mirror of
git://anongit.mindrot.org/openssh.git
synced 2025-01-03 16:22:05 +00:00
- (djm) Reorganise PAM & SIA password handling to eliminate some common code
This commit is contained in:
Damien Miller
parent
53d81483f0
commit
2101bfc4e1
@ -5,6 +5,7 @@
|
||||
Add a -t life option to ssh-agent that set the default lifetime.
|
||||
The default can still be overriden by using -t in ssh-add.
|
||||
OK markus@
|
||||
- (djm) Reorganise PAM & SIA password handling to eliminate some common code
|
||||
|
||||
20030120
|
||||
- (djm) Fix compilation for NetBSD from dtucker@zip.com.au
|
||||
@ -1048,4 +1049,4 @@
|
||||
save auth method before monitor_reset_key_state(); bugzilla bug #284;
|
||||
ok provos@
|
||||
|
||||
$Id: ChangeLog,v 1.2579 2003/01/22 00:47:19 djm Exp $
|
||||
$Id: ChangeLog,v 1.2580 2003/01/22 04:42:26 djm Exp $
|
||||
|
||||
10
auth-pam.c
10
auth-pam.c
@ -38,7 +38,7 @@ extern char *__progname;
|
||||
|
||||
extern int use_privsep;
|
||||
|
||||
RCSID("$Id: auth-pam.c,v 1.54 2002/07/28 20:24:08 stevesk Exp $");
|
||||
RCSID("$Id: auth-pam.c,v 1.55 2003/01/22 04:42:26 djm Exp $");
|
||||
|
||||
#define NEW_AUTHTOK_MSG \
|
||||
"Warning: Your password has expired, please change it now."
|
||||
@ -210,14 +210,6 @@ int auth_pam_password(Authctxt *authctxt, const char *password)
|
||||
|
||||
do_pam_set_conv(&conv);
|
||||
|
||||
/* deny if no user. */
|
||||
if (pw == NULL)
|
||||
return 0;
|
||||
if (pw->pw_uid == 0 && options.permit_root_login == PERMIT_NO_PASSWD)
|
||||
return 0;
|
||||
if (*password == '\0' && options.permit_empty_passwd == 0)
|
||||
return 0;
|
||||
|
||||
__pampasswd = password;
|
||||
|
||||
pamstate = INITIAL_LOGIN;
|
||||
|
||||
@ -92,52 +92,51 @@ extern char *aixloginmsg;
|
||||
int
|
||||
auth_password(Authctxt *authctxt, const char *password)
|
||||
{
|
||||
#if defined(USE_PAM)
|
||||
if (*password == '\0' && options.permit_empty_passwd == 0)
|
||||
return 0;
|
||||
return auth_pam_password(authctxt, password);
|
||||
#elif defined(HAVE_OSF_SIA)
|
||||
if (*password == '\0' && options.permit_empty_passwd == 0)
|
||||
return 0;
|
||||
return auth_sia_password(authctxt, password);
|
||||
#else
|
||||
#if !defined(USE_PAM) && !defined(HAVE_OSF_SIA)
|
||||
struct passwd * pw = authctxt->pw;
|
||||
char *encrypted_password;
|
||||
char *pw_password;
|
||||
char *salt;
|
||||
#if defined(__hpux) || defined(HAVE_SECUREWARE)
|
||||
# if defined(__hpux) || defined(HAVE_SECUREWARE)
|
||||
struct pr_passwd *spw;
|
||||
#endif /* __hpux || HAVE_SECUREWARE */
|
||||
#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
|
||||
# endif /* __hpux || HAVE_SECUREWARE */
|
||||
# if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
|
||||
struct spwd *spw;
|
||||
#endif
|
||||
#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
|
||||
# endif
|
||||
# if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
|
||||
struct passwd_adjunct *spw;
|
||||
#endif
|
||||
#ifdef WITH_AIXAUTHENTICATE
|
||||
# endif
|
||||
# ifdef WITH_AIXAUTHENTICATE
|
||||
char *authmsg;
|
||||
int authsuccess;
|
||||
int reenter = 1;
|
||||
#endif
|
||||
# endif
|
||||
#endif /* !defined(USE_PAM) && !defined(HAVE_OSF_SIA) */
|
||||
|
||||
/* deny if no user. */
|
||||
if (pw == NULL)
|
||||
return 0;
|
||||
#ifndef HAVE_CYGWIN
|
||||
if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
|
||||
if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_NO_PASSWD)
|
||||
return 0;
|
||||
#endif
|
||||
if (*password == '\0' && options.permit_empty_passwd == 0)
|
||||
return 0;
|
||||
#ifdef KRB5
|
||||
|
||||
#if defined(USE_PAM)
|
||||
return auth_pam_password(authctxt, password);
|
||||
#elif defined(HAVE_OSF_SIA)
|
||||
return auth_sia_password(authctxt, password);
|
||||
#else
|
||||
# ifdef KRB5
|
||||
if (options.kerberos_authentication == 1) {
|
||||
int ret = auth_krb5_password(authctxt, password);
|
||||
if (ret == 1 || ret == 0)
|
||||
return ret;
|
||||
/* Fall back to ordinary passwd authentication. */
|
||||
}
|
||||
#endif
|
||||
#ifdef HAVE_CYGWIN
|
||||
# endif
|
||||
# ifdef HAVE_CYGWIN
|
||||
if (is_winnt) {
|
||||
HANDLE hToken = cygwin_logon_user(pw, password);
|
||||
|
||||
@ -146,8 +145,8 @@ auth_password(Authctxt *authctxt, const char *password)
|
||||
cygwin_set_impersonation_token(hToken);
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
#ifdef WITH_AIXAUTHENTICATE
|
||||
# endif
|
||||
# ifdef WITH_AIXAUTHENTICATE
|
||||
authsuccess = (authenticate(pw->pw_name,password,&reenter,&authmsg) == 0);
|
||||
|
||||
if (authsuccess)
|
||||
@ -158,47 +157,47 @@ auth_password(Authctxt *authctxt, const char *password)
|
||||
aixloginmsg = NULL;
|
||||
|
||||
return(authsuccess);
|
||||
#endif
|
||||
#ifdef KRB4
|
||||
# endif
|
||||
# ifdef KRB4
|
||||
if (options.kerberos_authentication == 1) {
|
||||
int ret = auth_krb4_password(authctxt, password);
|
||||
if (ret == 1 || ret == 0)
|
||||
return ret;
|
||||
/* Fall back to ordinary passwd authentication. */
|
||||
}
|
||||
#endif
|
||||
#ifdef BSD_AUTH
|
||||
# endif
|
||||
# ifdef BSD_AUTH
|
||||
if (auth_userokay(pw->pw_name, authctxt->style, "auth-ssh",
|
||||
(char *)password) == 0)
|
||||
return 0;
|
||||
else
|
||||
return 1;
|
||||
#endif
|
||||
# endif
|
||||
pw_password = pw->pw_passwd;
|
||||
|
||||
/*
|
||||
* Various interfaces to shadow or protected password data
|
||||
*/
|
||||
#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
|
||||
# if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
|
||||
spw = getspnam(pw->pw_name);
|
||||
if (spw != NULL)
|
||||
pw_password = spw->sp_pwdp;
|
||||
#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
|
||||
# endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
|
||||
|
||||
#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
|
||||
# if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
|
||||
if (issecure() && (spw = getpwanam(pw->pw_name)) != NULL)
|
||||
pw_password = spw->pwa_passwd;
|
||||
#endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */
|
||||
# endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */
|
||||
|
||||
#ifdef HAVE_SECUREWARE
|
||||
# ifdef HAVE_SECUREWARE
|
||||
if ((spw = getprpwnam(pw->pw_name)) != NULL)
|
||||
pw_password = spw->ufld.fd_encrypt;
|
||||
#endif /* HAVE_SECUREWARE */
|
||||
# endif /* HAVE_SECUREWARE */
|
||||
|
||||
#if defined(__hpux) && !defined(HAVE_SECUREWARE)
|
||||
# if defined(__hpux) && !defined(HAVE_SECUREWARE)
|
||||
if (iscomsec() && (spw = getprpwnam(pw->pw_name)) != NULL)
|
||||
pw_password = spw->ufld.fd_encrypt;
|
||||
#endif /* defined(__hpux) && !defined(HAVE_SECUREWARE) */
|
||||
# endif /* defined(__hpux) && !defined(HAVE_SECUREWARE) */
|
||||
|
||||
/* Check for users with no password. */
|
||||
if ((password[0] == '\0') && (pw_password[0] == '\0'))
|
||||
@ -209,25 +208,25 @@ auth_password(Authctxt *authctxt, const char *password)
|
||||
else
|
||||
salt = "xx";
|
||||
|
||||
#ifdef HAVE_MD5_PASSWORDS
|
||||
# ifdef HAVE_MD5_PASSWORDS
|
||||
if (is_md5_salt(salt))
|
||||
encrypted_password = md5_crypt(password, salt);
|
||||
else
|
||||
encrypted_password = crypt(password, salt);
|
||||
#else /* HAVE_MD5_PASSWORDS */
|
||||
# if defined(__hpux) && !defined(HAVE_SECUREWARE)
|
||||
# else /* HAVE_MD5_PASSWORDS */
|
||||
# if defined(__hpux) && !defined(HAVE_SECUREWARE)
|
||||
if (iscomsec())
|
||||
encrypted_password = bigcrypt(password, salt);
|
||||
else
|
||||
encrypted_password = crypt(password, salt);
|
||||
# else
|
||||
# ifdef HAVE_SECUREWARE
|
||||
encrypted_password = bigcrypt(password, salt);
|
||||
# else
|
||||
# ifdef HAVE_SECUREWARE
|
||||
encrypted_password = bigcrypt(password, salt);
|
||||
# else
|
||||
encrypted_password = crypt(password, salt);
|
||||
# endif /* HAVE_SECUREWARE */
|
||||
# endif /* __hpux && !defined(HAVE_SECUREWARE) */
|
||||
#endif /* HAVE_MD5_PASSWORDS */
|
||||
# endif /* HAVE_SECUREWARE */
|
||||
# endif /* __hpux && !defined(HAVE_SECUREWARE) */
|
||||
# endif /* HAVE_MD5_PASSWORDS */
|
||||
|
||||
/* Authentication is accepted if the encrypted passwords are identical. */
|
||||
return (strcmp(encrypted_password, pw_password) == 0);
|
||||
|
||||
@ -57,7 +57,7 @@ auth_sia_password(Authctxt *authctxt, char *pass)
|
||||
|
||||
host = get_canonical_hostname(options.verify_reverse_mapping);
|
||||
|
||||
if (!user || !pass || pass[0] == '\0')
|
||||
if (pass[0] == '\0')
|
||||
return(0);
|
||||
|
||||
if (sia_ses_init(&ent, saved_argc, saved_argv, host, user, NULL, 0,
|
||||
|
||||
Loading…
Reference in New Issue
Block a user