "
210 				    "hostname size", optarg);
211 			hflag = 1;
212 			hostname = optarg;
213 			break;
214 		case 'p':
215 			pflag = 1;
216 			break;
217 		case '?':
218 		default:
219 			if (uid == 0)
220 				syslog(LOG_ERR, "invalid flag %c", ch);
221 			usage();
222 		}
223 	argc -= optind;
224 	argv += optind;
225 
226 	if (argc > 0) {
227 		username = strdup(*argv);
228 		if (username == NULL)
229 			err(1, "strdup()");
230 		ask = 0;
231 	} else {
232 		ask = 1;
233 	}
234 
235 	setproctitle("-%s", getprogname());
236 
237 	for (cnt = getdtablesize(); cnt > 2; cnt--)
238 		(void)close(cnt);
239 
240 	/*
241 	 * Get current TTY
242 	 */
243 	ttyn = ttyname(STDIN_FILENO);
244 	if (ttyn == NULL || *ttyn == '\0') {
245 		(void)snprintf(tname, sizeof(tname), "%s??", _PATH_TTY);
246 		ttyn = tname;
247 	}
248 	if ((tty = strrchr(ttyn, '/')) != NULL)
249 		++tty;
250 	else
251 		tty = ttyn;
252 
253 	/*
254 	 * Get "login-retries" & "login-backoff" from default class
255 	 */
256 	lc = login_getclass(NULL);
257 	prompt = login_getcapstr(lc, "login_prompt",
258 	    default_prompt, default_prompt);
259 	passwd_prompt = login_getcapstr(lc, "passwd_prompt",
260 	    default_passwd_prompt, default_passwd_prompt);
261 	retries = login_getcapnum(lc, "login-retries",
262 	    DEFAULT_RETRIES, DEFAULT_RETRIES);
263 	backoff = login_getcapnum(lc, "login-backoff",
264 	    DEFAULT_BACKOFF, DEFAULT_BACKOFF);
265 	login_close(lc);
266 	lc = NULL;
267 
268 	/*
269 	 * Try to authenticate the user until we succeed or time out.
270 	 */
271 	for (cnt = 0;; ask = 1) {
272 		if (ask) {
273 			fflag = 0;
274 			if (olduser != NULL)
275 				free(olduser);
276 			olduser = username;
277 			username = getloginname();
278 		}
279 		rootlogin = 0;
280 
281 		/*
282 		 * Note if trying multiple user names; log failures for
283 		 * previous user name, but don't bother logging one failure
284 		 * for nonexistent name (mistyped username).
285 		 */
286 		if (failures && strcmp(olduser, username) != 0) {
287 			if (failures > (pwd ? 0 : 1))
288 				badlogin(olduser);
289 		}
290 
291 		/*
292 		 * Load the PAM policy and set some variables
293 		 */
294 		pam_err = pam_start("login", username, &pamc, &pamh);
295 		if (pam_err != PAM_SUCCESS) {
296 			pam_syslog("pam_start()");
297 #ifdef USE_BSM_AUDIT
298 			au_login_fail("PAM Error", 1);
299 #endif
300 			bail(NO_SLEEP_EXIT, 1);
301 		}
302 		pam_err = pam_set_item(pamh, PAM_TTY, tty);
303 		if (pam_err != PAM_SUCCESS) {
304 			pam_syslog("pam_set_item(PAM_TTY)");
305 #ifdef USE_BSM_AUDIT
306 			au_login_fail("PAM Error", 1);
307 #endif
308 			bail(NO_SLEEP_EXIT, 1);
309 		}
310 		pam_err = pam_set_item(pamh, PAM_RHOST, hostname);
311 		if (pam_err != PAM_SUCCESS) {
312 			pam_syslog("pam_set_item(PAM_RHOST)");
313 #ifdef USE_BSM_AUDIT
314 			au_login_fail("PAM Error", 1);
315 #endif
316 			bail(NO_SLEEP_EXIT, 1);
317 		}
318 
319 		pwd = getpwnam(username);
320 		if (pwd != NULL && pwd->pw_uid == 0)
321 			rootlogin = 1;
322 
323 		/*
324 		 * If the -f option was specified and the caller is
325 		 * root or the caller isn't changing their uid, don't
326 		 * authenticate.
327 		 */
328 		if (pwd != NULL && fflag &&
329 		    (uid == (uid_t)0 || uid == (uid_t)pwd->pw_uid)) {
330 			/* already authenticated */
331 			rval = 0;
332 #ifdef USE_BSM_AUDIT
333 			auditsuccess = 0; /* opened a terminal window only */
334 #endif
335 		} else {
336 			fflag = 0;
337 			(void)setpriority(PRIO_PROCESS, 0, -4);
338 			rval = auth_pam();
339 			(void)setpriority(PRIO_PROCESS, 0, 0);
340 		}
341 
342 		if (pwd && rval == 0)
343 			break;
344 
345 		pam_cleanup();
346 
347 		/*
348 		 * We are not exiting here, but this corresponds to a failed
349 		 * login event, so set exitstatus to 1.
350 		 */
351 #ifdef USE_BSM_AUDIT
352 		au_login_fail("Login incorrect", 1);
353 #endif
354 
355 		(void)printf("Login incorrect\n");
356 		failures++;
357 
358 		pwd = NULL;
359 
360 		/*
361 		 * Allow up to 'retry' (10) attempts, but start
362 		 * backing off after 'backoff' (3) attempts.
363 		 */
364 		if (++cnt > backoff) {
365 			if (cnt >= retries) {
366 				badlogin(username);
367 				bail(SLEEP_EXIT, 1);
368 			}
369 			sleep((u_int)((cnt - backoff) * 5));
370 		}
371 	}
372 
373 	/* committed to login -- turn off timeout */
374 	(void)alarm((u_int)0);
375 	(void)signal(SIGHUP, SIG_DFL);
376 
377 	endpwent();
378 
379 #ifdef USE_BSM_AUDIT
380 	/* Audit successful login. */
381 	if (auditsuccess)
382 		au_login_success();
383 #endif
384 
385 	/*
386 	 * Establish the login class.
387 	 */
388 	lc = login_getpwclass(pwd);
389 	lc_user = login_getuserclass(pwd);
390 
391 	if (!(quietlog = login_getcapbool(lc_user, "hushlogin", 0)))
392 		quietlog = login_getcapbool(lc, "hushlogin", 0);
393 
394 	/*
395 	 * Switching needed for NFS with root access disabled.
396 	 *
397 	 * XXX: This change fails to modify the additional groups for the
398 	 * process, and as such, may restrict rights normally granted
399 	 * through those groups.
400 	 */
401 	(void)setegid(pwd->pw_gid);
402 	(void)seteuid(rootlogin ? 0 : pwd->pw_uid);
403 	if (!*pwd->pw_dir || chdir(pwd->pw_dir) < 0) {
404 		if (login_getcapbool(lc, "requirehome", 0))
405 			refused("Home directory not available", "HOMEDIR", 1);
406 		if (chdir("/") < 0)
407 			refused("Cannot find root directory", "ROOTDIR", 1);
408 		if (!quietlog || *pwd->pw_dir)
409 			printf("No home directory.\nLogging in with home = \"/\".\n");
410 		pwd->pw_dir = strdup("/");
411 		if (pwd->pw_dir == NULL) {
412 			syslog(LOG_NOTICE, "strdup(): %m");
413 			bail(SLEEP_EXIT, 1);
414 		}
415 	}
416 	(void)seteuid(euid);
417 	(void)setegid(egid);
418 	if (!quietlog) {
419 		quietlog = access(_PATH_HUSHLOGIN, F_OK) == 0;
420 		if (!quietlog)
421 			pam_silent = 0;
422 	}
423 
424 	shell = login_getcapstr(lc, "shell", pwd->pw_shell, pwd->pw_shell);
425 	if (*pwd->pw_shell == '\0')
426 		pwd->pw_shell = strdup(_PATH_BSHELL);
427 	if (pwd->pw_shell == NULL) {
428 		syslog(LOG_NOTICE, "strdup(): %m");
429 		bail(SLEEP_EXIT, 1);
430 	}
431 	if (*shell == '\0')   /* Not overridden */
432 		shell = pwd->pw_shell;
433 	if ((shell = strdup(shell)) == NULL) {
434 		syslog(LOG_NOTICE, "strdup(): %m");
435 		bail(SLEEP_EXIT, 1);
436 	}
437 
438 	/*
439 	 * Set device protections, depending on what terminal the
440 	 * user is logged in. This feature is used on Suns to give
441 	 * console users better privacy.
442 	 */
443 	login_fbtab(tty, pwd->pw_uid, pwd->pw_gid);
444 
445 	/*
446 	 * Clear flags of the tty.  None should be set, and when the
447 	 * user sets them otherwise, this can cause the chown to fail.
448 	 * Since it isn't clear that flags are useful on character
449 	 * devices, we just clear them.
450 	 *
451 	 * We don't log in the case of EOPNOTSUPP because dev might be
452 	 * on NFS, which doesn't support chflags.
453 	 *
454 	 * We don't log in the EROFS because that means that /dev is on
455 	 * a read only file system and we assume that the permissions there
456 	 * are sane.
457 	 */
458 	if (ttyn != tname && chflags(ttyn, 0))
459 		if (errno != EOPNOTSUPP && errno != EROFS)
460 			syslog(LOG_ERR, "chflags(%s): %m", ttyn);
461 	if (ttyn != tname && chown(ttyn, pwd->pw_uid,
462 	    (gr = getgrnam(TTYGRPNAME)) ? gr->gr_gid : pwd->pw_gid))
463 		if (errno != EROFS)
464 			syslog(LOG_ERR, "chown(%s): %m", ttyn);
465 
466 	/*
467 	 * Exclude cons/vt/ptys only, assume dialup otherwise
468 	 * TODO: Make dialup tty determination a library call
469 	 * for consistency (finger etc.)
470 	 */
471 	if (hflag && isdialuptty(tty))
472 		syslog(LOG_INFO, "DIALUP %s, %s", tty, pwd->pw_name);
473 
474 #ifdef LOGALL
475 	/*
476 	 * Syslog each successful login, so we don't have to watch
477 	 * hundreds of wtmp or lastlogin files.
478 	 */
479 	if (hflag)
480 		syslog(LOG_INFO, "login from %s on %s as %s",
481 		       hostname, tty, pwd->pw_name);
482 	else
483 		syslog(LOG_INFO, "login on %s as %s",
484 		       tty, pwd->pw_name);
485 #endif
486 
487 	/*
488 	 * If fflag is on, assume caller/authenticator has logged root
489 	 * login.
490 	 */
491 	if (rootlogin && fflag == 0) {
492 		if (hflag)
493 			syslog(LOG_NOTICE, "ROOT LOGIN (%s) ON %s FROM %s",
494 			    username, tty, hostname);
495 		else
496 			syslog(LOG_NOTICE, "ROOT LOGIN (%s) ON %s",
497 			    username, tty);
498 	}
499 
500 	/*
501 	 * Destroy environment unless user has requested its
502 	 * preservation - but preserve TERM in all cases
503 	 */
504 	term = getenv("TERM");
505 	if (!pflag)
506 		environ = envinit;
507 	if (term != NULL)
508 		setenv("TERM", term, 0);
509 
510 	/*
511 	 * PAM modules might add supplementary groups during pam_setcred().
512 	 */
513 	if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) != 0) {
514 		syslog(LOG_ERR, "setusercontext() failed - exiting");
515 		bail(NO_SLEEP_EXIT, 1);
516 	}
517 
518 	pam_err = pam_setcred(pamh, pam_silent|PAM_ESTABLISH_CRED);
519 	if (pam_err != PAM_SUCCESS) {
520 		pam_syslog("pam_setcred()");
521 		bail(NO_SLEEP_EXIT, 1);
522 	}
523 	pam_cred_established = 1;
524 
525 	pam_err = pam_open_session(pamh, pam_silent);
526 	if (pam_err != PAM_SUCCESS) {
527 		pam_syslog("pam_open_session()");
528 		bail(NO_SLEEP_EXIT, 1);
529 	}
530 	pam_session_established = 1;
531 
532 	/*
533 	 * We must fork() before setuid() because we need to call
534 	 * pam_close_session() as root.
535 	 */
536 	pid = fork();
537 	if (pid < 0) {
538 		err(1, "fork");
539 	} else if (pid != 0) {
540 		/*
541 		 * Parent: wait for child to finish, then clean up
542 		 * session.
543 		 */
544 		int status;
545 		setproctitle("-%s [pam]", getprogname());
546 		waitpid(pid, &status, 0);
547 		bail(NO_SLEEP_EXIT, 0);
548 	}
549 
550 	/*
551 	 * NOTICE: We are now in the child process!
552 	 */
553 
554 	/*
555 	 * Add any environment variables the PAM modules may have set.
556 	 */
557 	export_pam_environment();
558 
559 	/*
560 	 * We're done with PAM now; our parent will deal with the rest.
561 	 */
562 	pam_end(pamh, 0);
563 	pamh = NULL;
564 
565 	/*
566 	 * We don't need to be root anymore, so set the login name and
567 	 * the UID.
568 	 */
569 	if (setlogin(username) != 0) {
570 		syslog(LOG_ERR, "setlogin(%s): %m - exiting", username);
571 		bail(NO_SLEEP_EXIT, 1);
572 	}
573 	if (setusercontext(lc, pwd, pwd->pw_uid,
574 	    LOGIN_SETALL & ~(LOGIN_SETLOGIN|LOGIN_SETGROUP)) != 0) {
575 		syslog(LOG_ERR, "setusercontext() failed - exiting");
576 		exit(1);
577 	}
578 
579 	(void)setenv("SHELL", pwd->pw_shell, 1);
580 	(void)setenv("HOME", pwd->pw_dir, 1);
581 	/* Overwrite "term" from login.conf(5) for any known TERM */
582 	if (term == NULL && (tp = stypeof(tty)) != NULL)
583 		(void)setenv("TERM", tp, 1);
584 	else
585 		(void)setenv("TERM", TERM_UNKNOWN, 0);
586 	(void)setenv("LOGNAME", username, 1);
587 	(void)setenv("USER", username, 1);
588 	(void)setenv("PATH", rootlogin ? _PATH_STDPATH : _PATH_DEFPATH, 0);
589 
590 	if (!quietlog) {
591 		const char *cw;
592 
593 		cw = login_getcapstr(lc, "copyright", NULL, NULL);
594 		if (cw == NULL || motd(cw) == -1)
595 			(void)printf("%s", copyright);
596 
597 		(void)printf("\n");
598 
599 		cw = login_getcapstr(lc, "welcome", NULL, NULL);
600 		if (cw != NULL && access(cw, F_OK) == 0)
601 			motd(cw);
602 		else
603 			motd(_PATH_MOTDFILE);
604 
605 		if (login_getcapbool(lc_user, "nocheckmail", 0) == 0 &&
606 		    login_getcapbool(lc, "nocheckmail", 0) == 0) {
607 			char *cx;
608 
609 			/* $MAIL may have been set by class. */
610 			cx = getenv("MAIL");
611 			if (cx == NULL) {
612 				asprintf(&cx, "%s/%s",
613 				    _PATH_MAILDIR, pwd->pw_name);
614 			}
615 			if (cx && stat(cx, &st) == 0 && st.st_size != 0)
616 				(void)printf("You have %smail.\n",
617 				    (st.st_mtime > st.st_atime) ? "new " : "");
618 			if (getenv("MAIL") == NULL)
619 				free(cx);
620 		}
621 	}
622 
623 	login_close(lc_user);
624 	login_close(lc);
625 
626 	(void)signal(SIGALRM, SIG_DFL);
627 	(void)signal(SIGQUIT, SIG_DFL);
628 	(void)signal(SIGINT, SIG_DFL);
629 	(void)signal(SIGTSTP, SIG_IGN);
630 
631 	/*
632 	 * Login shells have a leading '-' in front of argv[0]
633 	 */
634 	p = strrchr(pwd->pw_shell, '/');
635 	if (asprintf(&arg0, "-%s", p ? p + 1 : pwd->pw_shell) >= MAXPATHLEN) {
636 		syslog(LOG_ERR, "user: %s: shell exceeds maximum pathname size",
637 		    username);
638 		errx(1, "shell exceeds maximum pathname size");
639 	} else if (arg0 == NULL) {
640 		err(1, "asprintf()");
641 	}
642 
643 	execlp(shell, arg0, (char *)0);
644 	err(1, "%s", shell);
645 
646 	/*
647 	 * That's it, folks!
648 	 */
649 }
650 
651 /*
652  * Attempt to authenticate the user using PAM.  Returns 0 if the user is
653  * authenticated, or 1 if not authenticated.  If some sort of PAM system
654  * error occurs (e.g., the "/etc/pam.conf" file is missing) then this
655  * function returns -1.  This can be used as an indication that we should
656  * fall back to a different authentication mechanism.
657  */
658 static int
659 auth_pam(void)
660 {
661 	const char *tmpl_user;
662 	const void *item;
663 	int rval;
664 
665 	pam_err = pam_authenticate(pamh, pam_silent);
666 	switch (pam_err) {
667 
668 	case PAM_SUCCESS:
669 		/*
670 		 * With PAM we support the concept of a "template"
671 		 * user.  The user enters a login name which is
672 		 * authenticated by PAM, usually via a remote service
673 		 * such as RADIUS or TACACS+.  If authentication
674 		 * succeeds, a different but related "template" name
675 		 * is used for setting the credentials, shell, and
676 		 * home directory.  The name the user enters need only
677 		 * exist on the remote authentication server, but the
678 		 * template name must be present in the local password
679 		 * database.
680 		 *
681 		 * This is supported by two various mechanisms in the
682 		 * individual modules.  However, from the application's
683 		 * point of view, the template user is always passed
684 		 * back as a changed value of the PAM_USER item.
685 		 */
686 		pam_err = pam_get_item(pamh, PAM_USER, &item);
687 		if (pam_err == PAM_SUCCESS) {
688 			tmpl_user = (const char *)item;
689 			if (strcmp(username, tmpl_user) != 0)
690 				pwd = getpwnam(tmpl_user);
691 		} else {
692 			pam_syslog("pam_get_item(PAM_USER)");
693 		}
694 		rval = 0;
695 		break;
696 
697 	case PAM_AUTH_ERR:
698 	case PAM_USER_UNKNOWN:
699 	case PAM_MAXTRIES:
700 		rval = 1;
701 		break;
702 
703 	default:
704 		pam_syslog("pam_authenticate()");
705 		rval = -1;
706 		break;
707 	}
708 
709 	if (rval == 0) {
710 		pam_err = pam_acct_mgmt(pamh, pam_silent);
711 		switch (pam_err) {
712 		case PAM_SUCCESS:
713 			break;
714 		case PAM_NEW_AUTHTOK_REQD:
715 			pam_err = pam_chauthtok(pamh,
716 			    pam_silent|PAM_CHANGE_EXPIRED_AUTHTOK);
717 			if (pam_err != PAM_SUCCESS) {
718 				pam_syslog("pam_chauthtok()");
719 				rval = 1;
720 			}
721 			break;
722 		default:
723 			pam_syslog("pam_acct_mgmt()");
724 			rval = 1;
725 			break;
726 		}
727 	}
728 
729 	if (rval != 0) {
730 		pam_end(pamh, pam_err);
731 		pamh = NULL;
732 	}
733 	return (rval);
734 }
735 
736 /*
737  * Export any environment variables PAM modules may have set
738  */
739 static void
740 export_pam_environment()
741 {
742 	char **pam_env;
743 	char **pp;
744 
745 	pam_env = pam_getenvlist(pamh);
746 	if (pam_env != NULL) {
747 		for (pp = pam_env; *pp != NULL; pp++) {
748 			if (!export(*pp))
749 				free(*pp);
750 		}
751 	}
752 }
753 
754 /*
755  * Perform sanity checks on an environment variable:
756  * - Make sure there is an '=' in the string.
757  * - Make sure the string doesn't run on too long.
758  * - Do not export certain variables.  This list was taken from the
759  *   Solaris pam_putenv(3) man page.
760  * Then export it.
761  */
762 static int
763 export(const char *s)
764 {
765 	static const char *noexport[] = {
766 		"SHELL", "HOME", "LOGNAME", "MAIL", "CDPATH",
767 		"IFS", "PATH", NULL
768 	};
769 	const char **pp;
770 	size_t n;
771 
772 	if (strlen(s) > 1024 || strchr(s, '=') == NULL)
773 		return (0);
774 	if (strncmp(s, "LD_", 3) == 0)
775 		return (0);
776 	for (pp = noexport; *pp != NULL; pp++) {
777 		n = strlen(*pp);
778 		if (s[n] == '=' && strncmp(s, *pp, n) == 0)
779 			return (0);
780 	}
781 	(void)putenv(s);
782 	return (1);
783 }
784 
785 static void
786 usage()
787 {
788 
789 	(void)fprintf(stderr, "usage: login [-fp] [-h hostname] [username]\n");
790 	exit(1);
791 }
792 
793 /*
794  * Prompt user and read login name from stdin.
795  */
796 static char *
797 getloginname()
798 {
799 	char *nbuf, *p;
800 	int ch;
801 
802 	nbuf = malloc(MAXLOGNAME);
803 	if (nbuf == NULL)
804 		err(1, "malloc()");
805 	do {
806 		(void)printf("%s", prompt);
807 		for (p = nbuf; (ch = getchar()) != '\n'; ) {
808 			if (ch == EOF) {
809 				badlogin(username);
810 				bail(NO_SLEEP_EXIT, 0);
811 			}
812 			if (p < nbuf + MAXLOGNAME - 1)
813 				*p++ = ch;
814 		}
815 	} while (p == nbuf);
816 
817 	*p = '\0';
818 	if (nbuf[0] == '-') {
819 		pam_silent = 0;
820 		memmove(nbuf, nbuf + 1, strlen(nbuf));
821 	} else {
822 		pam_silent = PAM_SILENT;
823 	}
824 	return nbuf;
825 }
826 
827 /*
828  * SIGINT handler for motd().
829  */
830 static volatile int motdinterrupt;
831 static void
832 sigint(int signo __unused)
833 {
834 	motdinterrupt = 1;
835 }
836 
837 /*
838  * Display the contents of a file (such as /etc/motd).
839  */
840 static int
841 motd(const char *motdfile)
842 {
843 	sig_t oldint;
844 	FILE *f;
845 	int ch;
846 
847 	if ((f = fopen(motdfile, "r")) == NULL)
848 		return (-1);
849 	motdinterrupt = 0;
850 	oldint = signal(SIGINT, sigint);
851 	while ((ch = fgetc(f)) != EOF && !motdinterrupt)
852 		putchar(ch);
853 	signal(SIGINT, oldint);
854 	if (ch != EOF || ferror(f)) {
855 		fclose(f);
856 		return (-1);
857 	}
858 	fclose(f);
859 	return (0);
860 }
861 
862 /*
863  * SIGALRM handler, to enforce login prompt timeout.
864  *
865  * XXX This can potentially confuse the hell out of PAM.  We should
866  * XXX instead implement a conversation function that returns
867  * XXX PAM_CONV_ERR when interrupted by a signal, and have the signal
868  * XXX handler just set a flag.
869  */
870 static void
871 timedout(int signo __unused)
872 {
873 
874 	longjmp(timeout_buf, signo);
875 }
876 
877 static void
878 badlogin(char *name)
879 {
880 
881 	if (failures == 0)
882 		return;
883 	if (hflag) {
884 		syslog(LOG_NOTICE, "%d LOGIN FAILURE%s FROM %s",
885 		    failures, failures > 1 ? "S" : "", hostname);
886 		syslog(LOG_AUTHPRIV|LOG_NOTICE,
887 		    "%d LOGIN FAILURE%s FROM %s, %s",
888 		    failures, failures > 1 ? "S" : "", hostname, name);
889 	} else {
890 		syslog(LOG_NOTICE, "%d LOGIN FAILURE%s ON %s",
891 		    failures, failures > 1 ? "S" : "", tty);
892 		syslog(LOG_AUTHPRIV|LOG_NOTICE,
893 		    "%d LOGIN FAILURE%s ON %s, %s",
894 		    failures, failures > 1 ? "S" : "", tty, name);
895 	}
896 	failures = 0;
897 }
898 
899 const char *
900 stypeof(char *ttyid)
901 {
902 	struct ttyent *t;
903 
904 	if (ttyid != NULL && *ttyid != '\0') {
905 		t = getttynam(ttyid);
906 		if (t != NULL && t->ty_type != NULL)
907 			return (t->ty_type);
908 	}
909 	return (NULL);
910 }
911 
912 static void
913 refused(const char *msg, const char *rtype, int lout)
914 {
915 
916 	if (msg != NULL)
917 	    printf("%s.\n", msg);
918 	if (hflag)
919 		syslog(LOG_NOTICE, "LOGIN %s REFUSED (%s) FROM %s ON TTY %s",
920 		    pwd->pw_name, rtype, hostname, tty);
921 	else
922 		syslog(LOG_NOTICE, "LOGIN %s REFUSED (%s) ON TTY %s",
923 		    pwd->pw_name, rtype, tty);
924 	if (lout)
925 		bail(SLEEP_EXIT, 1);
926 }
927 
928 /*
929  * Log a PAM error
930  */
931 static void
932 pam_syslog(const char *msg)
933 {
934 	syslog(LOG_ERR, "%s: %s", msg, pam_strerror(pamh, pam_err));
935 }
936 
937 /*
938  * Shut down PAM
939  */
940 static void
941 pam_cleanup()
942 {
943 
944 	if (pamh != NULL) {
945 		if (pam_session_established) {
946 			pam_err = pam_close_session(pamh, 0);
947 			if (pam_err != PAM_SUCCESS)
948 				pam_syslog("pam_close_session()");
949 		}
950 		pam_session_established = 0;
951 		if (pam_cred_established) {
952 			pam_err = pam_setcred(pamh, pam_silent|PAM_DELETE_CRED);
953 			if (pam_err != PAM_SUCCESS)
954 				pam_syslog("pam_setcred()");
955 		}
956 		pam_cred_established = 0;
957 		pam_end(pamh, pam_err);
958 		pamh = NULL;
959 	}
960 }
961 
962 /*
963  * Exit, optionally after sleeping a few seconds
964  */
965 void
966 bail(int sec, int eval)
967 {
968 
969 	pam_cleanup();
970 #ifdef USE_BSM_AUDIT
971 	if (pwd != NULL)
972 		audit_logout();
973 #endif
974 	(void)sleep(sec);
975 	exit(eval);
976 }
977