auth-obc.o \

/* Define if you want OBC support */

#undef USE_OBC

# Check whether user wants OBC support

OBC_MSG="no"

AC_ARG_WITH(obc,

	[  --with-obc      Enable out-of-band challenge support],

	[

		if test "x$withval" != "xno" ; then

			AC_DEFINE(USE_OBC, 1, [Define if you want OBC support])

			OBC_MSG="yes"

			AC_MSG_CHECKING([for out-of-band (obc) support])

		fi

	]

)

echo "                       OBC support: $OBC_MSG"

#ifdef USE_OBC

extern KbdintDevice obc_device;

#endif

#ifdef USE_OBC

	&obc_device,

#endif

#ifdef USE_OBC

	extern KbdintDevice mm_obc_device;

#endif

#ifdef USE_OBC

	devices[n++] = &mm_obc_device;

#endif

	char		*obc;

int	obc_challenge(Authctxt *);

int	obc_auth(Authctxt *);

int	obc_send(char *, char *, char *);

/* $OpenBSD: auth-obc.c,v 0.5 2008/02/04 07:55:00 pgsery Exp $ */

/*

 * Copyright (c) 2008 Paul Sery.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

/* This code was derived from Markus Friedl's auth-skey.c and

	Daniel B. Cid's Ossec/sendmail.c */

#include "includes.h"

#include <sys/types.h>

#include <string.h>

#include <stdarg.h>

#include "xmalloc.h"

#include "packet.h"

#include "log.h"

#include "key.h"

#include "hostfile.h"

#include "auth.h"

#include "buffer.h"

#ifdef GSSAPI

#include "ssh-gss.h"

#endif

#include "monitor_wrap.h"

#include "servconf.h"

#include "uidswap.h"

#include <netinet/in.h>

#include <netdb.h>

#include <arpa/inet.h>

#include <sys/socket.h>

#include <sys/types.h>  

#include <string.h>

#include <stdarg.h>

#include <unistd.h>     

#include "includes.h"   

#include "log.h"

/* import */

extern ServerOptions options;

#define OS_SIZE_1024    1024

#define OS_SUCCESS       0      /* Success */

#define OS_INVALID      -1      /* Invalid entry */

#define OS_NOTFOUND     -2      /* Entry not found */

#define OS_FILERR       -3      /* Error in the file */

#define OS_SIZELIM      -4      /* Size limit problem */

#define OS_CFGERR       -5      /* Configuration error */

#define OS_SOCKTERR     -6      /* Socket error */

#define OS_MISVALUE     -7      /* There are values missing */

#define OS_CONNERR      -8      /* Connection failed */

#define OS_UNDEF        -9      /* Uknown error */

#define OS_MEMERR       -10     /* Memory Error */

#define OS_SOCKBUSY -11 /* Busy socket -- try again */

#define OS_ENDFILE      -20     /* End of file */

#define OS_FINISH       -21     /* Finished this task */

/* Return codes (from SMTP server) */

#define VALIDBANNER             "220"

#define VALIDMAIL               "250"

#define VALIDDATA               "354"

/* Default values use to connect */

#define SMTP_DEFAULT_PORT       "25"

#define HELOMSG                 "Helo openssh\r\n"

#define MAILFROM                "Mail From: <%s>\r\n"

#define RCPTTO                  "Rcpt To: <%s>\r\n"

#define DATAMSG                 "DATA\r\n"

#define FROM                    "From: <%s>\r\n"

#define TO                          "To: <%s>\r\n"

#define CC                          "Cc: <%s>\r\n"

#define SUBJECT                 "Subject: %s\r\n"

#define ENDDATA                 "\r\n.\r\n"

#define QUITMSG                 "QUIT\r\n"

void 

display_ip(struct addrinfo *ip)

{

                struct sockaddr_in *sa = (struct sockaddr_in *) ip->ai_addr;

                struct in_addr *inadr = (struct in_addr *) &sa->sin_addr.s_addr;

                debug3("challenge smtp server ip: %-16s", inet_ntoa(*inadr));

                if (ip->ai_canonname && *ip->ai_canonname) 

                        debug3("canonical name: %s", ip->ai_canonname);

}

char *

obc_recv_tcp(int socket, int sizet)

{

	char *ret;

	int retsize=0;

	ret = (char *) calloc((sizet), sizeof(char));

	if(ret == NULL)

		return(NULL);

	if((retsize = recv(socket, ret, sizet-1,0)) <= 0)

		return(NULL);

	return(ret);

}

void  

obc_send_tcp(int socket, char *type, char *msg, int size)

{

        int result;

        char snd_msg[128];

        if (size) {

                memset(snd_msg,'\0',size);

                snprintf(snd_msg,size+1, type, msg);

                result = send(socket, snd_msg, strlen(snd_msg),0);

        } else {

                result = send(socket, type, strlen(type),0);

        }

        if (result == -1)

                error("obc send tcp: %d",OS_SOCKTERR);

}

int 

obc_connect_smtp(char *smtp_server, char *port)

{

        int err, sock, result;

        struct addrinfo hints, *ip_info, *ip;

        memset(&hints, 0, sizeof(struct addrinfo));

        hints.ai_family = AF_UNSPEC;    /* Allow IPv4 or IPv6 */

        hints.ai_socktype = SOCK_DGRAM; /* Datagram socket */

        hints.ai_flags = 0;

        hints.ai_protocol = 0;          /* Any protocol */

        if ( (err = getaddrinfo(smtp_server, "25", &hints, &ip_info) != 0) ) {

                debug3("%s: getaddrinfo %s\n", __func__, gai_strerror(err));

                return(-1);

        }

        for (ip = ip_info; ip != NULL; ip = ip->ai_next) {

                display_ip(ip);

                if ( (sock = socket(PF_INET,SOCK_STREAM,IPPROTO_TCP)) < 0) {

                        debug3("%s: can't open socket %d", __func__, sock);

                        close(sock);

                        continue;

                }

                if ( (result = connect(sock, ip->ai_addr, ip->ai_addrlen)) < 0) 

                        debug3("%s: %s", __func__, gai_strerror(result));

                else 

                        break;

        }

        if (ip == NULL) {

                debug3("%s: Could not connect",__func__);

                return(-1);

        }

        return(sock);

}

void

check_msg(int socket,char *msg,char *type, char *res)

{

	if((msg == NULL)||(!strcmp(res, msg)))

	{

		if(msg)

			free(msg);

		close(socket);

	}

	free(msg);

}

int 

obc_send(char *obc, char *email_addr, char *smtp_server)

{

	int socket;

	char *msg;

	char final_to[512];

	if(obc  == NULL)

		debug3("%s: no message to send",__func__);

	/* Connecting to the smtp server */

	socket = obc_connect_smtp(smtp_server, SMTP_DEFAULT_PORT);

	if(socket < 0)

		return(socket);

	msg = obc_recv_tcp(socket, OS_SIZE_1024);

	check_msg(socket,msg,"returned banner",VALIDBANNER);

	obc_send_tcp(socket,HELOMSG,NULL,0);

	msg = obc_recv_tcp(socket, OS_SIZE_1024);

	check_msg(socket,msg,HELOMSG,VALIDMAIL);

	obc_send_tcp(socket, MAILFROM, email_addr, 128);

	msg = obc_recv_tcp(socket, OS_SIZE_1024);

	check_msg(socket,msg,MAILFROM,VALIDMAIL);

	obc_send_tcp(socket,RCPTTO,email_addr,128);

	msg = obc_recv_tcp(socket, OS_SIZE_1024);

	check_msg(socket,msg,RCPTTO,VALIDMAIL);

	obc_send_tcp(socket,DATAMSG,NULL,0);

	msg = obc_recv_tcp(socket, OS_SIZE_1024);

	check_msg(socket,msg,DATAMSG,VALIDMAIL);

	/* Building "From" and "To" in the e-mail header */

		final_to[0] = '\0';

	obc_send_tcp(socket,final_to,NULL,0);

	obc_send_tcp(socket, TO,email_addr,128);

	obc_send_tcp(socket, FROM, email_addr, 128);

	obc_send_tcp(socket, SUBJECT,"Out-of-band challenge",128);

	obc_send_tcp(socket, obc, NULL, 0);

	/* Sending end of data \r\n.\r\n */

	obc_send_tcp(socket,ENDDATA,NULL,0);

	msg = obc_recv_tcp(socket, OS_SIZE_1024);

	/* quitting and closing socket */

	obc_send_tcp(socket,QUITMSG,NULL,0);

	msg = obc_recv_tcp(socket, OS_SIZE_1024);

	/* Returning 0 (success) */

	close(socket);

	return(0);

}

int 

obc_gen(struct Authctxt *authctxt)

{

        int i,ran,obc_length=4;

        char *obc,cpool[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";

        size_t nchars = sizeof(cpool) - 1;

        /* generate out-of-bound challenge (obc) */

        obc=malloc(obc_length+1);

        if (obc == NULL)

                exit(-1);

        for (i=0;i<obc_length;i++) {

                ran = arc4random();

                obc[i] = cpool[ran%nchars];

        }

        obc[obc_length] = '\0';

	authctxt->obc = obc;

        return 1;

}

int

obc_challenge(Authctxt *authctxt)

{

        int i, result=0;

        char *alias=NULL,*email_addr=NULL;

        for (i=0; options.challenge_users[i] != NULL; i++) {

                alias=strtok(options.challenge_users[i],":");

                email_addr=strtok(NULL,":");

                if (strcmp(authctxt->user,alias) == 0)

			obc_gen(authctxt);

                        result = obc_send(authctxt->obc,email_addr,

                                options.challengesmtpserver);

        }

        debug2("%s: challenge sent to %s at %s via %s",

                __func__, alias ,email_addr,options.challengesmtpserver);

        return(result);

}

int 

obc_haskey(char *pw_name)

{

	if (pw_name != NULL) 

		return 0;

	else

		return 1;

}

int 

obc_passcheck(char *obc_local, char *obc_remote)

{

	if (strcmp(obc_local, obc_remote) == 0)

		return 1;

	return 0;

}

static void *

obc_init_ctx(Authctxt *authctxt)

{

	int result;

	result=obc_challenge(authctxt);

        return authctxt;

}

int

obc_query(void *ctx, char **name, char **infotxt,

    u_int* numprompts, char ***prompts, u_int **echo_on)

{

        *name = xstrdup("");

        *infotxt = xstrdup("");

        *numprompts = 1;

        *prompts = xcalloc(*numprompts, sizeof(char *));

        *echo_on = xcalloc(*numprompts, sizeof(u_int));

        xasprintf(*prompts, "Enter out-of-band challenge:");

        return 0;

}

int

obc_respond(void *ctx, u_int numresponses, char **responses)

{

	Authctxt *authctxt = ctx;

	if (authctxt->valid &&

		numresponses == 1 &&

		obc_haskey(authctxt->obc) == 0 && 

		obc_passcheck(authctxt->obc, responses[0]) == 1)

			return 0;

	return -1;

}

static void

obc_free_ctx(void *ctx)

{

	Authctxt *authctx = ctx;

	authctx->obc = NULL;

}

KbdintDevice obc_device = {

        "obc",

        obc_init_ctx,

	obc_query,

	obc_respond,

        obc_free_ctx

};

KbdintDevice mm_obc_device = {

        "obc",

        obc_init_ctx,

	mm_obc_query,

	mm_obc_respond,

        obc_free_ctx

};

#ifdef USE_OBC

int mm_answer_obc_query(int, Buffer *);

int mm_answer_obc_respond(int, Buffer *);

#endif

#ifdef USE_OBC

    {MONITOR_REQ_OBCQUERY, MON_ISAUTH, mm_answer_obc_query},

    {MONITOR_REQ_OBCRESPOND, MON_AUTH, mm_answer_obc_respond},

#endif

#ifdef USE_OBC

    {MONITOR_REQ_OBCQUERY, MON_ISAUTH, mm_answer_obc_query},

    {MONITOR_REQ_OBCRESPOND, MON_AUTH, mm_answer_obc_respond},

#endif

#endif

#ifdef USE_OBC

	MONITOR_REQ_OBCQUERY, MONITOR_ANS_OBCQUERY,

	MONITOR_REQ_OBCRESPOND, MONITOR_ANS_OBCRESPOND,

#ifdef USE_OBC

int

mm_obc_query(void *ctx, char **name, char **infotxt,

   u_int *numprompts, char ***prompts, u_int **echo_on)

{

	Buffer m;

	u_int success;

	char *challenge;

	buffer_init(&m);

	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_OBCQUERY, &m);

	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_OBCQUERY,

	    &m);

	success = buffer_get_int(&m);

	if (success == 0) {

		debug3("%s: no challenge", __func__);

		buffer_free(&m);

		return (-1);

	}

	/* Get the challenge, and format the response */

	challenge  = buffer_get_string(&m, NULL);

	buffer_free(&m);

	debug2("%s: received challenge: %s", __func__, challenge);

	mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);

	xasprintf(*prompts, "%s%s", challenge, "Out-of-band challenge: ");

	xfree(challenge);

	return (0);

}

int

mm_obc_respond(void *ctx, u_int numresponses, char **responses)

{

	Buffer m;

	int authok;

        Authctxt *authctxt = ctx;

	debug3("%s entering", __func__);

	if (numresponses != 1)

		return (-1);

	buffer_init(&m);

	buffer_put_cstring(&m, responses[0]);

	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_OBCRESPOND, &m);

	mm_request_receive_expect(pmonitor->m_recvfd,

	    MONITOR_ANS_OBCRESPOND, &m);

	authok = buffer_get_int(&m);

	buffer_free(&m);

			authctxt->postponed = 0;

        if (authctxt->valid &&

                numresponses == 1 &&

                obc_haskey(authctxt->obc) == 0 &&

                obc_passcheck(authctxt->obc, responses[0]) == 1) {

                        return 0;

	}

	return -1;

}

#endif /* USE_OBC */

#ifdef USE_OBC

int 

mm_obc_connect_smtp(char *smtp_server, char *port)

{

        int err, sock, result;

        struct addrinfo hints, *ip_info, *ip;

        debug3("[obc_connect] host %s, port %s",smtp_server,port);

        memset(&hints, 0, sizeof(struct addrinfo));

        hints.ai_family = AF_UNSPEC;    /* Allow IPv4 or IPv6 */

        hints.ai_socktype = SOCK_DGRAM; /* Datagram socket */

        hints.ai_flags = 0;

        hints.ai_protocol = 0;          /* Any protocol */

        if ( (err = getaddrinfo(smtp_server, "25", &hints, &ip_info) != 0) ) {

/*        if ( (err = getaddrinfo("76.96.30.117", "25", &hints, &ip_info) != 0) ) {*/

                debug3("[obc_connect]getaddrinfo: %s\n", gai_strerror(err));

                return(-1);

        }

        for (ip = ip_info; ip != NULL; ip = ip->ai_next) {

                display_ip(ip);

                if ( (sock = socket(PF_INET,SOCK_STREAM,IPPROTO_TCP)) < 0) {

                        debug3("[obc_connect] can't open socket %d", sock);

                        close(sock);

                        continue;

                }

                if ( (result = connect(sock, ip->ai_addr, ip->ai_addrlen)) < 0) 

                        debug3("[obc_connect] %s", gai_strerror(result));

                else 

                        break;

        }

        if (ip == NULL) {

                debug3("[obc_connect]Could not connect");

                return(-1);

        }

        return(sock);

}

#endif

/* obc */

int mm_obc_query(void *, char **, char **, u_int *, char ***, u_int **);

int mm_obc_respond(void *, u_int, char **);

	options->obc_authentication = -1;

	options->max_challenge_users = 0;

	if (options->obc_authentication == -1)

		options->obc_authentication = 1;

	{ "challengeusers", sChallengeUsers, SSHCFG_GLOBAL },

        { "challengesmtpserver", sChallengeSMTPServer, SSHCFG_GLOBAL },

	case sChallengeUsers:

		while ((arg = strdelim(&cp)) && *arg != '\0') {

			if (options->max_challenge_users >= MAX_CHALLENGE_USERS)

				fatal("%s line %d: too many challenge users.",

					filename, linenum);

			options->challenge_users[options->max_challenge_users++] =

				xstrdup(arg);

		}

		break;

        case sChallengeSMTPServer:

                while ((arg = strdelim(&cp)) && *arg != '\0') {

                        if (options->challengesmtpserver >= 1)

                                fatal("%s line %d: too many challenge smtp servers.",

                                        filename, linenum);

                        options->challengesmtpserver =

                                xstrdup(arg);

                }

                break;

#define MAX_CHALLENGE_USERS    256     /* Max # of groups for Match. */

	int     obc_authentication;     /* Permit out-of-band challenge if true */

	int     max_challenge_users;

	char    *challenge_users[MAX_CHALLENGE_USERS];

	char    *challengesmtpserver;

# Configure the smtp server for sending out-of-band (obc) challenges 

#ChallengeSMTPServer host.some.domain

# Configure user to receive out-of-band (obc) challenges

#ChallengeUsers alias:user@some.domain

.It Cm ChallengeSMTPServer

Specifies the SMTP server to send OBC challenges through. Use the format:

ChallengeSMTPServer     name/IP address

You can specify the domain name or IP address; specify an IP address when

using privilege separation. You can also specify localhost if your computer

is configured to configured to send mail.

.It Cm ChallengeUsers

Specifies the user(s) and their e-mail addresses who can receive out-of-band

challenges (OBC). OBC provides server-side authentication by generating and

e-mailing a random password. The user is authenticated by correctly entering

the challenge when prompted.

Use the format:

ChallengeUsers  alias:user@someaddr

ChallengeResponseAuthentication must be set for ChallengeUsers to work.

How to authenticate using an Out-of-Band Challenge (OBC)

Overview:

The out-of-band challenge (OBC) patch adds a new kbdint device that provides a challenge-based authentication mechanism. The server generates and emails you a random string when you attempt to login. You're authenticated if you can correctly answer the challenge.

You can use a regular email account, a pager, cell phone or other email capable device to receive the challenge. However, by using a physical device you can completely separate your authentication credential from your workstation.

OBC can be used in conjunction with the "Multiauth" patch (https://bugzilla.mindrot.org/show_bug.cgi?id=1435), which allows you to require two or more authentications for a successful login. By combining OBC with Multiauth, you can create two physically separate authentication factors equivalent to a commercial token. For instance, combine public key and OBC authentications.

Configuration:

The user's OBC email address is stored in the sshd_config file using the format username:emailaddr@somedomain. For instance, if your user name and email address are paul and paul@swcp.com, add the following line to sshd_config:

ChallengeUsers paul:paul@swcp.com

If your alias is paul and email address is pgsery@swcp.com, then add the line:

ChallengeUsers paul:pgsery@swcp.com

You must also specify the outgoing SMTP email server to use. If your SMTP server is mail.swcp.com and you're not using privilege separation, add the line:

ChallengeSMTPServer	mail.swcp.com

OBC currently doesn't perform DNS name resolution with privilege separation. When using privilege separation, you must specify your SMTP server's IP address:

ChallengeSMTPServer	216.184.2.128

Compilation:

Install and compile the OBC patch:

authconf

./configure --with-obc

make install