1 /* 2 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * All rights reserved 5 * RSA-based authentication. This code determines whether to admit a login 6 * based on RSA authentication. This file also contains functions to check 7 * validity of the host key. 8 * 9 * As far as I am concerned, the code I have written for this software 10 * can be used freely for any purpose. Any derived versions of this 11 * software must be clearly marked as such, and if the derived work is 12 * incompatible with the protocol description in the RFC file, it must be 13 * called by a name other than "ssh" or "Secure Shell". 14 */ 15 16 #include "includes.h" 17 RCSID("$OpenBSD: auth-rsa.c,v 1.56 2002/06/10 16:53:06 stevesk Exp $"); 18 19 #pragma ident "%Z%%M% %I% %E% SMI" 20 21 #include <openssl/rsa.h> 22 #include <openssl/md5.h> 23 24 #include "rsa.h" 25 #include "packet.h" 26 #include "xmalloc.h" 27 #include "ssh1.h" 28 #include "mpaux.h" 29 #include "uidswap.h" 30 #include "match.h" 31 #include "auth-options.h" 32 #include "pathnames.h" 33 #include "log.h" 34 #include "servconf.h" 35 #include "auth.h" 36 #include "hostfile.h" 37 #include "monitor_wrap.h" 38 #include "ssh.h" 39 40 /* import */ 41 extern ServerOptions options; 42 43 /* 44 * Session identifier that is used to bind key exchange and authentication 45 * responses to a particular session. 46 */ 47 extern u_char session_id[16]; 48 49 /* 50 * The .ssh/authorized_keys file contains public keys, one per line, in the 51 * following format: 52 * options bits e n comment 53 * where bits, e and n are decimal numbers, 54 * and comment is any string of characters up to newline. The maximum 55 * length of a line is 8000 characters. See the documentation for a 56 * description of the options. 57 */ 58 59 BIGNUM * 60 auth_rsa_generate_challenge(Key *key) 61 { 62 BIGNUM *challenge; 63 BN_CTX *ctx; 64 65 if ((challenge = BN_new()) == NULL) 66 fatal("auth_rsa_generate_challenge: BN_new() failed"); 67 /* Generate a random challenge. */ 68 BN_rand(challenge, 256, 0, 0); 69 if ((ctx = BN_CTX_new()) == NULL) 70 fatal("auth_rsa_generate_challenge: BN_CTX_new() failed"); 71 BN_mod(challenge, challenge, key->rsa->n, ctx); 72 BN_CTX_free(ctx); 73 74 return challenge; 75 } 76 77 int 78 auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16]) 79 { 80 u_char buf[32], mdbuf[16]; 81 MD5_CTX md; 82 int len; 83 84 /* don't allow short keys */ 85 if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { 86 error("auth_rsa_verify_response: RSA modulus too small: %d < minimum %d bits", 87 BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE); 88 return (0); 89 } 90 91 /* The response is MD5 of decrypted challenge plus session id. */ 92 len = BN_num_bytes(challenge); 93 if (len <= 0 || len > 32) 94 fatal("auth_rsa_verify_response: bad challenge length %d", len); 95 memset(buf, 0, 32); 96 BN_bn2bin(challenge, buf + 32 - len); 97 MD5_Init(&md); 98 MD5_Update(&md, buf, 32); 99 MD5_Update(&md, session_id, 16); 100 MD5_Final(mdbuf, &md); 101 102 /* Verify that the response is the original challenge. */ 103 if (memcmp(response, mdbuf, 16) != 0) { 104 /* Wrong answer. */ 105 return (0); 106 } 107 /* Correct answer. */ 108 return (1); 109 } 110 111 /* 112 * Performs the RSA authentication challenge-response dialog with the client, 113 * and returns true (non-zero) if the client gave the correct answer to 114 * our challenge; returns zero if the client gives a wrong answer. 115 */ 116 117 int 118 auth_rsa_challenge_dialog(Key *key) 119 { 120 BIGNUM *challenge, *encrypted_challenge; 121 u_char response[16]; 122 int i, success; 123 124 if ((encrypted_challenge = BN_new()) == NULL) 125 fatal("auth_rsa_challenge_dialog: BN_new() failed"); 126 127 challenge = PRIVSEP(auth_rsa_generate_challenge(key)); 128 129 /* Encrypt the challenge with the public key. */ 130 rsa_public_encrypt(encrypted_challenge, challenge, key->rsa); 131 132 /* Send the encrypted challenge to the client. */ 133 packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE); 134 packet_put_bignum(encrypted_challenge); 135 packet_send(); 136 BN_clear_free(encrypted_challenge); 137 packet_write_wait(); 138 139 /* Wait for a response. */ 140 packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE); 141 for (i = 0; i < 16; i++) 142 response[i] = packet_get_char(); 143 packet_check_eom(); 144 145 success = PRIVSEP(auth_rsa_verify_response(key, challenge, response)); 146 BN_clear_free(challenge); 147 return (success); 148 } 149 150 /* 151 * check if there's user key matching client_n, 152 * return key if login is allowed, NULL otherwise 153 */ 154 155 int 156 auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) 157 { 158 char line[8192], *file; 159 int allowed = 0; 160 u_int bits; 161 FILE *f; 162 u_long linenum = 0; 163 struct stat st; 164 Key *key; 165 166 /* Temporarily use the user's uid. */ 167 temporarily_use_uid(pw); 168 169 /* The authorized keys. */ 170 file = authorized_keys_file(pw); 171 debug("trying public RSA key file %s", file); 172 173 /* Fail quietly if file does not exist */ 174 if (stat(file, &st) < 0) { 175 /* Restore the privileged uid. */ 176 restore_uid(); 177 xfree(file); 178 return (0); 179 } 180 /* Open the file containing the authorized keys. */ 181 f = fopen(file, "r"); 182 if (!f) { 183 /* Restore the privileged uid. */ 184 restore_uid(); 185 xfree(file); 186 return (0); 187 } 188 if (options.strict_modes && 189 secure_filename(f, file, pw, line, sizeof(line)) != 0) { 190 xfree(file); 191 fclose(f); 192 log("Authentication refused: %s", line); 193 restore_uid(); 194 return (0); 195 } 196 197 /* Flag indicating whether the key is allowed. */ 198 allowed = 0; 199 200 key = key_new(KEY_RSA1); 201 202 /* 203 * Go though the accepted keys, looking for the current key. If 204 * found, perform a challenge-response dialog to verify that the 205 * user really has the corresponding private key. 206 */ 207 while (fgets(line, sizeof(line), f)) { 208 char *cp; 209 char *options; 210 211 linenum++; 212 213 /* Skip leading whitespace, empty and comment lines. */ 214 for (cp = line; *cp == ' ' || *cp == '\t'; cp++) 215 ; 216 if (!*cp || *cp == '\n' || *cp == '#') 217 continue; 218 219 /* 220 * Check if there are options for this key, and if so, 221 * save their starting address and skip the option part 222 * for now. If there are no options, set the starting 223 * address to NULL. 224 */ 225 if (*cp < '0' || *cp > '9') { 226 int quoted = 0; 227 options = cp; 228 for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { 229 if (*cp == '\\' && cp[1] == '"') 230 cp++; /* Skip both */ 231 else if (*cp == '"') 232 quoted = !quoted; 233 } 234 } else 235 options = NULL; 236 237 /* Parse the key from the line. */ 238 if (hostfile_read_key(&cp, &bits, key) == 0) { 239 debug("%.100s, line %lu: non ssh1 key syntax", 240 file, linenum); 241 continue; 242 } 243 /* cp now points to the comment part. */ 244 245 /* Check if the we have found the desired key (identified by its modulus). */ 246 if (BN_cmp(key->rsa->n, client_n) != 0) 247 continue; 248 249 /* check the real bits */ 250 if (bits != BN_num_bits(key->rsa->n)) 251 log("Warning: %s, line %lu: keysize mismatch: " 252 "actual %d vs. announced %d.", 253 file, linenum, BN_num_bits(key->rsa->n), bits); 254 255 /* We have found the desired key. */ 256 /* 257 * If our options do not allow this key to be used, 258 * do not send challenge. 259 */ 260 if (!auth_parse_options(pw, options, file, linenum)) 261 continue; 262 263 /* break out, this key is allowed */ 264 allowed = 1; 265 break; 266 } 267 268 /* Restore the privileged uid. */ 269 restore_uid(); 270 271 /* Close the file. */ 272 xfree(file); 273 fclose(f); 274 275 /* return key if allowed */ 276 if (allowed && rkey != NULL) 277 *rkey = key; 278 else 279 key_free(key); 280 return (allowed); 281 } 282 283 /* 284 * Performs the RSA authentication dialog with the client. This returns 285 * 0 if the client could not be authenticated, and 1 if authentication was 286 * successful. This may exit if there is a serious protocol violation. 287 */ 288 int 289 auth_rsa(struct passwd *pw, BIGNUM *client_n) 290 { 291 Key *key; 292 char *fp; 293 294 /* no user given */ 295 if (pw == NULL) 296 return 0; 297 298 if (!PRIVSEP(auth_rsa_key_allowed(pw, client_n, &key))) { 299 auth_clear_options(); 300 return (0); 301 } 302 303 /* Perform the challenge-response dialog for this key. */ 304 if (!auth_rsa_challenge_dialog(key)) { 305 /* Wrong response. */ 306 verbose("Wrong response to RSA authentication challenge."); 307 packet_send_debug("Wrong response to RSA authentication challenge."); 308 /* 309 * Break out of the loop. Otherwise we might send 310 * another challenge and break the protocol. 311 */ 312 key_free(key); 313 return (0); 314 } 315 /* 316 * Correct response. The client has been successfully 317 * authenticated. Note that we have not yet processed the 318 * options; this will be reset if the options cause the 319 * authentication to be rejected. 320 */ 321 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); 322 verbose("Found matching %s key: %s", 323 key_type(key), fp); 324 xfree(fp); 325 key_free(key); 326 327 packet_send_debug("RSA authentication accepted."); 328 return (1); 329 } 330