xref: /titanic_44/usr/src/cmd/ssh/include/auth.h (revision 75ce41a57ff334bd8fe2cb9ed51eea835892f944)
1 /*	$OpenBSD: auth.h,v 1.41 2002/09/26 11:38:43 markus Exp $	*/
2 
3 #ifndef	_AUTH_H
4 #define	_AUTH_H
5 
6 #pragma ident	"%Z%%M%	%I%	%E% SMI"
7 
8 #ifdef __cplusplus
9 extern "C" {
10 #endif
11 
12 
13 /*
14  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
15  *
16  * Redistribution and use in source and binary forms, with or without
17  * modification, are permitted provided that the following conditions
18  * are met:
19  * 1. Redistributions of source code must retain the above copyright
20  *    notice, this list of conditions and the following disclaimer.
21  * 2. Redistributions in binary form must reproduce the above copyright
22  *    notice, this list of conditions and the following disclaimer in the
23  *    documentation and/or other materials provided with the distribution.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
26  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
27  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
28  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
29  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
30  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
31  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
32  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
33  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35  *
36  */
37 /*
38  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
39  * Use is subject to license terms.
40  */
41 
42 #include "key.h"
43 #include "hostfile.h"
44 #include <openssl/rsa.h>
45 
46 #ifdef USE_PAM
47 #include <security/pam_appl.h>
48 #endif /* USE_PAM */
49 
50 #ifdef HAVE_LOGIN_CAP
51 #include <login_cap.h>
52 #endif
53 #ifdef BSD_AUTH
54 #include <bsd_auth.h>
55 #endif
56 #ifdef KRB5
57 #include <krb5.h>
58 #endif
59 
60 typedef struct Authctxt Authctxt;
61 typedef struct Authmethod Authmethod;
62 typedef struct KbdintDevice KbdintDevice;
63 
64 #ifdef USE_PAM
65 typedef struct pam_stuff pam_stuff;
66 
67 struct pam_stuff {
68 	Authctxt	*authctxt;
69 	pam_handle_t	*h;
70 	int		state;
71 	int		last_pam_retval;
72 };
73 
74 /* See auth-pam.h and auth-pam.c */
75 
76 #define PAM_S_DONE_ACCT_MGMT		0x01 /* acct_mgmt done */
77 #define PAM_S_DONE_SETCRED		0x02 /* setcred done */
78 #define PAM_S_DONE_OPEN_SESSION		0x04 /* open_session done */
79 #define PAM_S_DONE			0x07 /* all done */
80 #endif /* USE_PAM */
81 
82 struct Authctxt {
83 	int		 success;
84 	int		 valid;
85 	int		 attempt;	/* all userauth attempt count */
86 	int		 init_attempt;	/* passwd/kbd-int attempt count */
87 	int		 failures;
88 	int		 init_failures;
89 	int		 unwind_dispatch_loop;
90 	int		 v1_auth_type;
91 	char		*v1_auth_name;
92 	Authmethod	*method;
93 	char		*user;
94 	char		*service;
95 	struct passwd	*pw;
96 	char		*style;
97 	void		*kbdintctxt;	/* XXX Switch to method_data;
98 					   v1 still needs this*/
99 #ifdef USE_PAM
100 	pam_stuff	*pam;
101 	char		*cuser; /* client side user, needed for setting
102 				   PAM_AUSER for hostbased authentication
103 				   using roles */
104 	u_long		 last_login_time; /* need to get the time of
105 					     last login before calling
106 					     pam_open_session() */
107 	char		 last_login_host[MAXHOSTNAMELEN];
108 	int		 pam_retval;	/* pam_stuff is cleaned before
109 					   BSM login failure auditing */
110 #endif /* USE_PAM */
111 
112 	/* SUNW - What follows remains to reduce diffs with OpenSSH but
113 	 *	  is not used in Solaris.  The Solaris SSH internal
114 	 *	  architecture requires that this stuff move into the
115 	 *	  Authmethod method_data.
116 	 */
117 #ifndef	SUNW_SSH
118 #ifdef BSD_AUTH
119 	auth_session_t	*as;
120 #endif
121 #ifdef KRB4
122 	char		*krb4_ticket_file;
123 #endif
124 #ifdef KRB5
125 	krb5_context	 krb5_ctx;
126 	krb5_auth_context krb5_auth_ctx;
127 	krb5_ccache	 krb5_fwd_ccache;
128 	krb5_principal	 krb5_user;
129 	char		*krb5_ticket_file;
130 #endif
131 	void *methoddata;
132 #endif /* SUNW_SSH */
133 };
134 
135 struct Authmethod {
136 	char	*name;
137 	int	*enabled;
138 	/*
139 	 * Userauth method state tracking fields updated in
140 	 * input_userauth_request() and auth-pam.c.
141 	 *
142 	 * The "void (*userauth)(Authctxt *authctxt)" function
143 	 * communicates the userauth result (success, failure,
144 	 * "postponed," abandoned) through the 'authenticated',
145 	 * 'postponed' and 'abandoned' fields.  Partial success is
146 	 * indicated by requiring other userauths to be used by setting
147 	 * their 'required' or 'sufficient' fields.
148 	 *
149 	 * Individual methods should only ever set 'not_again' if it
150 	 * makes no sense to complete the same userauth more than once,
151 	 * and they should set any methods' sufficient or required flags
152 	 * in order to force partial authentication and require that
153 	 * more userauths be tried.  The (void *) 'method_data' and
154 	 * 'hist_method_data' pointers can be used by methods such as
155 	 * pubkey which may make sense to run more than once during
156 	 * userauth or which may require multiple round tripes (e.g.,
157 	 * keyboard-interactive) and which need to keep some state;
158 	 * 'hist_method_data' is there specifically for pubkey userauth
159 	 * where multiple successful attempts should all use different
160 	 * keys.
161 	 *
162 	 * The "attempts," "abandons," "successes" and "failures" fields
163 	 * count the number of times a method has been attempted,
164 	 * abandoned, and has succeeded or failed.  Note that pubkey
165 	 * userauth does not double-count sig-less probes that are
166 	 * followed by a pubkey request for the same pubkey anw with a
167 	 * signature.
168 	 */
169 	void		(*userauth)(Authctxt *authctxt);
170 	void		(*abandon)(Authctxt *, Authmethod *);
171 	void		*method_data;
172 	void		*hist_method_data;
173 	unsigned int	 is_initial;
174 	unsigned int	 attempts:8;
175 	unsigned int	 abandons:8;
176 	unsigned int	 successes:8;
177 	unsigned int	 failures:8;
178 	/*
179 	 * Post-attempt state booleans (authenticated, abandoned, etc...)
180 	 */
181 	unsigned int	 authenticated:1;
182 	unsigned int	 not_again:1;
183 	unsigned int	 sufficient:1;
184 	unsigned int	 required:1;
185 	unsigned int	 postponed:1;
186 	unsigned int	 abandoned:1;
187 	/*
188 	 * NOTE: multi-round-trip userauth methods can either
189 	 *       recursively call dispatch_run and detect abandonment
190 	 *       within their message handlers (as PAM kbd-int does) or
191 	 *       set the postponed flag and let input_userauth_request()
192 	 *       detect abandonment (i.e., initiation of some userauth
193 	 *       method before completion of a started, multi-round-trip
194 	 *       userauth method).
195 	 *
196 	 */
197 };
198 
199 /*
200  * Keyboard interactive device:
201  * init_ctx	returns: non NULL upon success
202  * query	returns: 0 - success, otherwise failure
203  * respond	returns: 0 - success, 1 - need further interaction,
204  *		otherwise - failure
205  */
206 struct KbdintDevice
207 {
208 	const char *name;
209 	void*	(*init_ctx)(Authctxt*);
210 	int	(*query)(void *ctx, char **name, char **infotxt,
211 		    u_int *numprompts, char ***prompts, u_int **echo_on);
212 	int	(*respond)(void *ctx, u_int numresp, char **responses);
213 	void	(*free_ctx)(void *ctx);
214 };
215 
216 int      auth_rhosts(struct passwd *, const char *);
217 int
218 auth_rhosts2(struct passwd *, const char *, const char *, const char *);
219 
220 int	 auth_rhosts_rsa(struct passwd *, char *, Key *);
221 int      auth_password(Authctxt *, const char *);
222 int      auth_rsa(struct passwd *, BIGNUM *);
223 int      auth_rsa_challenge_dialog(Key *);
224 BIGNUM	*auth_rsa_generate_challenge(Key *);
225 int	 auth_rsa_verify_response(Key *, BIGNUM *, u_char[]);
226 int	 auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
227 
228 int	 auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
229 int	 hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
230 int	 user_key_allowed(struct passwd *, Key *);
231 
232 #ifdef KRB4
233 #include <krb.h>
234 int     auth_krb4(Authctxt *, KTEXT, char **, KTEXT);
235 int	auth_krb4_password(Authctxt *, const char *);
236 void    krb4_cleanup_proc(void *);
237 
238 #ifdef AFS
239 #include <kafs.h>
240 int     auth_krb4_tgt(Authctxt *, const char *);
241 int     auth_afs_token(Authctxt *, const char *);
242 #endif /* AFS */
243 
244 #endif /* KRB4 */
245 
246 #ifdef KRB5
247 int	auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *);
248 int	auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt);
249 int	auth_krb5_password(Authctxt *authctxt, const char *password);
250 void	krb5_cleanup_proc(void *authctxt);
251 #endif /* KRB5 */
252 
253 #include "auth-pam.h"
254 #include "auth2-pam.h"
255 
256 Authctxt *do_authentication(void);
257 Authctxt *do_authentication2(void);
258 
259 #ifdef HAVE_BSM
260 void	audit_failed_login_cleanup(void *);
261 #endif /* HAVE_BSM */
262 
263 int	userauth_check_partial_failure(Authctxt *authctxt);
264 void	userauth_force_kbdint(void);
265 
266 Authctxt *authctxt_new(void);
267 void	auth_log(Authctxt *, int, char *, char *);
268 void	userauth_finish(Authctxt *, char *);
269 void	userauth_user_svc_change(Authctxt *authctxt,
270 				 char *user,
271 				 char *service);
272 int	auth_root_allowed(char *);
273 
274 char	*auth2_read_banner(void);
275 
276 void	privsep_challenge_enable(void);
277 
278 void	auth2_challenge(Authctxt *, char *);
279 void	auth2_challenge_abandon(Authctxt *);
280 int	bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **);
281 int	bsdauth_respond(void *, u_int, char **);
282 int	skey_query(void *, char **, char **, u_int *, char ***, u_int **);
283 int	skey_respond(void *, u_int, char **);
284 
285 struct passwd * getpwnamallow(const char *user);
286 
287 char	*get_challenge(Authctxt *);
288 int	verify_response(Authctxt *, const char *);
289 
290 struct passwd * auth_get_user(void);
291 
292 char	*authorized_keys_file(struct passwd *);
293 char	*authorized_keys_file2(struct passwd *);
294 
295 int
296 secure_filename(FILE *, const char *, struct passwd *, char *, size_t);
297 
298 HostStatus
299 check_key_in_hostfiles(struct passwd *, Key *, const char *,
300     const char *, const char *);
301 
302 /* hostkey handling */
303 #ifndef lint
304 Key	*get_hostkey_by_index(int);
305 Key	*get_hostkey_by_type(int);
306 int	 get_hostkey_index(Key *);
307 #endif /* lint */
308 int	 ssh1_session_key(BIGNUM *);
309 
310 /* debug messages during authentication */
311 void	 auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2)));
312 void	 auth_debug_send(void);
313 void	 auth_debug_reset(void);
314 
315 #define AUTH_FAIL_MAX 6
316 #define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2)
317 #define AUTH_FAIL_MSG "Too many authentication failures for %.100s"
318 
319 #define SKEY_PROMPT "\nS/Key Password: "
320 
321 #ifdef __cplusplus
322 }
323 #endif
324 
325 #endif /* _AUTH_H */
326