Branch data     Line data    Source code

       1                 :            : /* $OpenBSD: auth-rh-rsa.c,v 1.43 2010/03/04 10:36:03 djm Exp $ */
       2                 :            : /*
       3                 :            :  * Author: Tatu Ylonen <ylo@cs.hut.fi>
       4                 :            :  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
       5                 :            :  *                    All rights reserved
       6                 :            :  * Rhosts or /etc/hosts.equiv authentication combined with RSA host
       7                 :            :  * authentication.
       8                 :            :  *
       9                 :            :  * As far as I am concerned, the code I have written for this software
      10                 :            :  * can be used freely for any purpose.  Any derived versions of this
      11                 :            :  * software must be clearly marked as such, and if the derived work is
      12                 :            :  * incompatible with the protocol description in the RFC file, it must be
      13                 :            :  * called by a name other than "ssh" or "Secure Shell".
      14                 :            :  */
      15                 :            : 
      16                 :            : #include "includes.h"
      17                 :            : 
      18                 :            : #include <sys/types.h>
      19                 :            : 
      20                 :            : #include <pwd.h>
      21                 :            : #include <stdarg.h>
      22                 :            : 
      23                 :            : #include "packet.h"
      24                 :            : #include "uidswap.h"
      25                 :            : #include "log.h"
      26                 :            : #include "buffer.h"
      27                 :            : #include "servconf.h"
      28                 :            : #include "key.h"
      29                 :            : #include "hostfile.h"
      30                 :            : #include "pathnames.h"
      31                 :            : #include "auth.h"
      32                 :            : #include "canohost.h"
      33                 :            : #ifdef GSSAPI
      34                 :            : #include "ssh-gss.h"
      35                 :            : #endif
      36                 :            : #include "monitor_wrap.h"
      37                 :            : 
      38                 :            : /* import */
      39                 :            : extern ServerOptions options;
      40                 :            : 
      41                 :            : int
      42                 :          0 : auth_rhosts_rsa_key_allowed(struct passwd *pw, char *cuser, char *chost,
      43                 :            :     Key *client_host_key)
      44                 :            : {
      45                 :            :         HostStatus host_status;
      46                 :            : 
      47         [ #  # ]:          0 :         if (auth_key_is_revoked(client_host_key))
      48                 :            :                 return 0;
      49                 :            : 
      50                 :            :         /* Check if we would accept it using rhosts authentication. */
      51         [ #  # ]:          0 :         if (!auth_rhosts(pw, cuser))
      52                 :            :                 return 0;
      53                 :            : 
      54         [ #  # ]:          0 :         host_status = check_key_in_hostfiles(pw, client_host_key,
      55                 :            :             chost, _PATH_SSH_SYSTEM_HOSTFILE,
      56                 :          0 :             options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);
      57                 :            : 
      58                 :          0 :         return (host_status == HOST_OK);
      59                 :            : }
      60                 :            : 
      61                 :            : /*
      62                 :            :  * Tries to authenticate the user using the .rhosts file and the host using
      63                 :            :  * its host key.  Returns true if authentication succeeds.
      64                 :            :  */
      65                 :            : int
      66                 :          0 : auth_rhosts_rsa(Authctxt *authctxt, char *cuser, Key *client_host_key)
      67                 :            : {
      68                 :            :         char *chost;
      69                 :          0 :         struct passwd *pw = authctxt->pw;
      70                 :            : 
      71                 :          0 :         debug("Trying rhosts with RSA host authentication for client user %.100s",
      72                 :            :             cuser);
      73                 :            : 
      74 [ #  # ][ #  # ]:          0 :         if (!authctxt->valid || client_host_key == NULL ||
                 [ #  # ]
      75                 :          0 :             client_host_key->rsa == NULL)
      76                 :            :                 return 0;
      77                 :            : 
      78                 :          0 :         chost = (char *)get_canonical_hostname(options.use_dns);
      79                 :          0 :         debug("Rhosts RSA authentication: canonical host %.900s", chost);
      80                 :            : 
      81 [ #  # ][ #  # ]:          0 :         if (!PRIVSEP(auth_rhosts_rsa_key_allowed(pw, cuser, chost, client_host_key))) {
      82                 :          0 :                 debug("Rhosts with RSA host authentication denied: unknown or invalid host key");
      83                 :          0 :                 packet_send_debug("Your host key cannot be verified: unknown or invalid host key.");
      84                 :          0 :                 return 0;
      85                 :            :         }
      86                 :            :         /* A matching host key was found and is known. */
      87                 :            : 
      88                 :            :         /* Perform the challenge-response dialog with the client for the host key. */
      89         [ #  # ]:          0 :         if (!auth_rsa_challenge_dialog(client_host_key)) {
      90                 :          0 :                 logit("Client on %.800s failed to respond correctly to host authentication.",
      91                 :            :                     chost);
      92                 :          0 :                 return 0;
      93                 :            :         }
      94                 :            :         /*
      95                 :            :          * We have authenticated the user using .rhosts or /etc/hosts.equiv,
      96                 :            :          * and the host using RSA. We accept the authentication.
      97                 :            :          */
      98                 :            : 
      99                 :          0 :         verbose("Rhosts with RSA host authentication accepted for %.100s, %.100s on %.700s.",
     100                 :            :             pw->pw_name, cuser, chost);
     101                 :          0 :         packet_send_debug("Rhosts with RSA host authentication accepted.");
     102                 :          0 :         return 1;
     103                 :            : }