passwd_auth.c revision 36e852a172cba914383d7341c988128b2c667fbd
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#include <string.h>
#include <stdlib.h>
#include <syslog.h>
#include <unistd.h>
#include <crypt.h>
#include <pwd.h>
#include <libintl.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <security/pam_impl.h>
#include <passwdutil.h>
/*PRINTFLIKE3*/
void
{
if (nowarn == 0)
NULL);
}
/*
* int pam_sm_authenticate(pamh, flags, argc, argv)
*
* Read authentication token from user.
*/
int
{
char *user;
char *password;
char *service;
int i;
int debug = 0;
int nowarn = 0;
int res;
char prompt[PAM_MAX_MSG_SIZE];
int retval;
int privileged;
char *rep_passwd = NULL;
char *repository_name = NULL;
int min;
int max;
int lstchg;
int server_policy = 0;
for (i = 0; i < argc; i++) {
debug = 1;
nowarn = 1;
server_policy = 1;
}
if (flags & PAM_SILENT)
nowarn = 1;
if (debug)
return (res);
}
"PAM_USER NULL or empty");
return (PAM_SYSTEM_ERR);
}
if (res != PAM_SUCCESS)
return (res);
return (PAM_IGNORE);
if (res != PAM_SUCCESS)
return (res);
if (res != PAM_SUCCESS) {
"error getting repository");
return (PAM_SYSTEM_ERR);
}
} else {
return (PAM_BUF_ERR);
}
if (res != PWU_SUCCESS) {
if (res == PWU_NOT_FOUND)
else if (res == PWU_DENIED)
else if (res == PWU_REPOSITORY_ERROR) {
"pam_passwd_auth: detected unsupported "
"configuration in /etc/nsswitch.conf.");
"Unsupported nsswitch entry for \"passwd:\"."
" Use \"-r repository \"."), service);
} else
if (debug)
"returned %d", retval);
goto out;
}
if (debug)
"passwd_auth: no authentication needed.");
goto out;
}
/*
* The password prompt differs between users updating their
* own password, and users updating other an user's password
*/
if (privileged) {
/*
* TRANSLATION_NOTE
* The following string has a single space at the end
*/
} else {
/*
* TRANSLATION_NOTE
* The following string has a single space at the end
*/
}
&password);
if (retval != PAM_SUCCESS)
goto out;
"got NULL password from get_authtok()");
goto out;
}
/* Privileged users can skip the tests that follow */
if (privileged)
goto setitem;
/*
* Non privileged user: so we need to check the old password
* and possible restrictions on password changes.
*/
/* Get password and it's age from the repository specified */
if (res != PWU_SUCCESS) {
goto out;
}
/*
* if repository isn't files|nis, and user wants to follow server
* policy, return PAM_IGNORE
*/
if (server_policy &&
retval = PAM_IGNORE;
goto out;
}
/*
* Chop off old SunOS-style password aging information.
*
* Note: old style password aging is only defined for UNIX-style
* crypt strings, hence the comma will always be at position 14.
* Note: This code is here because some other vendors might still
* support this style of password aging. If we don't remove
* the age field, users won't be able to change their password.
* XXX yank this code when we're certain this "compatibility"
* isn't needed anymore.
*/
goto out;
}
/*
* Now check to see if the user is allowed to change
* the password.
*/
/* aging is turned on, and a change is not forced */
/* Aged enough? */
"%s: Sorry: less than %d days "
"since the last change."),
goto out;
}
/*
* users with min>max are not allowed to
* change their password.
*/
"%s: You may not change "
"this password."), service);
goto out;
}
}
}
out:
if (password) {
}
if (rep_passwd) {
}
if (pwu_rep)
if (auth_user)
if (repository_name)
return (retval);
}
/*ARGSUSED*/
int
{
return (PAM_IGNORE);
}