Attachment #1170 for bug #1215




 */
/*
 * Copyright (c) 2003,2004 Damien Miller <djm@mindrot.org>
 * Copyright (c) 2003,2004,2006 Darren Tucker <dtucker@zip.com.au>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above

static int sshpam_session_open = 0;
static int sshpam_cred_established = 0;
static int sshpam_account_status = -1;
static int sshpam_faked_user = 0;
static char **sshpam_env = NULL;
static Authctxt *sshpam_authctxt = NULL;
static const char *sshpam_password = NULL;

# define pam_chauthtok(a,b)	(sshpam_chauthtok_ruid((a), (b)))
#endif

struct passwd *
sshpam_getpw(const char *user)
{
	struct passwd *pw;

	if ((pw = getpwnam(user)) != NULL)
		return(pw);

	debug("PAM: faking passwd struct for user '%.100s'", user);
	sshpam_faked_user = 1;
	if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL)
		return NULL;
	pw->pw_name = xstrdup(user);	/* XXX leak */
	pw->pw_shell = "/bin/true";
	pw->pw_gecos = "sshd fake PAM user";
	return (pw);
}

void
sshpam_check_userchanged(void)
{
	int sshpam_err;
	struct passwd *pw;
	const char *user;

	debug("sshpam_check_userchanged");
	sshpam_err = pam_get_item(sshpam_handle, PAM_USER, &user);
	if (sshpam_err != PAM_SUCCESS)
		fatal("PAM: could not get PAM_USER: %s",
		    pam_strerror(sshpam_handle, sshpam_err));
	if (strcmp(user, sshpam_authctxt->pw->pw_name) != 0) {
		debug("PAM: user mapped from '%.100s' to '%.100s'",
		    sshpam_authctxt->pw->pw_name, user);
		if ((pw = getpwnam(user)) == NULL)
			fatal("PAM: could not get passwd entry for user "
			    "'%.100s' provided by PAM_USER", user);
		sshpam_authctxt->pw = pw;	/* XXX leak */
		sshpam_authctxt->valid = allowed_user(pw);
		sshpam_faked_user = 0;
		debug("PAM: user '%.100s' now %svalid", user,
		    sshpam_authctxt->valid ? "" : "in");
	}
}

void
sshpam_password_change_required(int reqd)
{

static void
import_environments(Buffer *b)
{
	char *env, *user;
	u_int i, num_env;
	int err;


	/* Import variables set by do_pam_account */
	sshpam_account_status = buffer_get_int(b);
	sshpam_password_change_required(buffer_get_int(b));
	user = buffer_get_string(b, NULL);
	debug("PAM: got username '%.100s' from thread", user);
	if ((err = pam_set_item(sshpam_handle, PAM_USER, user)) != PAM_SUCCESS)
		fatal("PAM: failed to set PAM_USER: %s",
		    pam_strerror(sshpam_handle, err));
	sshpam_authctxt-> pw = sshpam_getpw(user);

	/* Import environment from subprocess */
	num_env = buffer_get_int(b);

	if (sshpam_err != PAM_SUCCESS)
		goto auth_fail;

	sshpam_check_userchanged();
	if (compat20) {
		if (!do_pam_account())
			goto auth_fail;

	/* Export variables set by do_pam_account */
	buffer_put_int(&buffer, sshpam_account_status);
	buffer_put_int(&buffer, sshpam_authctxt->force_pwchange);
	buffer_put_cstring(&buffer, sshpam_authctxt->pw->pw_name);

	/* Export any environment strings set in child */
	for(i = 0; environ[i] != NULL; i++)

	debug3("PAM: %s pam_acct_mgmt = %d (%s)", __func__, sshpam_err,
	    pam_strerror(sshpam_handle, sshpam_err));

	sshpam_check_userchanged();
	if (sshpam_faked_user)
		fatal("PAM: completed authentication but PAM account invalid");

	if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
		sshpam_account_status = 0;
		return (sshpam_account_status);

		    pam_strerror(sshpam_handle, sshpam_err));

	sshpam_err = pam_authenticate(sshpam_handle, flags);
	sshpam_check_userchanged();
	sshpam_password = NULL;
	if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
		debug("PAM: password authentication accepted for %.100s",

Lines 46-50 void sshpam_thread_cleanup(void); Link Here

(-)auth-pam.h (+2 lines)
46	void sshpam_cleanup(void);	46	void sshpam_cleanup(void);
47	int sshpam_auth_passwd(Authctxt , const char );	47	int sshpam_auth_passwd(Authctxt , const char );
48	int is_pam_session_open(void);	48	int is_pam_session_open(void);
		49	void sshpam_invalid_user(void);
		50	struct passwd sshpam_getpw(const char );
49		51
50	#endif /* USE_PAM */	52	#endif /* USE_PAM */

Lines 493-498 getpwnamallow(const char *user) Link Here

(-)auth.c (+4 lines)
493	struct passwd *pw;	493	struct passwd *pw;
494		494
495	pw = getpwnam(user);	495	pw = getpwnam(user);
		496	#ifdef USE_PAM
		497	if (options.use_pam && pw == NULL)
		498	pw = sshpam_getpw(user);
		499	#endif
496	if (pw == NULL) {	500	if (pw == NULL) {
497	logit("Invalid user %.100s from %.100s",	501	logit("Invalid user %.100s from %.100s",
498	user, get_remote_ipaddr());	502	user, get_remote_ipaddr());

Return to bug 1215

Lines 30-36 Link Here

(-)auth-pam.c (-2 / +60 lines)
30	*/	30	*/
31	/*	31	/*
32	* Copyright (c) 2003,2004 Damien Miller <djm@mindrot.org>	32	* Copyright (c) 2003,2004 Damien Miller <djm@mindrot.org>
33	* Copyright (c) 2003,2004 Darren Tucker <dtucker@zip.com.au>	33	* Copyright (c) 2003,2004,2006 Darren Tucker <dtucker@zip.com.au>
34	*	34	*
35	* Permission to use, copy, modify, and distribute this software for any	35	* Permission to use, copy, modify, and distribute this software for any
36	* purpose with or without fee is hereby granted, provided that the above	36	* purpose with or without fee is hereby granted, provided that the above
Lines 205-210 static int sshpam_authenticated = 0; Link Here
205	static int sshpam_session_open = 0;	205	static int sshpam_session_open = 0;
206	static int sshpam_cred_established = 0;	206	static int sshpam_cred_established = 0;
207	static int sshpam_account_status = -1;	207	static int sshpam_account_status = -1;
		208	static int sshpam_faked_user = 0;
208	static char **sshpam_env = NULL;	209	static char **sshpam_env = NULL;
209	static Authctxt *sshpam_authctxt = NULL;	210	static Authctxt *sshpam_authctxt = NULL;
210	static const char *sshpam_password = NULL;	211	static const char *sshpam_password = NULL;
Lines 249-254 sshpam_chauthtok_ruid(pam_handle_t *pamh Link Here
249	# define pam_chauthtok(a,b) (sshpam_chauthtok_ruid((a), (b)))	250	# define pam_chauthtok(a,b) (sshpam_chauthtok_ruid((a), (b)))
250	#endif	251	#endif
251		252
		253	struct passwd *
		254	sshpam_getpw(const char *user)
		255	{
		256	struct passwd *pw;
		257
		258	if ((pw = getpwnam(user)) != NULL)
		259	return(pw);
		260
		261	debug("PAM: faking passwd struct for user '%.100s'", user);
		262	sshpam_faked_user = 1;
		263	if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL)
		264	return NULL;
		265	pw->pw_name = xstrdup(user); /* XXX leak */
		266	pw->pw_shell = "/bin/true";
		267	pw->pw_gecos = "sshd fake PAM user";
		268	return (pw);
		269	}
		270
		271	void
		272	sshpam_check_userchanged(void)
		273	{
		274	int sshpam_err;
		275	struct passwd *pw;
		276	const char *user;
		277
		278	debug("sshpam_check_userchanged");
		279	sshpam_err = pam_get_item(sshpam_handle, PAM_USER, &user);
		280	if (sshpam_err != PAM_SUCCESS)
		281	fatal("PAM: could not get PAM_USER: %s",
		282	pam_strerror(sshpam_handle, sshpam_err));
		283	if (strcmp(user, sshpam_authctxt->pw->pw_name) != 0) {
		284	debug("PAM: user mapped from '%.100s' to '%.100s'",
		285	sshpam_authctxt->pw->pw_name, user);
		286	if ((pw = getpwnam(user)) == NULL)
		287	fatal("PAM: could not get passwd entry for user "
		288	"'%.100s' provided by PAM_USER", user);
		289	sshpam_authctxt->pw = pw; /* XXX leak */
		290	sshpam_authctxt->valid = allowed_user(pw);
		291	sshpam_faked_user = 0;
		292	debug("PAM: user '%.100s' now %svalid", user,
		293	sshpam_authctxt->valid ? "" : "in");
		294	}
		295	}
		296
252	void	297	void
253	sshpam_password_change_required(int reqd)	298	sshpam_password_change_required(int reqd)
254	{	299	{
Lines 271-277 sshpam_password_change_required(int reqd Link Here
271	static void	316	static void
272	import_environments(Buffer *b)	317	import_environments(Buffer *b)
273	{	318	{
274	char *env;	319	char env, user;
275	u_int i, num_env;	320	u_int i, num_env;
276	int err;	321	int err;
277		322
Lines 281-286 import_environments(Buffer *b) Link Here
281	/* Import variables set by do_pam_account */	326	/* Import variables set by do_pam_account */
282	sshpam_account_status = buffer_get_int(b);	327	sshpam_account_status = buffer_get_int(b);
283	sshpam_password_change_required(buffer_get_int(b));	328	sshpam_password_change_required(buffer_get_int(b));
		329	user = buffer_get_string(b, NULL);
		330	debug("PAM: got username '%.100s' from thread", user);
		331	if ((err = pam_set_item(sshpam_handle, PAM_USER, user)) != PAM_SUCCESS)
		332	fatal("PAM: failed to set PAM_USER: %s",
		333	pam_strerror(sshpam_handle, err));
		334	sshpam_authctxt-> pw = sshpam_getpw(user);
284		335
285	/* Import environment from subprocess */	336	/* Import environment from subprocess */
286	num_env = buffer_get_int(b);	337	num_env = buffer_get_int(b);
Lines 438-443 sshpam_thread(void *ctxtp) Link Here
438	if (sshpam_err != PAM_SUCCESS)	489	if (sshpam_err != PAM_SUCCESS)
439	goto auth_fail;	490	goto auth_fail;
440		491
		492	sshpam_check_userchanged();
441	if (compat20) {	493	if (compat20) {
442	if (!do_pam_account())	494	if (!do_pam_account())
443	goto auth_fail;	495	goto auth_fail;
Lines 456-461 sshpam_thread(void *ctxtp) Link Here
456	/* Export variables set by do_pam_account */	508	/* Export variables set by do_pam_account */
457	buffer_put_int(&buffer, sshpam_account_status);	509	buffer_put_int(&buffer, sshpam_account_status);
458	buffer_put_int(&buffer, sshpam_authctxt->force_pwchange);	510	buffer_put_int(&buffer, sshpam_authctxt->force_pwchange);
		511	buffer_put_cstring(&buffer, sshpam_authctxt->pw->pw_name);
459		512
460	/* Export any environment strings set in child */	513	/* Export any environment strings set in child */
461	for(i = 0; environ[i] != NULL; i++)	514	for(i = 0; environ[i] != NULL; i++)
Lines 864-869 do_pam_account(void) Link Here
864	debug3("PAM: %s pam_acct_mgmt = %d (%s)", __func__, sshpam_err,	917	debug3("PAM: %s pam_acct_mgmt = %d (%s)", __func__, sshpam_err,
865	pam_strerror(sshpam_handle, sshpam_err));	918	pam_strerror(sshpam_handle, sshpam_err));
866		919
		920	sshpam_check_userchanged();
		921	if (sshpam_faked_user)
		922	fatal("PAM: completed authentication but PAM account invalid");
		923
867	if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {	924	if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
868	sshpam_account_status = 0;	925	sshpam_account_status = 0;
869	return (sshpam_account_status);	926	return (sshpam_account_status);
Lines 1164-1169 sshpam_auth_passwd(Authctxt *authctxt, c Link Here
1164	pam_strerror(sshpam_handle, sshpam_err));	1221	pam_strerror(sshpam_handle, sshpam_err));
1165		1222
1166	sshpam_err = pam_authenticate(sshpam_handle, flags);	1223	sshpam_err = pam_authenticate(sshpam_handle, flags);
		1224	sshpam_check_userchanged();
1167	sshpam_password = NULL;	1225	sshpam_password = NULL;
1168	if (sshpam_err == PAM_SUCCESS && authctxt->valid) {	1226	if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
1169	debug("PAM: password authentication accepted for %.100s",	1227	debug("PAM: password authentication accepted for %.100s",