CHAUTHTOK_HELPER=$(libexecdir)/ssh-chauthtok-helper

INSTALL_SSH_CHAUTHTOK_HELPER=yes

ssh-chauthtok-helper${EXEEXT}: $(LIBCOMPAT) libssh.a ssh-chauthtok-helper.o

	$(LD) -o $@ ssh-chauthtok-helper.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBPAM) $(LIBS)

	if test ! -z "$(INSTALL_SSH_CHAUTHTOK_HELPER)" ; then \

		$(INSTALL) -m 4711 -s ssh-chauthtok-helper $(DESTDIR)$(libexecdir)/ssh-chauthtok-helper ; \

	fi

	-rm -f $(DESTDIR)$(CHAUTHTOK_HELPER)$(EXEEXT)

#include "misc.h"

/* HP-UX doesn't like credentials to be deleted. Skip and rely on pam_end() */

#ifndef __hpux

#endif

/* Set the TTY after session is open */

void do_pam_set_tty(const char *ttyname) {

	int pam_retval;

	if (ttyname != NULL) {

		debug("PAM setting tty to \"%.200s\"", ttyname);

		pam_retval = pam_set_item(__pamh, PAM_TTY, ttyname);

		if (pam_retval != PAM_SUCCESS)

			fatal("PAM set tty failed[%d]: %.200s",

			    pam_retval, PAM_STRERROR(__pamh, pam_retval));

	}

}

/* Call external pam_chauthtok helper */

int do_chauthtok_helper(void)

{

	mysig_t old_sigchld;

	pid_t pid;

	int retval;

	int pam_retval;

	const char *pam_user;

	pam_retval = pam_get_item(__pamh, PAM_USER, (const void **)&pam_user);

	debug2("pam_get_item(PAM_USER) = %d", pam_retval);

	if (pam_retval != PAM_SUCCESS) {

		fatal("Cannot pam_get_item PAM_USER: %.200s",

		    PAM_STRERROR(__pamh, pam_retval));

	}

	old_sigchld = mysignal(SIGCHLD, SIG_DFL);

	pid = fork();

	if (pid < 0) {

		fatal("Cannot fork %.200s: %.200s", SSH_CHAUTHTOK_HELPER,

		    strerror(errno));

	}

	if (pid == 0) {

		execl(SSH_CHAUTHTOK_HELPER, SSH_CHAUTHTOK_HELPER,

		    pam_user, (char *)0);

		fatal("Cannot execute %.200s: %.200s",

		    SSH_CHAUTHTOK_HELPER, strerror(errno));

	}

	if (waitpid(pid, &retval, 0) != pid)

		fatal("Cannot get exit status of %.200s (pid %d): %.200s",

		    SSH_CHAUTHTOK_HELPER, pid, strerror(errno));

	mysignal(SIGCHLD, old_sigchld);

	if (!WIFEXITED(retval)) {

       		if (WIFSIGNALED(retval)) {

	   		log("%.200s (pid %d) terminated by signal %d",

			    SSH_CHAUTHTOK_HELPER, pid, WTERMSIG(retval));

		} else {

	   		log("%.200s (pid %d) terminated abnormally",

			    SSH_CHAUTHTOK_HELPER, pid);

		}

	   	return 255;

	}

	return WEXITSTATUS(retval);

}

void do_pam_set_tty(const char *ttyname);

		/*

		 * We need to open the session here because PAM on HP-UX does not

		 * work after the call to permanently_set_uid.

		 */

		do_pam_session(pw->pw_name,NULL);

/*

 * Copyright (c) 2002 Michael Steffens.  All rights reserved.

 *

 * Derived from auth-pam.c,

 * Copyright (c) 2000 Damien Miller.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

/*

 * This program provides a workaround for sshd presently not supporting

 * user changes of expired passwords when running in privsep mode.

 *

 * When encountering an expired authentication token, the non-privileged

 * session daemon can delegate change to ssh-chauthtok-helper, which

 * should be installed suid root for performing this task.

 *

 * It is somewhat similar to the system passwd program, but dedicatedly

 * talks to modules configured for PAM service "sshd", rather than those

 * configured for passwd. These might be the same, but can also be

 * different.

 *

 * By nature this helper program can also be invoked by local users

 * directly, just as the passwd program can.  But in any case

 *

 * - non-root users can only change their own authentication tokens.

 *

 * - root users can change authentication tokens for others, but only

 *   with providing the old token.

 *

 * The second restriction is meant to be a fuse against the helper program

 * being accidentally invoked by a privileged daemon...

 *

 * The ssh-chauthtok-helper program unfortunately can't safely deal

 * with the PAM_RUSER and PAM_RHOST items, because there is no way of

 * preventing local users to feed in arbitrary values for these.

 * They are being left undefined here, relying on modules and their

 * configuration to decide whether to accept requests from unknown users

 * at unknown hosts.  (Always provided they have authenticated for the

 * local account, of course!)

 */

#include "includes.h"

#ifdef USE_PAM

#include "xmalloc.h"

#include "log.h"

#include "readpass.h"

#define SSHD_PAM_SERVICE "sshd"

#ifdef HAVE___PROGNAME

extern char *__progname;

#else

char *__progname;

#endif

int null_pam_conv;

/*

 * This is a downstripped version of do_pam_conversation() in pam-auth.c,

 * with the INITIAL_LOGIN mode removed.  At the time this program can be

 * run we already are authenticated and do have STDIN available.

 * The null_pam_conv flag enforces modules to be silent even if

 * they do not honor the PAM_SILENT flag.  We just don't need to tell

 * the user again that passwords are expired when calling pam_acct_mgmt(),

 * as this has already been done by the calling daemon.

 */

static int do_pam_conversation(int num_msg, const struct pam_message **msg,

	struct pam_response **resp, void *appdata_ptr)

{

	struct pam_response *reply;

	int count;

	char buf[1024];

	/* PAM will free this later */

	reply = xmalloc(num_msg * sizeof(*reply));

	for (count = 0; count < num_msg; count++) {

	       	/*

	       	 * stdio is connected, so interact directly

	       	 */

	       	switch(PAM_MSG_MEMBER(msg, count, msg_style)) {

	       	case PAM_PROMPT_ECHO_ON:

			if (null_pam_conv) {

				xfree(reply);

				return PAM_CONV_ERR;

			}

	       		fputs(PAM_MSG_MEMBER(msg, count, msg), stderr);

	       		fgets(buf, sizeof(buf), stdin);

	       		reply[count].resp = xstrdup(buf);

	       		reply[count].resp_retcode = PAM_SUCCESS;

	       		break;

	       	case PAM_PROMPT_ECHO_OFF:

			if (null_pam_conv) {

				xfree(reply);

				return PAM_CONV_ERR;

			}

	       		/*

			 * Lets's be a bit more paranoid than the original and

			 * avoid the read_passphrase() wrapper.  There is no

			 * need to care for non-tty, and eventually call

			 * ssh-askpass, as we don't have X11-forwarding at

			 * this point anyway.

			 */

	       		if (readpassphrase(PAM_MSG_MEMBER(msg, count, msg),

				buf, sizeof(buf), RPP_REQUIRE_TTY)) {

	       			reply[count].resp = xstrdup(buf);

	       		} else {

				reply[count].resp = xstrdup("");

	       		}

	       		memset(buf, 'x', sizeof(buf));

	       		reply[count].resp_retcode = PAM_SUCCESS;

	       		break;

	       	case PAM_ERROR_MSG:

	       	case PAM_TEXT_INFO:

	       		if (!null_pam_conv && PAM_MSG_MEMBER(msg, count, msg) != NULL)

	       			fprintf(stderr, "%s\n",

	       			    PAM_MSG_MEMBER(msg, count, msg));

	       		reply[count].resp = xstrdup("");

	       		reply[count].resp_retcode = PAM_SUCCESS;

	       		break;

	       	default:

	       		xfree(reply);

	       		return PAM_CONV_ERR;

	       	}

	}

	*resp = reply;

	return PAM_SUCCESS;

}

int main(int argc, char *argv[]) {

	struct passwd *pw;

	uid_t uid;

	uid_t euid;

	struct pam_conv conv = {

		(int (*)())do_pam_conversation,

		NULL

	};

	pam_handle_t *pamh;

	int pam_retval;

	int retval = 0;

        __progname = get_progname(argv[0]);

	log_init(__progname, SYSLOG_LEVEL_INFO,

		 SYSLOG_FACILITY_AUTH, 0);

	uid = getuid();

	euid = geteuid();

	if (euid != 0)

		fatal("Cannot change authtok using effective uid %ld", (long)euid);

	switch (argc) {

	case 2:

		if (!(pw = getpwnam(argv[1])))

			fatal("Cannot get uid of user %.200s: %.200s",

			    argv[1], strerror(errno));

		if (uid && pw->pw_uid != uid)

			fatal("Cannot chauthtok for user %.200s using uid %ld",

			    argv[1], (long)uid);

		break;

	default:

		fprintf(stderr, "Usage: ssh-chauthtok-helper <user>\n");

		return 1;

	}

	/* drop root real uid when changing authtok for another user */

	if (!uid && setuid(uid = pw->pw_uid))

		fatal("Cannot setuid %ld: %.200s", (long)uid, strerror(errno));

	null_pam_conv = 1;

	pam_retval = pam_start(SSHD_PAM_SERVICE, pw->pw_name, &conv, &pamh);

	switch (pam_retval) {

	case PAM_SUCCESS:

		break;

	default:

		fatal("PAM initialisation failed[%d]: %.200s",

		    pam_retval, PAM_STRERROR(pamh, pam_retval));

		break;

	}

	/*

	 * Some PAM implemetations (HP-UX) require pam_acct_mgmt() to

	 * be invoked before they can identify expired tokens on

	 * pam_chauthtok().

	 */

	pam_retval = pam_acct_mgmt(pamh, PAM_DISALLOW_NULL_AUTHTOK);

	switch (pam_retval) {

	case PAM_SUCCESS:

		/*

                 * We were called for changing expired authentication

		 * tokens and found nothing to do!  The caller should not

		 * consider this success...

		 */

		log("No expired authentication tokens found");

		retval = 255;

		break;

	case PAM_NEW_AUTHTOK_REQD:

		break;

	default:

		fatal("PAM pam_acct_mgmt failed[%d]: %.200s",

		    pam_retval, PAM_STRERROR(pamh, pam_retval));

		break;

	}

	/*

	 * pam_chauthtok() will perform authentication of its own, if required.

	 * For password change it will prompt for the old password only if

	 * the real uid is non-zero and the effective uid is zero.  It doesn't

	 * work with the effective uid being non-zero, which is why this

	 * program exists...

	 */

	if (!retval) {

		null_pam_conv = 0;

		pam_retval = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);

		switch (pam_retval) {

		case PAM_SUCCESS:

			break;

		default:

			log("PAM pam_chauthtok failed[%d]: %.200s",

			    pam_retval, PAM_STRERROR(pamh, pam_retval));

			break;

		}

		retval = pam_retval;

		null_pam_conv = 1;

	}

	pam_retval = pam_end(pamh, pam_retval);

	switch (pam_retval) {

	case PAM_SUCCESS:

		break;

	default:

		log("PAM pam_end failed[%d]: %.200s",

		    pam_retval, PAM_STRERROR(pamh, pam_retval));

		break;

	}

	return retval;

}

#else /* USE_PAM */

int main(int argc, char *argv[]) {

	fprintf(stderr, "Sorry, no PAM support...\n");

	return -1;

}

#endif /* USE_PAM */