diff options
Diffstat (limited to 'auth-rh-rsa.c')
-rw-r--r-- | auth-rh-rsa.c | 174 |
1 files changed, 86 insertions, 88 deletions
diff --git a/auth-rh-rsa.c b/auth-rh-rsa.c index 68e0b829e..4e9a383a2 100644 --- a/auth-rh-rsa.c +++ b/auth-rh-rsa.c | |||
@@ -1,21 +1,21 @@ | |||
1 | /* | 1 | /* |
2 | 2 | * | |
3 | auth-rh-rsa.c | 3 | * auth-rh-rsa.c |
4 | 4 | * | |
5 | Author: Tatu Ylonen <ylo@cs.hut.fi> | 5 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
6 | 6 | * | |
7 | Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 7 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
8 | All rights reserved | 8 | * All rights reserved |
9 | 9 | * | |
10 | Created: Sun May 7 03:08:06 1995 ylo | 10 | * Created: Sun May 7 03:08:06 1995 ylo |
11 | 11 | * | |
12 | Rhosts or /etc/hosts.equiv authentication combined with RSA host | 12 | * Rhosts or /etc/hosts.equiv authentication combined with RSA host |
13 | authentication. | 13 | * authentication. |
14 | 14 | * | |
15 | */ | 15 | */ |
16 | 16 | ||
17 | #include "includes.h" | 17 | #include "includes.h" |
18 | RCSID("$Id: auth-rh-rsa.c,v 1.5 1999/11/16 02:37:16 damien Exp $"); | 18 | RCSID("$Id: auth-rh-rsa.c,v 1.6 1999/11/24 13:26:21 damien Exp $"); |
19 | 19 | ||
20 | #include "packet.h" | 20 | #include "packet.h" |
21 | #include "ssh.h" | 21 | #include "ssh.h" |
@@ -26,78 +26,76 @@ RCSID("$Id: auth-rh-rsa.c,v 1.5 1999/11/16 02:37:16 damien Exp $"); | |||
26 | /* Tries to authenticate the user using the .rhosts file and the host using | 26 | /* Tries to authenticate the user using the .rhosts file and the host using |
27 | its host key. Returns true if authentication succeeds. */ | 27 | its host key. Returns true if authentication succeeds. */ |
28 | 28 | ||
29 | int auth_rhosts_rsa(struct passwd *pw, const char *client_user, | 29 | int |
30 | BIGNUM *client_host_key_e, BIGNUM *client_host_key_n) | 30 | auth_rhosts_rsa(struct passwd *pw, const char *client_user, |
31 | BIGNUM *client_host_key_e, BIGNUM *client_host_key_n) | ||
31 | { | 32 | { |
32 | extern ServerOptions options; | 33 | extern ServerOptions options; |
33 | const char *canonical_hostname; | 34 | const char *canonical_hostname; |
34 | HostStatus host_status; | 35 | HostStatus host_status; |
35 | BIGNUM *ke, *kn; | 36 | BIGNUM *ke, *kn; |
36 | 37 | ||
37 | debug("Trying rhosts with RSA host authentication for %.100s", client_user); | 38 | debug("Trying rhosts with RSA host authentication for %.100s", client_user); |
38 | 39 | ||
39 | /* Check if we would accept it using rhosts authentication. */ | 40 | /* Check if we would accept it using rhosts authentication. */ |
40 | if (!auth_rhosts(pw, client_user)) | 41 | if (!auth_rhosts(pw, client_user)) |
41 | return 0; | 42 | return 0; |
42 | 43 | ||
43 | canonical_hostname = get_canonical_hostname(); | 44 | canonical_hostname = get_canonical_hostname(); |
44 | 45 | ||
45 | debug("Rhosts RSA authentication: canonical host %.900s", | 46 | debug("Rhosts RSA authentication: canonical host %.900s", |
46 | canonical_hostname); | 47 | canonical_hostname); |
47 | 48 | ||
48 | /* Check if we know the host and its host key. */ | 49 | /* Check if we know the host and its host key. */ |
49 | /* Check system-wide host file. */ | 50 | ke = BN_new(); |
50 | ke = BN_new(); | 51 | kn = BN_new(); |
51 | kn = BN_new(); | 52 | host_status = check_host_in_hostfile(SSH_SYSTEM_HOSTFILE, canonical_hostname, |
52 | host_status = check_host_in_hostfile(SSH_SYSTEM_HOSTFILE, canonical_hostname, | 53 | client_host_key_e, client_host_key_n, |
53 | client_host_key_e, client_host_key_n, ke, kn); | 54 | ke, kn); |
54 | 55 | ||
55 | /* Check user host file unless ignored. */ | 56 | /* Check user host file unless ignored. */ |
56 | if (host_status != HOST_OK && !options.ignore_user_known_hosts) { | 57 | if (host_status != HOST_OK && !options.ignore_user_known_hosts) { |
57 | struct stat st; | 58 | struct stat st; |
58 | char *user_hostfile = tilde_expand_filename(SSH_USER_HOSTFILE, pw->pw_uid); | 59 | char *user_hostfile = tilde_expand_filename(SSH_USER_HOSTFILE, pw->pw_uid); |
59 | /* Check file permissions of SSH_USER_HOSTFILE, | 60 | /* Check file permissions of SSH_USER_HOSTFILE, auth_rsa() |
60 | auth_rsa() did already check pw->pw_dir, but there is a race XXX */ | 61 | did already check pw->pw_dir, but there is a race XXX */ |
61 | if (options.strict_modes && | 62 | if (options.strict_modes && |
62 | (stat(user_hostfile, &st) == 0) && | 63 | (stat(user_hostfile, &st) == 0) && |
63 | ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | 64 | ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || |
64 | (st.st_mode & 022) != 0)) { | 65 | (st.st_mode & 022) != 0)) { |
65 | log("Rhosts RSA authentication refused for %.100s: bad owner or modes for %.200s", | 66 | log("Rhosts RSA authentication refused for %.100s: bad owner or modes for %.200s", |
66 | pw->pw_name, user_hostfile); | 67 | pw->pw_name, user_hostfile); |
67 | } else { | 68 | } else { |
68 | /* XXX race between stat and the following open() */ | 69 | /* XXX race between stat and the following open() */ |
69 | temporarily_use_uid(pw->pw_uid); | 70 | temporarily_use_uid(pw->pw_uid); |
70 | host_status = check_host_in_hostfile(user_hostfile, canonical_hostname, | 71 | host_status = check_host_in_hostfile(user_hostfile, canonical_hostname, |
71 | client_host_key_e, client_host_key_n, ke, kn); | 72 | client_host_key_e, client_host_key_n, |
72 | restore_uid(); | 73 | ke, kn); |
73 | } | 74 | restore_uid(); |
74 | xfree(user_hostfile); | 75 | } |
75 | } | 76 | xfree(user_hostfile); |
76 | BN_free(ke); | 77 | } |
77 | BN_free(kn); | 78 | BN_free(ke); |
78 | 79 | BN_free(kn); | |
79 | if (host_status != HOST_OK) { | 80 | |
80 | /* The host key was not found. */ | 81 | if (host_status != HOST_OK) { |
81 | debug("Rhosts with RSA host authentication denied: unknown or invalid host key"); | 82 | debug("Rhosts with RSA host authentication denied: unknown or invalid host key"); |
82 | packet_send_debug("Your host key cannot be verified: unknown or invalid host key."); | 83 | packet_send_debug("Your host key cannot be verified: unknown or invalid host key."); |
83 | return 0; | 84 | return 0; |
84 | } | 85 | } |
85 | 86 | /* A matching host key was found and is known. */ | |
86 | /* A matching host key was found and is known. */ | 87 | |
87 | 88 | /* Perform the challenge-response dialog with the client for the host key. */ | |
88 | /* Perform the challenge-response dialog with the client for the host key. */ | 89 | if (!auth_rsa_challenge_dialog(client_host_key_e, client_host_key_n)) { |
89 | if (!auth_rsa_challenge_dialog(client_host_key_e, client_host_key_n)) | 90 | log("Client on %.800s failed to respond correctly to host authentication.", |
90 | { | 91 | canonical_hostname); |
91 | log("Client on %.800s failed to respond correctly to host authentication.", | 92 | return 0; |
92 | canonical_hostname); | 93 | } |
93 | return 0; | 94 | /* We have authenticated the user using .rhosts or /etc/hosts.equiv, and the host using RSA. |
94 | } | 95 | We accept the authentication. */ |
95 | 96 | ||
96 | /* We have authenticated the user using .rhosts or /etc/hosts.equiv, and | 97 | verbose("Rhosts with RSA host authentication accepted for %.100s, %.100s on %.700s.", |
97 | the host using RSA. We accept the authentication. */ | 98 | pw->pw_name, client_user, canonical_hostname); |
98 | 99 | packet_send_debug("Rhosts with RSA host authentication accepted."); | |
99 | log("Rhosts with RSA host authentication accepted for %.100s, %.100s on %.700s.", | 100 | return 1; |
100 | pw->pw_name, client_user, canonical_hostname); | ||
101 | packet_send_debug("Rhosts with RSA host authentication accepted."); | ||
102 | return 1; | ||
103 | } | 101 | } |