summaryrefslogtreecommitdiff
path: root/sshd.c
diff options
context:
space:
mode:
authorDamien Miller <djm@mindrot.org>2000-04-01 11:09:21 +1000
committerDamien Miller <djm@mindrot.org>2000-04-01 11:09:21 +1000
commitb38eff8e4ff901df9cf1113a9f14d64c3565a401 (patch)
tree9a856898f15f7760ed95c5d47789a6f954b4ad2f /sshd.c
parent450a7a1ff40fe7c2d84c93b83cf2df53445d807d (diff)
- Big OpenBSD CVS update (mainly beginnings of SSH2 infrastructure)
- [auth.c session.c sshd.c auth.h] split sshd.c -> auth.c session.c sshd.c plus cleanup and goto-removal - [bufaux.c bufaux.h] support ssh2 bignums - [channels.c channels.h clientloop.c sshd.c nchan.c nchan.h packet.c] [readconf.c ssh.c ssh.h serverloop.c] replace big switch() with function tables (prepare for ssh2) - [ssh2.h] ssh2 message type codes - [sshd.8] reorder Xr to avoid cutting - [serverloop.c] close(fdin) if fdin != fdout, shutdown otherwise, ok theo@ - [channels.c] missing close allow bigger packets - [cipher.c cipher.h] support ssh2 ciphers - [compress.c] cleanup, less code - [dispatch.c dispatch.h] function tables for different message types - [log-server.c] do not log() if debuggin to stderr rename a cpp symbol, to avoid param.h collision - [mpaux.c] KNF - [nchan.c] sync w/ channels.c
Diffstat (limited to 'sshd.c')
-rw-r--r--sshd.c1855
1 files changed, 110 insertions, 1745 deletions
diff --git a/sshd.c b/sshd.c
index bf951212c..6ec413d6f 100644
--- a/sshd.c
+++ b/sshd.c
@@ -11,19 +11,37 @@
11 */ 11 */
12 12
13#include "includes.h" 13#include "includes.h"
14RCSID("$OpenBSD: sshd.c,v 1.94 2000/03/23 22:15:34 markus Exp $"); 14RCSID("$OpenBSD: sshd.c,v 1.96 2000/03/28 21:15:45 markus Exp $");
15 15
16#include "xmalloc.h" 16#include "xmalloc.h"
17#include "rsa.h" 17#include "rsa.h"
18#include "ssh.h" 18#include "ssh.h"
19#include "pty.h" 19#include "pty.h"
20#include "packet.h" 20#include "packet.h"
21#include "buffer.h"
22#include "cipher.h" 21#include "cipher.h"
23#include "mpaux.h" 22#include "mpaux.h"
24#include "servconf.h" 23#include "servconf.h"
25#include "uidswap.h" 24#include "uidswap.h"
26#include "compat.h" 25#include "compat.h"
26#include "buffer.h"
27
28#ifdef HAVE_OPENSSL
29# include <openssl/dh.h>
30# include <openssl/bn.h>
31# include <openssl/hmac.h>
32# include <openssl/dsa.h>
33# include <openssl/rsa.h>
34#endif
35#ifdef HAVE_SSL
36# include <ssl/dh.h>
37# include <ssl/bn.h>
38# include <ssl/hmac.h>
39# include <ssl/dsa.h>
40# include <ssl/rsa.h>
41#endif
42#include "key.h"
43
44#include "auth.h"
27 45
28#ifdef LIBWRAP 46#ifdef LIBWRAP
29#include <tcpd.h> 47#include <tcpd.h>
@@ -36,9 +54,6 @@ int deny_severity = LOG_WARNING;
36#define O_NOCTTY 0 54#define O_NOCTTY 0
37#endif 55#endif
38 56
39/* Local Xauthority file. */
40static char *xauthfile = NULL;
41
42/* Server configuration options. */ 57/* Server configuration options. */
43ServerOptions options; 58ServerOptions options;
44 59
@@ -88,21 +103,7 @@ int num_listen_socks = 0;
88 * sshd will skip the version-number exchange 103 * sshd will skip the version-number exchange
89 */ 104 */
90char *client_version_string = NULL; 105char *client_version_string = NULL;
91 106char *server_version_string = NULL;
92/* Flags set in auth-rsa from authorized_keys flags. These are set in auth-rsa.c. */
93int no_port_forwarding_flag = 0;
94int no_agent_forwarding_flag = 0;
95int no_x11_forwarding_flag = 0;
96int no_pty_flag = 0;
97
98/* RSA authentication "command=" option. */
99char *forced_command = NULL;
100
101/* RSA authentication "environment=" options. */
102struct envstring *custom_environment = NULL;
103
104/* Session id for the current session. */
105unsigned char session_id[16];
106 107
107/* 108/*
108 * Any really sensitive data in the application is contained in this 109 * Any really sensitive data in the application is contained in this
@@ -130,43 +131,11 @@ int received_sighup = 0;
130 the private key. */ 131 the private key. */
131RSA *public_key; 132RSA *public_key;
132 133
133/* Prototypes for various functions defined later in this file. */ 134/* session identifier, used by RSA-auth */
134void do_ssh_kex(); 135unsigned char session_id[16];
135void do_authentication();
136void do_authloop(struct passwd * pw);
137void do_fake_authloop(char *user);
138void do_authenticated(struct passwd * pw);
139void do_exec_pty(const char *command, int ptyfd, int ttyfd,
140 const char *ttyname, struct passwd * pw, const char *term,
141 const char *display, const char *auth_proto,
142 const char *auth_data);
143void do_exec_no_pty(const char *command, struct passwd * pw,
144 const char *display, const char *auth_proto,
145 const char *auth_data);
146void do_child(const char *command, struct passwd * pw, const char *term,
147 const char *display, const char *auth_proto,
148 const char *auth_data, const char *ttyname);
149 136
150/* 137/* Prototypes for various functions defined later in this file. */
151 * Remove local Xauthority file. 138void do_ssh1_kex();
152 */
153void
154xauthfile_cleanup_proc(void *ignore)
155{
156 debug("xauthfile_cleanup_proc called");
157
158 if (xauthfile != NULL) {
159 char *p;
160 unlink(xauthfile);
161 p = strrchr(xauthfile, '/');
162 if (p != NULL) {
163 *p = '\0';
164 rmdir(xauthfile);
165 }
166 xfree(xauthfile);
167 xauthfile = NULL;
168 }
169}
170 139
171/* 140/*
172 * Close all listening sockets 141 * Close all listening sockets
@@ -250,35 +219,6 @@ grace_alarm_handler(int sig)
250} 219}
251 220
252/* 221/*
253 * convert ssh auth msg type into description
254 */
255char *
256get_authname(int type)
257{
258 static char buf[1024];
259 switch (type) {
260 case SSH_CMSG_AUTH_PASSWORD:
261 return "password";
262 case SSH_CMSG_AUTH_RSA:
263 return "rsa";
264 case SSH_CMSG_AUTH_RHOSTS_RSA:
265 return "rhosts-rsa";
266 case SSH_CMSG_AUTH_RHOSTS:
267 return "rhosts";
268#ifdef KRB4
269 case SSH_CMSG_AUTH_KERBEROS:
270 return "kerberos";
271#endif
272#ifdef SKEY
273 case SSH_CMSG_AUTH_TIS_RESPONSE:
274 return "s/key";
275#endif
276 }
277 snprintf(buf, sizeof buf, "bad-auth-msg-%d", type);
278 return buf;
279}
280
281/*
282 * Signal handler for the key regeneration alarm. Note that this 222 * Signal handler for the key regeneration alarm. Note that this
283 * alarm only occurs in the daemon waiting for connections, and it does not 223 * alarm only occurs in the daemon waiting for connections, and it does not
284 * do anything with the private key or random state before forking. 224 * do anything with the private key or random state before forking.
@@ -315,6 +255,88 @@ key_regeneration_alarm(int sig)
315 errno = save_errno; 255 errno = save_errno;
316} 256}
317 257
258void
259sshd_exchange_identification(int sock_in, int sock_out)
260{
261 int i;
262 int remote_major, remote_minor;
263 char *s;
264 char buf[256]; /* Must not be larger than remote_version. */
265 char remote_version[256]; /* Must be at least as big as buf. */
266
267 snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n",
268 PROTOCOL_MAJOR, PROTOCOL_MINOR, SSH_VERSION);
269 server_version_string = xstrdup(buf);
270
271 if (client_version_string == NULL) {
272 /* Send our protocol version identification. */
273 if (atomicio(write, sock_out, server_version_string, strlen(server_version_string))
274 != strlen(server_version_string)) {
275 log("Could not write ident string to %s.", get_remote_ipaddr());
276 fatal_cleanup();
277 }
278
279 /* Read other side\'s version identification. */
280 for (i = 0; i < sizeof(buf) - 1; i++) {
281 if (read(sock_in, &buf[i], 1) != 1) {
282 log("Did not receive ident string from %s.", get_remote_ipaddr());
283 fatal_cleanup();
284 }
285 if (buf[i] == '\r') {
286 buf[i] = '\n';
287 buf[i + 1] = 0;
288 continue;
289 /*break; XXX eat \r */
290 }
291 if (buf[i] == '\n') {
292 /* buf[i] == '\n' */
293 buf[i + 1] = 0;
294 break;
295 }
296 }
297 buf[sizeof(buf) - 1] = 0;
298 client_version_string = xstrdup(buf);
299 }
300
301 /*
302 * Check that the versions match. In future this might accept
303 * several versions and set appropriate flags to handle them.
304 */
305 if (sscanf(client_version_string, "SSH-%d.%d-%[^\n]\n",
306 &remote_major, &remote_minor, remote_version) != 3) {
307 s = "Protocol mismatch.\n";
308 (void) atomicio(write, sock_out, s, strlen(s));
309 close(sock_in);
310 close(sock_out);
311 log("Bad protocol version identification '%.100s' from %s",
312 client_version_string, get_remote_ipaddr());
313 fatal_cleanup();
314 }
315 debug("Client protocol version %d.%d; client software version %.100s",
316 remote_major, remote_minor, remote_version);
317
318 switch(remote_major) {
319 case 1:
320 if (remote_minor < 3) {
321 packet_disconnect("Your ssh version is too old and"
322 "is no longer supported. Please install a newer version.");
323 } else if (remote_minor == 3) {
324 /* note that this disables agent-forwarding */
325 enable_compat13();
326 }
327 break;
328 default:
329 s = "Protocol major versions differ.\n";
330 (void) atomicio(write, sock_out, s, strlen(s));
331 close(sock_in);
332 close(sock_out);
333 log("Protocol major versions differ for %s: %d vs. %d",
334 get_remote_ipaddr(), PROTOCOL_MAJOR, remote_major);
335 fatal_cleanup();
336 break;
337 }
338}
339
318/* 340/*
319 * Main program for the daemon. 341 * Main program for the daemon.
320 */ 342 */
@@ -325,12 +347,9 @@ main(int ac, char **av)
325 extern int optind; 347 extern int optind;
326 int opt, sock_in = 0, sock_out = 0, newsock, i, fdsetsz, pid, on = 1; 348 int opt, sock_in = 0, sock_out = 0, newsock, i, fdsetsz, pid, on = 1;
327 socklen_t fromlen; 349 socklen_t fromlen;
328 int remote_major, remote_minor;
329 int silentrsa = 0; 350 int silentrsa = 0;
330 fd_set *fdset; 351 fd_set *fdset;
331 struct sockaddr_storage from; 352 struct sockaddr_storage from;
332 char buf[100]; /* Must not be larger than remote_version. */
333 char remote_version[100]; /* Must be at least as big as buf. */
334 const char *remote_ip; 353 const char *remote_ip;
335 int remote_port; 354 int remote_port;
336 char *comment; 355 char *comment;
@@ -794,73 +813,7 @@ main(int ac, char **av)
794 if (!debug_flag) 813 if (!debug_flag)
795 alarm(options.login_grace_time); 814 alarm(options.login_grace_time);
796 815
797 if (client_version_string != NULL) { 816 sshd_exchange_identification(sock_in, sock_out);
798 /* we are exec'ed by sshd2, so skip exchange of protocol version */
799 strlcpy(buf, client_version_string, sizeof(buf));
800 } else {
801 /* Send our protocol version identification. */
802 snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n",
803 PROTOCOL_MAJOR, PROTOCOL_MINOR, SSH_VERSION);
804 if (atomicio(write, sock_out, buf, strlen(buf)) != strlen(buf)) {
805 log("Could not write ident string to %s.", remote_ip);
806 fatal_cleanup();
807 }
808
809 /* Read other side\'s version identification. */
810 for (i = 0; i < sizeof(buf) - 1; i++) {
811 if (read(sock_in, &buf[i], 1) != 1) {
812 log("Did not receive ident string from %s.", remote_ip);
813 fatal_cleanup();
814 }
815 if (buf[i] == '\r') {
816 buf[i] = '\n';
817 buf[i + 1] = 0;
818 break;
819 }
820 if (buf[i] == '\n') {
821 /* buf[i] == '\n' */
822 buf[i + 1] = 0;
823 break;
824 }
825 }
826 buf[sizeof(buf) - 1] = 0;
827 }
828
829 /*
830 * Check that the versions match. In future this might accept
831 * several versions and set appropriate flags to handle them.
832 */
833 if (sscanf(buf, "SSH-%d.%d-%[^\n]\n", &remote_major, &remote_minor,
834 remote_version) != 3) {
835 char *s = "Protocol mismatch.\n";
836
837 (void) atomicio(write, sock_out, s, strlen(s));
838 close(sock_in);
839 close(sock_out);
840 log("Bad protocol version identification '%.100s' from %s",
841 buf, remote_ip);
842 fatal_cleanup();
843 }
844 debug("Client protocol version %d.%d; client software version %.100s",
845 remote_major, remote_minor, remote_version);
846 if (remote_major != PROTOCOL_MAJOR) {
847 char *s = "Protocol major versions differ.\n";
848
849 (void) atomicio(write, sock_out, s, strlen(s));
850 close(sock_in);
851 close(sock_out);
852 log("Protocol major versions differ for %s: %d vs. %d",
853 remote_ip, PROTOCOL_MAJOR, remote_major);
854 fatal_cleanup();
855 }
856 /* Check that the client has sufficiently high software version. */
857 if (remote_major == 1 && remote_minor < 3)
858 packet_disconnect("Your ssh version is too old and is no longer supported. Please install a newer version.");
859
860 if (remote_major == 1 && remote_minor == 3) {
861 /* note that this disables agent-forwarding */
862 enable_compat13();
863 }
864 /* 817 /*
865 * Check that the connection comes from a privileged port. Rhosts- 818 * Check that the connection comes from a privileged port. Rhosts-
866 * and Rhosts-RSA-Authentication only make sense from priviledged 819 * and Rhosts-RSA-Authentication only make sense from priviledged
@@ -884,8 +837,7 @@ main(int ac, char **av)
884 packet_set_nonblocking(); 837 packet_set_nonblocking();
885 838
886 /* perform the key exchange */ 839 /* perform the key exchange */
887 do_ssh_kex(); 840 do_ssh1_kex();
888
889 /* authenticate user and start session */ 841 /* authenticate user and start session */
890 do_authentication(); 842 do_authentication();
891 843
@@ -895,10 +847,6 @@ main(int ac, char **av)
895 (void) dest_tkt(); 847 (void) dest_tkt();
896#endif /* KRB4 */ 848#endif /* KRB4 */
897 849
898 /* Cleanup user's local Xauthority file. */
899 if (xauthfile)
900 xauthfile_cleanup_proc(NULL);
901
902 /* The connection has been terminated. */ 850 /* The connection has been terminated. */
903 verbose("Closing connection to %.100s", remote_ip); 851 verbose("Closing connection to %.100s", remote_ip);
904 852
@@ -914,7 +862,7 @@ main(int ac, char **av)
914 * SSH1 key exchange 862 * SSH1 key exchange
915 */ 863 */
916void 864void
917do_ssh_kex() 865do_ssh1_kex()
918{ 866{
919 int i, len; 867 int i, len;
920 int plen, slen; 868 int plen, slen;
@@ -1101,1586 +1049,3 @@ do_ssh_kex()
1101 packet_send(); 1049 packet_send();
1102 packet_write_wait(); 1050 packet_write_wait();
1103} 1051}
1104
1105
1106/*
1107 * Check if the user is allowed to log in via ssh. If user is listed in
1108 * DenyUsers or user's primary group is listed in DenyGroups, false will
1109 * be returned. If AllowUsers isn't empty and user isn't listed there, or
1110 * if AllowGroups isn't empty and user isn't listed there, false will be
1111 * returned.
1112 * If the user's shell is not executable, false will be returned.
1113 * Otherwise true is returned.
1114 */
1115static int
1116allowed_user(struct passwd * pw)
1117{
1118 struct stat st;
1119 struct group *grp;
1120 int i;
1121#ifdef WITH_AIXAUTHENTICATE
1122 char *loginmsg;
1123#endif /* WITH_AIXAUTHENTICATE */
1124
1125 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
1126 if (!pw)
1127 return 0;
1128
1129 /* deny if shell does not exists or is not executable */
1130 if (stat(pw->pw_shell, &st) != 0)
1131 return 0;
1132 if (!((st.st_mode & S_IFREG) && (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP))))
1133 return 0;
1134
1135 /* Return false if user is listed in DenyUsers */
1136 if (options.num_deny_users > 0) {
1137 if (!pw->pw_name)
1138 return 0;
1139 for (i = 0; i < options.num_deny_users; i++)
1140 if (match_pattern(pw->pw_name, options.deny_users[i]))
1141 return 0;
1142 }
1143 /* Return false if AllowUsers isn't empty and user isn't listed there */
1144 if (options.num_allow_users > 0) {
1145 if (!pw->pw_name)
1146 return 0;
1147 for (i = 0; i < options.num_allow_users; i++)
1148 if (match_pattern(pw->pw_name, options.allow_users[i]))
1149 break;
1150 /* i < options.num_allow_users iff we break for loop */
1151 if (i >= options.num_allow_users)
1152 return 0;
1153 }
1154 /* Get the primary group name if we need it. Return false if it fails */
1155 if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
1156 grp = getgrgid(pw->pw_gid);
1157 if (!grp)
1158 return 0;
1159
1160 /* Return false if user's group is listed in DenyGroups */
1161 if (options.num_deny_groups > 0) {
1162 if (!grp->gr_name)
1163 return 0;
1164 for (i = 0; i < options.num_deny_groups; i++)
1165 if (match_pattern(grp->gr_name, options.deny_groups[i]))
1166 return 0;
1167 }
1168 /*
1169 * Return false if AllowGroups isn't empty and user's group
1170 * isn't listed there
1171 */
1172 if (options.num_allow_groups > 0) {
1173 if (!grp->gr_name)
1174 return 0;
1175 for (i = 0; i < options.num_allow_groups; i++)
1176 if (match_pattern(grp->gr_name, options.allow_groups[i]))
1177 break;
1178 /* i < options.num_allow_groups iff we break for
1179 loop */
1180 if (i >= options.num_allow_groups)
1181 return 0;
1182 }
1183 }
1184
1185#ifdef WITH_AIXAUTHENTICATE
1186 if (loginrestrictions(pw->pw_name,S_LOGIN,NULL,&loginmsg) != 0)
1187 return 0;
1188#endif /* WITH_AIXAUTHENTICATE */
1189
1190 /* We found no reason not to let this user try to log on... */
1191 return 1;
1192}
1193
1194/*
1195 * Performs authentication of an incoming connection. Session key has already
1196 * been exchanged and encryption is enabled.
1197 */
1198void
1199do_authentication()
1200{
1201 struct passwd *pw, pwcopy;
1202 int plen;
1203 unsigned int ulen;
1204 char *user;
1205
1206 /* Get the name of the user that we wish to log in as. */
1207 packet_read_expect(&plen, SSH_CMSG_USER);
1208
1209 /* Get the user name. */
1210 user = packet_get_string(&ulen);
1211 packet_integrity_check(plen, (4 + ulen), SSH_CMSG_USER);
1212
1213 setproctitle("%s", user);
1214
1215#ifdef WITH_AIXAUTHENTICATE
1216 char *loginmsg;
1217#endif /* WITH_AIXAUTHENTICATE */
1218
1219#ifdef AFS
1220 /* If machine has AFS, set process authentication group. */
1221 if (k_hasafs()) {
1222 k_setpag();
1223 k_unlog();
1224 }
1225#endif /* AFS */
1226
1227 /* Verify that the user is a valid user. */
1228 pw = getpwnam(user);
1229 if (!pw || !allowed_user(pw))
1230 do_fake_authloop(user);
1231 xfree(user);
1232
1233 /* Take a copy of the returned structure. */
1234 memset(&pwcopy, 0, sizeof(pwcopy));
1235 pwcopy.pw_name = xstrdup(pw->pw_name);
1236 pwcopy.pw_passwd = xstrdup(pw->pw_passwd);
1237 pwcopy.pw_uid = pw->pw_uid;
1238 pwcopy.pw_gid = pw->pw_gid;
1239 pwcopy.pw_dir = xstrdup(pw->pw_dir);
1240 pwcopy.pw_shell = xstrdup(pw->pw_shell);
1241 pw = &pwcopy;
1242
1243#ifdef USE_PAM
1244 start_pam(pw);
1245#endif
1246
1247 /*
1248 * If we are not running as root, the user must have the same uid as
1249 * the server.
1250 */
1251 if (getuid() != 0 && pw->pw_uid != getuid())
1252 packet_disconnect("Cannot change user when server not running as root.");
1253
1254 debug("Attempting authentication for %.100s.", pw->pw_name);
1255
1256 /* If the user has no password, accept authentication immediately. */
1257 if (options.password_authentication &&
1258#ifdef KRB4
1259 (!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
1260#endif /* KRB4 */
1261#ifdef USE_PAM
1262 auth_pam_password(pw, "")) {
1263#else /* USE_PAM */
1264 auth_password(pw, "")) {
1265#endif /* USE_PAM */
1266 /* Authentication with empty password succeeded. */
1267 log("Login for user %s from %.100s, accepted without authentication.",
1268 pw->pw_name, get_remote_ipaddr());
1269 } else {
1270 /* Loop until the user has been authenticated or the
1271 connection is closed, do_authloop() returns only if
1272 authentication is successfull */
1273 do_authloop(pw);
1274 }
1275
1276 /* The user has been authenticated and accepted. */
1277#ifdef WITH_AIXAUTHENTICATE
1278 loginsuccess(user,get_canonical_hostname(),"ssh",&loginmsg);
1279#endif /* WITH_AIXAUTHENTICATE */
1280 packet_start(SSH_SMSG_SUCCESS);
1281 packet_send();
1282 packet_write_wait();
1283
1284 /* Perform session preparation. */
1285 do_authenticated(pw);
1286}
1287
1288#define AUTH_FAIL_MAX 6
1289#define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2)
1290#define AUTH_FAIL_MSG "Too many authentication failures for %.100s"
1291
1292/*
1293 * read packets and try to authenticate local user *pw.
1294 * return if authentication is successfull
1295 */
1296void
1297do_authloop(struct passwd * pw)
1298{
1299 int attempt = 0;
1300 unsigned int bits;
1301 RSA *client_host_key;
1302 BIGNUM *n;
1303 char *client_user = NULL, *password = NULL;
1304 char user[1024];
1305 unsigned int dlen;
1306 int plen, nlen, elen;
1307 unsigned int ulen;
1308 int type = 0;
1309 void (*authlog) (const char *fmt,...) = verbose;
1310
1311 /* Indicate that authentication is needed. */
1312 packet_start(SSH_SMSG_FAILURE);
1313 packet_send();
1314 packet_write_wait();
1315
1316 for (attempt = 1;; attempt++) {
1317 int authenticated = 0;
1318 strlcpy(user, "", sizeof user);
1319
1320 /* Get a packet from the client. */
1321 type = packet_read(&plen);
1322
1323 /* Process the packet. */
1324 switch (type) {
1325#ifdef AFS
1326 case SSH_CMSG_HAVE_KERBEROS_TGT:
1327 if (!options.kerberos_tgt_passing) {
1328 /* packet_get_all(); */
1329 verbose("Kerberos tgt passing disabled.");
1330 break;
1331 } else {
1332 /* Accept Kerberos tgt. */
1333 char *tgt = packet_get_string(&dlen);
1334 packet_integrity_check(plen, 4 + dlen, type);
1335 if (!auth_kerberos_tgt(pw, tgt))
1336 verbose("Kerberos tgt REFUSED for %s", pw->pw_name);
1337 xfree(tgt);
1338 }
1339 continue;
1340
1341 case SSH_CMSG_HAVE_AFS_TOKEN:
1342 if (!options.afs_token_passing || !k_hasafs()) {
1343 /* packet_get_all(); */
1344 verbose("AFS token passing disabled.");
1345 break;
1346 } else {
1347 /* Accept AFS token. */
1348 char *token_string = packet_get_string(&dlen);
1349 packet_integrity_check(plen, 4 + dlen, type);
1350 if (!auth_afs_token(pw, token_string))
1351 verbose("AFS token REFUSED for %s", pw->pw_name);
1352 xfree(token_string);
1353 }
1354 continue;
1355#endif /* AFS */
1356#ifdef KRB4
1357 case SSH_CMSG_AUTH_KERBEROS:
1358 if (!options.kerberos_authentication) {
1359 /* packet_get_all(); */
1360 verbose("Kerberos authentication disabled.");
1361 break;
1362 } else {
1363 /* Try Kerberos v4 authentication. */
1364 KTEXT_ST auth;
1365 char *tkt_user = NULL;
1366 char *kdata = packet_get_string((unsigned int *) &auth.length);
1367 packet_integrity_check(plen, 4 + auth.length, type);
1368
1369 if (auth.length < MAX_KTXT_LEN)
1370 memcpy(auth.dat, kdata, auth.length);
1371 xfree(kdata);
1372
1373 authenticated = auth_krb4(pw->pw_name, &auth, &tkt_user);
1374
1375 if (authenticated) {
1376 snprintf(user, sizeof user, " tktuser %s", tkt_user);
1377 xfree(tkt_user);
1378 }
1379 }
1380 break;
1381#endif /* KRB4 */
1382
1383 case SSH_CMSG_AUTH_RHOSTS:
1384 if (!options.rhosts_authentication) {
1385 verbose("Rhosts authentication disabled.");
1386 break;
1387 }
1388 /*
1389 * Get client user name. Note that we just have to
1390 * trust the client; this is one reason why rhosts
1391 * authentication is insecure. (Another is
1392 * IP-spoofing on a local network.)
1393 */
1394 client_user = packet_get_string(&ulen);
1395 packet_integrity_check(plen, 4 + ulen, type);
1396
1397 /* Try to authenticate using /etc/hosts.equiv and
1398 .rhosts. */
1399 authenticated = auth_rhosts(pw, client_user);
1400
1401 snprintf(user, sizeof user, " ruser %s", client_user);
1402 break;
1403
1404 case SSH_CMSG_AUTH_RHOSTS_RSA:
1405 if (!options.rhosts_rsa_authentication) {
1406 verbose("Rhosts with RSA authentication disabled.");
1407 break;
1408 }
1409 /*
1410 * Get client user name. Note that we just have to
1411 * trust the client; root on the client machine can
1412 * claim to be any user.
1413 */
1414 client_user = packet_get_string(&ulen);
1415
1416 /* Get the client host key. */
1417 client_host_key = RSA_new();
1418 if (client_host_key == NULL)
1419 fatal("RSA_new failed");
1420 client_host_key->e = BN_new();
1421 client_host_key->n = BN_new();
1422 if (client_host_key->e == NULL || client_host_key->n == NULL)
1423 fatal("BN_new failed");
1424 bits = packet_get_int();
1425 packet_get_bignum(client_host_key->e, &elen);
1426 packet_get_bignum(client_host_key->n, &nlen);
1427
1428 if (bits != BN_num_bits(client_host_key->n))
1429 error("Warning: keysize mismatch for client_host_key: "
1430 "actual %d, announced %d", BN_num_bits(client_host_key->n), bits);
1431 packet_integrity_check(plen, (4 + ulen) + 4 + elen + nlen, type);
1432
1433 authenticated = auth_rhosts_rsa(pw, client_user, client_host_key);
1434 RSA_free(client_host_key);
1435
1436 snprintf(user, sizeof user, " ruser %s", client_user);
1437 break;
1438
1439 case SSH_CMSG_AUTH_RSA:
1440 if (!options.rsa_authentication) {
1441 verbose("RSA authentication disabled.");
1442 break;
1443 }
1444 /* RSA authentication requested. */
1445 n = BN_new();
1446 packet_get_bignum(n, &nlen);
1447 packet_integrity_check(plen, nlen, type);
1448 authenticated = auth_rsa(pw, n);
1449 BN_clear_free(n);
1450 break;
1451
1452 case SSH_CMSG_AUTH_PASSWORD:
1453 if (!options.password_authentication) {
1454 verbose("Password authentication disabled.");
1455 break;
1456 }
1457 /*
1458 * Read user password. It is in plain text, but was
1459 * transmitted over the encrypted channel so it is
1460 * not visible to an outside observer.
1461 */
1462 password = packet_get_string(&dlen);
1463 packet_integrity_check(plen, 4 + dlen, type);
1464
1465#ifdef USE_PAM
1466 /* Do PAM auth with password */
1467 authenticated = auth_pam_password(pw, password);
1468#else /* USE_PAM */
1469 /* Try authentication with the password. */
1470 authenticated = auth_password(pw, password);
1471#endif /* USE_PAM */
1472 memset(password, 0, strlen(password));
1473 xfree(password);
1474 break;
1475
1476#ifdef SKEY
1477 case SSH_CMSG_AUTH_TIS:
1478 debug("rcvd SSH_CMSG_AUTH_TIS");
1479 if (options.skey_authentication == 1) {
1480 char *skeyinfo = skey_keyinfo(pw->pw_name);
1481 if (skeyinfo == NULL) {
1482 debug("generating fake skeyinfo for %.100s.", pw->pw_name);
1483 skeyinfo = skey_fake_keyinfo(pw->pw_name);
1484 }
1485 if (skeyinfo != NULL) {
1486 /* we send our s/key- in tis-challenge messages */
1487 debug("sending challenge '%s'", skeyinfo);
1488 packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE);
1489 packet_put_string(skeyinfo, strlen(skeyinfo));
1490 packet_send();
1491 packet_write_wait();
1492 continue;
1493 }
1494 }
1495 break;
1496 case SSH_CMSG_AUTH_TIS_RESPONSE:
1497 debug("rcvd SSH_CMSG_AUTH_TIS_RESPONSE");
1498 if (options.skey_authentication == 1) {
1499 char *response = packet_get_string(&dlen);
1500 debug("skey response == '%s'", response);
1501 packet_integrity_check(plen, 4 + dlen, type);
1502 authenticated = (skey_haskey(pw->pw_name) == 0 &&
1503 skey_passcheck(pw->pw_name, response) != -1);
1504 xfree(response);
1505 }
1506 break;
1507#else
1508 case SSH_CMSG_AUTH_TIS:
1509 /* TIS Authentication is unsupported */
1510 log("TIS authentication unsupported.");
1511 break;
1512#endif
1513
1514 default:
1515 /*
1516 * Any unknown messages will be ignored (and failure
1517 * returned) during authentication.
1518 */
1519 log("Unknown message during authentication: type %d", type);
1520 break;
1521 }
1522
1523 /*
1524 * Check if the user is logging in as root and root logins
1525 * are disallowed.
1526 * Note that root login is allowed for forced commands.
1527 */
1528 if (authenticated && pw->pw_uid == 0 && !options.permit_root_login) {
1529 if (forced_command) {
1530 log("Root login accepted for forced command.");
1531 } else {
1532 authenticated = 0;
1533 log("ROOT LOGIN REFUSED FROM %.200s",
1534 get_canonical_hostname());
1535 }
1536 }
1537
1538 /* Raise logging level */
1539 if (authenticated ||
1540 attempt == AUTH_FAIL_LOG ||
1541 type == SSH_CMSG_AUTH_PASSWORD)
1542 authlog = log;
1543
1544 authlog("%s %s for %.200s from %.200s port %d%s",
1545 authenticated ? "Accepted" : "Failed",
1546 get_authname(type),
1547 pw->pw_uid == 0 ? "ROOT" : pw->pw_name,
1548 get_remote_ipaddr(),
1549 get_remote_port(),
1550 user);
1551
1552#ifdef USE_PAM
1553 if (authenticated) {
1554 if (!do_pam_account(pw->pw_name, client_user)) {
1555 if (client_user != NULL) {
1556 xfree(client_user);
1557 client_user = NULL;
1558 }
1559 do_fake_authloop(pw->pw_name);
1560 }
1561 return;
1562 }
1563#else /* USE_PAM */
1564 if (authenticated) {
1565 return;
1566 }
1567#endif /* USE_PAM */
1568
1569 if (client_user != NULL) {
1570 xfree(client_user);
1571 client_user = NULL;
1572 }
1573
1574 if (attempt > AUTH_FAIL_MAX)
1575 packet_disconnect(AUTH_FAIL_MSG, pw->pw_name);
1576
1577 /* Send a message indicating that the authentication attempt failed. */
1578 packet_start(SSH_SMSG_FAILURE);
1579 packet_send();
1580 packet_write_wait();
1581 }
1582}
1583
1584/*
1585 * The user does not exist or access is denied,
1586 * but fake indication that authentication is needed.
1587 */
1588void
1589do_fake_authloop(char *user)
1590{
1591 int attempt = 0;
1592
1593 log("Faking authloop for illegal user %.200s from %.200s port %d",
1594 user,
1595 get_remote_ipaddr(),
1596 get_remote_port());
1597
1598 /* Indicate that authentication is needed. */
1599 packet_start(SSH_SMSG_FAILURE);
1600 packet_send();
1601 packet_write_wait();
1602
1603 /*
1604 * Keep reading packets, and always respond with a failure. This is
1605 * to avoid disclosing whether such a user really exists.
1606 */
1607 for (attempt = 1;; attempt++) {
1608 /* Read a packet. This will not return if the client disconnects. */
1609 int plen;
1610#ifndef SKEY
1611 (void)packet_read(&plen);
1612#else /* SKEY */
1613 int type = packet_read(&plen);
1614 unsigned int dlen;
1615 char *password, *skeyinfo;
1616 /* Try to send a fake s/key challenge. */
1617 if (options.skey_authentication == 1 &&
1618 (skeyinfo = skey_fake_keyinfo(user)) != NULL) {
1619 password = NULL;
1620 if (type == SSH_CMSG_AUTH_TIS) {
1621 packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE);
1622 packet_put_string(skeyinfo, strlen(skeyinfo));
1623 packet_send();
1624 packet_write_wait();
1625 continue;
1626 } else if (type == SSH_CMSG_AUTH_PASSWORD &&
1627 options.password_authentication &&
1628 (password = packet_get_string(&dlen)) != NULL &&
1629 dlen == 5 &&
1630 strncasecmp(password, "s/key", 5) == 0 ) {
1631 packet_send_debug(skeyinfo);
1632 }
1633 if (password != NULL)
1634 xfree(password);
1635 }
1636#endif
1637 if (attempt > AUTH_FAIL_MAX)
1638 packet_disconnect(AUTH_FAIL_MSG, user);
1639
1640 /*
1641 * Send failure. This should be indistinguishable from a
1642 * failed authentication.
1643 */
1644 packet_start(SSH_SMSG_FAILURE);
1645 packet_send();
1646 packet_write_wait();
1647#ifdef WITH_AIXAUTHENTICATE
1648 if (strncmp(get_authname(type),"password",
1649 strlen(get_authname(type))) == 0)
1650 loginfailed(pw->pw_name,get_canonical_hostname(),"ssh");
1651#endif /* WITH_AIXAUTHENTICATE */
1652 }
1653 /* NOTREACHED */
1654 abort();
1655}
1656
1657struct pty_cleanup_context {
1658 const char *ttyname;
1659 int pid;
1660};
1661
1662/*
1663 * Function to perform cleanup if we get aborted abnormally (e.g., due to a
1664 * dropped connection).
1665 */
1666void
1667pty_cleanup_proc(void *context)
1668{
1669 struct pty_cleanup_context *cu = context;
1670
1671 debug("pty_cleanup_proc called");
1672
1673 /* Record that the user has logged out. */
1674 record_logout(cu->pid, cu->ttyname);
1675
1676 /* Release the pseudo-tty. */
1677 pty_release(cu->ttyname);
1678}
1679
1680/* simple cleanup: chown tty slave back to root */
1681static void
1682pty_release_proc(void *tty)
1683{
1684 char *ttyname = tty;
1685 pty_release(ttyname);
1686}
1687
1688/*
1689 * Prepares for an interactive session. This is called after the user has
1690 * been successfully authenticated. During this message exchange, pseudo
1691 * terminals are allocated, X11, TCP/IP, and authentication agent forwardings
1692 * are requested, etc.
1693 */
1694void
1695do_authenticated(struct passwd * pw)
1696{
1697 int type;
1698 int compression_level = 0, enable_compression_after_reply = 0;
1699 int have_pty = 0, ptyfd = -1, ttyfd = -1;
1700 int row, col, xpixel, ypixel, screen;
1701 char ttyname[64];
1702 char *command, *term = NULL, *display = NULL, *proto = NULL, *data = NULL;
1703 int plen;
1704 unsigned int dlen;
1705 int n_bytes;
1706
1707 /*
1708 * Cancel the alarm we set to limit the time taken for
1709 * authentication.
1710 */
1711 alarm(0);
1712
1713 /*
1714 * Inform the channel mechanism that we are the server side and that
1715 * the client may request to connect to any port at all. (The user
1716 * could do it anyway, and we wouldn\'t know what is permitted except
1717 * by the client telling us, so we can equally well trust the client
1718 * not to request anything bogus.)
1719 */
1720 if (!no_port_forwarding_flag)
1721 channel_permit_all_opens();
1722
1723 /*
1724 * We stay in this loop until the client requests to execute a shell
1725 * or a command.
1726 */
1727 while (1) {
1728
1729 /* Get a packet from the client. */
1730 type = packet_read(&plen);
1731
1732 /* Process the packet. */
1733 switch (type) {
1734 case SSH_CMSG_REQUEST_COMPRESSION:
1735 packet_integrity_check(plen, 4, type);
1736 compression_level = packet_get_int();
1737 if (compression_level < 1 || compression_level > 9) {
1738 packet_send_debug("Received illegal compression level %d.",
1739 compression_level);
1740 goto fail;
1741 }
1742 /* Enable compression after we have responded with SUCCESS. */
1743 enable_compression_after_reply = 1;
1744 break;
1745
1746 case SSH_CMSG_REQUEST_PTY:
1747 if (no_pty_flag) {
1748 debug("Allocating a pty not permitted for this authentication.");
1749 goto fail;
1750 }
1751 if (have_pty)
1752 packet_disconnect("Protocol error: you already have a pty.");
1753
1754 debug("Allocating pty.");
1755
1756 /* Allocate a pty and open it. */
1757 if (!pty_allocate(&ptyfd, &ttyfd, ttyname,
1758 sizeof(ttyname))) {
1759 error("Failed to allocate pty.");
1760 goto fail;
1761 }
1762 fatal_add_cleanup(pty_release_proc, (void *)ttyname);
1763 pty_setowner(pw, ttyname);
1764
1765 /* Get TERM from the packet. Note that the value may be of arbitrary length. */
1766 term = packet_get_string(&dlen);
1767 packet_integrity_check(dlen, strlen(term), type);
1768
1769 /* Remaining bytes */
1770 n_bytes = plen - (4 + dlen + 4 * 4);
1771
1772 if (strcmp(term, "") == 0) {
1773 xfree(term);
1774 term = NULL;
1775 }
1776
1777 /* Get window size from the packet. */
1778 row = packet_get_int();
1779 col = packet_get_int();
1780 xpixel = packet_get_int();
1781 ypixel = packet_get_int();
1782 pty_change_window_size(ptyfd, row, col, xpixel, ypixel);
1783
1784 /* Get tty modes from the packet. */
1785 tty_parse_modes(ttyfd, &n_bytes);
1786 packet_integrity_check(plen, 4 + dlen + 4 * 4 + n_bytes, type);
1787
1788 /* Indicate that we now have a pty. */
1789 have_pty = 1;
1790 break;
1791
1792 case SSH_CMSG_X11_REQUEST_FORWARDING:
1793 if (!options.x11_forwarding) {
1794 packet_send_debug("X11 forwarding disabled in server configuration file.");
1795 goto fail;
1796 }
1797#ifdef XAUTH_PATH
1798 if (no_x11_forwarding_flag) {
1799 packet_send_debug("X11 forwarding not permitted for this authentication.");
1800 goto fail;
1801 }
1802 debug("Received request for X11 forwarding with auth spoofing.");
1803 if (display)
1804 packet_disconnect("Protocol error: X11 display already set.");
1805 {
1806 unsigned int proto_len, data_len;
1807 proto = packet_get_string(&proto_len);
1808 data = packet_get_string(&data_len);
1809 packet_integrity_check(plen, 4 + proto_len + 4 + data_len + 4, type);
1810 }
1811 if (packet_get_protocol_flags() & SSH_PROTOFLAG_SCREEN_NUMBER)
1812 screen = packet_get_int();
1813 else
1814 screen = 0;
1815 display = x11_create_display_inet(screen, options.x11_display_offset);
1816 if (!display)
1817 goto fail;
1818
1819 /* Setup to always have a local .Xauthority. */
1820 xauthfile = xmalloc(MAXPATHLEN);
1821 strlcpy(xauthfile, "/tmp/ssh-XXXXXXXX", MAXPATHLEN);
1822 temporarily_use_uid(pw->pw_uid);
1823 if (mkdtemp(xauthfile) == NULL) {
1824 restore_uid();
1825 error("private X11 dir: mkdtemp %s failed: %s",
1826 xauthfile, strerror(errno));
1827 xfree(xauthfile);
1828 xauthfile = NULL;
1829 goto fail;
1830 }
1831 strlcat(xauthfile, "/cookies", MAXPATHLEN);
1832 open(xauthfile, O_RDWR|O_CREAT|O_EXCL, 0600);
1833 restore_uid();
1834 fatal_add_cleanup(xauthfile_cleanup_proc, NULL);
1835 break;
1836#else /* XAUTH_PATH */
1837 packet_send_debug("No xauth program; cannot forward with spoofing.");
1838 goto fail;
1839#endif /* XAUTH_PATH */
1840
1841 case SSH_CMSG_AGENT_REQUEST_FORWARDING:
1842 if (no_agent_forwarding_flag || compat13) {
1843 debug("Authentication agent forwarding not permitted for this authentication.");
1844 goto fail;
1845 }
1846 debug("Received authentication agent forwarding request.");
1847 auth_input_request_forwarding(pw);
1848 break;
1849
1850 case SSH_CMSG_PORT_FORWARD_REQUEST:
1851 if (no_port_forwarding_flag) {
1852 debug("Port forwarding not permitted for this authentication.");
1853 goto fail;
1854 }
1855 debug("Received TCP/IP port forwarding request.");
1856 channel_input_port_forward_request(pw->pw_uid == 0);
1857 break;
1858
1859 case SSH_CMSG_MAX_PACKET_SIZE:
1860 if (packet_set_maxsize(packet_get_int()) < 0)
1861 goto fail;
1862 break;
1863
1864 case SSH_CMSG_EXEC_SHELL:
1865 /* Set interactive/non-interactive mode. */
1866 packet_set_interactive(have_pty || display != NULL,
1867 options.keepalives);
1868
1869 if (forced_command != NULL)
1870 goto do_forced_command;
1871 debug("Forking shell.");
1872 packet_integrity_check(plen, 0, type);
1873 if (have_pty)
1874 do_exec_pty(NULL, ptyfd, ttyfd, ttyname, pw, term, display, proto, data);
1875 else
1876 do_exec_no_pty(NULL, pw, display, proto, data);
1877 return;
1878
1879 case SSH_CMSG_EXEC_CMD:
1880 /* Set interactive/non-interactive mode. */
1881 packet_set_interactive(have_pty || display != NULL,
1882 options.keepalives);
1883
1884 if (forced_command != NULL)
1885 goto do_forced_command;
1886 /* Get command from the packet. */
1887 {
1888 unsigned int dlen;
1889 command = packet_get_string(&dlen);
1890 debug("Executing command '%.500s'", command);
1891 packet_integrity_check(plen, 4 + dlen, type);
1892 }
1893 if (have_pty)
1894 do_exec_pty(command, ptyfd, ttyfd, ttyname, pw, term, display, proto, data);
1895 else
1896 do_exec_no_pty(command, pw, display, proto, data);
1897 xfree(command);
1898 return;
1899
1900 default:
1901 /*
1902 * Any unknown messages in this phase are ignored,
1903 * and a failure message is returned.
1904 */
1905 log("Unknown packet type received after authentication: %d", type);
1906 goto fail;
1907 }
1908
1909 /* The request was successfully processed. */
1910 packet_start(SSH_SMSG_SUCCESS);
1911 packet_send();
1912 packet_write_wait();
1913
1914 /* Enable compression now that we have replied if appropriate. */
1915 if (enable_compression_after_reply) {
1916 enable_compression_after_reply = 0;
1917 packet_start_compression(compression_level);
1918 }
1919 continue;
1920
1921fail:
1922 /* The request failed. */
1923 packet_start(SSH_SMSG_FAILURE);
1924 packet_send();
1925 packet_write_wait();
1926 continue;
1927
1928do_forced_command:
1929 /*
1930 * There is a forced command specified for this login.
1931 * Execute it.
1932 */
1933 debug("Executing forced command: %.900s", forced_command);
1934 if (have_pty)
1935 do_exec_pty(forced_command, ptyfd, ttyfd, ttyname, pw, term, display, proto, data);
1936 else
1937 do_exec_no_pty(forced_command, pw, display, proto, data);
1938 return;
1939 }
1940}
1941
1942/*
1943 * This is called to fork and execute a command when we have no tty. This
1944 * will call do_child from the child, and server_loop from the parent after
1945 * setting up file descriptors and such.
1946 */
1947void
1948do_exec_no_pty(const char *command, struct passwd * pw,
1949 const char *display, const char *auth_proto,
1950 const char *auth_data)
1951{
1952 int pid;
1953
1954#ifdef USE_PIPES
1955 int pin[2], pout[2], perr[2];
1956 /* Allocate pipes for communicating with the program. */
1957 if (pipe(pin) < 0 || pipe(pout) < 0 || pipe(perr) < 0)
1958 packet_disconnect("Could not create pipes: %.100s",
1959 strerror(errno));
1960#else /* USE_PIPES */
1961 int inout[2], err[2];
1962 /* Uses socket pairs to communicate with the program. */
1963 if (socketpair(AF_UNIX, SOCK_STREAM, 0, inout) < 0 ||
1964 socketpair(AF_UNIX, SOCK_STREAM, 0, err) < 0)
1965 packet_disconnect("Could not create socket pairs: %.100s",
1966 strerror(errno));
1967#endif /* USE_PIPES */
1968
1969 setproctitle("%s@notty", pw->pw_name);
1970
1971#ifdef USE_PAM
1972 do_pam_setcred();
1973#endif /* USE_PAM */
1974
1975 /* Fork the child. */
1976 if ((pid = fork()) == 0) {
1977 /* Child. Reinitialize the log since the pid has changed. */
1978 log_init(av0, options.log_level, options.log_facility, log_stderr);
1979
1980 /*
1981 * Create a new session and process group since the 4.4BSD
1982 * setlogin() affects the entire process group.
1983 */
1984 if (setsid() < 0)
1985 error("setsid failed: %.100s", strerror(errno));
1986
1987#ifdef USE_PIPES
1988 /*
1989 * Redirect stdin. We close the parent side of the socket
1990 * pair, and make the child side the standard input.
1991 */
1992 close(pin[1]);
1993 if (dup2(pin[0], 0) < 0)
1994 perror("dup2 stdin");
1995 close(pin[0]);
1996
1997 /* Redirect stdout. */
1998 close(pout[0]);
1999 if (dup2(pout[1], 1) < 0)
2000 perror("dup2 stdout");
2001 close(pout[1]);
2002
2003 /* Redirect stderr. */
2004 close(perr[0]);
2005 if (dup2(perr[1], 2) < 0)
2006 perror("dup2 stderr");
2007 close(perr[1]);
2008#else /* USE_PIPES */
2009 /*
2010 * Redirect stdin, stdout, and stderr. Stdin and stdout will
2011 * use the same socket, as some programs (particularly rdist)
2012 * seem to depend on it.
2013 */
2014 close(inout[1]);
2015 close(err[1]);
2016 if (dup2(inout[0], 0) < 0) /* stdin */
2017 perror("dup2 stdin");
2018 if (dup2(inout[0], 1) < 0) /* stdout. Note: same socket as stdin. */
2019 perror("dup2 stdout");
2020 if (dup2(err[0], 2) < 0) /* stderr */
2021 perror("dup2 stderr");
2022#endif /* USE_PIPES */
2023
2024 /* Do processing for the child (exec command etc). */
2025 do_child(command, pw, NULL, display, auth_proto, auth_data, NULL);
2026 /* NOTREACHED */
2027 }
2028 if (pid < 0)
2029 packet_disconnect("fork failed: %.100s", strerror(errno));
2030#ifdef USE_PIPES
2031 /* We are the parent. Close the child sides of the pipes. */
2032 close(pin[0]);
2033 close(pout[1]);
2034 close(perr[1]);
2035
2036 /* Enter the interactive session. */
2037 server_loop(pid, pin[1], pout[0], perr[0]);
2038 /* server_loop has closed pin[1], pout[1], and perr[1]. */
2039#else /* USE_PIPES */
2040 /* We are the parent. Close the child sides of the socket pairs. */
2041 close(inout[0]);
2042 close(err[0]);
2043
2044 /*
2045 * Enter the interactive session. Note: server_loop must be able to
2046 * handle the case that fdin and fdout are the same.
2047 */
2048 server_loop(pid, inout[1], inout[1], err[1]);
2049 /* server_loop has closed inout[1] and err[1]. */
2050#endif /* USE_PIPES */
2051}
2052
2053/*
2054 * This is called to fork and execute a command when we have a tty. This
2055 * will call do_child from the child, and server_loop from the parent after
2056 * setting up file descriptors, controlling tty, updating wtmp, utmp,
2057 * lastlog, and other such operations.
2058 */
2059void
2060do_exec_pty(const char *command, int ptyfd, int ttyfd,
2061 const char *ttyname, struct passwd * pw, const char *term,
2062 const char *display, const char *auth_proto,
2063 const char *auth_data)
2064{
2065 int pid, fdout;
2066 int ptymaster;
2067 const char *hostname;
2068 time_t last_login_time;
2069 char buf[100], *time_string;
2070 FILE *f;
2071 char line[256];
2072 struct stat st;
2073 int quiet_login;
2074 struct sockaddr_storage from;
2075 socklen_t fromlen;
2076 struct pty_cleanup_context cleanup_context;
2077
2078 /* Get remote host name. */
2079 hostname = get_canonical_hostname();
2080
2081 /*
2082 * Get the time when the user last logged in. Buf will be set to
2083 * contain the hostname the last login was from.
2084 */
2085 if (!options.use_login) {
2086 last_login_time = get_last_login_time(pw->pw_uid, pw->pw_name,
2087 buf, sizeof(buf));
2088 }
2089 setproctitle("%s@%s", pw->pw_name, strrchr(ttyname, '/') + 1);
2090
2091#ifdef USE_PAM
2092 do_pam_session(pw->pw_name, ttyname);
2093 do_pam_setcred();
2094#endif /* USE_PAM */
2095
2096 /* Fork the child. */
2097 if ((pid = fork()) == 0) {
2098 pid = getpid();
2099
2100 /* Child. Reinitialize the log because the pid has
2101 changed. */
2102 log_init(av0, options.log_level, options.log_facility, log_stderr);
2103
2104 /* Close the master side of the pseudo tty. */
2105 close(ptyfd);
2106
2107 /* Make the pseudo tty our controlling tty. */
2108 pty_make_controlling_tty(&ttyfd, ttyname);
2109
2110 /* Redirect stdin from the pseudo tty. */
2111 if (dup2(ttyfd, fileno(stdin)) < 0)
2112 error("dup2 stdin failed: %.100s", strerror(errno));
2113
2114 /* Redirect stdout to the pseudo tty. */
2115 if (dup2(ttyfd, fileno(stdout)) < 0)
2116 error("dup2 stdin failed: %.100s", strerror(errno));
2117
2118 /* Redirect stderr to the pseudo tty. */
2119 if (dup2(ttyfd, fileno(stderr)) < 0)
2120 error("dup2 stdin failed: %.100s", strerror(errno));
2121
2122 /* Close the extra descriptor for the pseudo tty. */
2123 close(ttyfd);
2124
2125 /*
2126 * Get IP address of client. This is needed because we want
2127 * to record where the user logged in from. If the
2128 * connection is not a socket, let the ip address be 0.0.0.0.
2129 */
2130 memset(&from, 0, sizeof(from));
2131 if (packet_get_connection_in() == packet_get_connection_out()) {
2132 fromlen = sizeof(from);
2133 if (getpeername(packet_get_connection_in(),
2134 (struct sockaddr *) & from, &fromlen) < 0) {
2135 debug("getpeername: %.100s", strerror(errno));
2136 fatal_cleanup();
2137 }
2138 }
2139 /* Record that there was a login on that terminal. */
2140 record_login(pid, ttyname, pw->pw_name, pw->pw_uid, hostname,
2141 (struct sockaddr *)&from);
2142
2143 /* Check if .hushlogin exists. */
2144 snprintf(line, sizeof line, "%.200s/.hushlogin", pw->pw_dir);
2145 quiet_login = stat(line, &st) >= 0;
2146
2147#ifdef USE_PAM
2148 if (!quiet_login)
2149 print_pam_messages();
2150#endif /* USE_PAM */
2151
2152 /*
2153 * If the user has logged in before, display the time of last
2154 * login. However, don't display anything extra if a command
2155 * has been specified (so that ssh can be used to execute
2156 * commands on a remote machine without users knowing they
2157 * are going to another machine). Login(1) will do this for
2158 * us as well, so check if login(1) is used
2159 */
2160 if (command == NULL && last_login_time != 0 && !quiet_login &&
2161 !options.use_login) {
2162 /* Convert the date to a string. */
2163 time_string = ctime(&last_login_time);
2164 /* Remove the trailing newline. */
2165 if (strchr(time_string, '\n'))
2166 *strchr(time_string, '\n') = 0;
2167 /* Display the last login time. Host if displayed
2168 if known. */
2169 if (strcmp(buf, "") == 0)
2170 printf("Last login: %s\r\n", time_string);
2171 else
2172 printf("Last login: %s from %s\r\n", time_string, buf);
2173 }
2174 /*
2175 * Print /etc/motd unless a command was specified or printing
2176 * it was disabled in server options or login(1) will be
2177 * used. Note that some machines appear to print it in
2178 * /etc/profile or similar.
2179 */
2180 if (command == NULL && options.print_motd && !quiet_login &&
2181 !options.use_login) {
2182 /* Print /etc/motd if it exists. */
2183 f = fopen("/etc/motd", "r");
2184 if (f) {
2185 while (fgets(line, sizeof(line), f))
2186 fputs(line, stdout);
2187 fclose(f);
2188 }
2189 }
2190 /* Do common processing for the child, such as execing the command. */
2191 do_child(command, pw, term, display, auth_proto, auth_data, ttyname);
2192 /* NOTREACHED */
2193 }
2194 if (pid < 0)
2195 packet_disconnect("fork failed: %.100s", strerror(errno));
2196 /* Parent. Close the slave side of the pseudo tty. */
2197 close(ttyfd);
2198
2199 /*
2200 * Add a cleanup function to clear the utmp entry and record logout
2201 * time in case we call fatal() (e.g., the connection gets closed).
2202 */
2203 cleanup_context.pid = pid;
2204 cleanup_context.ttyname = ttyname;
2205 fatal_add_cleanup(pty_cleanup_proc, (void *) &cleanup_context);
2206 fatal_remove_cleanup(pty_release_proc, (void *) ttyname);
2207
2208 /*
2209 * Create another descriptor of the pty master side for use as the
2210 * standard input. We could use the original descriptor, but this
2211 * simplifies code in server_loop. The descriptor is bidirectional.
2212 */
2213 fdout = dup(ptyfd);
2214 if (fdout < 0)
2215 packet_disconnect("dup #1 failed: %.100s", strerror(errno));
2216
2217 /* we keep a reference to the pty master */
2218 ptymaster = dup(ptyfd);
2219 if (ptymaster < 0)
2220 packet_disconnect("dup #2 failed: %.100s", strerror(errno));
2221
2222 /* Enter interactive session. */
2223 server_loop(pid, ptyfd, fdout, -1);
2224 /* server_loop _has_ closed ptyfd and fdout. */
2225
2226 /* Cancel the cleanup function. */
2227 fatal_remove_cleanup(pty_cleanup_proc, (void *) &cleanup_context);
2228
2229 /* Record that the user has logged out. */
2230 record_logout(pid, ttyname);
2231
2232 /* Release the pseudo-tty. */
2233 pty_release(ttyname);
2234
2235 /*
2236 * Close the server side of the socket pairs. We must do this after
2237 * the pty cleanup, so that another process doesn't get this pty
2238 * while we're still cleaning up.
2239 */
2240 if (close(ptymaster) < 0)
2241 error("close(ptymaster): %s", strerror(errno));
2242}
2243
2244/*
2245 * Sets the value of the given variable in the environment. If the variable
2246 * already exists, its value is overriden.
2247 */
2248void
2249child_set_env(char ***envp, unsigned int *envsizep, const char *name,
2250 const char *value)
2251{
2252 unsigned int i, namelen;
2253 char **env;
2254
2255 /*
2256 * Find the slot where the value should be stored. If the variable
2257 * already exists, we reuse the slot; otherwise we append a new slot
2258 * at the end of the array, expanding if necessary.
2259 */
2260 env = *envp;
2261 namelen = strlen(name);
2262 for (i = 0; env[i]; i++)
2263 if (strncmp(env[i], name, namelen) == 0 && env[i][namelen] == '=')
2264 break;
2265 if (env[i]) {
2266 /* Reuse the slot. */
2267 xfree(env[i]);
2268 } else {
2269 /* New variable. Expand if necessary. */
2270 if (i >= (*envsizep) - 1) {
2271 (*envsizep) += 50;
2272 env = (*envp) = xrealloc(env, (*envsizep) * sizeof(char *));
2273 }
2274 /* Need to set the NULL pointer at end of array beyond the new slot. */
2275 env[i + 1] = NULL;
2276 }
2277
2278 /* Allocate space and format the variable in the appropriate slot. */
2279 env[i] = xmalloc(strlen(name) + 1 + strlen(value) + 1);
2280 snprintf(env[i], strlen(name) + 1 + strlen(value) + 1, "%s=%s", name, value);
2281}
2282
2283/*
2284 * Reads environment variables from the given file and adds/overrides them
2285 * into the environment. If the file does not exist, this does nothing.
2286 * Otherwise, it must consist of empty lines, comments (line starts with '#')
2287 * and assignments of the form name=value. No other forms are allowed.
2288 */
2289void
2290read_environment_file(char ***env, unsigned int *envsize,
2291 const char *filename)
2292{
2293 FILE *f;
2294 char buf[4096];
2295 char *cp, *value;
2296
2297 f = fopen(filename, "r");
2298 if (!f)
2299 return;
2300
2301 while (fgets(buf, sizeof(buf), f)) {
2302 for (cp = buf; *cp == ' ' || *cp == '\t'; cp++)
2303 ;
2304 if (!*cp || *cp == '#' || *cp == '\n')
2305 continue;
2306 if (strchr(cp, '\n'))
2307 *strchr(cp, '\n') = '\0';
2308 value = strchr(cp, '=');
2309 if (value == NULL) {
2310 fprintf(stderr, "Bad line in %.100s: %.200s\n", filename, buf);
2311 continue;
2312 }
2313 /* Replace the equals sign by nul, and advance value to the value string. */
2314 *value = '\0';
2315 value++;
2316 child_set_env(env, envsize, cp, value);
2317 }
2318 fclose(f);
2319}
2320
2321#ifdef USE_PAM
2322/*
2323 * Sets any environment variables which have been specified by PAM
2324 */
2325void do_pam_environment(char ***env, int *envsize)
2326{
2327 char *equals, var_name[512], var_val[512];
2328 char **pam_env;
2329 int i;
2330
2331 if ((pam_env = fetch_pam_environment()) == NULL)
2332 return;
2333
2334 for(i = 0; pam_env[i] != NULL; i++) {
2335 if ((equals = strstr(pam_env[i], "=")) == NULL)
2336 continue;
2337
2338 if (strlen(pam_env[i]) < (sizeof(var_name) - 1))
2339 {
2340 memset(var_name, '\0', sizeof(var_name));
2341 memset(var_val, '\0', sizeof(var_val));
2342
2343 strncpy(var_name, pam_env[i], equals - pam_env[i]);
2344 strcpy(var_val, equals + 1);
2345
2346 debug("PAM environment: %s=%s", var_name, var_val);
2347
2348 child_set_env(env, envsize, var_name, var_val);
2349 }
2350 }
2351}
2352#endif /* USE_PAM */
2353
2354/*
2355 * Performs common processing for the child, such as setting up the
2356 * environment, closing extra file descriptors, setting the user and group
2357 * ids, and executing the command or shell.
2358 */
2359void
2360do_child(const char *command, struct passwd * pw, const char *term,
2361 const char *display, const char *auth_proto,
2362 const char *auth_data, const char *ttyname)
2363{
2364 const char *shell, *cp = NULL;
2365 char buf[256];
2366 FILE *f;
2367 unsigned int envsize, i;
2368 char **env;
2369 extern char **environ;
2370 struct stat st;
2371 char *argv[10];
2372
2373#ifndef USE_PAM /* pam_nologin handles this */
2374 /* Check /etc/nologin. */
2375 f = fopen("/etc/nologin", "r");
2376 if (f) {
2377 /* /etc/nologin exists. Print its contents and exit. */
2378 while (fgets(buf, sizeof(buf), f))
2379 fputs(buf, stderr);
2380 fclose(f);
2381 if (pw->pw_uid != 0)
2382 exit(254);
2383 }
2384#endif /* USE_PAM */
2385
2386 /* Set login name in the kernel. */
2387 if (setlogin(pw->pw_name) < 0)
2388 error("setlogin failed: %s", strerror(errno));
2389
2390 /* Set uid, gid, and groups. */
2391 /* Login(1) does this as well, and it needs uid 0 for the "-h"
2392 switch, so we let login(1) to this for us. */
2393 if (!options.use_login) {
2394 if (getuid() == 0 || geteuid() == 0) {
2395 if (setgid(pw->pw_gid) < 0) {
2396 perror("setgid");
2397 exit(1);
2398 }
2399 /* Initialize the group list. */
2400 if (initgroups(pw->pw_name, pw->pw_gid) < 0) {
2401 perror("initgroups");
2402 exit(1);
2403 }
2404 endgrent();
2405
2406 /* Permanently switch to the desired uid. */
2407 permanently_set_uid(pw->pw_uid);
2408 }
2409 if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
2410 fatal("Failed to set uids to %d.", (int) pw->pw_uid);
2411 }
2412 /*
2413 * Get the shell from the password data. An empty shell field is
2414 * legal, and means /bin/sh.
2415 */
2416 shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
2417
2418#ifdef AFS
2419 /* Try to get AFS tokens for the local cell. */
2420 if (k_hasafs()) {
2421 char cell[64];
2422
2423 if (k_afs_cell_of_file(pw->pw_dir, cell, sizeof(cell)) == 0)
2424 krb_afslog(cell, 0);
2425
2426 krb_afslog(0, 0);
2427 }
2428#endif /* AFS */
2429
2430 /* Initialize the environment. */
2431 envsize = 100;
2432 env = xmalloc(envsize * sizeof(char *));
2433 env[0] = NULL;
2434
2435 if (!options.use_login) {
2436 /* Set basic environment. */
2437 child_set_env(&env, &envsize, "USER", pw->pw_name);
2438 child_set_env(&env, &envsize, "LOGNAME", pw->pw_name);
2439 child_set_env(&env, &envsize, "HOME", pw->pw_dir);
2440 child_set_env(&env, &envsize, "PATH", _PATH_STDPATH);
2441
2442 snprintf(buf, sizeof buf, "%.200s/%.50s",
2443 _PATH_MAILDIR, pw->pw_name);
2444 child_set_env(&env, &envsize, "MAIL", buf);
2445
2446 /* Normal systems set SHELL by default. */
2447 child_set_env(&env, &envsize, "SHELL", shell);
2448 }
2449 if (getenv("TZ"))
2450 child_set_env(&env, &envsize, "TZ", getenv("TZ"));
2451
2452 /* Set custom environment options from RSA authentication. */
2453 while (custom_environment) {
2454 struct envstring *ce = custom_environment;
2455 char *s = ce->s;
2456 int i;
2457 for (i = 0; s[i] != '=' && s[i]; i++);
2458 if (s[i] == '=') {
2459 s[i] = 0;
2460 child_set_env(&env, &envsize, s, s + i + 1);
2461 }
2462 custom_environment = ce->next;
2463 xfree(ce->s);
2464 xfree(ce);
2465 }
2466
2467 snprintf(buf, sizeof buf, "%.50s %d %d",
2468 get_remote_ipaddr(), get_remote_port(), get_local_port());
2469 child_set_env(&env, &envsize, "SSH_CLIENT", buf);
2470
2471 if (ttyname)
2472 child_set_env(&env, &envsize, "SSH_TTY", ttyname);
2473 if (term)
2474 child_set_env(&env, &envsize, "TERM", term);
2475 if (display)
2476 child_set_env(&env, &envsize, "DISPLAY", display);
2477
2478#ifdef _AIX
2479 {
2480 char *authstate,*krb5cc;
2481
2482 if ((authstate = getenv("AUTHSTATE")) != NULL)
2483 child_set_env(&env,&envsize,"AUTHSTATE",authstate);
2484
2485 if ((krb5cc = getenv("KRB5CCNAME")) != NULL)
2486 child_set_env(&env,&envsize,"KRB5CCNAME",krb5cc);
2487 }
2488#endif
2489
2490#ifdef KRB4
2491 {
2492 extern char *ticket;
2493
2494 if (ticket)
2495 child_set_env(&env, &envsize, "KRBTKFILE", ticket);
2496 }
2497#endif /* KRB4 */
2498
2499#ifdef USE_PAM
2500 /* Pull in any environment variables that may have been set by PAM. */
2501 do_pam_environment(&env, &envsize);
2502#endif /* USE_PAM */
2503
2504 if (xauthfile)
2505 child_set_env(&env, &envsize, "XAUTHORITY", xauthfile);
2506
2507 if (auth_get_socket_name() != NULL)
2508 child_set_env(&env, &envsize, SSH_AUTHSOCKET_ENV_NAME,
2509 auth_get_socket_name());
2510
2511 read_environment_file(&env,&envsize,"/etc/environment");
2512
2513 /* read $HOME/.ssh/environment. */
2514 if (!options.use_login) {
2515 snprintf(buf, sizeof buf, "%.200s/.ssh/environment", pw->pw_dir);
2516 read_environment_file(&env, &envsize, buf);
2517 }
2518 if (debug_flag) {
2519 /* dump the environment */
2520 fprintf(stderr, "Environment:\n");
2521 for (i = 0; env[i]; i++)
2522 fprintf(stderr, " %.200s\n", env[i]);
2523 }
2524 /*
2525 * Close the connection descriptors; note that this is the child, and
2526 * the server will still have the socket open, and it is important
2527 * that we do not shutdown it. Note that the descriptors cannot be
2528 * closed before building the environment, as we call
2529 * get_remote_ipaddr there.
2530 */
2531 if (packet_get_connection_in() == packet_get_connection_out())
2532 close(packet_get_connection_in());
2533 else {
2534 close(packet_get_connection_in());
2535 close(packet_get_connection_out());
2536 }
2537 /*
2538 * Close all descriptors related to channels. They will still remain
2539 * open in the parent.
2540 */
2541 /* XXX better use close-on-exec? -markus */
2542 channel_close_all();
2543
2544 /*
2545 * Close any extra file descriptors. Note that there may still be
2546 * descriptors left by system functions. They will be closed later.
2547 */
2548 endpwent();
2549
2550 /*
2551 * Close any extra open file descriptors so that we don\'t have them
2552 * hanging around in clients. Note that we want to do this after
2553 * initgroups, because at least on Solaris 2.3 it leaves file
2554 * descriptors open.
2555 */
2556 for (i = 3; i < 64; i++)
2557 close(i);
2558
2559 /* Change current directory to the user\'s home directory. */
2560 if (chdir(pw->pw_dir) < 0)
2561 fprintf(stderr, "Could not chdir to home directory %s: %s\n",
2562 pw->pw_dir, strerror(errno));
2563
2564 /*
2565 * Must take new environment into use so that .ssh/rc, /etc/sshrc and
2566 * xauth are run in the proper environment.
2567 */
2568 environ = env;
2569
2570 /*
2571 * Run $HOME/.ssh/rc, /etc/sshrc, or xauth (whichever is found first
2572 * in this order).
2573 */
2574 if (!options.use_login) {
2575 if (stat(SSH_USER_RC, &st) >= 0) {
2576 if (debug_flag)
2577 fprintf(stderr, "Running /bin/sh %s\n", SSH_USER_RC);
2578
2579 f = popen("/bin/sh " SSH_USER_RC, "w");
2580 if (f) {
2581 if (auth_proto != NULL && auth_data != NULL)
2582 fprintf(f, "%s %s\n", auth_proto, auth_data);
2583 pclose(f);
2584 } else
2585 fprintf(stderr, "Could not run %s\n", SSH_USER_RC);
2586 } else if (stat(SSH_SYSTEM_RC, &st) >= 0) {
2587 if (debug_flag)
2588 fprintf(stderr, "Running /bin/sh %s\n", SSH_SYSTEM_RC);
2589
2590 f = popen("/bin/sh " SSH_SYSTEM_RC, "w");
2591 if (f) {
2592 if (auth_proto != NULL && auth_data != NULL)
2593 fprintf(f, "%s %s\n", auth_proto, auth_data);
2594 pclose(f);
2595 } else
2596 fprintf(stderr, "Could not run %s\n", SSH_SYSTEM_RC);
2597 }
2598#ifdef XAUTH_PATH
2599 else {
2600 /* Add authority data to .Xauthority if appropriate. */
2601 if (auth_proto != NULL && auth_data != NULL) {
2602 if (debug_flag)
2603 fprintf(stderr, "Running %.100s add %.100s %.100s %.100s\n",
2604 XAUTH_PATH, display, auth_proto, auth_data);
2605
2606 f = popen(XAUTH_PATH " -q -", "w");
2607 if (f) {
2608 fprintf(f, "add %s %s %s\n", display, auth_proto, auth_data);
2609 pclose(f);
2610 } else
2611 fprintf(stderr, "Could not run %s -q -\n", XAUTH_PATH);
2612 }
2613 }
2614#endif /* XAUTH_PATH */
2615
2616 /* Get the last component of the shell name. */
2617 cp = strrchr(shell, '/');
2618 if (cp)
2619 cp++;
2620 else
2621 cp = shell;
2622 }
2623 /*
2624 * If we have no command, execute the shell. In this case, the shell
2625 * name to be passed in argv[0] is preceded by '-' to indicate that
2626 * this is a login shell.
2627 */
2628 if (!command) {
2629 if (!options.use_login) {
2630 char buf[256];
2631
2632 /*
2633 * Check for mail if we have a tty and it was enabled
2634 * in server options.
2635 */
2636 if (ttyname && options.check_mail) {
2637 char *mailbox;
2638 struct stat mailstat;
2639 mailbox = getenv("MAIL");
2640 if (mailbox != NULL) {
2641 if (stat(mailbox, &mailstat) != 0 || mailstat.st_size == 0)
2642 printf("No mail.\n");
2643 else if (mailstat.st_mtime < mailstat.st_atime)
2644 printf("You have mail.\n");
2645 else
2646 printf("You have new mail.\n");
2647 }
2648 }
2649 /* Start the shell. Set initial character to '-'. */
2650 buf[0] = '-';
2651 strncpy(buf + 1, cp, sizeof(buf) - 1);
2652 buf[sizeof(buf) - 1] = 0;
2653
2654 /* Execute the shell. */
2655 argv[0] = buf;
2656 argv[1] = NULL;
2657 execve(shell, argv, env);
2658
2659 /* Executing the shell failed. */
2660 perror(shell);
2661 exit(1);
2662
2663 } else {
2664 /* Launch login(1). */
2665
2666 execl(LOGIN_PROGRAM, "login", "-h", get_remote_ipaddr(),
2667 "-p", "-f", "--", pw->pw_name, NULL);
2668
2669 /* Login couldn't be executed, die. */
2670
2671 perror("login");
2672 exit(1);
2673 }
2674 }
2675 /*
2676 * Execute the command using the user's shell. This uses the -c
2677 * option to execute the command.
2678 */
2679 argv[0] = (char *) cp;
2680 argv[1] = "-c";
2681 argv[2] = (char *) command;
2682 argv[3] = NULL;
2683 execve(shell, argv, env);
2684 perror(shell);
2685 exit(1);
2686}
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-30 05:53:33 +0000