1 /* $OpenBSD: auth.h,v 1.41 2002/09/26 11:38:43 markus Exp $ */ 2 3 #ifndef _AUTH_H 4 #define _AUTH_H 5 6 #pragma ident "%Z%%M% %I% %E% SMI" 7 8 #ifdef __cplusplus 9 extern "C" { 10 #endif 11 12 13 /* 14 * Copyright (c) 2000 Markus Friedl. All rights reserved. 15 * 16 * Redistribution and use in source and binary forms, with or without 17 * modification, are permitted provided that the following conditions 18 * are met: 19 * 1. Redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer. 21 * 2. Redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 30 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 31 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 32 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 33 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 34 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 35 * 36 */ 37 /* 38 * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 39 * Use is subject to license terms. 40 */ 41 42 #include "key.h" 43 #include "hostfile.h" 44 #include <openssl/rsa.h> 45 46 #ifdef USE_PAM 47 #include <security/pam_appl.h> 48 #endif /* USE_PAM */ 49 50 #ifdef HAVE_LOGIN_CAP 51 #include <login_cap.h> 52 #endif 53 #ifdef BSD_AUTH 54 #include <bsd_auth.h> 55 #endif 56 #ifdef KRB5 57 #include <krb5.h> 58 #endif 59 60 typedef struct Authctxt Authctxt; 61 typedef struct Authmethod Authmethod; 62 typedef struct KbdintDevice KbdintDevice; 63 64 #ifdef USE_PAM 65 typedef struct pam_stuff pam_stuff; 66 67 struct pam_stuff { 68 Authctxt *authctxt; 69 pam_handle_t *h; 70 int state; 71 int last_pam_retval; 72 }; 73 74 /* See auth-pam.h and auth-pam.c */ 75 76 #define PAM_S_DONE_ACCT_MGMT 0x01 /* acct_mgmt done */ 77 #define PAM_S_DONE_SETCRED 0x02 /* setcred done */ 78 #define PAM_S_DONE_OPEN_SESSION 0x04 /* open_session done */ 79 #define PAM_S_DONE 0x07 /* all done */ 80 #endif /* USE_PAM */ 81 82 struct Authctxt { 83 int success; 84 int valid; 85 int attempt; /* all userauth attempt count */ 86 int init_attempt; /* passwd/kbd-int attempt count */ 87 int failures; 88 int init_failures; 89 int unwind_dispatch_loop; 90 int v1_auth_type; 91 char *v1_auth_name; 92 Authmethod *method; 93 char *user; 94 char *service; 95 struct passwd *pw; 96 char *style; 97 void *kbdintctxt; /* XXX Switch to method_data; 98 v1 still needs this*/ 99 #ifdef USE_PAM 100 pam_stuff *pam; 101 u_long last_login_time; /* need to get the time of 102 last login before calling 103 pam_open_session() */ 104 char last_login_host[MAXHOSTNAMELEN]; 105 int pam_retval; /* pam_stuff is cleaned before 106 BSM login failure auditing */ 107 #endif /* USE_PAM */ 108 109 /* SUNW - What follows remains to reduce diffs with OpenSSH but 110 * is not used in Solaris. The Solaris SSH internal 111 * architecture requires that this stuff move into the 112 * Authmethod method_data. 113 */ 114 #ifndef SUNW_SSH 115 #ifdef BSD_AUTH 116 auth_session_t *as; 117 #endif 118 #ifdef KRB4 119 char *krb4_ticket_file; 120 #endif 121 #ifdef KRB5 122 krb5_context krb5_ctx; 123 krb5_auth_context krb5_auth_ctx; 124 krb5_ccache krb5_fwd_ccache; 125 krb5_principal krb5_user; 126 char *krb5_ticket_file; 127 #endif 128 void *methoddata; 129 #endif /* SUNW_SSH */ 130 }; 131 132 struct Authmethod { 133 char *name; 134 int *enabled; 135 /* 136 * Userauth method state tracking fields updated in 137 * input_userauth_request() and auth-pam.c. 138 * 139 * The "void (*userauth)(Authctxt *authctxt)" function 140 * communicates the userauth result (success, failure, 141 * "postponed," abandoned) through the 'authenticated', 142 * 'postponed' and 'abandoned' fields. Partial success is 143 * indicated by requiring other userauths to be used by setting 144 * their 'required' or 'sufficient' fields. 145 * 146 * Individual methods should only ever set 'not_again' if it 147 * makes no sense to complete the same userauth more than once, 148 * and they should set any methods' sufficient or required flags 149 * in order to force partial authentication and require that 150 * more userauths be tried. The (void *) 'method_data' and 151 * 'hist_method_data' pointers can be used by methods such as 152 * pubkey which may make sense to run more than once during 153 * userauth or which may require multiple round tripes (e.g., 154 * keyboard-interactive) and which need to keep some state; 155 * 'hist_method_data' is there specifically for pubkey userauth 156 * where multiple successful attempts should all use different 157 * keys. 158 * 159 * The "attempts," "abandons," "successes" and "failures" fields 160 * count the number of times a method has been attempted, 161 * abandoned, and has succeeded or failed. Note that pubkey 162 * userauth does not double-count sig-less probes that are 163 * followed by a pubkey request for the same pubkey anw with a 164 * signature. 165 */ 166 void (*userauth)(Authctxt *authctxt); 167 void (*abandon)(Authctxt *, Authmethod *); 168 void *method_data; 169 void *hist_method_data; 170 unsigned int is_initial; 171 unsigned int attempts:8; 172 unsigned int abandons:8; 173 unsigned int successes:8; 174 unsigned int failures:8; 175 /* 176 * Post-attempt state booleans (authenticated, abandoned, etc...) 177 */ 178 unsigned int authenticated:1; 179 unsigned int not_again:1; 180 unsigned int sufficient:1; 181 unsigned int required:1; 182 unsigned int postponed:1; 183 unsigned int abandoned:1; 184 /* 185 * NOTE: multi-round-trip userauth methods can either 186 * recursively call dispatch_run and detect abandonment 187 * within their message handlers (as PAM kbd-int does) or 188 * set the postponed flag and let input_userauth_request() 189 * detect abandonment (i.e., initiation of some userauth 190 * method before completion of a started, multi-round-trip 191 * userauth method). 192 * 193 */ 194 }; 195 196 /* 197 * Keyboard interactive device: 198 * init_ctx returns: non NULL upon success 199 * query returns: 0 - success, otherwise failure 200 * respond returns: 0 - success, 1 - need further interaction, 201 * otherwise - failure 202 */ 203 struct KbdintDevice 204 { 205 const char *name; 206 void* (*init_ctx)(Authctxt*); 207 int (*query)(void *ctx, char **name, char **infotxt, 208 u_int *numprompts, char ***prompts, u_int **echo_on); 209 int (*respond)(void *ctx, u_int numresp, char **responses); 210 void (*free_ctx)(void *ctx); 211 }; 212 213 int auth_rhosts(struct passwd *, const char *); 214 int 215 auth_rhosts2(struct passwd *, const char *, const char *, const char *); 216 217 int auth_rhosts_rsa(struct passwd *, char *, Key *); 218 int auth_password(Authctxt *, const char *); 219 int auth_rsa(struct passwd *, BIGNUM *); 220 int auth_rsa_challenge_dialog(Key *); 221 BIGNUM *auth_rsa_generate_challenge(Key *); 222 int auth_rsa_verify_response(Key *, BIGNUM *, u_char[]); 223 int auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **); 224 225 int auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *); 226 int hostbased_key_allowed(struct passwd *, const char *, char *, Key *); 227 int user_key_allowed(struct passwd *, Key *); 228 229 #ifdef KRB4 230 #include <krb.h> 231 int auth_krb4(Authctxt *, KTEXT, char **, KTEXT); 232 int auth_krb4_password(Authctxt *, const char *); 233 void krb4_cleanup_proc(void *); 234 235 #ifdef AFS 236 #include <kafs.h> 237 int auth_krb4_tgt(Authctxt *, const char *); 238 int auth_afs_token(Authctxt *, const char *); 239 #endif /* AFS */ 240 241 #endif /* KRB4 */ 242 243 #ifdef KRB5 244 int auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *); 245 int auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt); 246 int auth_krb5_password(Authctxt *authctxt, const char *password); 247 void krb5_cleanup_proc(void *authctxt); 248 #endif /* KRB5 */ 249 250 #include "auth-pam.h" 251 #include "auth2-pam.h" 252 253 Authctxt *do_authentication(void); 254 Authctxt *do_authentication2(void); 255 256 #ifdef HAVE_BSM 257 void audit_failed_login_cleanup(void *); 258 #endif /* HAVE_BSM */ 259 260 int userauth_check_partial_failure(Authctxt *authctxt); 261 void userauth_force_kbdint(void); 262 263 Authctxt *authctxt_new(void); 264 void auth_log(Authctxt *, int, char *, char *); 265 void userauth_finish(Authctxt *, char *); 266 void userauth_user_svc_change(Authctxt *authctxt, 267 char *user, 268 char *service); 269 int auth_root_allowed(char *); 270 271 char *auth2_read_banner(void); 272 273 void privsep_challenge_enable(void); 274 275 void auth2_challenge(Authctxt *, char *); 276 void auth2_challenge_abandon(Authctxt *); 277 int bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **); 278 int bsdauth_respond(void *, u_int, char **); 279 int skey_query(void *, char **, char **, u_int *, char ***, u_int **); 280 int skey_respond(void *, u_int, char **); 281 282 struct passwd * getpwnamallow(const char *user); 283 284 char *get_challenge(Authctxt *); 285 int verify_response(Authctxt *, const char *); 286 287 struct passwd * auth_get_user(void); 288 289 char *authorized_keys_file(struct passwd *); 290 char *authorized_keys_file2(struct passwd *); 291 292 int 293 secure_filename(FILE *, const char *, struct passwd *, char *, size_t); 294 295 HostStatus 296 check_key_in_hostfiles(struct passwd *, Key *, const char *, 297 const char *, const char *); 298 299 /* hostkey handling */ 300 #ifndef lint 301 Key *get_hostkey_by_index(int); 302 Key *get_hostkey_by_type(int); 303 int get_hostkey_index(Key *); 304 #endif /* lint */ 305 int ssh1_session_key(BIGNUM *); 306 307 /* debug messages during authentication */ 308 void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2))); 309 void auth_debug_send(void); 310 void auth_debug_reset(void); 311 312 #define AUTH_FAIL_MAX 6 313 #define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2) 314 #define AUTH_FAIL_MSG "Too many authentication failures for %.100s" 315 316 #define SKEY_PROMPT "\nS/Key Password: " 317 318 #ifdef __cplusplus 319 } 320 #endif 321 322 #endif /* _AUTH_H */ 323