diff options
-rw-r--r-- | ChangeLog | 5 | ||||
-rw-r--r-- | auth-krb5.c | 13 | ||||
-rw-r--r-- | openbsd-compat/port-aix.c | 25 | ||||
-rw-r--r-- | openbsd-compat/port-aix.h | 6 | ||||
-rw-r--r-- | platform.c | 12 | ||||
-rw-r--r-- | platform.h | 4 |
6 files changed, 59 insertions, 6 deletions
@@ -1,3 +1,8 @@ | |||
1 | 20091221 | ||
2 | - (dtucker) [auth-krb5.c platform.{c,h} openbsd-compat/port-aix.{c,h}] | ||
3 | Bug #1583: Use system's kerberos principal name on AIX if it's available. | ||
4 | Based on a patch from and tested by Miguel Sanders | ||
5 | |||
1 | 20091208 | 6 | 20091208 |
2 | - (dtucker) Bug #1470: Disable OOM-killing of the listening sshd on Linux, | 7 | - (dtucker) Bug #1470: Disable OOM-killing of the listening sshd on Linux, |
3 | based on a patch from Vaclav Ovsik and Colin Watson. ok djm. | 8 | based on a patch from Vaclav Ovsik and Colin Watson. ok djm. |
diff --git a/auth-krb5.c b/auth-krb5.c index 868288126..d019fe202 100644 --- a/auth-krb5.c +++ b/auth-krb5.c | |||
@@ -78,6 +78,11 @@ auth_krb5_password(Authctxt *authctxt, const char *password) | |||
78 | krb5_error_code problem; | 78 | krb5_error_code problem; |
79 | krb5_ccache ccache = NULL; | 79 | krb5_ccache ccache = NULL; |
80 | int len; | 80 | int len; |
81 | char *client, *platform_client; | ||
82 | |||
83 | /* get platform-specific kerberos client principal name (if it exists) */ | ||
84 | platform_client = platform_krb5_get_principal_name(authctxt->pw->pw_name); | ||
85 | client = platform_client ? platform_client : authctxt->pw->pw_name; | ||
81 | 86 | ||
82 | temporarily_use_uid(authctxt->pw); | 87 | temporarily_use_uid(authctxt->pw); |
83 | 88 | ||
@@ -85,7 +90,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password) | |||
85 | if (problem) | 90 | if (problem) |
86 | goto out; | 91 | goto out; |
87 | 92 | ||
88 | problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name, | 93 | problem = krb5_parse_name(authctxt->krb5_ctx, client, |
89 | &authctxt->krb5_user); | 94 | &authctxt->krb5_user); |
90 | if (problem) | 95 | if (problem) |
91 | goto out; | 96 | goto out; |
@@ -141,8 +146,7 @@ auth_krb5_password(Authctxt *authctxt, const char *password) | |||
141 | if (problem) | 146 | if (problem) |
142 | goto out; | 147 | goto out; |
143 | 148 | ||
144 | if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, | 149 | if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) { |
145 | authctxt->pw->pw_name)) { | ||
146 | problem = -1; | 150 | problem = -1; |
147 | goto out; | 151 | goto out; |
148 | } | 152 | } |
@@ -176,6 +180,9 @@ auth_krb5_password(Authctxt *authctxt, const char *password) | |||
176 | 180 | ||
177 | out: | 181 | out: |
178 | restore_uid(); | 182 | restore_uid(); |
183 | |||
184 | if (platform_client != NULL) | ||
185 | xfree(platform_client); | ||
179 | 186 | ||
180 | if (problem) { | 187 | if (problem) { |
181 | if (ccache) | 188 | if (ccache) |
diff --git a/openbsd-compat/port-aix.c b/openbsd-compat/port-aix.c index d9c0876f3..0bdefbf6d 100644 --- a/openbsd-compat/port-aix.c +++ b/openbsd-compat/port-aix.c | |||
@@ -374,6 +374,31 @@ aix_restoreauthdb(void) | |||
374 | 374 | ||
375 | # endif /* WITH_AIXAUTHENTICATE */ | 375 | # endif /* WITH_AIXAUTHENTICATE */ |
376 | 376 | ||
377 | # ifdef USE_AIX_KRB_NAME | ||
378 | /* | ||
379 | * aix_krb5_get_principal_name: returns the user's kerberos client principal name if | ||
380 | * configured, otherwise NULL. Caller must free returned string. | ||
381 | */ | ||
382 | char * | ||
383 | aix_krb5_get_principal_name(char *pw_name) | ||
384 | { | ||
385 | char *authname = NULL, *authdomain = NULL, *principal = NULL; | ||
386 | |||
387 | setuserdb(S_READ); | ||
388 | if (getuserattr(pw_name, S_AUTHDOMAIN, &authdomain, SEC_CHAR) != 0) | ||
389 | debug("AIX getuserattr S_AUTHDOMAIN: %s", strerror(errno)); | ||
390 | if (getuserattr(pw_name, S_AUTHNAME, &authname, SEC_CHAR) != 0) | ||
391 | debug("AIX getuserattr S_AUTHNAME: %s", strerror(errno)); | ||
392 | |||
393 | if (authdomain != NULL) | ||
394 | xasprintf(&principal, "%s@%s", authname ? authname : pw_name, authdomain); | ||
395 | else if (authname != NULL) | ||
396 | principal = xstrdup(authname); | ||
397 | enduserdb(); | ||
398 | return principal; | ||
399 | } | ||
400 | # endif /* USE_AIX_KRB_NAME */ | ||
401 | |||
377 | # if defined(AIX_GETNAMEINFO_HACK) && !defined(BROKEN_ADDRINFO) | 402 | # if defined(AIX_GETNAMEINFO_HACK) && !defined(BROKEN_ADDRINFO) |
378 | # undef getnameinfo | 403 | # undef getnameinfo |
379 | /* | 404 | /* |
diff --git a/openbsd-compat/port-aix.h b/openbsd-compat/port-aix.h index 3ac76ae15..53e4e88a0 100644 --- a/openbsd-compat/port-aix.h +++ b/openbsd-compat/port-aix.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $Id: port-aix.h,v 1.31 2009/08/20 06:20:50 dtucker Exp $ */ | 1 | /* $Id: port-aix.h,v 1.32 2009/12/20 23:49:22 dtucker Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * | 4 | * |
@@ -95,6 +95,10 @@ int sys_auth_record_login(const char *, const char *, const char *, Buffer *); | |||
95 | # define CUSTOM_SYS_AUTH_GET_LASTLOGIN_MSG | 95 | # define CUSTOM_SYS_AUTH_GET_LASTLOGIN_MSG |
96 | char *sys_auth_get_lastlogin_msg(const char *, uid_t); | 96 | char *sys_auth_get_lastlogin_msg(const char *, uid_t); |
97 | # define CUSTOM_FAILED_LOGIN 1 | 97 | # define CUSTOM_FAILED_LOGIN 1 |
98 | # if defined(S_AUTHDOMAIN) && defined (S_AUTHNAME) | ||
99 | # define USE_AIX_KRB_NAME | ||
100 | char *aix_krb5_get_principal_name(char *); | ||
101 | # endif | ||
98 | #endif | 102 | #endif |
99 | 103 | ||
100 | void aix_setauthdb(const char *); | 104 | void aix_setauthdb(const char *); |
diff --git a/platform.c b/platform.c index 2dc4352f4..e3a428aaa 100644 --- a/platform.c +++ b/platform.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $Id: platform.c,v 1.2 2009/12/08 02:39:48 dtucker Exp $ */ | 1 | /* $Id: platform.c,v 1.3 2009/12/20 23:49:22 dtucker Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright (c) 2006 Darren Tucker. All rights reserved. | 4 | * Copyright (c) 2006 Darren Tucker. All rights reserved. |
@@ -56,3 +56,13 @@ platform_post_fork_child(void) | |||
56 | oom_adjust_restore(); | 56 | oom_adjust_restore(); |
57 | #endif | 57 | #endif |
58 | } | 58 | } |
59 | |||
60 | char * | ||
61 | platform_krb5_get_principal_name(const char *pw_name) | ||
62 | { | ||
63 | #ifdef USE_AIX_KRB_NAME | ||
64 | return aix_krb5_get_principal_name(pw_name); | ||
65 | #else | ||
66 | return NULL; | ||
67 | #endif | ||
68 | } | ||
diff --git a/platform.h b/platform.h index 8a34e364e..07ae3ad85 100644 --- a/platform.h +++ b/platform.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $Id: platform.h,v 1.2 2009/12/08 02:39:48 dtucker Exp $ */ | 1 | /* $Id: platform.h,v 1.3 2009/12/20 23:49:22 dtucker Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright (c) 2006 Darren Tucker. All rights reserved. | 4 | * Copyright (c) 2006 Darren Tucker. All rights reserved. |
@@ -22,3 +22,5 @@ void platform_pre_listen(void); | |||
22 | void platform_pre_fork(void); | 22 | void platform_pre_fork(void); |
23 | void platform_post_fork_parent(pid_t child_pid); | 23 | void platform_post_fork_parent(pid_t child_pid); |
24 | void platform_post_fork_child(void); | 24 | void platform_post_fork_child(void); |
25 | char * platform_get_krb5_client(const char *); | ||
26 | |||