Attachment #540 for bug #14

View | Details | Raw Unified | Return to bug 14 | Differences between

and this patch

Lines 85-91 SSHDOBJS=sshd.o auth-rhosts.o auth-passw Link Here

(-)Makefile.in (-1 / +1 lines)
85	kexdhs.o kexgexs.o \	85	kexdhs.o kexgexs.o \
86	auth-krb5.o \	86	auth-krb5.o \
87	auth2-gss.o gss-serv.o gss-serv-krb5.o \	87	auth2-gss.o gss-serv.o gss-serv-krb5.o \
88	loginrec.o auth-pam.o auth-sia.o md5crypt.o	88	loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o
89		89
90	MANPAGES = scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out	90	MANPAGES = scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out sshd_config.5.out ssh_config.5.out
91	MANPAGES_IN = scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5	91	MANPAGES_IN = scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 sshd_config.5 ssh_config.5

Lines 46-51 RCSID("$OpenBSD: auth-passwd.c,v 1.31 20 Link Here

(-)auth-passwd.c (+8 lines)
46	#ifdef WITH_AIXAUTHENTICATE	46	#ifdef WITH_AIXAUTHENTICATE
47	# include "canohost.h"	47	# include "canohost.h"
48	#endif	48	#endif
		49	#include "auth-shadow.h"
49		50
50	extern ServerOptions options;	51	extern ServerOptions options;
51	int sys_auth_passwd(Authctxt , const char );	52	int sys_auth_passwd(Authctxt , const char );
Lines 100-105 auth_password(Authctxt *authctxt, const Link Here
100	return ok;	101	return ok;
101	}	102	}
102	#endif	103	#endif
		104	#ifdef USE_SHADOW
		105	if (auth_shadow_pwexpired(authctxt)) {
		106	disable_forwarding();
		107	authctxt->force_pwchange = 1;
		108	}
		109	#endif
		110
103	return (sys_auth_passwd(authctxt, password) && ok);	111	return (sys_auth_passwd(authctxt, password) && ok);
104	}	112	}
105		113




/*
 * Copyright (c) 2004 Darren Tucker.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"
RCSID("$Id$");

#ifdef USE_SHADOW
#include <shadow.h>

#include "auth.h"
#include "auth-shadow.h"
#include "buffer.h"
#include "log.h"

#define DAY	(24L * 60 * 60) /* 1 day in seconds */

extern Buffer loginmsg;

/*
 * Check shadow password expiry.
 * Returns: 1 = password expired, 0 = password not expired
 */
int
auth_shadow_pwexpired(Authctxt *ctxt)
{
	struct spwd *spw = NULL;
	const char *user = ctxt->pw->pw_name;
	time_t today;

	if ((spw = getspnam(user)) == NULL) {
		error("Could not get shadow information for %.100s", user);
		return 0;
	}

	today = time(NULL) / DAY;
	debug3("%s: today %d sp_lstchg %d sp_max %d", __func__, (int)today,
	    (int)spw->sp_lstchg, (int)spw->sp_max);

#if defined(__hpux) && !defined(HAVE_SECUREWARE)
	if (iscomsec() && spw->sp_min == 0 && spw->sp_max == 0 &&
	    spw->sp_warn == 0)
		return 0;	/* HP-UX Trusted Mode: expiry disabled */
#endif

	/* TODO: Add code to put expiry warnings into loginmsg */

	if (spw->sp_lstchg == 0) {
		logit("User %.100s password has expired (root forced)", user);
		return 1;
	}

	if (spw->sp_max != -1 && today > spw->sp_lstchg + spw->sp_max) {
		logit("User %.100s password has expired (password aged)", user);
		return 1;
	}

	return 0;
}
#endif	/* USE_SHADOW */




/* $Id$ */

/*
 * Copyright (c) 2004 Darren Tucker.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

int auth_shadow_pwexpired(Authctxt *);





			logit("Account %.100s has expired", pw->pw_name);
			return 0;
		}

#if defined(__hpux) && !defined(HAVE_SECUREWARE)
		if (iscomsec() && spw->sp_min == 0 && spw->sp_max == 0 &&
		     spw->sp_warn == 0)
			disabled = 1;   /* Trusted Mode: expiry disabled */
#endif

		if (!disabled && spw->sp_lstchg == 0) {
			logit("User %.100s password has expired (root forced)",
			    pw->pw_name);
			return 0;
		}

		if (!disabled && spw->sp_max != -1 &&
		    today > spw->sp_lstchg + spw->sp_max) {
			logit("User %.100s password has expired (password aged)",
			    pw->pw_name);
			return 0;
		}
	}
#endif /* HAS_SHADOW_EXPIRE */
#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */

Lines 585-590 struct winsize { Link Here

(-)defines.h (+3 lines)
585	# endif	585	# endif
586	#endif	586	#endif
587		587
		588	#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
		589	# define USE_SHADOW
		590	#endif
588		591
589	/* The login() library function in libutil is first choice */	592	/* The login() library function in libutil is first choice */
590	#if defined(HAVE_LOGIN) && !defined(DISABLE_LOGIN)	593	#if defined(HAVE_LOGIN) && !defined(DISABLE_LOGIN)

Return to bug 14

Added Link Here

(-)auth-shadow.c (+80 lines)
1	/*
2	* Copyright (c) 2004 Darren Tucker. All rights reserved.
3	*
4	* Redistribution and use in source and binary forms, with or without
5	* modification, are permitted provided that the following conditions
6	* are met:
7	* 1. Redistributions of source code must retain the above copyright
8	* notice, this list of conditions and the following disclaimer.
9	* 2. Redistributions in binary form must reproduce the above copyright
10	* notice, this list of conditions and the following disclaimer in the
11	* documentation and/or other materials provided with the distribution.
12	*
13	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23	*/
24
25	#include "includes.h"
26	RCSID("$Id$");
27
28	#ifdef USE_SHADOW
29	#include <shadow.h>
30
31	#include "auth.h"
32	#include "auth-shadow.h"
33	#include "buffer.h"
34	#include "log.h"
35
36	#define DAY (24L * 60 * 60) /* 1 day in seconds */
37
38	extern Buffer loginmsg;
39
40	/*
41	* Check shadow password expiry.
42	* Returns: 1 = password expired, 0 = password not expired
43	*/
44	int
45	auth_shadow_pwexpired(Authctxt *ctxt)
46	{
47	struct spwd *spw = NULL;
48	const char *user = ctxt->pw->pw_name;
49	time_t today;
50
51	if ((spw = getspnam(user)) == NULL) {
52	error("Could not get shadow information for %.100s", user);
53	return 0;
54	}
55
56	today = time(NULL) / DAY;
57	debug3("%s: today %d sp_lstchg %d sp_max %d", __func__, (int)today,
58	(int)spw->sp_lstchg, (int)spw->sp_max);
59
60	#if defined(__hpux) && !defined(HAVE_SECUREWARE)
61	if (iscomsec() && spw->sp_min == 0 && spw->sp_max == 0 &&
62	spw->sp_warn == 0)
63	return 0; /* HP-UX Trusted Mode: expiry disabled */
64	#endif
65
66	/* TODO: Add code to put expiry warnings into loginmsg */
67
68	if (spw->sp_lstchg == 0) {
69	logit("User %.100s password has expired (root forced)", user);
70	return 1;
71	}
72
73	if (spw->sp_max != -1 && today > spw->sp_lstchg + spw->sp_max) {
74	logit("User %.100s password has expired (password aged)", user);
75	return 1;
76	}
77
78	return 0;
79	}
80	#endif /* USE_SHADOW */

Added Link Here

(-)auth-shadow.h (+28 lines)
1	/* $Id$ */
2
3	/*
4	* Copyright (c) 2004 Darren Tucker. All rights reserved.
5	*
6	* Redistribution and use in source and binary forms, with or without
7	* modification, are permitted provided that the following conditions
8	* are met:
9	* 1. Redistributions of source code must retain the above copyright
10	* notice, this list of conditions and the following disclaimer.
11	* 2. Redistributions in binary form must reproduce the above copyright
12	* notice, this list of conditions and the following disclaimer in the
13	* documentation and/or other materials provided with the distribution.
14	*
15	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25	*/
26
27	int auth_shadow_pwexpired(Authctxt *);
28

Lines 106-130 allowed_user(struct passwd * pw) Link Here

(-)auth.c (-19 lines)
106	logit("Account %.100s has expired", pw->pw_name);	106	logit("Account %.100s has expired", pw->pw_name);
107	return 0;	107	return 0;
108	}	108	}
109
110	#if defined(__hpux) && !defined(HAVE_SECUREWARE)
111	if (iscomsec() && spw->sp_min == 0 && spw->sp_max == 0 &&
112	spw->sp_warn == 0)
113	disabled = 1; /* Trusted Mode: expiry disabled */
114	#endif
115
116	if (!disabled && spw->sp_lstchg == 0) {
117	logit("User %.100s password has expired (root forced)",
118	pw->pw_name);
119	return 0;
120	}
121
122	if (!disabled && spw->sp_max != -1 &&
123	today > spw->sp_lstchg + spw->sp_max) {
124	logit("User %.100s password has expired (password aged)",
125	pw->pw_name);
126	return 0;
127	}
128	}	109	}
129	#endif /* HAS_SHADOW_EXPIRE */	110	#endif /* HAS_SHADOW_EXPIRE */
130	#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */	111	#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */