1 /* $OpenBSD: auth.h,v 1.41 2002/09/26 11:38:43 markus Exp $ */ 2 3 #ifndef _AUTH_H 4 #define _AUTH_H 5 6 #pragma ident "%Z%%M% %I% %E% SMI" 7 8 #ifdef __cplusplus 9 extern "C" { 10 #endif 11 12 13 /* 14 * Copyright (c) 2000 Markus Friedl. All rights reserved. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions 18 * are met: 19 * 1. Redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer. 21 * 2. Redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35 * 36 */ 37 /* 38 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 39 * Use is subject to license terms. 40 */ 41 42 #include "key.h" 43 #include "hostfile.h" 44 #include <openssl/rsa.h> 45 46 #ifdef USE_PAM 47 #include <security/pam_appl.h> 48 #endif /* USE_PAM */ 49 50 #ifdef HAVE_LOGIN_CAP 51 #include <login_cap.h> 52 #endif 53 #ifdef BSD_AUTH 54 #include <bsd_auth.h> 55 #endif 56 #ifdef KRB5 57 #include <krb5.h> 58 #endif 59 60 typedef struct Authctxt Authctxt; 61 typedef struct Authmethod Authmethod; 62 typedef struct KbdintDevice KbdintDevice; 63 64 #ifdef USE_PAM 65 typedef struct pam_stuff pam_stuff; 66 67 struct pam_stuff { 68 Authctxt *authctxt; 69 pam_handle_t *h; 70 int state; 71 int last_pam_retval; 72 }; 73 74 /* See auth-pam.h and auth-pam.c */ 75 76 #define PAM_S_DONE_ACCT_MGMT 0x01 /* acct_mgmt done */ 77 #define PAM_S_DONE_SETCRED 0x02 /* setcred done */ 78 #define PAM_S_DONE_OPEN_SESSION 0x04 /* open_session done */ 79 #define PAM_S_DONE 0x07 /* all done */ 80 #endif /* USE_PAM */ 81 82 struct Authctxt { 83 int success; 84 int valid; 85 int attempt; /* all userauth attempt count */ 86 int init_attempt; /* passwd/kbd-int attempt count */ 87 int failures; 88 int init_failures; 89 int unwind_dispatch_loop; 90 int v1_auth_type; 91 char *v1_auth_name; 92 Authmethod *method; 93 char *user; 94 char *service; 95 struct passwd *pw; 96 char *style; 97 void *kbdintctxt; /* XXX Switch to method_data; 98 v1 still needs this*/ 99 #ifdef USE_PAM 100 pam_stuff *pam; 101 char *cuser; /* client side user, needed for setting 102 PAM_AUSER for hostbased authentication 103 using roles */ 104 u_long last_login_time; /* need to get the time of 105 last login before calling 106 pam_open_session() */ 107 char last_login_host[MAXHOSTNAMELEN]; 108 int pam_retval; /* pam_stuff is cleaned before 109 BSM login failure auditing */ 110 #endif /* USE_PAM */ 111 112 /* SUNW - What follows remains to reduce diffs with OpenSSH but 113 * is not used in Solaris. The Solaris SSH internal 114 * architecture requires that this stuff move into the 115 * Authmethod method_data. 116 */ 117 #ifndef SUNW_SSH 118 #ifdef BSD_AUTH 119 auth_session_t *as; 120 #endif 121 #ifdef KRB4 122 char *krb4_ticket_file; 123 #endif 124 #ifdef KRB5 125 krb5_context krb5_ctx; 126 krb5_auth_context krb5_auth_ctx; 127 krb5_ccache krb5_fwd_ccache; 128 krb5_principal krb5_user; 129 char *krb5_ticket_file; 130 #endif 131 void *methoddata; 132 #endif /* SUNW_SSH */ 133 }; 134 135 struct Authmethod { 136 char *name; 137 int *enabled; 138 /* 139 * Userauth method state tracking fields updated in 140 * input_userauth_request() and auth-pam.c. 141 * 142 * The "void (*userauth)(Authctxt *authctxt)" function 143 * communicates the userauth result (success, failure, 144 * "postponed," abandoned) through the 'authenticated', 145 * 'postponed' and 'abandoned' fields. Partial success is 146 * indicated by requiring other userauths to be used by setting 147 * their 'required' or 'sufficient' fields. 148 * 149 * Individual methods should only ever set 'not_again' if it 150 * makes no sense to complete the same userauth more than once, 151 * and they should set any methods' sufficient or required flags 152 * in order to force partial authentication and require that 153 * more userauths be tried. The (void *) 'method_data' and 154 * 'hist_method_data' pointers can be used by methods such as 155 * pubkey which may make sense to run more than once during 156 * userauth or which may require multiple round tripes (e.g., 157 * keyboard-interactive) and which need to keep some state; 158 * 'hist_method_data' is there specifically for pubkey userauth 159 * where multiple successful attempts should all use different 160 * keys. 161 * 162 * The "attempts," "abandons," "successes" and "failures" fields 163 * count the number of times a method has been attempted, 164 * abandoned, and has succeeded or failed. Note that pubkey 165 * userauth does not double-count sig-less probes that are 166 * followed by a pubkey request for the same pubkey anw with a 167 * signature. 168 */ 169 void (*userauth)(Authctxt *authctxt); 170 void (*abandon)(Authctxt *, Authmethod *); 171 void *method_data; 172 void *hist_method_data; 173 unsigned int is_initial; 174 unsigned int attempts:8; 175 unsigned int abandons:8; 176 unsigned int successes:8; 177 unsigned int failures:8; 178 /* 179 * Post-attempt state booleans (authenticated, abandoned, etc...) 180 */ 181 unsigned int authenticated:1; 182 unsigned int not_again:1; 183 unsigned int sufficient:1; 184 unsigned int required:1; 185 unsigned int postponed:1; 186 unsigned int abandoned:1; 187 /* 188 * NOTE: multi-round-trip userauth methods can either 189 * recursively call dispatch_run and detect abandonment 190 * within their message handlers (as PAM kbd-int does) or 191 * set the postponed flag and let input_userauth_request() 192 * detect abandonment (i.e., initiation of some userauth 193 * method before completion of a started, multi-round-trip 194 * userauth method). 195 * 196 */ 197 }; 198 199 /* 200 * Keyboard interactive device: 201 * init_ctx returns: non NULL upon success 202 * query returns: 0 - success, otherwise failure 203 * respond returns: 0 - success, 1 - need further interaction, 204 * otherwise - failure 205 */ 206 struct KbdintDevice 207 { 208 const char *name; 209 void* (*init_ctx)(Authctxt*); 210 int (*query)(void *ctx, char **name, char **infotxt, 211 u_int *numprompts, char ***prompts, u_int **echo_on); 212 int (*respond)(void *ctx, u_int numresp, char **responses); 213 void (*free_ctx)(void *ctx); 214 }; 215 216 int auth_rhosts(struct passwd *, const char *); 217 int 218 auth_rhosts2(struct passwd *, const char *, const char *, const char *); 219 220 int auth_rhosts_rsa(struct passwd *, char *, Key *); 221 int auth_password(Authctxt *, const char *); 222 int auth_rsa(struct passwd *, BIGNUM *); 223 int auth_rsa_challenge_dialog(Key *); 224 BIGNUM *auth_rsa_generate_challenge(Key *); 225 int auth_rsa_verify_response(Key *, BIGNUM *, u_char[]); 226 int auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **); 227 228 int auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *); 229 int hostbased_key_allowed(struct passwd *, const char *, char *, Key *); 230 int user_key_allowed(struct passwd *, Key *); 231 232 #ifdef KRB4 233 #include <krb.h> 234 int auth_krb4(Authctxt *, KTEXT, char **, KTEXT); 235 int auth_krb4_password(Authctxt *, const char *); 236 void krb4_cleanup_proc(void *); 237 238 #ifdef AFS 239 #include <kafs.h> 240 int auth_krb4_tgt(Authctxt *, const char *); 241 int auth_afs_token(Authctxt *, const char *); 242 #endif /* AFS */ 243 244 #endif /* KRB4 */ 245 246 #ifdef KRB5 247 int auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *); 248 int auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt); 249 int auth_krb5_password(Authctxt *authctxt, const char *password); 250 void krb5_cleanup_proc(void *authctxt); 251 #endif /* KRB5 */ 252 253 #include "auth-pam.h" 254 #include "auth2-pam.h" 255 256 Authctxt *do_authentication(void); 257 Authctxt *do_authentication2(void); 258 259 #ifdef HAVE_BSM 260 void audit_failed_login_cleanup(void *); 261 #endif /* HAVE_BSM */ 262 263 int userauth_check_partial_failure(Authctxt *authctxt); 264 void userauth_force_kbdint(void); 265 266 Authctxt *authctxt_new(void); 267 void auth_log(Authctxt *, int, char *, char *); 268 void userauth_finish(Authctxt *, char *); 269 void userauth_user_svc_change(Authctxt *authctxt, 270 char *user, 271 char *service); 272 int auth_root_allowed(char *); 273 274 char *auth2_read_banner(void); 275 276 void privsep_challenge_enable(void); 277 278 void auth2_challenge(Authctxt *, char *); 279 void auth2_challenge_abandon(Authctxt *); 280 int bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **); 281 int bsdauth_respond(void *, u_int, char **); 282 int skey_query(void *, char **, char **, u_int *, char ***, u_int **); 283 int skey_respond(void *, u_int, char **); 284 285 struct passwd * getpwnamallow(const char *user); 286 287 char *get_challenge(Authctxt *); 288 int verify_response(Authctxt *, const char *); 289 290 struct passwd * auth_get_user(void); 291 292 char *authorized_keys_file(struct passwd *); 293 char *authorized_keys_file2(struct passwd *); 294 295 int 296 secure_filename(FILE *, const char *, struct passwd *, char *, size_t); 297 298 HostStatus 299 check_key_in_hostfiles(struct passwd *, Key *, const char *, 300 const char *, const char *); 301 302 /* hostkey handling */ 303 #ifndef lint 304 Key *get_hostkey_by_index(int); 305 Key *get_hostkey_by_type(int); 306 int get_hostkey_index(Key *); 307 #endif /* lint */ 308 int ssh1_session_key(BIGNUM *); 309 310 /* debug messages during authentication */ 311 void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2))); 312 void auth_debug_send(void); 313 void auth_debug_reset(void); 314 315 #define AUTH_FAIL_MAX 6 316 #define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2) 317 #define AUTH_FAIL_MSG "Too many authentication failures for %.100s" 318 319 #define SKEY_PROMPT "\nS/Key Password: " 320 321 #ifdef __cplusplus 322 } 323 #endif 324 325 #endif /* _AUTH_H */ 326