/* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved * * As far as I am concerned, the code I have written for this software * can be used freely for any purpose. Any derived versions of this * software must be clearly marked as such, and if the derived work is * incompatible with the protocol description in the RFC file, it must be * called by a name other than "ssh" or "Secure Shell". */ #include "includes.h" RCSID("$OpenBSD: auth1.c,v 1.22 2001/03/23 12:02:49 markus Exp $"); #include "xmalloc.h" #include "rsa.h" #include "ssh1.h" #include "packet.h" #include "buffer.h" #include "mpaux.h" #include "log.h" #include "servconf.h" #include "compat.h" #include "auth.h" #include "session.h" #include "misc.h" #include "serverloop.h" /* import */ extern ServerOptions options; #ifdef WITH_AIXAUTHENTICATE extern char *aixloginmsg; #endif /* WITH_AIXAUTHENTICATE */ /* * convert ssh auth msg type into description */ char * get_authname(int type) { static char buf[1024]; switch (type) { case SSH_CMSG_AUTH_PASSWORD: return "password"; case SSH_CMSG_AUTH_RSA: return "rsa"; case SSH_CMSG_AUTH_RHOSTS_RSA: return "rhosts-rsa"; case SSH_CMSG_AUTH_RHOSTS: return "rhosts"; case SSH_CMSG_AUTH_TIS: case SSH_CMSG_AUTH_TIS_RESPONSE: return "challenge-response"; #ifdef KRB4 case SSH_CMSG_AUTH_KERBEROS: return "kerberos"; #endif } snprintf(buf, sizeof buf, "bad-auth-msg-%d", type); return buf; } /* * read packets, try to authenticate the user and * return only if authentication is successful */ void do_authloop(Authctxt *authctxt) { int authenticated = 0; u_int bits; RSA *client_host_key; BIGNUM *n; char *client_user, *password; char info[1024]; u_int dlen; int plen, nlen, elen; int type = 0; /* Indicate that authentication is needed. */ packet_start(SSH_SMSG_FAILURE); packet_send(); packet_write_wait(); client_user = NULL; for (;;) { /* default to fail */ authenticated = 0; info[0] = '\0'; /* Get a packet from the client. */ type = packet_read(&plen); /* Process the packet. */ switch (type) { #ifdef AFS case SSH_CMSG_HAVE_KERBEROS_TGT: if (!options.kerberos_tgt_passing) { verbose("Kerberos tgt passing disabled."); break; } else { /* Accept Kerberos tgt. */ char *tgt = packet_get_string(&dlen); packet_integrity_check(plen, 4 + dlen, type); if (!auth_kerberos_tgt(pw, tgt)) verbose("Kerberos tgt REFUSED for %.100s", authctxt->user); xfree(tgt); } continue; case SSH_CMSG_HAVE_AFS_TOKEN: if (!options.afs_token_passing || !k_hasafs()) { verbose("AFS token passing disabled."); break; } else { /* Accept AFS token. */ char *token_string = packet_get_string(&dlen); packet_integrity_check(plen, 4 + dlen, type); if (!auth_afs_token(pw, token_string)) verbose("AFS token REFUSED for %.100s", authctxt->user); xfree(token_string); } continue; #endif /* AFS */ #ifdef KRB4 case SSH_CMSG_AUTH_KERBEROS: if (!options.kerberos_authentication) { verbose("Kerberos authentication disabled."); break; } else { /* Try Kerberos v4 authentication. */ KTEXT_ST auth; char *tkt_user = NULL; char *kdata = packet_get_string((u_int *) &auth.length); packet_integrity_check(plen, 4 + auth.length, type); if (authctxt->valid) { if (auth.length < MAX_KTXT_LEN) memcpy(auth.dat, kdata, auth.length); authenticated = auth_krb4(pw->pw_name, &auth, &tkt_user); if (authenticated) { snprintf(info, sizeof info, " tktuser %.100s", tkt_user); xfree(tkt_user); } } xfree(kdata); } break; #endif /* KRB4 */ case SSH_CMSG_AUTH_RSA: if (!options.rsa_authentication) { verbose("RSA authentication disabled."); break; } authctxt->how = AUTH_RSA; /* RSA authentication requested. */ n = BN_new(); packet_get_bignum(n, &nlen); packet_integrity_check(plen, nlen, type); authenticated = auth_rsa(authctxt, n); BN_clear_free(n); packet_set_interactive(1); server_loop(authctxt->pid, authctxt->master, authctxt->master, -1); exit(0); break; case SSH_CMSG_AUTH_PASSWORD: if (!options.password_authentication) { verbose("Password authentication disabled."); break; } authctxt->how = AUTH_PASSWD; /* * Read user password. It is in plain text, but was * transmitted over the encrypted channel so it is * not visible to an outside observer. */ password = packet_get_string(&dlen); packet_integrity_check(plen, 4 + dlen, type); /* Try authentication with the password. */ authenticated = auth_password(authctxt, password); break; case SSH_CMSG_AUTH_TIS: debug("rcvd SSH_CMSG_AUTH_TIS"); if (options.challenge_reponse_authentication == 1) { char *challenge = get_challenge(authctxt, authctxt->style); if (challenge != NULL) { debug("sending challenge '%s'", challenge); packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE); packet_put_cstring(challenge); packet_send(); packet_write_wait(); continue; } } break; case SSH_CMSG_AUTH_TIS_RESPONSE: debug("rcvd SSH_CMSG_AUTH_TIS_RESPONSE"); if (options.challenge_reponse_authentication == 1) { char *response = packet_get_string(&dlen); debug("got response '%s'", response); packet_integrity_check(plen, 4 + dlen, type); authenticated = verify_response(authctxt, response); memset(response, 'r', dlen); xfree(response); } break; default: /* * Any unknown messages will be ignored (and failure * returned) during authentication. */ log("Unknown message during authentication: type %d", type); break; } #ifdef BSD_AUTH if (authctxt->as) { auth_close(authctxt->as); authctxt->as = NULL; } #endif authctxt->valid = 1; if (client_user != NULL) { xfree(client_user); client_user = NULL; } if (authenticated) return; packet_start(SSH_SMSG_FAILURE); packet_send(); packet_write_wait(); } } /* * Performs authentication of an incoming connection. Session key has already * been exchanged and encryption is enabled. */ void do_authentication() { Authctxt *authctxt; struct passwd *pw; int plen; u_int ulen; char *user, *style = NULL; /* Get the name of the user that we wish to log in as. */ packet_read_expect(&plen, SSH_CMSG_USER); /* Get the user name. */ user = packet_get_string(&ulen); packet_integrity_check(plen, (4 + ulen), SSH_CMSG_USER); if ((style = strchr(user, ':')) != NULL) *style++ = 0; authctxt = authctxt_new(); authctxt->user = user; authctxt->sharp.login = strdup(user); authctxt->style = style; /* * Loop until the user has been authenticated or the connection is * closed, do_authloop() returns only if authentication is successful */ do_authloop(authctxt); debug(":->%s", authctxt->sharp.login); /* The user has been authenticated and accepted. */ packet_start(SSH_SMSG_SUCCESS); packet_send(); packet_write_wait(); /* Perform session preparation. */ do_authenticated(authctxt); return; }