dhkeys.c revision 36e852a172cba914383d7341c988128b2c667fbd
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#include <stdlib.h>
#include <syslog.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>
#include <assert.h>
#include <stdarg.h>
#include <limits.h>
#include <signal.h>
#include <pthread.h>
#include <synch.h>
#include <rpcsvc/nispasswd.h>
#include <rpcsvc/yppasswd.h>
#include <rpc/key_prot.h>
#include <nss_dbdefs.h>
#include <nsswitch.h>
#include <rpcsvc/nis_dhext.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <security/pam_impl.h>
#include <libintl.h>
#include <passwdutil.h>
#include "key_call_uid.h"
#include <shadow.h>
extern int _nfssys(int, void *);
/*
* int msg(pamh, ...)
*
* display message to the user
*/
/*PRINTFLIKE2*/
static int
{
}
/*
* Get the secret key for the given netname, key length, and algorithm
* type and send it to keyserv if the given pw decrypts it. Update the
* following counter args as necessary: get_seckey_cnt, good_pw_cnt, and
* set_seckey_cnt.
*
* Returns 0 on malloc failure, else 1.
*/
static int
const char *netname, /* in */
const char *pw, /* in */
int *get_seckey_cnt, /* out */
int *good_pw_cnt, /* out */
int *set_seckey_cnt, /* out */
int flags, /* in */
int debug) /* in */
{
char *skey;
int skeylen;
return (0);
}
(*get_seckey_cnt)++;
if (skey[0]) {
/* password does decrypt secret key */
(*good_pw_cnt)++;
(*set_seckey_cnt)++;
} else {
if (debug)
"get_and_set_seckey: could not "
"set secret key for keytype "
}
} else {
sizeof (messages[0]),
"Password does not "
"decrypt secret key (type = %d-%d) "
}
}
} else {
if (debug)
"could not get secret key for keytype %d-%d",
}
return (1);
}
/*
* int establish_key(pamh, flags, debug, netname)
*
* This routine establishes the Secure RPC Credentials for the
* user specified in PAM_USER, using the password in PAM_AUTHTOK.
*
* Establishing RPC credentials is considered a "helper" function for the PAM
* stack so we should only return failures or PAM_IGNORE. Returning PAM_SUCCESS
* may short circuit the stack and circumvent later critical checks.
*
* we are called from pam_sm_setcred:
* 1. if we are root (uid == 0), we do nothing and return
* PAM_IGNORE.
* 2. else, we try to establish credentials.
*
* We return framework errors as appropriate such as PAM_USER_UNKNOWN,
* PAM_BUF_ERR, PAM_PERM_DENIED.
*
* If we succeed in establishing credentials we return PAM_IGNORE.
*
* If we fail to establish credentials then we return:
* - PAM_SERVICE_ERR (credentials needed) or PAM_SYSTEM_ERR
* (credentials not needed) if netname could not be created;
* - PAM_AUTH_ERR (credentials needed) or PAM_IGNORE (credentials
* not needed) if no credentials were retrieved;
* - PAM_AUTH_ERR if the password didn't decrypt the cred;
* - PAM_SYSTEM_ERR if the cred's could not be stored.
*
* This routine returns the user's netname in "netname".
*
* All tools--but the PAM stack--currently use getpass() to obtain
* the user's secure RPC password. We must make sure we don't use more than
* the first des_block (eight) characters of whatever is handed down to us.
* Therefore, we use a local variable "short_pass" to hold those 8 char's.
*/
static int
{
char *user;
char *passwd;
int result;
int err;
char *scratch;
int scratchlen;
mechanism_t **mechs;
mechanism_t **mpp;
int get_seckey_cnt = 0;
int set_seckey_cnt = 0;
int good_pw_cnt = 0;
int valid_mech_cnt = 0;
if (debug)
return (PAM_USER_UNKNOWN);
}
return (PAM_BUF_ERR);
goto out;
}
/*
* We don't set credentials when root logs in.
*/
if (uid == 0) {
result = PAM_IGNORE;
goto out;
}
if (err != 1) {
if (debug)
goto out;
}
/* passwd can be NULL (no passwd or su as root) */
if (passwd) {
} else
short_passp = NULL;
if (AUTH_DES_COMPAT_CHK(mp))
break; /* fall through to AUTH_DES below */
if (!VALID_MECH_ENTRY(mp))
continue;
if (debug)
goto out;
}
}
/* fall through to AUTH_DES below */
} else {
/*
* No usable mechs found in security congifuration file thus
* fallback to AUTH_DES compat.
*/
if (debug)
"found. Trying AUTH_DES.");
}
/*
* We always perform AUTH_DES for the benefit of services like NFS
* that may depend on the classic des 192bit key being set.
*/
goto out;
}
if (debug) {
}
if (get_seckey_cnt == 0) { /* No credentials */
result = PAM_IGNORE;
goto out;
}
if (good_pw_cnt == 0) { /* wrong password */
goto out;
}
if (set_seckey_cnt == 0) {
goto out;
}
/* Credentials have been successfully established, return PAM_IGNORE */
result = PAM_IGNORE;
out:
/*
* If we are authenticating we attempt to establish credentials
* where appropriate. Failure to do so is only an error if we
* definitely needed them. Thus always return PAM_IGNORE
* if we are authenticating and credentials were not needed.
*/
return (result);
}
/*ARGSUSED*/
int
{
return (PAM_IGNORE);
}
typedef struct argres {
int result;
} argres_t;
/*
* Revoke NFS DES credentials.
* NFS may not be installed so we need to deal with SIGSYS
* when we call _nfssys(); we thus call _nfssys() in a seperate thread that
* is created specifically for this call. The thread specific signalmask
* is set to ignore SIGSYS. After the call to _nfssys(), the thread
* ceases to exist.
*/
static void *
revoke_nfs_cred(void *ap)
{
struct nfs_revauth_args nra;
(void) sigemptyset(&isigset);
}
} else {
}
return (NULL);
}
static int
{
int result;
char *uname;
if (debug)
"pam_dhkeys: user NULL or empty in remove_key()");
return (PAM_USER_UNKNOWN);
}
if ((flags & PAM_SILENT) == 0) {
"removing root credentials would"
" break the rpc services that"));
"use secure rpc on this host!"));
"root may use keylogout -f to do"
" this (at your own risk)!"));
}
return (PAM_PERM_DENIED);
}
return (PAM_BUF_ERR);
} else
if (pwu_rep != PWU_DEFAULT_REP)
if (result == PWU_NOT_FOUND)
return (PAM_USER_UNKNOWN);
if (result == PWU_DENIED)
return (PAM_PERM_DENIED);
if (result != PWU_SUCCESS)
return (PAM_SYSTEM_ERR);
if ((flags & PAM_SILENT) == 0) {
"Warning: NFS credentials not destroyed"));
}
return (PAM_AUTH_ERR);
}
return (PAM_IGNORE);
}
int
{
int i;
int debug = 0;
int result;
for (i = 0; i < argc; i++) {
debug = 1;
flags |= PAM_SILENT;
}
/* Check for invalid flags */
(flags & PAM_REINITIALIZE_CRED) == 0 &&
(flags & PAM_REFRESH_CRED) == 0 &&
(flags & PAM_DELETE_CRED) == 0 &&
(flags & PAM_SILENT) == 0) {
flags);
return (PAM_SYSTEM_ERR);
}
/* doesn't apply to UNIX */
if (debug)
"ignored\n");
return (PAM_IGNORE);
}
if (flags & PAM_DELETE_CRED) {
if (debug)
} else {
/* Some diagnostics */
if ((flags & PAM_SILENT) == 0) {
if (result == PAM_AUTH_ERR)
"Password does not decrypt any secret "
"keys for %s."), netname);
"Could not set secret key(s) for %s. "
"The key server may be down."), netname);
}
/* Not having credentials set is not an error... */
result = PAM_IGNORE;
}
return (result);
}
/*ARGSUSED*/
void
{
if (data) {
}
}
/*ARGSUSED*/
int
{
return (PAM_IGNORE);
}