- otto@cvs.openbsd.org 2005/01/21 08:32:02

     [auth-passwd.c sshd.c]
     Warn in advance for password and account expiry; initialize loginmsg
     buffer earlier and clear it after privsep fork. ok and help dtucker@
     markus@

1 files changed, 50 insertions, 1 deletions

diff --git a/auth-passwd.c b/auth-passwd.c
index 7a68e0562..2e5fbc73a 100644
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -36,17 +36,27 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth-passwd.c,v 1.31 2004/01/30 09:48:57 markus Exp $");
+RCSID("$OpenBSD: auth-passwd.c,v 1.32 2005/01/21 08:32:02 otto Exp $");
 
 #include "packet.h"
+#include "buffer.h"
 #include "log.h"
 #include "servconf.h"
 #include "auth.h"
 #include "auth-options.h"
 
+extern Buffer loginmsg;
 extern ServerOptions options;
 int sys_auth_passwd(Authctxt *, const char *);
 
+#ifdef HAVE_LOGIN_CAP
+extern login_cap_t *lc;
+#endif
+
+
+#define DAY             (24L * 60 * 60) /* 1 day in seconds */
+#define TWO_WEEKS       (2L * 7 * DAY)  /* 2 weeks in seconds */
+
 void
 disable_forwarding(void)
 {
@@ -111,11 +121,46 @@ auth_password(Authctxt *authctxt, const char *password)
 }
 
 #ifdef BSD_AUTH
+static void
+warn_expiry(Authctxt *authctxt, auth_session_t *as)
+{
+        char buf[256];
+        quad_t pwtimeleft, actimeleft, daysleft, pwwarntime, acwarntime;
+
+        pwwarntime = acwarntime = TWO_WEEKS;
+
+        pwtimeleft = auth_check_change(as);
+        actimeleft = auth_check_expire(as);
+#if HAVE_LOGIN_CAP
+        if (authctxt->valid) {
+                pwwarntime = login_getcaptime(lc, "password-warn", TWO_WEEKS,
+                    TWO_WEEKS);
+                acwarntime = login_getcaptime(lc, "expire-warn", TWO_WEEKS,
+                    TWO_WEEKS);
+        }
+#endif
+        if (pwtimeleft != 0 && pwtimeleft < pwwarntime) {
+                daysleft = pwtimeleft / DAY + 1;
+                snprintf(buf, sizeof(buf),
+                    "Your password will expire in %lld day%s.\n",
+                    daysleft, daysleft == 1 ? "" : "s");
+                buffer_append(&loginmsg, buf, strlen(buf));
+        }
+        if (actimeleft != 0 && actimeleft < acwarntime) {
+                daysleft = actimeleft / DAY + 1;
+                snprintf(buf, sizeof(buf),
+                    "Your account will expire in %lld day%s.\n",
+                    daysleft, daysleft == 1 ? "" : "s");
+                buffer_append(&loginmsg, buf, strlen(buf));
+        }
+}
+
 int
 sys_auth_passwd(Authctxt *authctxt, const char *password)
 {
         struct passwd *pw = authctxt->pw;
         auth_session_t *as;
+        static int expire_checked = 0;
 
         as = auth_usercheck(pw->pw_name, authctxt->style, "auth-ssh",
             (char *)password);
@@ -125,6 +170,10 @@ sys_auth_passwd(Authctxt *authctxt, const char *password)
                 authctxt->force_pwchange = 1;
                 return (1);
         } else {
+                if (!expire_checked) {
+                        expire_checked = 1;
+                        warn_expiry(authctxt, as);
+                }
                 return (auth_close(as));
         }
 }