1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #include <sys/param.h> 28 #include <security/pam_appl.h> 29 #include <security/pam_modules.h> 30 #include <pwd.h> 31 #include <shadow.h> 32 #include <string.h> 33 #include <rpc/types.h> 34 #include <rpc/auth.h> 35 #include <locale.h> 36 #include <crypt.h> 37 #include <syslog.h> 38 39 extern int ruserok(const char *, int, const char *, const char *); 40 41 /* 42 * pam_sm_authenticate - Checks if the user is allowed remote access 43 */ 44 /*ARGSUSED*/ 45 int 46 pam_sm_authenticate( 47 pam_handle_t *pamh, 48 int flags, 49 int argc, 50 const char **argv) 51 { 52 char *host = NULL, *lusername = NULL; 53 struct passwd pwd; 54 char pwd_buffer[1024]; 55 int is_superuser; 56 char *rusername; 57 int i; 58 int debug = 0; 59 60 for (i = 0; i < argc; i++) { 61 if (strcasecmp(argv[i], "debug") == 0) 62 debug = 1; 63 else 64 syslog(LOG_DEBUG, "illegal option %s", argv[i]); 65 } 66 67 if (pam_get_item(pamh, PAM_USER, (void **) &lusername) != PAM_SUCCESS) 68 return (PAM_SERVICE_ERR); 69 if (pam_get_item(pamh, PAM_RHOST, (void **) &host) != PAM_SUCCESS) 70 return (PAM_SERVICE_ERR); 71 if (pam_get_item(pamh, PAM_RUSER, (void **)&rusername) != PAM_SUCCESS) 72 return (PAM_SERVICE_ERR); 73 74 if (lusername == NULL || *lusername == '\0') 75 return (PAM_USER_UNKNOWN); 76 if (rusername == NULL || *rusername == '\0') 77 return (PAM_AUTH_ERR); 78 if (host == NULL || *host == '\0') 79 return (PAM_AUTH_ERR); 80 81 if (debug) { 82 syslog(LOG_DEBUG, 83 "rhosts authenticate: user = %s, host = %s", 84 lusername, host); 85 } 86 87 if (getpwnam_r(lusername, &pwd, pwd_buffer, sizeof (pwd_buffer)) 88 == NULL) 89 return (PAM_USER_UNKNOWN); 90 91 if (pwd.pw_uid == 0) 92 is_superuser = 1; 93 else 94 is_superuser = 0; 95 96 return (ruserok(host, is_superuser, rusername, lusername) 97 == -1 ? PAM_AUTH_ERR : PAM_SUCCESS); 98 99 } 100 101 /* 102 * dummy pam_sm_setcred - does nothing 103 */ 104 /*ARGSUSED*/ 105 int 106 pam_sm_setcred( 107 pam_handle_t *pamh, 108 int flags, 109 int argc, 110 const char **argv) 111 { 112 return (PAM_IGNORE); 113 } 114