Attachment #1826 for bug #1316

View | Details | Raw Unified | Return to bug 1316
Collapse All | Expand All

Lines 91-97 Link Here

(-)gMakefile.in (-1 / +1 lines)
91	auth2-gss.o gss-serv.o gss-serv-krb5.o \	91	auth2-gss.o gss-serv.o gss-serv-krb5.o \
92	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \	92	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
93	audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o \	93	audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o \
94	roaming_common.o roaming_serv.o	94	roaming_common.o roaming_serv.o ldapauth.o
95		95
96	MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out	96	MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
97	MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5	97	MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5




OpenSSH LDAP PUBLIC KEY PATCH 
Copyright (c) 2003 Eric AUGE (eau@phear.org)
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.
3. The name of the author may not be used to endorse or promote products
   derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

purposes of this patch:

This patch would help to have authentication centralization policy
using ssh public key authentication.
This patch could be an alternative to other "secure" authentication system
working in a similar way (Kerberos, SecurID, etc...), except the fact 
that it's based on OpenSSH and its public key abilities.

>> FYI: <<
'uid': means unix accounts existing on the current server
'lpkServerGroup:' mean server group configured on the current server ('lpkServerGroup' in sshd_config)

example schema:


                                  server1 (uid: eau,rival,toto) (lpkServerGroup: unix)
                ___________      /
               /           \ --- - server3 (uid: eau, titi) (lpkServerGroup: unix)
              | LDAP Server |    \
	      | eau  ,rival |     server2 (uid: rival, eau) (lpkServerGroup: unix)
	      | titi ,toto  |
	      | userx,....  |         server5 (uid: eau)  (lpkServerGroup: mail)
               \___________/ \       /
	                       ----- - server4 (uid: eau, rival)  (no group configured)
			             \
				        etc...

- WHAT WE NEED :

  * configured LDAP server somewhere on the network (i.e. OpenLDAP)
  * patched sshd (with this patch ;)
  * LDAP user(/group) entry (look at users.ldif (& groups.ldif)):
        User entry:
	- attached to the 'ldapPublicKey' objectclass
	- attached to the 'posixAccount' objectclass
	- with a filled 'sshPublicKey' attribute 
	Example:
		dn: uid=eau,ou=users,dc=cuckoos,dc=net
		objectclass: top
		objectclass: person
		objectclass: organizationalPerson
		objectclass: posixAccount
		objectclass: ldapPublicKey
		description: Eric AUGE Account
		userPassword: blah
		cn: Eric AUGE
		sn: Eric AUGE
		uid: eau
		uidNumber: 1034
		gidNumber: 1
		homeDirectory: /export/home/eau
		sshPublicKey: ssh-dss AAAAB3...
		sshPublicKey: ssh-dss AAAAM5...

	Group entry:
	- attached to the 'posixGroup' objectclass
	- with a 'cn' groupname attribute
	- with multiple 'memberUid' attributes filled with usernames allowed in this group
	Example:
		# few members
		dn: cn=unix,ou=groups,dc=cuckoos,dc=net
		objectclass: top
		objectclass: posixGroup
		description: Unix based servers group
		cn: unix
		gidNumber: 1002
		memberUid: eau
		memberUid: user1
		memberUid: user2


- HOW IT WORKS :

  * without patch
  If a user wants to authenticate to log in a server the sshd, will first look for authentication method allowed (RSAauth,kerberos,etc..)
  and if RSAauth and tickets based auth fails, it will fallback to standard password authentication (if enabled).

  * with the patch
  If a user want to authenticate to log in a server, the sshd will first look for auth method including LDAP pubkey, if the ldappubkey options is enabled.
  It will do an ldapsearch to get the public key directly from the LDAP instead of reading it from the server filesystem. 
  (usually in $HOME/.ssh/authorized_keys)

  If groups are enabled, it will also check if the user that wants to login is in the group of the server he is trying to log into.
  If it fails, it falls back on RSA auth files ($HOME/.ssh/authorized_keys), etc.. and finally to standard password authentication (if enabled).

  7 tokens are added to sshd_config :
  # here is the new patched ldap related tokens
  # entries in your LDAP must be posixAccount & strongAuthenticationUser & posixGroup
  UseLPK yes								# look the pub key into LDAP
  LpkServers ldap://10.31.32.5/ ldap://10.31.32.4 ldap://10.31.32.3	# which LDAP server for users ? (URL format)
  LpkUserDN  ou=users,dc=foobar,dc=net					# which base DN for users ?
  LpkGroupDN ou=groups,dc=foobar,dc=net					# which base DN for groups ? 
  LpkBindDN cn=manager,dc=foobar,dc=net					# which bind DN ?
  LpkBindPw asecret							# bind DN credidentials
  LpkServerGroup agroupname						# the group the server is part of

  Right now i'm using anonymous binding to get public keys, because getting public keys of someone doesn't impersonate him¸ but there is some
  flaws you have to take care of.

- HOW TO INSERT A USER/KEY INTO AN LDAP ENTRY

  * my way (there is plenty :)
  - create ldif file (i.e. users.ldif)
  - cat ~/.ssh/id_dsa.pub OR cat ~/.ssh/id_rsa.pub OR cat ~/.ssh/identity.pub
  - my way in 4 steps :
  Example:

  # you add this to the user entry in the LDIF file :
  [...]
  objectclass: posixAccount
  objectclass: ldapPublicKey
  [...]
  sshPubliKey: ssh-dss AAAABDh12DDUR2...
  [...]

  # insert your entry and you're done :)
  ldapadd -D balblabla -w bleh < file.ldif 
  
  all standard options can be present in the 'sshPublicKey' attribute.

- WHY :

  Simply because, i was looking for a way to centralize all sysadmins authentication, easily,  without completely using LDAP 
  as authentication method (like pam_ldap etc..).  
  
  After looking into Kerberos, SecurID, and other centralized secure authentications systems, the use of RSA and LDAP to get 
  public key for authentication allows us to control who has access to which server (the user needs an account and to be in 'strongAuthenticationUser'
  objectclass within LDAP and part of the group the SSH server is in). 

  Passwords update are no longer a nightmare for a server farm (key pair passphrase is stored on each user's box and private key is locally encrypted using his passphrase 
  so each user can change it as much as he wants). 

  Blocking a user account can be done directly from the LDAP (if sshd is using RSAAuth + ldap only).

- RULES :  
  Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema. 
  and the additionnal lpk.schema.

  This patch could allow a smooth transition between standard auth (/etc/passwd) and complete LDAP based authentication 
  (pamldap, nss_ldap, etc..).

  This can be an alternative to other (old?/expensive?) authentication methods (Kerberos/SecurID/..).
  
  Referring to schema at the beginning of this file if user 'eau' is only in group 'unix'
  'eau' would ONLY access 'server1', 'server2', 'server3' AND 'server4' BUT NOT 'server5'.
  If you then modify the LDAP 'mail' group entry to add 'memberUid: eau' THEN user 'eau' would be able
  to log in 'server5' (i hope you got the idea, my english is bad :).

  Each server's sshd is patched and configured to ask the public key and the group infos in the LDAP
  server.
  When you want to allow a new user to have access to the server parc, you just add him an account on 
  your servers, you add his public key into his entry on the LDAP server, it's done. 

  Because sshds are looking public keys into the LDAP directly instead of a file ($HOME/.ssh/authorized_keys).

  When the user needs to change his passphrase he can do it directly from his workstation by changing 
  his own key set lock passphrase, and all servers are automatically aware.
 
  With a CAREFUL LDAP server configuration you could allow a user to add/delete/modify his own entry himself
  so he can add/modify/delete himself his public key when needed.

­ FLAWS :
  LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP 
  allow write to users dn, somebody could replace someuser's public key by its own and impersonate some 
  of your users in all your server farm be VERY CAREFUL.
  
  MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login 
  as the impersonnated user.

  If LDAP server is down then, fallback on passwd auth.
  
  the ldap code part has not been well audited yet.

- LDAP USER ENTRY EXAMPLES (LDIF Format, look in users.ldif)
    --- CUT HERE ---
    dn: uid=jdoe,ou=users,dc=foobar,dc=net
    objectclass: top
    objectclass: person
    objectclass: organizationalPerson
    objectclass: posixAccount
    objectclass: ldapPublicKey
    description: My account
    cn: John Doe
    sn: John Doe
    uid: jdoe
    uidNumber: 100
    gidNumber: 100
    homeDirectory: /home/jdoe
    sshPublicKey: ssh-dss AAAAB3NzaC1kc3MAAAEBAOvL8pREUg9wSy/8+hQJ54YF3AXkB0OZrXB....
    [...]
    --- CUT HERE ---

- LDAP GROUP ENTRY EXAMPLES (LDIF Format, look in groups.ldif)
    --- CUT HERE ---
    dn: cn=unix,ou=groups,dc=cuckoos,dc=net
    objectclass: top
    objectclass: posixGroup
    description: Unix based servers group
    cn: unix
    gidNumber: 1002
    memberUid: jdoe
    memberUid: user1
    memberUid: user2
    [...]
    --- CUT HERE ---

>> FYI: << 
Multiple 'sshPublicKey' in a user entry are allowed, as well as multiple 'memberUid' attributes in a group entry

- COMPILING:
  1. Apply the patch
  2. ./configure --with-your-options --with-ldap=/prefix/to/ldap_libs_and_includes
  3. make
  4. it's done.

- BLA :
  I hope this could help, and i hope to be clear enough,, or give ideas.  questions/comments/improvements are welcome.
  
- TODO :
  Redesign differently.

- DOCS/LINK :
  http://pacsec.jp/core05/psj05-barisani-en.pdf
  http://fritz.potsdam.edu/projects/openssh-lpk/
  http://fritz.potsdam.edu/projects/sshgate/
  http://dev.inversepath.com/trac/openssh-lpk
  http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )

- CONTRIBUTORS/IDEAS/GREETS :
  - Falk Siemonsmeier.
  - Jacob Rief.
  - Michael Durchgraf.
  - frederic peters.
  - Finlay dobbie.
  - Stefan Fisher.
  - Robin H. Johnson.
  - Adrian Bridgett.

- CONTACT :
  - Eric AUGE <eau@phear.org>
  - Andrea Barisani <andrea@inversepath.com>




	FILE *f;
	u_long linenum = 0;
	Key *key;
#ifdef WITH_LDAP_PUBKEY
	ldap_key_t * k;
	unsigned int i = 0;
#endif

	/* Temporarily use the user's uid. */
	temporarily_use_uid(pw);

#ifdef WITH_LDAP_PUBKEY
	/* here is the job */
	key = key_new(KEY_RSA1);

	if (options.lpk.on) {
	    debug("[LDAP] trying LDAP first uid=%s", pw->pw_name);
	    if ( ldap_ismember(&options.lpk, pw->pw_name) > 0) {
		if ( (k = ldap_getuserkey(&options.lpk, pw->pw_name)) != NULL) {
		    for (i = 0 ; i < k->num ; i++) {
			char *cp, *options = NULL;

			for (cp = k->keys[i]->bv_val; *cp == ' ' || *cp == '\t'; cp++)
			    ;
			if (!*cp || *cp == '\n' || *cp == '#')
			    continue;

			/*
			* Check if there are options for this key, and if so,
			* save their starting address and skip the option part
			* for now.  If there are no options, set the starting
			* address to NULL.
			 */
			if (*cp < '0' || *cp > '9') {
			    int quoted = 0;
			    options = cp;
			    for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
				if (*cp == '\\' && cp[1] == '"')
				    cp++;	/* Skip both */
				else if (*cp == '"')
				    quoted = !quoted;
			    }
			} else
			    options = NULL;

			/* Parse the key from the line. */
			if (hostfile_read_key(&cp, &bits, key) == 0) {
			    debug("[LDAP] line %d: non ssh1 key syntax", i);
			    continue;
			}
			/* cp now points to the comment part. */

			/* Check if the we have found the desired key (identified by its modulus). */
			if (BN_cmp(key->rsa->n, client_n) != 0)
			    continue;

			/* check the real bits  */
			if (bits != (unsigned int)BN_num_bits(key->rsa->n))
			    logit("[LDAP] Warning: ldap, line %lu: keysize mismatch: "
				    "actual %d vs. announced %d.", (unsigned long)i, BN_num_bits(key->rsa->n), bits);

			/* We have found the desired key. */
			/*
			* If our options do not allow this key to be used,
			* do not send challenge.
			 */
			if (!auth_parse_options(pw, options, "[LDAP]", (unsigned long) i))
			    continue;

			/* break out, this key is allowed */
			allowed = 1;

			/* add the return stuff etc... */
			/* Restore the privileged uid. */
			restore_uid();

			/* return key if allowed */
			if (allowed && rkey != NULL)
			    *rkey = key;
			else
			    key_free(key);

			ldap_keys_free(k);
			return (allowed);
		    }
		} else {
		    logit("[LDAP] no keys found for '%s'!", pw->pw_name);
		}
	    } else {
		logit("[LDAP] '%s' is not in '%s'", pw->pw_name, options.lpk.sgroup);
	    }
	}
#endif
	/* The authorized keys. */
	file = authorized_keys_file(pw);
	debug("trying public RSA key file %s", file);

Lines 58-63 Link Here

(-)gauth2-pubkey.c (+73 lines)
58	#include "misc.h"	58	#include "misc.h"
59	#include "authfile.h"	59	#include "authfile.h"
60		60
		61	#ifdef WITH_LDAP_PUBKEY
		62	#include "ldapauth.h"
		63	#endif
		64
61	/* import */	65	/* import */
62	extern ServerOptions options;	66	extern ServerOptions options;
63	extern u_char *session_id2;	67	extern u_char *session_id2;
Lines 187-196 Link Here
187	u_long linenum = 0;	191	u_long linenum = 0;
188	Key *found;	192	Key *found;
189	char *fp;	193	char *fp;
		194	#ifdef WITH_LDAP_PUBKEY
		195	ldap_key_t * k;
		196	unsigned int i = 0;
		197	#endif
190		198
191	/* Temporarily use the user's uid. */	199	/* Temporarily use the user's uid. */
192	temporarily_use_uid(pw);	200	temporarily_use_uid(pw);
193		201
		202	#ifdef WITH_LDAP_PUBKEY
		203	found_key = 0;
		204	/* allocate a new key type */
		205	found = key_new(key->type);
		206
		207	/* first check if the options is enabled, then try.. */
		208	if (options.lpk.on) {
		209	debug("[LDAP] trying LDAP first uid=%s",pw->pw_name);
		210	if (ldap_ismember(&options.lpk, pw->pw_name) > 0) {
		211	if ((k = ldap_getuserkey(&options.lpk, pw->pw_name)) != NULL) {
		212	/* Skip leading whitespace, empty and comment lines. */
		213	for (i = 0 ; i < k->num ; i++) {
		214	/* dont forget if multiple keys to reset options */
		215	char cp, options = NULL;
		216
		217	for (cp = (char )k->keys[i]->bv_val; cp == ' ' \|\| *cp == '\t'; cp++)
		218	;
		219	if (!cp \|\| cp == '\n' \|\| *cp == '#')
		220	continue;
		221
		222	if (key_read(found, &cp) != 1) {
		223	/* no key? check if there are options for this key */
		224	int quoted = 0;
		225	debug2("[LDAP] user_key_allowed: check options: '%s'", cp);
		226	options = cp;
		227	for (; cp && (quoted \|\| (cp != ' ' && *cp != '\t')); cp++) {
		228	if (*cp == '\\' && cp[1] == '"')
		229	cp++; /* Skip both */
		230	else if (*cp == '"')
		231	quoted = !quoted;
		232	}
		233	/* Skip remaining whitespace. */
		234	for (; cp == ' ' \|\| cp == '\t'; cp++)
		235	;
		236	if (key_read(found, &cp) != 1) {
		237	debug2("[LDAP] user_key_allowed: advance: '%s'", cp);
		238	/* still no key? advance to next line*/
		239	continue;
		240	}
		241	}
		242
		243	if (key_equal(found, key) &&
		244	auth_parse_options(pw, options, file, linenum) == 1) {
		245	found_key = 1;
		246	debug("[LDAP] matching key found");
		247	fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
		248	verbose("[LDAP] Found matching %s key: %s", key_type(found), fp);
		249
		250	/* restoring memory */
		251	ldap_keys_free(k);
		252	xfree(fp);
		253	restore_uid();
		254	key_free(found);
		255	return found_key;
		256	break;
		257	}
		258	}/* end of LDAP for() */
		259	} else {
		260	logit("[LDAP] no keys found for '%s'!", pw->pw_name);
		261	}
		262	} else {
		263	logit("[LDAP] '%s' is not in '%s'", pw->pw_name, options.lpk.sgroup);
		264	}
		265	}
266	#endif
194	debug("trying public key file %s", file);	267	debug("trying public key file %s", file);
195	f = auth_openkeyfile(file, pw, options.strict_modes);	268	f = auth_openkeyfile(file, pw, options.strict_modes);
196		269

Lines 575-580 Link Here

(-)gconfig.h.in (+3 lines)
575	/* Define to 1 if you have the <linux/if_tun.h> header file. */	575	/* Define to 1 if you have the <linux/if_tun.h> header file. */
576	#undef HAVE_LINUX_IF_TUN_H	576	#undef HAVE_LINUX_IF_TUN_H
577		577
		578	/* Define if you want LDAP support */
		579	#undef WITH_LDAP_PUBKEY
		580
578	/* Define if your libraries define login() */	581	/* Define if your libraries define login() */
579	#undef HAVE_LOGIN	582	#undef HAVE_LOGIN
580		583




  --with-tcp-wrappers[=PATH] Enable tcpwrappers support (optionally in PATH)
  --with-libedit[=PATH]   Enable libedit support for sftp
  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)
  --with-ldap[=PATH]      Enable LDAP pubkey support (optionally in PATH)
  --with-ssl-dir=PATH     Specify path to OpenSSL installation
  --without-openssl-header-check Disable OpenSSL version consistency check
  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support

fi


# Check whether user wants LDAP support
LDAP_MSG="no"

# Check whether --with-ldap was given.
if test "${with_ldap+set}" = set; then
  withval=$with_ldap;
		if test "x$withval" != "xno" ; then

			if test "x$withval" != "xyes" ; then
				CPPFLAGS="$CPPFLAGS -I${withval}/include"
				LDFLAGS="$LDFLAGS -L${withval}/lib"
			fi


cat >>confdefs.h <<\_ACEOF
#define WITH_LDAP_PUBKEY 1
_ACEOF

			LIBS="-lldap $LIBS"
			LDAP_MSG="yes"

			{ echo "$as_me:$LINENO: checking for LDAP support" >&5
echo $ECHO_N "checking for LDAP support... $ECHO_C" >&6; }
			cat >conftest.$ac_ext <<_ACEOF
/* confdefs.h.  */
_ACEOF
cat confdefs.h >>conftest.$ac_ext
cat >>conftest.$ac_ext <<_ACEOF
/* end confdefs.h.  */
#include <sys/types.h>
				 #include <ldap.h>
int
main ()
{
(void)ldap_init(0, 0);
  ;
  return 0;
}
_ACEOF
rm -f conftest.$ac_objext
if { (ac_try="$ac_compile"
case "(($ac_try" in
  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
  *) ac_try_echo=$ac_try;;
esac
eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
  (eval "$ac_compile") 2>conftest.er1
  ac_status=$?
  grep -v '^ *+' conftest.er1 >conftest.err
  rm -f conftest.er1
  cat conftest.err >&5
  echo "$as_me:$LINENO: \$? = $ac_status" >&5
  (exit $ac_status); } && {
	 test -z "$ac_c_werror_flag" ||
	 test ! -s conftest.err
       } && test -s conftest.$ac_objext; then
  { echo "$as_me:$LINENO: result: yes" >&5
echo "${ECHO_T}yes" >&6; }
else
  echo "$as_me: failed program was:" >&5
sed 's/^/| /' conftest.$ac_ext >&5


				    { echo "$as_me:$LINENO: result: no" >&5
echo "${ECHO_T}no" >&6; }
					{ { echo "$as_me:$LINENO: error: ** Incomplete or missing ldap libraries **" >&5
echo "$as_me: error: ** Incomplete or missing ldap libraries **" >&2;}
   { (exit 1); exit 1; }; }


fi

rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
		fi


fi






echo "                 Smartcard support: $SCARD_MSG"
echo "                     S/KEY support: $SKEY_MSG"
echo "              TCP Wrappers support: $TCPW_MSG"
echo "                      LDAP support: $LDAP_MSG"
echo "              MD5 password support: $MD5_MSG"
echo "                   libedit support: $LIBEDIT_MSG"
echo "  Solaris process contract support: $SPC_MSG"




	esac ]
)

# Check whether user wants LDAP support
LDAP_MSG="no"
AC_ARG_WITH(ldap,
	[  --with-ldap[[=PATH]]      Enable LDAP pubkey support (optionally in PATH)],
	[
		if test "x$withval" != "xno" ; then

			if test "x$withval" != "xyes" ; then
				CPPFLAGS="$CPPFLAGS -I${withval}/include"
				LDFLAGS="$LDFLAGS -L${withval}/lib"
			fi

			AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])
			LIBS="-lldap $LIBS"
			LDAP_MSG="yes"
	
			AC_MSG_CHECKING([for LDAP support])
			AC_TRY_COMPILE(
				[#include <sys/types.h>
				 #include <ldap.h>],
				[(void)ldap_init(0, 0);],
				[AC_MSG_RESULT(yes)],
				[
				    AC_MSG_RESULT(no) 
					AC_MSG_ERROR([** Incomplete or missing ldap libraries **])
				]
        	)
		fi
	]
)

dnl    Checks for library functions. Please keep in alphabetical order
AC_CHECK_FUNCS( \
	arc4random \

echo "                 Smartcard support: $SCARD_MSG"
echo "                     S/KEY support: $SKEY_MSG"
echo "              TCP Wrappers support: $TCPW_MSG"
echo "                      LDAP support: $LDAP_MSG"
echo "              MD5 password support: $MD5_MSG"
echo "                   libedit support: $LIBEDIT_MSG"
echo "  Solaris process contract support: $SPC_MSG"




/* 
 * $Id: openssh-lpk-4.3p1-0.3.7.patch,v 1.3 2006/04/18 15:29:09 eau Exp $
 */

/*
 *
 * Copyright (c) 2005, Eric AUGE <eau@phear.org>
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
 *
 * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
 * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
 * Neither the name of the phear.org nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, 
 * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 
 * IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, 
 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 *
 */

#include "includes.h"

#ifdef WITH_LDAP_PUBKEY

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

#include "ldapauth.h"
#include "log.h"

static char *attrs[] = {
    PUBKEYATTR,
    NULL
};

/* filter building infos */
#define FILTER_GROUP_PREFIX "(&(objectclass=posixGroup)"
#define FILTER_OR_PREFIX "(|"
#define FILTER_OR_SUFFIX ")"
#define FILTER_CN_PREFIX "(cn="
#define FILTER_CN_SUFFIX ")"
#define FILTER_UID_FORMAT "(memberUid=%s)"
#define FILTER_GROUP_SUFFIX ")"
#define FILTER_GROUP_SIZE(group) (size_t) (strlen(group)+(ldap_count_group(group)*5)+52)

/* just filter building stuff */
#define REQUEST_GROUP_SIZE(filter, uid) (size_t) (strlen(filter)+strlen(uid)+1)
#define REQUEST_GROUP(buffer, prefilter, pwname) \
    buffer = (char *) calloc(REQUEST_GROUP_SIZE(prefilter, pwname), sizeof(char)); \
    if (!buffer) { \
        perror("calloc()"); \
        return FAILURE; \
    } \
    snprintf(buffer, REQUEST_GROUP_SIZE(prefilter,pwname), prefilter, pwname)
/*
XXX OLD group building macros
#define REQUEST_GROUP_SIZE(grp, uid) (size_t) (strlen(grp)+strlen(uid)+46)
#define REQUEST_GROUP(buffer,pwname,grp) \
    buffer = (char *) calloc(REQUEST_GROUP_SIZE(grp, pwname), sizeof(char)); \
    if (!buffer) { \
        perror("calloc()"); \
        return FAILURE; \
    } \
    snprintf(buffer,REQUEST_GROUP_SIZE(grp,pwname),"(&(objectclass=posixGroup)(cn=%s)(memberUid=%s))",grp,pwname)
    */

/*
XXX stock upstream version without extra filter support
#define REQUEST_USER_SIZE(uid) (size_t) (strlen(uid)+64)
#define REQUEST_USER(buffer, pwname) \
    buffer = (char *) calloc(REQUEST_USER_SIZE(pwname), sizeof(char)); \
    if (!buffer) { \
        perror("calloc()"); \
        return NULL; \
    } \
    snprintf(buffer,REQUEST_USER_SIZE(pwname),"(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s))",pwname)
   */

#define REQUEST_USER_SIZE(uid, filter) (size_t) (strlen(uid)+64+(filter != NULL ? strlen(filter) : 0))
#define REQUEST_USER(buffer, pwname, customfilter) \
    buffer = (char *) calloc(REQUEST_USER_SIZE(pwname, customfilter), sizeof(char)); \
    if (!buffer) { \
        perror("calloc()"); \
        return NULL; \
    } \
    snprintf(buffer, REQUEST_USER_SIZE(pwname, customfilter), \
    	"(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)", \
	pwname, (customfilter != NULL ? customfilter : ""))

/* some portable and working tokenizer, lame though */
static int tokenize(char ** o, size_t size, char * input) {
    unsigned int i = 0, num;
    const char * charset = " \t";
    char * ptr = input;

    /* leading white spaces are ignored */
    num = strspn(ptr, charset);
    ptr += num;

    while ((num = strcspn(ptr, charset))) {
        if (i < size-1) {
            o[i++] = ptr;
            ptr += num;
            if (*ptr)
                *ptr++ = '\0';
        }
    }
    o[i] = NULL;
    return SUCCESS;
}

void ldap_close(ldap_opt_t * ldap) {

    if (!ldap)
        return;

    if ( ldap_unbind_ext(ldap->ld, NULL, NULL) < 0)
	ldap_perror(ldap->ld, "ldap_unbind()");

    ldap->ld = NULL;
    FLAG_SET_DISCONNECTED(ldap->flags);

    return;
}

/* init && bind */
int ldap_connect(ldap_opt_t * ldap) {
    int version = LDAP_VERSION3;

    if (!ldap->servers)
        return FAILURE;

    /* Connection Init and setup */
    ldap->ld = ldap_init(ldap->servers, LDAP_PORT);
    if (!ldap->ld) {
        ldap_perror(ldap->ld, "ldap_init()");
        return FAILURE;
    }

    if ( ldap_set_option(ldap->ld, LDAP_OPT_PROTOCOL_VERSION, &version) != LDAP_OPT_SUCCESS) {
        ldap_perror(ldap->ld, "ldap_set_option(LDAP_OPT_PROTOCOL_VERSION)");
        return FAILURE;
    }

    /* Timeouts setup */
    if (ldap_set_option(ldap->ld, LDAP_OPT_NETWORK_TIMEOUT, &ldap->b_timeout) != LDAP_SUCCESS) {
        ldap_perror(ldap->ld, "ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT)");
    }
    if (ldap_set_option(ldap->ld, LDAP_OPT_TIMEOUT, &ldap->s_timeout) != LDAP_SUCCESS) {
        ldap_perror(ldap->ld, "ldap_set_option(LDAP_OPT_TIMEOUT)");
    }

    /* TLS support */
    if ( (ldap->tls == -1) || (ldap->tls == 1) ) {
        if (ldap_start_tls_s(ldap->ld, NULL, NULL ) != LDAP_SUCCESS) {
            /* failed then reinit the initial connect */
            ldap_perror(ldap->ld, "ldap_connect: (TLS) ldap_start_tls()");
            if (ldap->tls == 1)
                return FAILURE;

            ldap->ld = ldap_init(ldap->servers, LDAP_PORT);
            if (!ldap->ld) { 
                ldap_perror(ldap->ld, "ldap_init()");
                return FAILURE;
            }

            if ( ldap_set_option(ldap->ld, LDAP_OPT_PROTOCOL_VERSION, &version) != LDAP_OPT_SUCCESS) {
                 ldap_perror(ldap->ld, "ldap_set_option()");
                 return FAILURE;
            }
        }
    }


    if ( ldap_simple_bind_s(ldap->ld, ldap->binddn, ldap->bindpw) != LDAP_SUCCESS) {
        ldap_perror(ldap->ld, "ldap_simple_bind_s()");
        return FAILURE;
    }

    /* says it is connected */
    FLAG_SET_CONNECTED(ldap->flags);

    return SUCCESS;
}

/* must free allocated ressource */
static char * ldap_build_host(char *host, int port) {
    unsigned int size = strlen(host)+11;
    char * h = (char *) calloc (size, sizeof(char));
    int rc;
    if (!h)
         return NULL;

    rc = snprintf(h, size, "%s:%d ", host, port);
    if (rc == -1)
        return NULL;
    return h;
}

static int ldap_count_group(const char * input) {
    const char * charset = " \t";
    const char * ptr = input;
    unsigned int count = 0;
    unsigned int num;

    num = strspn(ptr, charset);
    ptr += num;

    while ((num = strcspn(ptr, charset))) {
    count++;
    ptr += num;
    ptr++;
    }

    return count;
}

/* format filter */
char * ldap_parse_groups(const char * groups) {
    unsigned int buffer_size = FILTER_GROUP_SIZE(groups);
    char * buffer = (char *) calloc(buffer_size, sizeof(char));
    char * g = NULL;
    char * garray[32];
    unsigned int i = 0;

    if ((!groups)||(!buffer))
        return NULL;

    g = strdup(groups);
    if (!g) {
        free(buffer);
        return NULL;
    }

    /* first separate into n tokens */
    if ( tokenize(garray, sizeof(garray)/sizeof(*garray), g) < 0) {
        free(g);
        free(buffer);
        return NULL;
    }

    /* build the final filter format */
    strlcat(buffer, FILTER_GROUP_PREFIX, buffer_size);
    strlcat(buffer, FILTER_OR_PREFIX, buffer_size);
    i = 0;
    while (garray[i]) {
        strlcat(buffer, FILTER_CN_PREFIX, buffer_size);
        strlcat(buffer, garray[i], buffer_size);
        strlcat(buffer, FILTER_CN_SUFFIX, buffer_size);
        i++;
    }
    strlcat(buffer, FILTER_OR_SUFFIX, buffer_size);
    strlcat(buffer, FILTER_UID_FORMAT, buffer_size);
    strlcat(buffer, FILTER_GROUP_SUFFIX, buffer_size);

    free(g);
    return buffer;
}

/* a bit dirty but leak free  */
char * ldap_parse_servers(const char * servers) {
    char * s = NULL;
    char * tmp = NULL, *urls[32];
    unsigned int num = 0 , i = 0 , asize = 0;
    LDAPURLDesc *urld[32];

    if (!servers)
        return NULL;

    /* local copy of the arg */
    s = strdup(servers);
    if (!s)
        return NULL;

    /* first separate into URL tokens */
    if ( tokenize(urls, sizeof(urls)/sizeof(*urls), s) < 0)
        return NULL;

    i = 0;
    while (urls[i]) {
        if (! ldap_is_ldap_url(urls[i]) ||
           (ldap_url_parse(urls[i], &urld[i]) != 0)) {
                return NULL;
        }
        i++;
    }

    /* now free(s) */
    free (s);

    /* how much memory do we need */
    num = i;
    for (i = 0 ; i < num ; i++)
        asize += strlen(urld[i]->lud_host)+11;

    /* alloc */
    s = (char *) calloc( asize+1 , sizeof(char));
    if (!s) {
        for (i = 0 ; i < num ; i++)
            ldap_free_urldesc(urld[i]);
        return NULL;
    }

    /* then build the final host string */
    for (i = 0 ; i < num ; i++) {
        /* built host part */
        tmp = ldap_build_host(urld[i]->lud_host, urld[i]->lud_port);
        strncat(s, tmp, strlen(tmp));
        ldap_free_urldesc(urld[i]);
        free(tmp);
    }

    return s;
}

void ldap_options_print(ldap_opt_t * ldap) {
    debug("ldap options:");
    debug("servers: %s", ldap->servers);
    if (ldap->u_basedn)
        debug("user basedn: %s", ldap->u_basedn);
    if (ldap->g_basedn)
        debug("group basedn: %s", ldap->g_basedn);
    if (ldap->binddn)
        debug("binddn: %s", ldap->binddn);
    if (ldap->bindpw)
        debug("bindpw: %s", ldap->bindpw);
    if (ldap->sgroup)
        debug("group: %s", ldap->sgroup);
    if (ldap->filter)
        debug("filter: %s", ldap->filter);
}

void ldap_options_free(ldap_opt_t * l) {
    if (!l)
        return;
    if (l->servers)
        free(l->servers);
    if (l->u_basedn)
        free(l->u_basedn);
    if (l->g_basedn)
        free(l->g_basedn);
    if (l->binddn)
        free(l->binddn);
    if (l->bindpw)
        free(l->bindpw);
    if (l->sgroup)
        free(l->sgroup);
    if (l->fgroup)
        free(l->fgroup);
    if (l->filter)
        free(l->filter);
    if (l->l_conf)
        free(l->l_conf);
    free(l);
}

/* free keys */
void ldap_keys_free(ldap_key_t * k) {
    ldap_value_free_len(k->keys);
    free(k);
    return;
}

ldap_key_t * ldap_getuserkey(ldap_opt_t *l, const char * user) {
    ldap_key_t * k = (ldap_key_t *) calloc (1, sizeof(ldap_key_t));
    LDAPMessage *res, *e;
    char * filter;
    int i;

    if ((!k) || (!l))
         return NULL;

    /* Am i still connected ? RETRY n times */
    /* XXX TODO: setup some conf value for retrying */
    if (!(l->flags & FLAG_CONNECTED))
        for (i = 0 ; i < 2 ; i++)
            if (ldap_connect(l) == 0)
                break;

    /* quick check for attempts to be evil */
    if ((strchr(user, '(') != NULL) || (strchr(user, ')') != NULL) ||
        (strchr(user, '*') != NULL) || (strchr(user, '\\') != NULL))
        return NULL;

    /* build  filter for LDAP request */
    REQUEST_USER(filter, user, l->filter);

    if ( ldap_search_st( l->ld,
        l->u_basedn,
        LDAP_SCOPE_SUBTREE,
        filter,
        attrs, 0, &l->s_timeout, &res ) != LDAP_SUCCESS) {
        
        ldap_perror(l->ld, "ldap_search_st()");

        free(filter);
        free(k);

        /* XXX error on search, timeout etc.. close ask for reconnect */
        ldap_close(l);

        return NULL;
    } 

    /* free */
    free(filter);

    /* check if any results */
    i = ldap_count_entries(l->ld,res);
    if (i <= 0) {
        ldap_msgfree(res);
        free(k);
        return NULL;
    }

    if (i > 1)
        debug("[LDAP] duplicate entries, using the FIRST entry returned");

    e = ldap_first_entry(l->ld, res);
    k->keys = ldap_get_values_len(l->ld, e, PUBKEYATTR);
    k->num = ldap_count_values_len(k->keys);

    ldap_msgfree(res);
    return k;
}


/* -1 if trouble
   0 if user is NOT member of current server group
   1 if user IS MEMBER of current server group 
 */
int ldap_ismember(ldap_opt_t * l, const char * user) {
    LDAPMessage *res;
    char * filter;
    int i;

    if ((!l->sgroup) || !(l->g_basedn))
        return 1;

    /* Am i still connected ? RETRY n times */
    /* XXX TODO: setup some conf value for retrying */
    if (!(l->flags & FLAG_CONNECTED)) 
        for (i = 0 ; i < 2 ; i++)
            if (ldap_connect(l) == 0)
                 break;

    /* quick check for attempts to be evil */
    if ((strchr(user, '(') != NULL) || (strchr(user, ')') != NULL) ||
        (strchr(user, '*') != NULL) || (strchr(user, '\\') != NULL))
        return FAILURE;

    /* build filter for LDAP request */
    REQUEST_GROUP(filter, l->fgroup, user);

    if (ldap_search_st( l->ld, 
        l->g_basedn,
        LDAP_SCOPE_SUBTREE,
        filter,
        NULL, 0, &l->s_timeout, &res) != LDAP_SUCCESS) {
    
        ldap_perror(l->ld, "ldap_search_st()");

        free(filter);

        /* XXX error on search, timeout etc.. close ask for reconnect */
        ldap_close(l);

        return FAILURE;
    }

    free(filter);

    /* check if any results */
    if (ldap_count_entries(l->ld, res) > 0) {
        ldap_msgfree(res);
        return 1;
    }

    ldap_msgfree(res);
    return 0;
}

/*
 * ldap.conf simple parser
 * XXX TODO:  sanity checks
 * must either
 * - free the previous ldap_opt_before replacing entries
 * - free each necessary previously parsed elements
 * ret:
 * -1 on FAILURE, 0 on SUCCESS
 */
int ldap_parse_lconf(ldap_opt_t * l) {
    FILE * lcd; /* ldap.conf descriptor */
    char buf[BUFSIZ];
    char * s = NULL, * k = NULL, * v = NULL;
    int li, len;

    lcd = fopen (l->l_conf, "r");
    if (lcd == NULL) {
        /* debug("Cannot open %s", l->l_conf); */
        perror("ldap_parse_lconf()");
        return FAILURE;
    }
    
    while (fgets (buf, sizeof (buf), lcd) != NULL) {

        if (*buf == '\n' || *buf == '#')
            continue;

        k = buf;
        v = k;
        while (*v != '\0' && *v != ' ' && *v != '\t')
            v++;

        if (*v == '\0')
            continue;

        *(v++) = '\0';

        while (*v == ' ' || *v == '\t')
            v++;

        li = strlen (v) - 1;
        while (v[li] == ' ' || v[li] == '\t' || v[li] == '\n')
            --li;
        v[li + 1] = '\0';

        if (!strcasecmp (k, "uri")) {
            if ((l->servers = ldap_parse_servers(v)) == NULL) {
                fatal("error in ldap servers");
            return FAILURE;
            }

        }
        else if (!strcasecmp (k, "base")) { 
            s = strchr (v, '?');
            if (s != NULL) {
                len = s - v;
                l->u_basedn = malloc (len + 1);
                strncpy (l->u_basedn, v, len);
                l->u_basedn[len] = '\0';
            } else {
                l->u_basedn = strdup (v);
            }
        }
        else if (!strcasecmp (k, "binddn")) {
            l->binddn = strdup (v);
        }
        else if (!strcasecmp (k, "bindpw")) {
            l->bindpw = strdup (v);
        }
        else if (!strcasecmp (k, "timelimit")) {
            l->s_timeout.tv_sec = atoi (v);
                }
        else if (!strcasecmp (k, "bind_timelimit")) {
            l->b_timeout.tv_sec = atoi (v);
        }
        else if (!strcasecmp (k, "ssl")) {
            if (!strcasecmp (v, "start_tls"))
                l->tls = 1;
        }
    }

    fclose (lcd);
    return SUCCESS;
}

#endif /* WITH_LDAP_PUBKEY */




/*
 * $Id: openssh-lpk-4.3p1-0.3.7.patch,v 1.3 2006/04/18 15:29:09 eau Exp $ 
 */

/*
 *
 * Copyright (c) 2005, Eric AUGE <eau@phear.org>
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
 *
 * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
 * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
 * Neither the name of the phear.org nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, 
 * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 
 * IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, 
 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 *
 */

#ifndef LDAPAUTH_H
#define LDAPAUTH_H

#define LDAP_DEPRECATED 1

#include <string.h>
#include <time.h>
#include <ldap.h>
#include <lber.h>

/* tokens in use for config */
#define _DEFAULT_LPK_TOKEN "UseLPK"
#define _DEFAULT_SRV_TOKEN "LpkServers"
#define _DEFAULT_USR_TOKEN "LpkUserDN"
#define _DEFAULT_GRP_TOKEN "LpkGroupDN"
#define _DEFAULT_BDN_TOKEN "LpkBindDN"
#define _DEFAULT_BPW_TOKEN "LpkBindPw"
#define _DEFAULT_MYG_TOKEN "LpkServerGroup"
#define _DEFAULT_FIL_TOKEN "LpkFilter"
#define _DEFAULT_TLS_TOKEN "LpkForceTLS"
#define _DEFAULT_BTI_TOKEN "LpkBindTimelimit"
#define _DEFAULT_STI_TOKEN "LpkSearchTimelimit"
#define _DEFAULT_LDP_TOKEN "LpkLdapConf"

/* default options */
#define _DEFAULT_LPK_ON 0
#define _DEFAULT_LPK_SERVERS NULL
#define _DEFAULT_LPK_UDN NULL
#define _DEFAULT_LPK_GDN NULL
#define _DEFAULT_LPK_BINDDN NULL
#define _DEFAULT_LPK_BINDPW NULL
#define _DEFAULT_LPK_SGROUP NULL
#define _DEFAULT_LPK_FILTER NULL
#define _DEFAULT_LPK_TLS -1
#define _DEFAULT_LPK_BTIMEOUT 10
#define _DEFAULT_LPK_STIMEOUT 10
#define _DEFAULT_LPK_LDP NULL

/* flags */
#define FLAG_EMPTY	    0x00000000
#define FLAG_CONNECTED	    0x00000001

/* flag macros */
#define FLAG_SET_EMPTY(x)		x&=(FLAG_EMPTY)
#define FLAG_SET_CONNECTED(x)		x|=(FLAG_CONNECTED)
#define FLAG_SET_DISCONNECTED(x)	x&=~(FLAG_CONNECTED)

/* defines */
#define FAILURE -1
#define SUCCESS 0
#define PUBKEYATTR "sshPublicKey"

/* 
 *
 * defined files path 
 * (should be relocated to pathnames.h,
 * if one day it's included within the tree) 
 *
 */
#define _PATH_LDAP_CONFIG_FILE "/etc/ldap.conf"

/* structures */
typedef struct ldap_options {
    int on;			/* Use it or NOT */
    LDAP * ld;			/* LDAP file desc */
    char * servers;		/* parsed servers for ldaplib failover handling */
    char * u_basedn;		/* user basedn */
    char * g_basedn;		/* group basedn */
    char * binddn;		/* binddn */
    char * bindpw;		/* bind password */
    char * sgroup;		/* server group */
    char * fgroup;		/* group filter */
    char * filter;		/* additional filter */
    char * l_conf;		/* use ldap.conf */
    int tls;			/* TLS only */
    struct timeval b_timeout;   /* bind timeout */
    struct timeval s_timeout;   /* search timeout */
    unsigned int flags;		/* misc flags (reconnection, future use?) */
} ldap_opt_t;

typedef struct ldap_keys {
    struct berval ** keys;	/* the public keys retrieved */
    unsigned int num;		/* number of keys */
} ldap_key_t;


/* function headers */
void ldap_close(ldap_opt_t *);
int ldap_connect(ldap_opt_t *);
char * ldap_parse_groups(const char *);
char * ldap_parse_servers(const char *);
void ldap_options_print(ldap_opt_t *);
void ldap_options_free(ldap_opt_t *);
void ldap_keys_free(ldap_key_t *);
int ldap_parse_lconf(ldap_opt_t *);
ldap_key_t * ldap_getuserkey(ldap_opt_t *, const char *);
int ldap_ismember(ldap_opt_t *, const char *);

#endif





Post to ML -> User Made Quick Install Doc.
Contribution from John Lane <john@lane.uk.net>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

OpenSSH LDAP keystore Patch
===========================

NOTE: these notes are a transcript of a specific installation
      they work for me, your specifics may be different!
      from John Lane March 17th 2005         john@lane.uk.net

This is a patch to OpenSSH 4.0p1 to allow it to obtain users' public keys
from their LDAP record as an alternative to ~/.ssh/authorized_keys.

(Assuming here that necessary build stuff is in $BUILD)

cd $BUILD/openssh-4.0p1
patch -Np1 -i $BUILD/openssh-lpk-4.0p1-0.3.patch
mkdir -p /var/empty &&
./configure --prefix=/usr --sysconfdir=/etc/ssh \
    --libexecdir=/usr/sbin --with-md5-passwords --with-pam \
    --with-libs="-lldap" --with-cppflags="-DWITH_LDAP_PUBKEY"
Now do.
make &&
make install

Add the following config to /etc/ssh/ssh_config
UseLPK yes
LpkServers ldap://myhost.mydomain.com
LpkUserDN  ou=People,dc=mydomain,dc=com

We need to tell sshd about the SSL keys during boot, as root's
environment does not exist at that time. Edit /etc/rc.d/init.d/sshd.
Change the startup code from this:
                echo "Starting SSH Server..."
                loadproc /usr/sbin/sshd
                ;;
to this:
                echo "Starting SSH Server..."
                LDAPRC="/root/.ldaprc" loadproc /usr/sbin/sshd
                ;;

Re-start the sshd daemon:
/etc/rc.d/init.d/sshd restart

Install the additional LDAP schema
cp $BUILD/openssh-lpk-0.2.schema  /etc/openldap/schema/openssh.schema

Now add the openSSH LDAP schema to /etc/openldap/slapd.conf:
Add the following to the end of the existing block of schema includes
include         /etc/openldap/schema/openssh.schema

Re-start the LDAP server:
/etc/rc.d/init.d/slapd restart

To add one or more public keys to a user, eg "testuser" :
ldapsearch -x -W -Z -LLL -b "uid=testuser,ou=People,dc=mydomain,dc=com" -D
"uid=testuser,ou=People,dc=mydomain,dc=com" > /tmp/testuser

append the following to this /tmp/testuser file
objectclass: ldapPublicKey
sshPublicKey: ssh-rsa
AAAAB3NzaC1yc2EAAAABJQAAAIB3dsrwqXqD7E4zYYrxwdDKBUQxKMioXy9pxFVai64kAPxjU9KS
qIo7QfkjslfsjflksjfldfkjsldfjLX/5zkzRmT28I5piGzunPv17S89z8XwSsuAoR1t86t+5dlI
7eZE/gVbn2UQkQq7+kdDTS2yXV6VnC52N/kKLG3ciBkBAw== General Purpose RSA Key

Then do a modify:
ldapmodify -x -D "uid=testuser,ou=People,dc=mydomain,dc=com" -W -f
/tmp/testuser -Z
Enter LDAP Password:
modifying entry "uid=testuser,ou=People,dc=mydomain,dc=com"
And check the modify is ok:
ldapsearch -x -W -Z -b "uid=testuser,ou=People,dc=mydomain,dc=com" -D
"uid=testuser,ou=People,dc=mydomain,dc=com"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <uid=testuser,ou=People,dc=mydomain,dc=com> with scope sub
# filter: (objectclass=*)
# requesting: ALL
#

# testuser, People, mydomain.com
dn: uid=testuser,ou=People,dc=mydomain,dc=com
uid: testuser
cn: testuser
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
objectClass: ldapPublicKey
shadowLastChange: 12757
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 9999
gidNumber: 501
homeDirectory: /home/testuser
userPassword:: e1NTSEF9UDgwV1hnM1VjUDRJK0k1YnFiL1d4ZUJObXlZZ3Z3UTU=
sshPublicKey: ssh-rsa
AAAAB3NzaC1yc2EAAAABJQAAAIB3dsrwqXqD7E4zYYrxwdDKBUQxKMioXy9pxFVai64kAPxjU9KSqIo7QfkjslfsjflksjfldfkjsldfjLX/5zkzRmT28I5piGzunPv17S89z
8XwSsuAoR1t86t+5dlI7eZE/gVbn2UQkQq7+kdDTS2yXV6VnC52N/kKLG3ciBkBAw== General Purpose RSA Key

# search result
search: 3
result: 0 Success

# numResponses: 2
# numEntries: 1

Now start a ssh session to user "testuser" from usual ssh client (e.g.
puTTY). Login should succeed.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++




#
# LDAP Public Key Patch schema for use with openssh-ldappubkey
# Author: Eric AUGE <eau@phear.org>
# 
# Based on the proposal of : Mark Ruijter
#


# octetString SYNTAX
attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' 
	DESC 'MANDATORY: OpenSSH Public key' 
	EQUALITY octetStringMatch
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )

# printableString SYNTAX yes|no
objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
	DESC 'MANDATORY: OpenSSH LPK objectclass'
	MUST ( sshPublicKey $ uid ) 
	)




#
# LDAP Public Key Patch schema for use with openssh-ldappubkey
# Author: Eric AUGE <eau@phear.org>
# 
# Schema for Sun Directory Server.
# Based on the original schema, modified by Stefan Fischer.
#

dn: cn=schema

# octetString SYNTAX
attributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' 
	DESC 'MANDATORY: OpenSSH Public key' 
	EQUALITY octetStringMatch
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )

# printableString SYNTAX yes|no
objectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
	DESC 'MANDATORY: OpenSSH LPK objectclass'
	MUST ( sshPublicKey $ uid ) 
	)

Lines 16-21 Link Here

(-)gservconf.h (+7 lines)
16	#ifndef SERVCONF_H	16	#ifndef SERVCONF_H
17	#define SERVCONF_H	17	#define SERVCONF_H
18		18
		19	#ifdef WITH_LDAP_PUBKEY
		20	#include "ldapauth.h"
		21	#endif
		22
19	#define MAX_PORTS 256 /* Max # ports. */	23	#define MAX_PORTS 256 /* Max # ports. */
20		24
21	#define MAX_ALLOW_USERS 256 /* Max # users on allow list. */	25	#define MAX_ALLOW_USERS 256 /* Max # users on allow list. */
Lines 150-155 Link Here
150	int use_pam; /* Enable auth via PAM */	154	int use_pam; /* Enable auth via PAM */
151		155
152	int permit_tun;	156	int permit_tun;
		157	#ifdef WITH_LDAP_PUBKEY
		158	ldap_opt_t lpk;
		159	#endif
153		160
154	int num_permitted_opens;	161	int num_permitted_opens;
155		162

Lines 127-132 Link Here

(-)gsshd.c (+14 lines)
127	int deny_severity;	127	int deny_severity;
128	#endif /* LIBWRAP */	128	#endif /* LIBWRAP */
129		129
		130	#ifdef WITH_LDAP_PUBKEY
		131	#include "ldapauth.h"
		132	#endif
		133
130	#ifndef O_NOCTTY	134	#ifndef O_NOCTTY
131	#define O_NOCTTY 0	135	#define O_NOCTTY 0
132	#endif	136	#endif
Lines 1530-1535 Link Here
1530	exit(1);	1534	exit(1);
1531	}	1535	}
1532		1536
		1537	#ifdef WITH_LDAP_PUBKEY
		1538	/* ldap_options_print(&options.lpk); */
		1539	/* XXX initialize/check ldap connection and set LD /
		1540	if (options.lpk.on) {
		1541	if (options.lpk.l_conf && (ldap_parse_lconf(&options.lpk) < 0) )
		1542	error("[LDAP] could not parse %s", options.lpk.l_conf);
		1543	if (ldap_connect(&options.lpk) < 0)
		1544	error("[LDAP] could not initialize ldap connection");
		1545	}
		1546	#endif
1533	debug("sshd version %.100s", SSH_RELEASE);	1547	debug("sshd version %.100s", SSH_RELEASE);
1534		1548
1535	/* Store privilege separation user for later use if required. */	1549	/* Store privilege separation user for later use if required. */




# no default banner path
#Banner none

# here are the new patched ldap related tokens
# entries in your LDAP must have posixAccount & ldapPublicKey objectclass
#UseLPK yes
#LpkLdapConf /etc/ldap.conf
#LpkServers  ldap://10.1.7.1/ ldap://10.1.7.2/
#LpkUserDN   ou=users,dc=phear,dc=org
#LpkGroupDN  ou=groups,dc=phear,dc=org
#LpkBindDN cn=Manager,dc=phear,dc=org
#LpkBindPw secret
#LpkServerGroup mail
#LpkFilter (hostAccess=master.phear.org)
#LpkForceTLS no
#LpkSearchTimelimit 3
#LpkBindTimelimit 3

# override default of no subsystems
Subsystem	sftp	/usr/libexec/sftp-server





program.
The default is
.Pa /usr/X11R6/bin/xauth .
.It Cm UseLPK
Specifies whether LDAP public key retrieval must be used or not. It allow
an easy centralisation of public keys within an LDAP directory. The argument must be
.Dq yes
or
.Dq no .
.It Cm LpkLdapConf
Specifies whether LDAP Public keys should parse the specified ldap.conf file
instead of sshd_config Tokens. The argument must be a valid path to an ldap.conf
file like
.Pa /etc/ldap.conf
.It Cm LpkServers
Specifies LDAP one or more [:space:] separated server's url the following form may be used:
.Pp
LpkServers ldaps://127.0.0.1 ldap://127.0.0.2 ldap://127.0.0.3
.It Cm LpkUserDN
Specifies the LDAP user DN.
.Pp
LpkUserDN ou=users,dc=phear,dc=org
.It Cm LpkGroupDN
Specifies the LDAP groups DN.
.Pp
LpkGroupDN ou=groups,dc=phear,dc=org
.It Cm LpkBindDN
Specifies the LDAP bind DN to use if necessary.
.Pp
LpkBindDN cn=Manager,dc=phear,dc=org
.It Cm LpkBindPw
Specifies the LDAP bind credential. 
.Pp
LpkBindPw secret
.It Cm LpkServerGroup
Specifies one or more [:space:] separated group the server is part of. 
.Pp
LpkServerGroup unix mail prod
.It Cm LpkFilter
Specifies an additional LDAP filter to use for finding SSH keys
.Pp
LpkFilter (hostAccess=master.phear.org)
.It Cm LpkForceTLS
Specifies if the LDAP server connection must be tried, forced or not used. The argument must be 
.Dq yes
or
.Dq no
or
.Dq try .
.It Cm LpkSearchTimelimit
Sepcifies the search time limit before the search is considered over. value is
in seconds.
.Pp
LpkSearchTimelimit 3
.It Cm LpkBindTimelimit
Sepcifies the bind time limit before the connection is considered dead. value is
in seconds.
.Pp
LpkBindTimelimit 3
.El
.Sh TIME FORMATS
.Xr sshd 8

Lines 42-47 Link Here

(-)servconf.c (+169 lines)
42	#include "channels.h"	42	#include "channels.h"
43	#include "groupaccess.h"	43	#include "groupaccess.h"
44		44
		45	#ifdef WITH_LDAP_PUBKEY
		46	#include "ldapauth.h"
		47	#endif
		48
45	static void add_listen_addr(ServerOptions , char , int);	49	static void add_listen_addr(ServerOptions , char , int);
46	static void add_one_listen_addr(ServerOptions , char , int);	50	static void add_one_listen_addr(ServerOptions , char , int);
47		51
Lines 131-136 Link Here
131	options->zero_knowledge_password_authentication = -1;	135	options->zero_knowledge_password_authentication = -1;
132	options->revoked_keys_file = NULL;	136	options->revoked_keys_file = NULL;
133	options->trusted_user_ca_keys = NULL;	137	options->trusted_user_ca_keys = NULL;
		138	#ifdef WITH_LDAP_PUBKEY
		139	/* XXX dirty */
		140	options->lpk.ld = NULL;
		141	options->lpk.on = -1;
		142	options->lpk.servers = NULL;
		143	options->lpk.u_basedn = NULL;
		144	options->lpk.g_basedn = NULL;
		145	options->lpk.binddn = NULL;
		146	options->lpk.bindpw = NULL;
		147	options->lpk.sgroup = NULL;
		148	options->lpk.filter = NULL;
		149	options->lpk.fgroup = NULL;
		150	options->lpk.l_conf = NULL;
		151	options->lpk.tls = -1;
		152	options->lpk.b_timeout.tv_sec = -1;
		153	options->lpk.s_timeout.tv_sec = -1;
		154	options->lpk.flags = FLAG_EMPTY;
		155	#endif
134	}	156	}
135		157
136	void	158	void
Lines 265-270 Link Here
265	options->permit_tun = SSH_TUNMODE_NO;	287	options->permit_tun = SSH_TUNMODE_NO;
266	if (options->zero_knowledge_password_authentication == -1)	288	if (options->zero_knowledge_password_authentication == -1)
267	options->zero_knowledge_password_authentication = 0;	289	options->zero_knowledge_password_authentication = 0;
		290	#ifdef WITH_LDAP_PUBKEY
		291	if (options->lpk.on == -1)
		292	options->lpk.on = _DEFAULT_LPK_ON;
		293	if (options->lpk.servers == NULL)
		294	options->lpk.servers = _DEFAULT_LPK_SERVERS;
		295	if (options->lpk.u_basedn == NULL)
		296	options->lpk.u_basedn = _DEFAULT_LPK_UDN;
		297	if (options->lpk.g_basedn == NULL)
		298	options->lpk.g_basedn = _DEFAULT_LPK_GDN;
		299	if (options->lpk.binddn == NULL)
		300	options->lpk.binddn = _DEFAULT_LPK_BINDDN;
		301	if (options->lpk.bindpw == NULL)
		302	options->lpk.bindpw = _DEFAULT_LPK_BINDPW;
		303	if (options->lpk.sgroup == NULL)
		304	options->lpk.sgroup = _DEFAULT_LPK_SGROUP;
		305	if (options->lpk.filter == NULL)
		306	options->lpk.filter = _DEFAULT_LPK_FILTER;
		307	if (options->lpk.tls == -1)
		308	options->lpk.tls = _DEFAULT_LPK_TLS;
		309	if (options->lpk.b_timeout.tv_sec == -1)
		310	options->lpk.b_timeout.tv_sec = _DEFAULT_LPK_BTIMEOUT;
		311	if (options->lpk.s_timeout.tv_sec == -1)
		312	options->lpk.s_timeout.tv_sec = _DEFAULT_LPK_STIMEOUT;
		313	if (options->lpk.l_conf == NULL)
		314	options->lpk.l_conf = _DEFAULT_LPK_LDP;
		315	#endif
268		316
269	/* Turn privilege separation on by default */	317	/* Turn privilege separation on by default */
270	if (use_privsep == -1)	318	if (use_privsep == -1)
Lines 312-317 Link Here
312	sZeroKnowledgePasswordAuthentication, sHostCertificate,	360	sZeroKnowledgePasswordAuthentication, sHostCertificate,
313	sRevokedKeys, sTrustedUserCAKeys,	361	sRevokedKeys, sTrustedUserCAKeys,
314	sDeprecated, sUnsupported	362	sDeprecated, sUnsupported
		363	#ifdef WITH_LDAP_PUBKEY
		364	,sLdapPublickey, sLdapServers, sLdapUserDN
		365	,sLdapGroupDN, sBindDN, sBindPw, sMyGroup
		366	,sLdapFilter, sForceTLS, sBindTimeout
		367	,sSearchTimeout, sLdapConf
		368	#endif
315	} ServerOpCodes;	369	} ServerOpCodes;
316		370
317	#define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */	371	#define SSHCFG_GLOBAL 0x01 /* allowed in main section of sshd_config */
Lines 432-437 Link Here
432	{ "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },	486	{ "hostcertificate", sHostCertificate, SSHCFG_GLOBAL },
433	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },	487	{ "revokedkeys", sRevokedKeys, SSHCFG_ALL },
434	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },	488	{ "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
		489	#ifdef WITH_LDAP_PUBKEY
		490	{ _DEFAULT_LPK_TOKEN, sLdapPublickey, SSHCFG_GLOBAL },
		491	{ _DEFAULT_SRV_TOKEN, sLdapServers, SSHCFG_GLOBAL },
		492	{ _DEFAULT_USR_TOKEN, sLdapUserDN, SSHCFG_GLOBAL },
		493	{ _DEFAULT_GRP_TOKEN, sLdapGroupDN, SSHCFG_GLOBAL },
		494	{ _DEFAULT_BDN_TOKEN, sBindDN, SSHCFG_GLOBAL },
		495	{ _DEFAULT_BPW_TOKEN, sBindPw, SSHCFG_GLOBAL },
		496	{ _DEFAULT_MYG_TOKEN, sMyGroup, SSHCFG_GLOBAL },
		497	{ _DEFAULT_FIL_TOKEN, sLdapFilter, SSHCFG_GLOBAL },
		498	{ _DEFAULT_TLS_TOKEN, sForceTLS, SSHCFG_GLOBAL },
		499	{ _DEFAULT_BTI_TOKEN, sBindTimeout, SSHCFG_GLOBAL },
		500	{ _DEFAULT_STI_TOKEN, sSearchTimeout, SSHCFG_GLOBAL },
		501	{ _DEFAULT_LDP_TOKEN, sLdapConf, SSHCFG_GLOBAL },
		502	#endif
435	{ NULL, sBadOption, 0 }	503	{ NULL, sBadOption, 0 }
436	};	504	};
437		505
Lines 1349-1354 Link Here
1349	while (arg)	1417	while (arg)
1350	arg = strdelim(&cp);	1418	arg = strdelim(&cp);
1351	break;	1419	break;
		1420	#ifdef WITH_LDAP_PUBKEY
		1421	case sLdapPublickey:
		1422	intptr = &options->lpk.on;
		1423	goto parse_flag;
		1424	case sLdapServers:
		1425	/* arg = strdelim(&cp); */
		1426	p = line;
		1427	while(*p++);
		1428	arg = p;
		1429	if (!arg \|\| *arg == '\0')
		1430	fatal("%s line %d: missing ldap server",filename,linenum);
		1431	arg[strlen(arg)] = '\0';
		1432	if ((options->lpk.servers = ldap_parse_servers(arg)) == NULL)
		1433	fatal("%s line %d: error in ldap servers", filename, linenum);
		1434	memset(arg,0,strlen(arg));
		1435	break;
		1436	case sLdapUserDN:
		1437	arg = cp;
		1438	if (!arg \|\| *arg == '\0')
		1439	fatal("%s line %d: missing ldap server",filename,linenum);
		1440	arg[strlen(arg)] = '\0';
		1441	options->lpk.u_basedn = xstrdup(arg);
		1442	memset(arg,0,strlen(arg));
		1443	break;
		1444	case sLdapGroupDN:
		1445	arg = cp;
		1446	if (!arg \|\| *arg == '\0')
		1447	fatal("%s line %d: missing ldap server",filename,linenum);
		1448	arg[strlen(arg)] = '\0';
		1449	options->lpk.g_basedn = xstrdup(arg);
		1450	memset(arg,0,strlen(arg));
		1451	break;
		1452	case sBindDN:
		1453	arg = cp;
		1454	if (!arg \|\| *arg == '\0')
		1455	fatal("%s line %d: missing binddn",filename,linenum);
		1456	arg[strlen(arg)] = '\0';
		1457	options->lpk.binddn = xstrdup(arg);
		1458	memset(arg,0,strlen(arg));
		1459	break;
		1460	case sBindPw:
		1461	arg = cp;
		1462	if (!arg \|\| *arg == '\0')
		1463	fatal("%s line %d: missing bindpw",filename,linenum);
		1464	arg[strlen(arg)] = '\0';
		1465	options->lpk.bindpw = xstrdup(arg);
		1466	memset(arg,0,strlen(arg));
		1467	break;
		1468	case sMyGroup:
		1469	arg = cp;
		1470	if (!arg \|\| *arg == '\0')
		1471	fatal("%s line %d: missing groupname",filename, linenum);
		1472	arg[strlen(arg)] = '\0';
		1473	options->lpk.sgroup = xstrdup(arg);
		1474	if (options->lpk.sgroup)
		1475	options->lpk.fgroup = ldap_parse_groups(options->lpk.sgroup);
		1476	memset(arg,0,strlen(arg));
		1477	break;
		1478	case sLdapFilter:
		1479	arg = cp;
		1480	if (!arg \|\| *arg == '\0')
		1481	fatal("%s line %d: missing filter",filename, linenum);
		1482	arg[strlen(arg)] = '\0';
		1483	options->lpk.filter = xstrdup(arg);
1484	memset(arg,0,strlen(arg));
1485	break;
1486	case sForceTLS:
1487	intptr = &options->lpk.tls;
1488	arg = strdelim(&cp);
1489	if (!arg \|\| *arg == '\0')
1490	fatal("%s line %d: missing yes/no argument.",
1491	filename, linenum);
1492	value = 0; /* silence compiler */
1493	if (strcmp(arg, "yes") == 0)
1494	value = 1;
1495	else if (strcmp(arg, "no") == 0)
1496	value = 0;
1497	else if (strcmp(arg, "try") == 0)
1498	value = -1;
1499	else
1500	fatal("%s line %d: Bad yes/no argument: %s",
1501	filename, linenum, arg);
1502	if (*intptr == -1)
1503	*intptr = value;
1504	break;
1505	case sBindTimeout:
1506	intptr = (int *) &options->lpk.b_timeout.tv_sec;
1507	goto parse_int;
1508	case sSearchTimeout:
1509	intptr = (int *) &options->lpk.s_timeout.tv_sec;
1510	goto parse_int;
1511	break;
1512	case sLdapConf:
1513	arg = cp;
1514	if (!arg \|\| *arg == '\0')
1515	fatal("%s line %d: missing LpkLdapConf", filename, linenum);
1516	arg[strlen(arg)] = '\0';
1517	options->lpk.l_conf = xstrdup(arg);
1518	memset(arg, 0, strlen(arg));
1519	break;
1520	#endif
1352		1521
1353	default:	1522	default:
1354	fatal("%s line %d: Missing handler for opcode %s (%d)",	1523	fatal("%s line %d: Missing handler for opcode %s (%d)",

Return to bug 1316

Lines 1340-1345 Link Here

(-)gconfigure (+81 lines)
1340	--with-tcp-wrappers[=PATH] Enable tcpwrappers support (optionally in PATH)	1340	--with-tcp-wrappers[=PATH] Enable tcpwrappers support (optionally in PATH)
1341	--with-libedit[=PATH] Enable libedit support for sftp	1341	--with-libedit[=PATH] Enable libedit support for sftp
1342	--with-audit=module Enable EXPERIMENTAL audit support (modules=debug,bsm)	1342	--with-audit=module Enable EXPERIMENTAL audit support (modules=debug,bsm)
		1343	--with-ldap[=PATH] Enable LDAP pubkey support (optionally in PATH)
1343	--with-ssl-dir=PATH Specify path to OpenSSL installation	1344	--with-ssl-dir=PATH Specify path to OpenSSL installation
1344	--without-openssl-header-check Disable OpenSSL version consistency check	1345	--without-openssl-header-check Disable OpenSSL version consistency check
1345	--with-ssl-engine Enable OpenSSL (hardware) ENGINE support	1346	--with-ssl-engine Enable OpenSSL (hardware) ENGINE support
Lines 12845-12850 Link Here
12845	fi	12846	fi
12846		12847
12847		12848
		12849	# Check whether user wants LDAP support
		12850	LDAP_MSG="no"
		12851
		12852	# Check whether --with-ldap was given.
		12853	if test "${with_ldap+set}" = set; then
		12854	withval=$with_ldap;
		12855	if test "x$withval" != "xno" ; then
		12856
		12857	if test "x$withval" != "xyes" ; then
		12858	CPPFLAGS="$CPPFLAGS -I${withval}/include"
		12859	LDFLAGS="$LDFLAGS -L${withval}/lib"
		12860	fi
		12861
		12862
		12863	cat >>confdefs.h <<\_ACEOF
		12864	#define WITH_LDAP_PUBKEY 1
		12865	_ACEOF
		12866
		12867	LIBS="-lldap $LIBS"
		12868	LDAP_MSG="yes"
		12869
		12870	{ echo "$as_me:$LINENO: checking for LDAP support" >&5
		12871	echo $ECHO_N "checking for LDAP support... $ECHO_C" >&6; }
		12872	cat >conftest.$ac_ext <<_ACEOF
		12873	/* confdefs.h. */
		12874	_ACEOF
		12875	cat confdefs.h >>conftest.$ac_ext
		12876	cat >>conftest.$ac_ext <<_ACEOF
		12877	/* end confdefs.h. */
		12878	#include <sys/types.h>
		12879	#include <ldap.h>
		12880	int
		12881	main ()
		12882	{
		12883	(void)ldap_init(0, 0);
		12884	;
		12885	return 0;
		12886	}
		12887	_ACEOF
		12888	rm -f conftest.$ac_objext
		12889	if { (ac_try="$ac_compile"
		12890	case "(($ac_try" in
		12891	\" \| \` \| \\) ac_try_echo=\$ac_try;;
		12892	*) ac_try_echo=$ac_try;;
		12893	esac
		12894	eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
		12895	(eval "$ac_compile") 2>conftest.er1
		12896	ac_status=$?
		12897	grep -v '^ *+' conftest.er1 >conftest.err
		12898	rm -f conftest.er1
		12899	cat conftest.err >&5
		12900	echo "$as_me:$LINENO: \$? = $ac_status" >&5
		12901	(exit $ac_status); } && {
		12902	test -z "$ac_c_werror_flag" \|\|
		12903	test ! -s conftest.err
		12904	} && test -s conftest.$ac_objext; then
		12905	{ echo "$as_me:$LINENO: result: yes" >&5
		12906	echo "${ECHO_T}yes" >&6; }
		12907	else
		12908	echo "$as_me: failed program was:" >&5
		12909	sed 's/^/\| /' conftest.$ac_ext >&5
		12910
		12911
		12912	{ echo "$as_me:$LINENO: result: no" >&5
12913	echo "${ECHO_T}no" >&6; }
12914	{ { echo "$as_me:$LINENO: error: Incomplete or missing ldap libraries " >&5
12915	echo "$as_me: error: Incomplete or missing ldap libraries " >&2;}
12916	{ (exit 1); exit 1; }; }
12917
12918
12919	fi
12920
12921	rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
12922	fi
12923
12924
12925	fi
12926
12927
12848		12928
12849		12929
12850		12930
Lines 30786-30791 Link Here
30786	echo " Smartcard support: $SCARD_MSG"	30866	echo " Smartcard support: $SCARD_MSG"
30787	echo " S/KEY support: $SKEY_MSG"	30867	echo " S/KEY support: $SKEY_MSG"
30788	echo " TCP Wrappers support: $TCPW_MSG"	30868	echo " TCP Wrappers support: $TCPW_MSG"
		30869	echo " LDAP support: $LDAP_MSG"
30789	echo " MD5 password support: $MD5_MSG"	30870	echo " MD5 password support: $MD5_MSG"
30790	echo " libedit support: $LIBEDIT_MSG"	30871	echo " libedit support: $LIBEDIT_MSG"
30791	echo " Solaris process contract support: $SPC_MSG"	30872	echo " Solaris process contract support: $SPC_MSG"

Lines 1323-1328 Link Here

(-)gconfigure.ac (+32 lines)
1323	esac ]	1323	esac ]
1324	)	1324	)
1325		1325
		1326	# Check whether user wants LDAP support
		1327	LDAP_MSG="no"
		1328	AC_ARG_WITH(ldap,
		1329	[ --with-ldap[[=PATH]] Enable LDAP pubkey support (optionally in PATH)],
		1330	[
		1331	if test "x$withval" != "xno" ; then
		1332
		1333	if test "x$withval" != "xyes" ; then
		1334	CPPFLAGS="$CPPFLAGS -I${withval}/include"
		1335	LDFLAGS="$LDFLAGS -L${withval}/lib"
		1336	fi
		1337
		1338	AC_DEFINE([WITH_LDAP_PUBKEY], 1, [Enable LDAP pubkey support])
		1339	LIBS="-lldap $LIBS"
		1340	LDAP_MSG="yes"
		1341
		1342	AC_MSG_CHECKING([for LDAP support])
		1343	AC_TRY_COMPILE(
		1344	[#include <sys/types.h>
		1345	#include <ldap.h>],
		1346	[(void)ldap_init(0, 0);],
		1347	[AC_MSG_RESULT(yes)],
		1348	[
		1349	AC_MSG_RESULT(no)
		1350	AC_MSG_ERROR([ Incomplete or missing ldap libraries ])
		1351	]
		1352	)
		1353	fi
		1354	]
		1355	)
		1356
1326	dnl Checks for library functions. Please keep in alphabetical order	1357	dnl Checks for library functions. Please keep in alphabetical order
1327	AC_CHECK_FUNCS( \	1358	AC_CHECK_FUNCS( \
1328	arc4random \	1359	arc4random \
Lines 4185-4190 Link Here
4185	echo " Smartcard support: $SCARD_MSG"	4216	echo " Smartcard support: $SCARD_MSG"
4186	echo " S/KEY support: $SKEY_MSG"	4217	echo " S/KEY support: $SKEY_MSG"
4187	echo " TCP Wrappers support: $TCPW_MSG"	4218	echo " TCP Wrappers support: $TCPW_MSG"
		4219	echo " LDAP support: $LDAP_MSG"
4188	echo " MD5 password support: $MD5_MSG"	4220	echo " MD5 password support: $MD5_MSG"
4189	echo " libedit support: $LIBEDIT_MSG"	4221	echo " libedit support: $LIBEDIT_MSG"
4190	echo " Solaris process contract support: $SPC_MSG"	4222	echo " Solaris process contract support: $SPC_MSG"

Lines 107-112 Link Here

(-)gsshd_config (+15 lines)
107	# no default banner path	107	# no default banner path
108	#Banner none	108	#Banner none
109		109
		110	# here are the new patched ldap related tokens
		111	# entries in your LDAP must have posixAccount & ldapPublicKey objectclass
		112	#UseLPK yes
		113	#LpkLdapConf /etc/ldap.conf
		114	#LpkServers ldap://10.1.7.1/ ldap://10.1.7.2/
		115	#LpkUserDN ou=users,dc=phear,dc=org
		116	#LpkGroupDN ou=groups,dc=phear,dc=org
		117	#LpkBindDN cn=Manager,dc=phear,dc=org
		118	#LpkBindPw secret
		119	#LpkServerGroup mail
		120	#LpkFilter (hostAccess=master.phear.org)
		121	#LpkForceTLS no
		122	#LpkSearchTimelimit 3
		123	#LpkBindTimelimit 3
		124
110	# override default of no subsystems	125	# override default of no subsystems
111	Subsystem sftp /usr/libexec/sftp-server	126	Subsystem sftp /usr/libexec/sftp-server
112		127

Lines 1043-1048 Link Here

(-)gsshd_config.5 (+56 lines)
1043	program.	1043	program.
1044	The default is	1044	The default is
1045	.Pa /usr/X11R6/bin/xauth .	1045	.Pa /usr/X11R6/bin/xauth .
		1046	.It Cm UseLPK
		1047	Specifies whether LDAP public key retrieval must be used or not. It allow
		1048	an easy centralisation of public keys within an LDAP directory. The argument must be
		1049	.Dq yes
		1050	or
		1051	.Dq no .
		1052	.It Cm LpkLdapConf
		1053	Specifies whether LDAP Public keys should parse the specified ldap.conf file
		1054	instead of sshd_config Tokens. The argument must be a valid path to an ldap.conf
		1055	file like
		1056	.Pa /etc/ldap.conf
		1057	.It Cm LpkServers
		1058	Specifies LDAP one or more [:space:] separated server's url the following form may be used:
		1059	.Pp
		1060	LpkServers ldaps://127.0.0.1 ldap://127.0.0.2 ldap://127.0.0.3
		1061	.It Cm LpkUserDN
		1062	Specifies the LDAP user DN.
		1063	.Pp
		1064	LpkUserDN ou=users,dc=phear,dc=org
		1065	.It Cm LpkGroupDN
		1066	Specifies the LDAP groups DN.
		1067	.Pp
		1068	LpkGroupDN ou=groups,dc=phear,dc=org
		1069	.It Cm LpkBindDN
		1070	Specifies the LDAP bind DN to use if necessary.
		1071	.Pp
		1072	LpkBindDN cn=Manager,dc=phear,dc=org
		1073	.It Cm LpkBindPw
		1074	Specifies the LDAP bind credential.
		1075	.Pp
		1076	LpkBindPw secret
		1077	.It Cm LpkServerGroup
		1078	Specifies one or more [:space:] separated group the server is part of.
		1079	.Pp
		1080	LpkServerGroup unix mail prod
		1081	.It Cm LpkFilter
		1082	Specifies an additional LDAP filter to use for finding SSH keys
		1083	.Pp
		1084	LpkFilter (hostAccess=master.phear.org)
		1085	.It Cm LpkForceTLS
		1086	Specifies if the LDAP server connection must be tried, forced or not used. The argument must be
		1087	.Dq yes
		1088	or
		1089	.Dq no
		1090	or
		1091	.Dq try .
		1092	.It Cm LpkSearchTimelimit
		1093	Sepcifies the search time limit before the search is considered over. value is
		1094	in seconds.
		1095	.Pp
		1096	LpkSearchTimelimit 3
		1097	.It Cm LpkBindTimelimit
		1098	Sepcifies the bind time limit before the connection is considered dead. value is
		1099	in seconds.
		1100	.Pp
		1101	LpkBindTimelimit 3
1046	.El	1102	.El
1047	.Sh TIME FORMATS	1103	.Sh TIME FORMATS
1048	.Xr sshd 8	1104	.Xr sshd 8

Line 0 Link Here

(-)gREADME.lpk (+267 lines)
		1	OpenSSH LDAP PUBLIC KEY PATCH
		2	Copyright (c) 2003 Eric AUGE (eau@phear.org)
		3	All rights reserved.
		4
		5	Redistribution and use in source and binary forms, with or without
		6	modification, are permitted provided that the following conditions
		7	are met:
		8	1. Redistributions of source code must retain the above copyright
		9	notice, this list of conditions and the following disclaimer.
		10	2. Redistributions in binary form must reproduce the above copyright
		11	notice, this list of conditions and the following disclaimer in the
		12	documentation and/or other materials provided with the distribution.
		13	3. The name of the author may not be used to endorse or promote products
		14	derived from this software without specific prior written permission.
		15
		16	THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
		17	IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
		18	OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
		19	IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
		20	INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
		21	NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
		22	DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
		23	THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
		24	(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
		25	THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		26
		27	purposes of this patch:
		28
		29	This patch would help to have authentication centralization policy
		30	using ssh public key authentication.
		31	This patch could be an alternative to other "secure" authentication system
		32	working in a similar way (Kerberos, SecurID, etc...), except the fact
		33	that it's based on OpenSSH and its public key abilities.
		34
		35	>> FYI: <<
		36	'uid': means unix accounts existing on the current server
		37	'lpkServerGroup:' mean server group configured on the current server ('lpkServerGroup' in sshd_config)
		38
		39	example schema:
		40
		41
		42	server1 (uid: eau,rival,toto) (lpkServerGroup: unix)
		43	___________ /
		44	/ \ --- - server3 (uid: eau, titi) (lpkServerGroup: unix)
		45	\| LDAP Server \| \
		46	\| eau ,rival \| server2 (uid: rival, eau) (lpkServerGroup: unix)
		47	\| titi ,toto \|
		48	\| userx,.... \| server5 (uid: eau) (lpkServerGroup: mail)
		49	\___________/ \ /
		50	----- - server4 (uid: eau, rival) (no group configured)
		51	\
		52	etc...
		53
		54	- WHAT WE NEED :
		55
		56	* configured LDAP server somewhere on the network (i.e. OpenLDAP)
		57	* patched sshd (with this patch ;)
		58	* LDAP user(/group) entry (look at users.ldif (& groups.ldif)):
		59	User entry:
		60	- attached to the 'ldapPublicKey' objectclass
		61	- attached to the 'posixAccount' objectclass
		62	- with a filled 'sshPublicKey' attribute
		63	Example:
		64	dn: uid=eau,ou=users,dc=cuckoos,dc=net
65	objectclass: top
66	objectclass: person
67	objectclass: organizationalPerson
68	objectclass: posixAccount
69	objectclass: ldapPublicKey
70	description: Eric AUGE Account
71	userPassword: blah
72	cn: Eric AUGE
73	sn: Eric AUGE
74	uid: eau
75	uidNumber: 1034
76	gidNumber: 1
77	homeDirectory: /export/home/eau
78	sshPublicKey: ssh-dss AAAAB3...
79	sshPublicKey: ssh-dss AAAAM5...
80
81	Group entry:
82	- attached to the 'posixGroup' objectclass
83	- with a 'cn' groupname attribute
84	- with multiple 'memberUid' attributes filled with usernames allowed in this group
85	Example:
86	# few members
87	dn: cn=unix,ou=groups,dc=cuckoos,dc=net
88	objectclass: top
89	objectclass: posixGroup
90	description: Unix based servers group
91	cn: unix
92	gidNumber: 1002
93	memberUid: eau
94	memberUid: user1
95	memberUid: user2
96
97
98	- HOW IT WORKS :
99
100	* without patch
101	If a user wants to authenticate to log in a server the sshd, will first look for authentication method allowed (RSAauth,kerberos,etc..)
102	and if RSAauth and tickets based auth fails, it will fallback to standard password authentication (if enabled).
103
104	* with the patch
105	If a user want to authenticate to log in a server, the sshd will first look for auth method including LDAP pubkey, if the ldappubkey options is enabled.
106	It will do an ldapsearch to get the public key directly from the LDAP instead of reading it from the server filesystem.
107	(usually in $HOME/.ssh/authorized_keys)
108
109	If groups are enabled, it will also check if the user that wants to login is in the group of the server he is trying to log into.
110	If it fails, it falls back on RSA auth files ($HOME/.ssh/authorized_keys), etc.. and finally to standard password authentication (if enabled).
111
112	7 tokens are added to sshd_config :
113	# here is the new patched ldap related tokens
114	# entries in your LDAP must be posixAccount & strongAuthenticationUser & posixGroup
115	UseLPK yes # look the pub key into LDAP
116	LpkServers ldap://10.31.32.5/ ldap://10.31.32.4 ldap://10.31.32.3 # which LDAP server for users ? (URL format)
117	LpkUserDN ou=users,dc=foobar,dc=net # which base DN for users ?
118	LpkGroupDN ou=groups,dc=foobar,dc=net # which base DN for groups ?
119	LpkBindDN cn=manager,dc=foobar,dc=net # which bind DN ?
120	LpkBindPw asecret # bind DN credidentials
121	LpkServerGroup agroupname # the group the server is part of
122
123	Right now i'm using anonymous binding to get public keys, because getting public keys of someone doesn't impersonate him¸ but there is some
124	flaws you have to take care of.
125
126	- HOW TO INSERT A USER/KEY INTO AN LDAP ENTRY
127
128	* my way (there is plenty :)
129	- create ldif file (i.e. users.ldif)
130	- cat ~/.ssh/id_dsa.pub OR cat ~/.ssh/id_rsa.pub OR cat ~/.ssh/identity.pub
131	- my way in 4 steps :
132	Example:
133
134	# you add this to the user entry in the LDIF file :
135	[...]
136	objectclass: posixAccount
137	objectclass: ldapPublicKey
138	[...]
139	sshPubliKey: ssh-dss AAAABDh12DDUR2...
140	[...]
141
142	# insert your entry and you're done :)
143	ldapadd -D balblabla -w bleh < file.ldif
144
145	all standard options can be present in the 'sshPublicKey' attribute.
146
147	- WHY :
148
149	Simply because, i was looking for a way to centralize all sysadmins authentication, easily, without completely using LDAP
150	as authentication method (like pam_ldap etc..).
151
152	After looking into Kerberos, SecurID, and other centralized secure authentications systems, the use of RSA and LDAP to get
153	public key for authentication allows us to control who has access to which server (the user needs an account and to be in 'strongAuthenticationUser'
154	objectclass within LDAP and part of the group the SSH server is in).
155
156	Passwords update are no longer a nightmare for a server farm (key pair passphrase is stored on each user's box and private key is locally encrypted using his passphrase
157	so each user can change it as much as he wants).
158
159	Blocking a user account can be done directly from the LDAP (if sshd is using RSAAuth + ldap only).
160
161	- RULES :
162	Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema.
163	and the additionnal lpk.schema.
164
165	This patch could allow a smooth transition between standard auth (/etc/passwd) and complete LDAP based authentication
166	(pamldap, nss_ldap, etc..).
167
168	This can be an alternative to other (old?/expensive?) authentication methods (Kerberos/SecurID/..).
169
170	Referring to schema at the beginning of this file if user 'eau' is only in group 'unix'
171	'eau' would ONLY access 'server1', 'server2', 'server3' AND 'server4' BUT NOT 'server5'.
172	If you then modify the LDAP 'mail' group entry to add 'memberUid: eau' THEN user 'eau' would be able
173	to log in 'server5' (i hope you got the idea, my english is bad :).
174
175	Each server's sshd is patched and configured to ask the public key and the group infos in the LDAP
176	server.
177	When you want to allow a new user to have access to the server parc, you just add him an account on
178	your servers, you add his public key into his entry on the LDAP server, it's done.
179
180	Because sshds are looking public keys into the LDAP directly instead of a file ($HOME/.ssh/authorized_keys).
181
182	When the user needs to change his passphrase he can do it directly from his workstation by changing
183	his own key set lock passphrase, and all servers are automatically aware.
184
185	With a CAREFUL LDAP server configuration you could allow a user to add/delete/modify his own entry himself
186	so he can add/modify/delete himself his public key when needed.
187
188	FLAWS :
189	LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP
190	allow write to users dn, somebody could replace someuser's public key by its own and impersonate some
191	of your users in all your server farm be VERY CAREFUL.
192
193	MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login
194	as the impersonnated user.
195
196	If LDAP server is down then, fallback on passwd auth.
197
198	the ldap code part has not been well audited yet.
199
200	- LDAP USER ENTRY EXAMPLES (LDIF Format, look in users.ldif)
201	--- CUT HERE ---
202	dn: uid=jdoe,ou=users,dc=foobar,dc=net
203	objectclass: top
204	objectclass: person
205	objectclass: organizationalPerson
206	objectclass: posixAccount
207	objectclass: ldapPublicKey
208	description: My account
209	cn: John Doe
210	sn: John Doe
211	uid: jdoe
212	uidNumber: 100
213	gidNumber: 100
214	homeDirectory: /home/jdoe
215	sshPublicKey: ssh-dss AAAAB3NzaC1kc3MAAAEBAOvL8pREUg9wSy/8+hQJ54YF3AXkB0OZrXB....
216	[...]
217	--- CUT HERE ---
218
219	- LDAP GROUP ENTRY EXAMPLES (LDIF Format, look in groups.ldif)
220	--- CUT HERE ---
221	dn: cn=unix,ou=groups,dc=cuckoos,dc=net
222	objectclass: top
223	objectclass: posixGroup
224	description: Unix based servers group
225	cn: unix
226	gidNumber: 1002
227	memberUid: jdoe
228	memberUid: user1
229	memberUid: user2
230	[...]
231	--- CUT HERE ---
232
233	>> FYI: <<
234	Multiple 'sshPublicKey' in a user entry are allowed, as well as multiple 'memberUid' attributes in a group entry
235
236	- COMPILING:
237	1. Apply the patch
238	2. ./configure --with-your-options --with-ldap=/prefix/to/ldap_libs_and_includes
239	3. make
240	4. it's done.
241
242	- BLA :
243	I hope this could help, and i hope to be clear enough,, or give ideas. questions/comments/improvements are welcome.
244
245	- TODO :
246	Redesign differently.
247
248	- DOCS/LINK :
249	http://pacsec.jp/core05/psj05-barisani-en.pdf
250	http://fritz.potsdam.edu/projects/openssh-lpk/
251	http://fritz.potsdam.edu/projects/sshgate/
252	http://dev.inversepath.com/trac/openssh-lpk
253	http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )
254
255	- CONTRIBUTORS/IDEAS/GREETS :
256	- Falk Siemonsmeier.
257	- Jacob Rief.
258	- Michael Durchgraf.
259	- frederic peters.
260	- Finlay dobbie.
261	- Stefan Fisher.
262	- Robin H. Johnson.
263	- Adrian Bridgett.
264
265	- CONTACT :
266	- Eric AUGE <eau@phear.org>
267	- Andrea Barisani <andrea@inversepath.com>

Lines 177-186 Link Here

(-)gauth-rsa.c (+86 lines)
177	FILE *f;	177	FILE *f;
178	u_long linenum = 0;	178	u_long linenum = 0;
179	Key *key;	179	Key *key;
		180	#ifdef WITH_LDAP_PUBKEY
		181	ldap_key_t * k;
		182	unsigned int i = 0;
		183	#endif
180		184
181	/* Temporarily use the user's uid. */	185	/* Temporarily use the user's uid. */
182	temporarily_use_uid(pw);	186	temporarily_use_uid(pw);
183		187
		188	#ifdef WITH_LDAP_PUBKEY
		189	/* here is the job */
		190	key = key_new(KEY_RSA1);
		191
		192	if (options.lpk.on) {
		193	debug("[LDAP] trying LDAP first uid=%s", pw->pw_name);
		194	if ( ldap_ismember(&options.lpk, pw->pw_name) > 0) {
		195	if ( (k = ldap_getuserkey(&options.lpk, pw->pw_name)) != NULL) {
		196	for (i = 0 ; i < k->num ; i++) {
		197	char cp, options = NULL;
		198
		199	for (cp = k->keys[i]->bv_val; cp == ' ' \|\| cp == '\t'; cp++)
		200	;
		201	if (!cp \|\| cp == '\n' \|\| *cp == '#')
		202	continue;
		203
		204	/*
		205	* Check if there are options for this key, and if so,
		206	* save their starting address and skip the option part
		207	* for now. If there are no options, set the starting
		208	* address to NULL.
		209	*/
		210	if (cp < '0' \|\| cp > '9') {
		211	int quoted = 0;
		212	options = cp;
		213	for (; cp && (quoted \|\| (cp != ' ' && *cp != '\t')); cp++) {
		214	if (*cp == '\\' && cp[1] == '"')
		215	cp++; /* Skip both */
		216	else if (*cp == '"')
		217	quoted = !quoted;
		218	}
		219	} else
		220	options = NULL;
		221
		222	/* Parse the key from the line. */
		223	if (hostfile_read_key(&cp, &bits, key) == 0) {
		224	debug("[LDAP] line %d: non ssh1 key syntax", i);
		225	continue;
		226	}
		227	/* cp now points to the comment part. */
		228
		229	/* Check if the we have found the desired key (identified by its modulus). */
		230	if (BN_cmp(key->rsa->n, client_n) != 0)
		231	continue;
		232
		233	/* check the real bits */
		234	if (bits != (unsigned int)BN_num_bits(key->rsa->n))
		235	logit("[LDAP] Warning: ldap, line %lu: keysize mismatch: "
		236	"actual %d vs. announced %d.", (unsigned long)i, BN_num_bits(key->rsa->n), bits);
		237
		238	/* We have found the desired key. */
		239	/*
		240	* If our options do not allow this key to be used,
		241	* do not send challenge.
		242	*/
		243	if (!auth_parse_options(pw, options, "[LDAP]", (unsigned long) i))
		244	continue;
		245
		246	/* break out, this key is allowed */
		247	allowed = 1;
		248
		249	/* add the return stuff etc... */
		250	/* Restore the privileged uid. */
		251	restore_uid();
252
253	/* return key if allowed */
254	if (allowed && rkey != NULL)
255	*rkey = key;
256	else
257	key_free(key);
258
259	ldap_keys_free(k);
260	return (allowed);
261	}
262	} else {
263	logit("[LDAP] no keys found for '%s'!", pw->pw_name);
264	}
265	} else {
266	logit("[LDAP] '%s' is not in '%s'", pw->pw_name, options.lpk.sgroup);
267	}
268	}
269	#endif
184	/* The authorized keys. */	270	/* The authorized keys. */
185	file = authorized_keys_file(pw);	271	file = authorized_keys_file(pw);
186	debug("trying public RSA key file %s", file);	272	debug("trying public RSA key file %s", file);

Line 0 Link Here

(-)gldapauth.c (+575 lines)
		1	/*
		2	* $Id: openssh-lpk-4.3p1-0.3.7.patch,v 1.3 2006/04/18 15:29:09 eau Exp $
		3	*/
		4
		5	/*
		6	*
		7	* Copyright (c) 2005, Eric AUGE <eau@phear.org>
		8	* All rights reserved.
		9	*
		10	* Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
		11	*
		12	* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
		13	* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
		14	* Neither the name of the phear.org nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
		15	*
		16	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
		17	* BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
		18	* IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
		19	* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
		20	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
		21	* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		22	*
		23	*
		24	*/
		25
		26	#include "includes.h"
		27
		28	#ifdef WITH_LDAP_PUBKEY
		29
		30	#include <stdio.h>
		31	#include <stdlib.h>
		32	#include <unistd.h>
		33	#include <string.h>
		34
		35	#include "ldapauth.h"
		36	#include "log.h"
		37
		38	static char *attrs[] = {
		39	PUBKEYATTR,
		40	NULL
		41	};
		42
		43	/* filter building infos */
		44	#define FILTER_GROUP_PREFIX "(&(objectclass=posixGroup)"
		45	#define FILTER_OR_PREFIX "(\|"
		46	#define FILTER_OR_SUFFIX ")"
		47	#define FILTER_CN_PREFIX "(cn="
		48	#define FILTER_CN_SUFFIX ")"
		49	#define FILTER_UID_FORMAT "(memberUid=%s)"
		50	#define FILTER_GROUP_SUFFIX ")"
		51	#define FILTER_GROUP_SIZE(group) (size_t) (strlen(group)+(ldap_count_group(group)*5)+52)
		52
		53	/* just filter building stuff */
		54	#define REQUEST_GROUP_SIZE(filter, uid) (size_t) (strlen(filter)+strlen(uid)+1)
		55	#define REQUEST_GROUP(buffer, prefilter, pwname) \
		56	buffer = (char *) calloc(REQUEST_GROUP_SIZE(prefilter, pwname), sizeof(char)); \
		57	if (!buffer) { \
		58	perror("calloc()"); \
		59	return FAILURE; \
		60	} \
		61	snprintf(buffer, REQUEST_GROUP_SIZE(prefilter,pwname), prefilter, pwname)
		62	/*
		63	XXX OLD group building macros
		64	#define REQUEST_GROUP_SIZE(grp, uid) (size_t) (strlen(grp)+strlen(uid)+46)
65	#define REQUEST_GROUP(buffer,pwname,grp) \
66	buffer = (char *) calloc(REQUEST_GROUP_SIZE(grp, pwname), sizeof(char)); \
67	if (!buffer) { \
68	perror("calloc()"); \
69	return FAILURE; \
70	} \
71	snprintf(buffer,REQUEST_GROUP_SIZE(grp,pwname),"(&(objectclass=posixGroup)(cn=%s)(memberUid=%s))",grp,pwname)
72	*/
73
74	/*
75	XXX stock upstream version without extra filter support
76	#define REQUEST_USER_SIZE(uid) (size_t) (strlen(uid)+64)
77	#define REQUEST_USER(buffer, pwname) \
78	buffer = (char *) calloc(REQUEST_USER_SIZE(pwname), sizeof(char)); \
79	if (!buffer) { \
80	perror("calloc()"); \
81	return NULL; \
82	} \
83	snprintf(buffer,REQUEST_USER_SIZE(pwname),"(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s))",pwname)
84	*/
85
86	#define REQUEST_USER_SIZE(uid, filter) (size_t) (strlen(uid)+64+(filter != NULL ? strlen(filter) : 0))
87	#define REQUEST_USER(buffer, pwname, customfilter) \
88	buffer = (char *) calloc(REQUEST_USER_SIZE(pwname, customfilter), sizeof(char)); \
89	if (!buffer) { \
90	perror("calloc()"); \
91	return NULL; \
92	} \
93	snprintf(buffer, REQUEST_USER_SIZE(pwname, customfilter), \
94	"(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)", \
95	pwname, (customfilter != NULL ? customfilter : ""))
96
97	/* some portable and working tokenizer, lame though */
98	static int tokenize(char ** o, size_t size, char * input) {
99	unsigned int i = 0, num;
100	const char * charset = " \t";
101	char * ptr = input;
102
103	/* leading white spaces are ignored */
104	num = strspn(ptr, charset);
105	ptr += num;
106
107	while ((num = strcspn(ptr, charset))) {
108	if (i < size-1) {
109	o[i++] = ptr;
110	ptr += num;
111	if (*ptr)
112	*ptr++ = '\0';
113	}
114	}
115	o[i] = NULL;
116	return SUCCESS;
117	}
118
119	void ldap_close(ldap_opt_t * ldap) {
120
121	if (!ldap)
122	return;
123
124	if ( ldap_unbind_ext(ldap->ld, NULL, NULL) < 0)
125	ldap_perror(ldap->ld, "ldap_unbind()");
126
127	ldap->ld = NULL;
128	FLAG_SET_DISCONNECTED(ldap->flags);
129
130	return;
131	}
132
133	/* init && bind */
134	int ldap_connect(ldap_opt_t * ldap) {
135	int version = LDAP_VERSION3;
136
137	if (!ldap->servers)
138	return FAILURE;
139
140	/* Connection Init and setup */
141	ldap->ld = ldap_init(ldap->servers, LDAP_PORT);
142	if (!ldap->ld) {
143	ldap_perror(ldap->ld, "ldap_init()");
144	return FAILURE;
145	}
146
147	if ( ldap_set_option(ldap->ld, LDAP_OPT_PROTOCOL_VERSION, &version) != LDAP_OPT_SUCCESS) {
148	ldap_perror(ldap->ld, "ldap_set_option(LDAP_OPT_PROTOCOL_VERSION)");
149	return FAILURE;
150	}
151
152	/* Timeouts setup */
153	if (ldap_set_option(ldap->ld, LDAP_OPT_NETWORK_TIMEOUT, &ldap->b_timeout) != LDAP_SUCCESS) {
154	ldap_perror(ldap->ld, "ldap_set_option(LDAP_OPT_NETWORK_TIMEOUT)");
155	}
156	if (ldap_set_option(ldap->ld, LDAP_OPT_TIMEOUT, &ldap->s_timeout) != LDAP_SUCCESS) {
157	ldap_perror(ldap->ld, "ldap_set_option(LDAP_OPT_TIMEOUT)");
158	}
159
160	/* TLS support */
161	if ( (ldap->tls == -1) \|\| (ldap->tls == 1) ) {
162	if (ldap_start_tls_s(ldap->ld, NULL, NULL ) != LDAP_SUCCESS) {
163	/* failed then reinit the initial connect */
164	ldap_perror(ldap->ld, "ldap_connect: (TLS) ldap_start_tls()");
165	if (ldap->tls == 1)
166	return FAILURE;
167
168	ldap->ld = ldap_init(ldap->servers, LDAP_PORT);
169	if (!ldap->ld) {
170	ldap_perror(ldap->ld, "ldap_init()");
171	return FAILURE;
172	}
173
174	if ( ldap_set_option(ldap->ld, LDAP_OPT_PROTOCOL_VERSION, &version) != LDAP_OPT_SUCCESS) {
175	ldap_perror(ldap->ld, "ldap_set_option()");
176	return FAILURE;
177	}
178	}
179	}
180
181
182	if ( ldap_simple_bind_s(ldap->ld, ldap->binddn, ldap->bindpw) != LDAP_SUCCESS) {
183	ldap_perror(ldap->ld, "ldap_simple_bind_s()");
184	return FAILURE;
185	}
186
187	/* says it is connected */
188	FLAG_SET_CONNECTED(ldap->flags);
189
190	return SUCCESS;
191	}
192
193	/* must free allocated ressource */
194	static char * ldap_build_host(char *host, int port) {
195	unsigned int size = strlen(host)+11;
196	char * h = (char *) calloc (size, sizeof(char));
197	int rc;
198	if (!h)
199	return NULL;
200
201	rc = snprintf(h, size, "%s:%d ", host, port);
202	if (rc == -1)
203	return NULL;
204	return h;
205	}
206
207	static int ldap_count_group(const char * input) {
208	const char * charset = " \t";
209	const char * ptr = input;
210	unsigned int count = 0;
211	unsigned int num;
212
213	num = strspn(ptr, charset);
214	ptr += num;
215
216	while ((num = strcspn(ptr, charset))) {
217	count++;
218	ptr += num;
219	ptr++;
220	}
221
222	return count;
223	}
224
225	/* format filter */
226	char * ldap_parse_groups(const char * groups) {
227	unsigned int buffer_size = FILTER_GROUP_SIZE(groups);
228	char * buffer = (char *) calloc(buffer_size, sizeof(char));
229	char * g = NULL;
230	char * garray[32];
231	unsigned int i = 0;
232
233	if ((!groups)\|\|(!buffer))
234	return NULL;
235
236	g = strdup(groups);
237	if (!g) {
238	free(buffer);
239	return NULL;
240	}
241
242	/* first separate into n tokens */
243	if ( tokenize(garray, sizeof(garray)/sizeof(*garray), g) < 0) {
244	free(g);
245	free(buffer);
246	return NULL;
247	}
248
249	/* build the final filter format */
250	strlcat(buffer, FILTER_GROUP_PREFIX, buffer_size);
251	strlcat(buffer, FILTER_OR_PREFIX, buffer_size);
252	i = 0;
253	while (garray[i]) {
254	strlcat(buffer, FILTER_CN_PREFIX, buffer_size);
255	strlcat(buffer, garray[i], buffer_size);
256	strlcat(buffer, FILTER_CN_SUFFIX, buffer_size);
257	i++;
258	}
259	strlcat(buffer, FILTER_OR_SUFFIX, buffer_size);
260	strlcat(buffer, FILTER_UID_FORMAT, buffer_size);
261	strlcat(buffer, FILTER_GROUP_SUFFIX, buffer_size);
262
263	free(g);
264	return buffer;
265	}
266
267	/* a bit dirty but leak free */
268	char * ldap_parse_servers(const char * servers) {
269	char * s = NULL;
270	char * tmp = NULL, *urls[32];
271	unsigned int num = 0 , i = 0 , asize = 0;
272	LDAPURLDesc *urld[32];
273
274	if (!servers)
275	return NULL;
276
277	/* local copy of the arg */
278	s = strdup(servers);
279	if (!s)
280	return NULL;
281
282	/* first separate into URL tokens */
283	if ( tokenize(urls, sizeof(urls)/sizeof(*urls), s) < 0)
284	return NULL;
285
286	i = 0;
287	while (urls[i]) {
288	if (! ldap_is_ldap_url(urls[i]) \|\|
289	(ldap_url_parse(urls[i], &urld[i]) != 0)) {
290	return NULL;
291	}
292	i++;
293	}
294
295	/* now free(s) */
296	free (s);
297
298	/* how much memory do we need */
299	num = i;
300	for (i = 0 ; i < num ; i++)
301	asize += strlen(urld[i]->lud_host)+11;
302
303	/* alloc */
304	s = (char *) calloc( asize+1 , sizeof(char));
305	if (!s) {
306	for (i = 0 ; i < num ; i++)
307	ldap_free_urldesc(urld[i]);
308	return NULL;
309	}
310
311	/* then build the final host string */
312	for (i = 0 ; i < num ; i++) {
313	/* built host part */
314	tmp = ldap_build_host(urld[i]->lud_host, urld[i]->lud_port);
315	strncat(s, tmp, strlen(tmp));
316	ldap_free_urldesc(urld[i]);
317	free(tmp);
318	}
319
320	return s;
321	}
322
323	void ldap_options_print(ldap_opt_t * ldap) {
324	debug("ldap options:");
325	debug("servers: %s", ldap->servers);
326	if (ldap->u_basedn)
327	debug("user basedn: %s", ldap->u_basedn);
328	if (ldap->g_basedn)
329	debug("group basedn: %s", ldap->g_basedn);
330	if (ldap->binddn)
331	debug("binddn: %s", ldap->binddn);
332	if (ldap->bindpw)
333	debug("bindpw: %s", ldap->bindpw);
334	if (ldap->sgroup)
335	debug("group: %s", ldap->sgroup);
336	if (ldap->filter)
337	debug("filter: %s", ldap->filter);
338	}
339
340	void ldap_options_free(ldap_opt_t * l) {
341	if (!l)
342	return;
343	if (l->servers)
344	free(l->servers);
345	if (l->u_basedn)
346	free(l->u_basedn);
347	if (l->g_basedn)
348	free(l->g_basedn);
349	if (l->binddn)
350	free(l->binddn);
351	if (l->bindpw)
352	free(l->bindpw);
353	if (l->sgroup)
354	free(l->sgroup);
355	if (l->fgroup)
356	free(l->fgroup);
357	if (l->filter)
358	free(l->filter);
359	if (l->l_conf)
360	free(l->l_conf);
361	free(l);
362	}
363
364	/* free keys */
365	void ldap_keys_free(ldap_key_t * k) {
366	ldap_value_free_len(k->keys);
367	free(k);
368	return;
369	}
370
371	ldap_key_t * ldap_getuserkey(ldap_opt_t l, const char user) {
372	ldap_key_t * k = (ldap_key_t *) calloc (1, sizeof(ldap_key_t));
373	LDAPMessage res, e;
374	char * filter;
375	int i;
376
377	if ((!k) \|\| (!l))
378	return NULL;
379
380	/* Am i still connected ? RETRY n times */
381	/* XXX TODO: setup some conf value for retrying */
382	if (!(l->flags & FLAG_CONNECTED))
383	for (i = 0 ; i < 2 ; i++)
384	if (ldap_connect(l) == 0)
385	break;
386
387	/* quick check for attempts to be evil */
388	if ((strchr(user, '(') != NULL) \|\| (strchr(user, ')') != NULL) \|\|
389	(strchr(user, '*') != NULL) \|\| (strchr(user, '\\') != NULL))
390	return NULL;
391
392	/* build filter for LDAP request */
393	REQUEST_USER(filter, user, l->filter);
394
395	if ( ldap_search_st( l->ld,
396	l->u_basedn,
397	LDAP_SCOPE_SUBTREE,
398	filter,
399	attrs, 0, &l->s_timeout, &res ) != LDAP_SUCCESS) {
400
401	ldap_perror(l->ld, "ldap_search_st()");
402
403	free(filter);
404	free(k);
405
406	/* XXX error on search, timeout etc.. close ask for reconnect */
407	ldap_close(l);
408
409	return NULL;
410	}
411
412	/* free */
413	free(filter);
414
415	/* check if any results */
416	i = ldap_count_entries(l->ld,res);
417	if (i <= 0) {
418	ldap_msgfree(res);
419	free(k);
420	return NULL;
421	}
422
423	if (i > 1)
424	debug("[LDAP] duplicate entries, using the FIRST entry returned");
425
426	e = ldap_first_entry(l->ld, res);
427	k->keys = ldap_get_values_len(l->ld, e, PUBKEYATTR);
428	k->num = ldap_count_values_len(k->keys);
429
430	ldap_msgfree(res);
431	return k;
432	}
433
434
435	/* -1 if trouble
436	0 if user is NOT member of current server group
437	1 if user IS MEMBER of current server group
438	*/
439	int ldap_ismember(ldap_opt_t * l, const char * user) {
440	LDAPMessage *res;
441	char * filter;
442	int i;
443
444	if ((!l->sgroup) \|\| !(l->g_basedn))
445	return 1;
446
447	/* Am i still connected ? RETRY n times */
448	/* XXX TODO: setup some conf value for retrying */
449	if (!(l->flags & FLAG_CONNECTED))
450	for (i = 0 ; i < 2 ; i++)
451	if (ldap_connect(l) == 0)
452	break;
453
454	/* quick check for attempts to be evil */
455	if ((strchr(user, '(') != NULL) \|\| (strchr(user, ')') != NULL) \|\|
456	(strchr(user, '*') != NULL) \|\| (strchr(user, '\\') != NULL))
457	return FAILURE;
458
459	/* build filter for LDAP request */
460	REQUEST_GROUP(filter, l->fgroup, user);
461
462	if (ldap_search_st( l->ld,
463	l->g_basedn,
464	LDAP_SCOPE_SUBTREE,
465	filter,
466	NULL, 0, &l->s_timeout, &res) != LDAP_SUCCESS) {
467
468	ldap_perror(l->ld, "ldap_search_st()");
469
470	free(filter);
471
472	/* XXX error on search, timeout etc.. close ask for reconnect */
473	ldap_close(l);
474
475	return FAILURE;
476	}
477
478	free(filter);
479
480	/* check if any results */
481	if (ldap_count_entries(l->ld, res) > 0) {
482	ldap_msgfree(res);
483	return 1;
484	}
485
486	ldap_msgfree(res);
487	return 0;
488	}
489
490	/*
491	* ldap.conf simple parser
492	* XXX TODO: sanity checks
493	* must either
494	* - free the previous ldap_opt_before replacing entries
495	* - free each necessary previously parsed elements
496	* ret:
497	* -1 on FAILURE, 0 on SUCCESS
498	*/
499	int ldap_parse_lconf(ldap_opt_t * l) {
500	FILE * lcd; /* ldap.conf descriptor */
501	char buf[BUFSIZ];
502	char * s = NULL, * k = NULL, * v = NULL;
503	int li, len;
504
505	lcd = fopen (l->l_conf, "r");
506	if (lcd == NULL) {
507	/* debug("Cannot open %s", l->l_conf); */
508	perror("ldap_parse_lconf()");
509	return FAILURE;
510	}
511
512	while (fgets (buf, sizeof (buf), lcd) != NULL) {
513
514	if (buf == '\n' \|\| buf == '#')
515	continue;
516
517	k = buf;
518	v = k;
519	while (v != '\0' && v != ' ' && *v != '\t')
520	v++;
521
522	if (*v == '\0')
523	continue;
524
525	*(v++) = '\0';
526
527	while (v == ' ' \|\| v == '\t')
528	v++;
529
530	li = strlen (v) - 1;
531	while (v[li] == ' ' \|\| v[li] == '\t' \|\| v[li] == '\n')
532	--li;
533	v[li + 1] = '\0';
534
535	if (!strcasecmp (k, "uri")) {
536	if ((l->servers = ldap_parse_servers(v)) == NULL) {
537	fatal("error in ldap servers");
538	return FAILURE;
539	}
540
541	}
542	else if (!strcasecmp (k, "base")) {
543	s = strchr (v, '?');
544	if (s != NULL) {
545	len = s - v;
546	l->u_basedn = malloc (len + 1);
547	strncpy (l->u_basedn, v, len);
548	l->u_basedn[len] = '\0';
549	} else {
550	l->u_basedn = strdup (v);
551	}
552	}
553	else if (!strcasecmp (k, "binddn")) {
554	l->binddn = strdup (v);
555	}
556	else if (!strcasecmp (k, "bindpw")) {
557	l->bindpw = strdup (v);
558	}
559	else if (!strcasecmp (k, "timelimit")) {
560	l->s_timeout.tv_sec = atoi (v);
561	}
562	else if (!strcasecmp (k, "bind_timelimit")) {
563	l->b_timeout.tv_sec = atoi (v);
564	}
565	else if (!strcasecmp (k, "ssl")) {
566	if (!strcasecmp (v, "start_tls"))
567	l->tls = 1;
568	}
569	}
570
571	fclose (lcd);
572	return SUCCESS;
573	}
574
575	#endif /* WITH_LDAP_PUBKEY */

Line 0 Link Here

(-)gldapauth.h (+124 lines)
		1	/*
		2	* $Id: openssh-lpk-4.3p1-0.3.7.patch,v 1.3 2006/04/18 15:29:09 eau Exp $
		3	*/
		4
		5	/*
		6	*
		7	* Copyright (c) 2005, Eric AUGE <eau@phear.org>
		8	* All rights reserved.
		9	*
		10	* Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
		11	*
		12	* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
		13	* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
		14	* Neither the name of the phear.org nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
		15	*
		16	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
		17	* BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
		18	* IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
		19	* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
		20	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
		21	* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
		22	*
		23	*
		24	*/
		25
		26	#ifndef LDAPAUTH_H
		27	#define LDAPAUTH_H
		28
		29	#define LDAP_DEPRECATED 1
		30
		31	#include <string.h>
		32	#include <time.h>
		33	#include <ldap.h>
		34	#include <lber.h>
		35
		36	/* tokens in use for config */
		37	#define _DEFAULT_LPK_TOKEN "UseLPK"
		38	#define _DEFAULT_SRV_TOKEN "LpkServers"
		39	#define _DEFAULT_USR_TOKEN "LpkUserDN"
		40	#define _DEFAULT_GRP_TOKEN "LpkGroupDN"
		41	#define _DEFAULT_BDN_TOKEN "LpkBindDN"
		42	#define _DEFAULT_BPW_TOKEN "LpkBindPw"
		43	#define _DEFAULT_MYG_TOKEN "LpkServerGroup"
		44	#define _DEFAULT_FIL_TOKEN "LpkFilter"
		45	#define _DEFAULT_TLS_TOKEN "LpkForceTLS"
		46	#define _DEFAULT_BTI_TOKEN "LpkBindTimelimit"
		47	#define _DEFAULT_STI_TOKEN "LpkSearchTimelimit"
		48	#define _DEFAULT_LDP_TOKEN "LpkLdapConf"
		49
		50	/* default options */
		51	#define _DEFAULT_LPK_ON 0
		52	#define _DEFAULT_LPK_SERVERS NULL
		53	#define _DEFAULT_LPK_UDN NULL
		54	#define _DEFAULT_LPK_GDN NULL
		55	#define _DEFAULT_LPK_BINDDN NULL
		56	#define _DEFAULT_LPK_BINDPW NULL
		57	#define _DEFAULT_LPK_SGROUP NULL
		58	#define _DEFAULT_LPK_FILTER NULL
		59	#define _DEFAULT_LPK_TLS -1
		60	#define _DEFAULT_LPK_BTIMEOUT 10
		61	#define _DEFAULT_LPK_STIMEOUT 10
		62	#define _DEFAULT_LPK_LDP NULL
		63
		64	/* flags */
65	#define FLAG_EMPTY 0x00000000
66	#define FLAG_CONNECTED 0x00000001
67
68	/* flag macros */
69	#define FLAG_SET_EMPTY(x) x&=(FLAG_EMPTY)
70	#define FLAG_SET_CONNECTED(x) x\|=(FLAG_CONNECTED)
71	#define FLAG_SET_DISCONNECTED(x) x&=~(FLAG_CONNECTED)
72
73	/* defines */
74	#define FAILURE -1
75	#define SUCCESS 0
76	#define PUBKEYATTR "sshPublicKey"
77
78	/*
79	*
80	* defined files path
81	* (should be relocated to pathnames.h,
82	* if one day it's included within the tree)
83	*
84	*/
85	#define _PATH_LDAP_CONFIG_FILE "/etc/ldap.conf"
86
87	/* structures */
88	typedef struct ldap_options {
89	int on; /* Use it or NOT */
90	LDAP * ld; /* LDAP file desc */
91	char * servers; /* parsed servers for ldaplib failover handling */
92	char * u_basedn; /* user basedn */
93	char * g_basedn; /* group basedn */
94	char * binddn; /* binddn */
95	char * bindpw; /* bind password */
96	char * sgroup; /* server group */
97	char * fgroup; /* group filter */
98	char * filter; /* additional filter */
99	char * l_conf; /* use ldap.conf */
100	int tls; /* TLS only */
101	struct timeval b_timeout; /* bind timeout */
102	struct timeval s_timeout; /* search timeout */
103	unsigned int flags; /* misc flags (reconnection, future use?) */
104	} ldap_opt_t;
105
106	typedef struct ldap_keys {
107	struct berval ** keys; /* the public keys retrieved */
108	unsigned int num; /* number of keys */
109	} ldap_key_t;
110
111
112	/* function headers */
113	void ldap_close(ldap_opt_t *);
114	int ldap_connect(ldap_opt_t *);
115	char * ldap_parse_groups(const char *);
116	char * ldap_parse_servers(const char *);
117	void ldap_options_print(ldap_opt_t *);
118	void ldap_options_free(ldap_opt_t *);
119	void ldap_keys_free(ldap_key_t *);
120	int ldap_parse_lconf(ldap_opt_t *);
121	ldap_key_t * ldap_getuserkey(ldap_opt_t , const char );
122	int ldap_ismember(ldap_opt_t , const char );
123
124	#endif

Line 0 Link Here

(-)glpk-user-example.txt (+117 lines)
		1
		2	Post to ML -> User Made Quick Install Doc.
		3	Contribution from John Lane <john@lane.uk.net>
		4
		5	++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
		6
		7	OpenSSH LDAP keystore Patch
		8	===========================
		9
		10	NOTE: these notes are a transcript of a specific installation
		11	they work for me, your specifics may be different!
		12	from John Lane March 17th 2005 john@lane.uk.net
		13
		14	This is a patch to OpenSSH 4.0p1 to allow it to obtain users' public keys
		15	from their LDAP record as an alternative to ~/.ssh/authorized_keys.
		16
		17	(Assuming here that necessary build stuff is in $BUILD)
		18
		19	cd $BUILD/openssh-4.0p1
		20	patch -Np1 -i $BUILD/openssh-lpk-4.0p1-0.3.patch
		21	mkdir -p /var/empty &&
		22	./configure --prefix=/usr --sysconfdir=/etc/ssh \
		23	--libexecdir=/usr/sbin --with-md5-passwords --with-pam \
		24	--with-libs="-lldap" --with-cppflags="-DWITH_LDAP_PUBKEY"
		25	Now do.
		26	make &&
		27	make install
		28
		29	Add the following config to /etc/ssh/ssh_config
		30	UseLPK yes
		31	LpkServers ldap://myhost.mydomain.com
		32	LpkUserDN ou=People,dc=mydomain,dc=com
		33
		34	We need to tell sshd about the SSL keys during boot, as root's
		35	environment does not exist at that time. Edit /etc/rc.d/init.d/sshd.
		36	Change the startup code from this:
		37	echo "Starting SSH Server..."
		38	loadproc /usr/sbin/sshd
		39	;;
		40	to this:
		41	echo "Starting SSH Server..."
		42	LDAPRC="/root/.ldaprc" loadproc /usr/sbin/sshd
		43	;;
		44
		45	Re-start the sshd daemon:
		46	/etc/rc.d/init.d/sshd restart
		47
		48	Install the additional LDAP schema
		49	cp $BUILD/openssh-lpk-0.2.schema /etc/openldap/schema/openssh.schema
		50
		51	Now add the openSSH LDAP schema to /etc/openldap/slapd.conf:
		52	Add the following to the end of the existing block of schema includes
		53	include /etc/openldap/schema/openssh.schema
		54
		55	Re-start the LDAP server:
		56	/etc/rc.d/init.d/slapd restart
		57
		58	To add one or more public keys to a user, eg "testuser" :
		59	ldapsearch -x -W -Z -LLL -b "uid=testuser,ou=People,dc=mydomain,dc=com" -D
		60	"uid=testuser,ou=People,dc=mydomain,dc=com" > /tmp/testuser
		61
		62	append the following to this /tmp/testuser file
		63	objectclass: ldapPublicKey
		64	sshPublicKey: ssh-rsa
65	AAAAB3NzaC1yc2EAAAABJQAAAIB3dsrwqXqD7E4zYYrxwdDKBUQxKMioXy9pxFVai64kAPxjU9KS
66	qIo7QfkjslfsjflksjfldfkjsldfjLX/5zkzRmT28I5piGzunPv17S89z8XwSsuAoR1t86t+5dlI
67	7eZE/gVbn2UQkQq7+kdDTS2yXV6VnC52N/kKLG3ciBkBAw== General Purpose RSA Key
68
69	Then do a modify:
70	ldapmodify -x -D "uid=testuser,ou=People,dc=mydomain,dc=com" -W -f
71	/tmp/testuser -Z
72	Enter LDAP Password:
73	modifying entry "uid=testuser,ou=People,dc=mydomain,dc=com"
74	And check the modify is ok:
75	ldapsearch -x -W -Z -b "uid=testuser,ou=People,dc=mydomain,dc=com" -D
76	"uid=testuser,ou=People,dc=mydomain,dc=com"
77	Enter LDAP Password:
78	# extended LDIF
79	#
80	# LDAPv3
81	# base <uid=testuser,ou=People,dc=mydomain,dc=com> with scope sub
82	# filter: (objectclass=*)
83	# requesting: ALL
84	#
85
86	# testuser, People, mydomain.com
87	dn: uid=testuser,ou=People,dc=mydomain,dc=com
88	uid: testuser
89	cn: testuser
90	objectClass: account
91	objectClass: posixAccount
92	objectClass: top
93	objectClass: shadowAccount
94	objectClass: ldapPublicKey
95	shadowLastChange: 12757
96	shadowMax: 99999
97	shadowWarning: 7
98	loginShell: /bin/bash
99	uidNumber: 9999
100	gidNumber: 501
101	homeDirectory: /home/testuser
102	userPassword:: e1NTSEF9UDgwV1hnM1VjUDRJK0k1YnFiL1d4ZUJObXlZZ3Z3UTU=
103	sshPublicKey: ssh-rsa
104	AAAAB3NzaC1yc2EAAAABJQAAAIB3dsrwqXqD7E4zYYrxwdDKBUQxKMioXy9pxFVai64kAPxjU9KSqIo7QfkjslfsjflksjfldfkjsldfjLX/5zkzRmT28I5piGzunPv17S89z
105	8XwSsuAoR1t86t+5dlI7eZE/gVbn2UQkQq7+kdDTS2yXV6VnC52N/kKLG3ciBkBAw== General Purpose RSA Key
106
107	# search result
108	search: 3
109	result: 0 Success
110
111	# numResponses: 2
112	# numEntries: 1
113
114	Now start a ssh session to user "testuser" from usual ssh client (e.g.
115	puTTY). Login should succeed.
116
117	++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Line 0 Link Here

(-)gopenssh-lpk_openldap.schema (+19 lines)
	1	#
	2	# LDAP Public Key Patch schema for use with openssh-ldappubkey
	3	# Author: Eric AUGE <eau@phear.org>
	4	#
	5	# Based on the proposal of : Mark Ruijter
	6	#
	7
	8
	9	# octetString SYNTAX
	10	attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
	11	DESC 'MANDATORY: OpenSSH Public key'
	12	EQUALITY octetStringMatch
	13	SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
	14
	15	# printableString SYNTAX yes\|no
	16	objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
	17	DESC 'MANDATORY: OpenSSH LPK objectclass'
	18	MUST ( sshPublicKey $ uid )
	19	)

Line 0 Link Here

(-)gopenssh-lpk_sun.schema (+21 lines)
	1	#
	2	# LDAP Public Key Patch schema for use with openssh-ldappubkey
	3	# Author: Eric AUGE <eau@phear.org>
	4	#
	5	# Schema for Sun Directory Server.
	6	# Based on the original schema, modified by Stefan Fischer.
	7	#
	8
	9	dn: cn=schema
	10
	11	# octetString SYNTAX
	12	attributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
	13	DESC 'MANDATORY: OpenSSH Public key'
	14	EQUALITY octetStringMatch
	15	SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
	16
	17	# printableString SYNTAX yes\|no
	18	objectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
	19	DESC 'MANDATORY: OpenSSH LPK objectclass'
	20	MUST ( sshPublicKey $ uid )
	21	)