2 * session.c - PPP session control.
4 * Copyright (c) 2007 Diego Rivera. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. The name(s) of the authors of this software must not be used to
14 * endorse or promote products derived from this software without
15 * prior written permission.
17 * 3. Redistributions of any form whatsoever must retain the following
19 * "This product includes software developed by Paul Mackerras
20 * <paulus@samba.org>".
22 * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
23 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
24 * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
25 * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
26 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
27 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
28 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
30 * Derived from auth.c, which is:
32 * Copyright (c) 1984-2000 Carnegie Mellon University. All rights reserved.
34 * Redistribution and use in source and binary forms, with or without
35 * modification, are permitted provided that the following conditions
38 * 1. Redistributions of source code must retain the above copyright
39 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in
43 * the documentation and/or other materials provided with the
46 * 3. The name "Carnegie Mellon University" must not be used to
47 * endorse or promote products derived from this software without
48 * prior written permission. For permission or any legal
49 * details, please contact
50 * Office of Technology Transfer
51 * Carnegie Mellon University
53 * Pittsburgh, PA 15213-3890
54 * (412) 268-4387, fax: (412) 268-7395
55 * tech-transfer@andrew.cmu.edu
57 * 4. Redistributions of any form whatsoever must retain the following
59 * "This product includes software developed by Computing Services
60 * at Carnegie Mellon University (http://www.cmu.edu/computing/)."
62 * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
63 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
64 * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
65 * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
66 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
67 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
68 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
87 #include <security/pam_appl.h>
88 #endif /* #ifdef USE_PAM */
90 #define SET_MSG(var, msg) if (var != NULL) { var[0] = msg; }
91 #define COPY_STRING(s) ((s) ? strdup(s) : NULL)
93 #define SUCCESS_MSG "Session started successfully"
94 #define ABORT_MSG "Session can't be started without a username"
95 #define SERVICE_NAME "ppp"
97 #define SESSION_FAILED 0
100 /* We have successfully started a session */
101 static bool logged_in = 0;
105 * Static variables used to communicate between the conversation function
106 * and the server_login function
108 static const char *PAM_username;
109 static const char *PAM_password;
110 static int PAM_session = 0;
111 static pam_handle_t *pamh = NULL;
113 /* PAM conversation function
114 * Here we assume (for now, at least) that echo on means login name, and
115 * echo off means password.
118 static int conversation (int num_msg,
119 const struct pam_message **msg,
120 struct pam_response **resp, void *appdata_ptr)
123 struct pam_response *reply = NULL;
125 reply = malloc(sizeof(struct pam_response) * num_msg);
126 if (!reply) return PAM_CONV_ERR;
128 for (replies = 0; replies < num_msg; replies++) {
129 switch (msg[replies]->msg_style) {
130 case PAM_PROMPT_ECHO_ON:
131 reply[replies].resp_retcode = PAM_SUCCESS;
132 reply[replies].resp = COPY_STRING(PAM_username);
135 case PAM_PROMPT_ECHO_OFF:
136 reply[replies].resp_retcode = PAM_SUCCESS;
137 reply[replies].resp = COPY_STRING(PAM_password);
143 /* ignore it, but pam still wants a NULL response... */
144 reply[replies].resp_retcode = PAM_SUCCESS;
145 reply[replies].resp = NULL;
148 /* Must be an error of some sort... */
157 static struct pam_conv pam_conv_data = {
161 #endif /* #ifdef USE_PAM */
164 session_start(const int flags, const char *user, const char *passwd, const char *ttyName, char **msg)
170 bool try_session = 0;
171 #else /* #ifdef USE_PAM */
176 struct spwd *getspnam();
178 #endif /* #ifdef HAS_SHADOW */
179 #endif /* #ifdef USE_PAM */
181 SET_MSG(msg, SUCCESS_MSG);
183 /* If no verification is requested, then simply return an OK */
184 if (!(SESS_ALL & flags)) {
189 SET_MSG(msg, ABORT_MSG);
190 return SESSION_FAILED;
194 /* Find the '\\' in the username */
195 /* This needs to be fixed to support different username schemes */
196 if ((usr = strchr(user, '\\')) == NULL)
203 PAM_password = passwd;
205 dbglog("Initializing PAM (%d) for user %s", flags, usr);
206 pam_error = pam_start (SERVICE_NAME, usr, &pam_conv_data, &pamh);
207 dbglog("---> PAM INIT Result = %d", pam_error);
208 ok = (pam_error == PAM_SUCCESS);
211 ok = (pam_set_item(pamh, PAM_TTY, ttyName) == PAM_SUCCESS) &&
212 (pam_set_item(pamh, PAM_RHOST, ifname) == PAM_SUCCESS);
215 if (ok && (SESS_AUTH & flags)) {
216 dbglog("Attempting PAM authentication");
217 pam_error = pam_authenticate (pamh, PAM_SILENT);
218 if (pam_error == PAM_SUCCESS) {
219 /* PAM auth was OK */
220 dbglog("PAM Authentication OK for %s", user);
222 /* No matter the reason, we fail because we're authenticating */
224 if (pam_error == PAM_USER_UNKNOWN) {
225 dbglog("User unknown, failing PAM authentication");
226 SET_MSG(msg, "User unknown - cannot authenticate via PAM");
228 /* Any other error means authentication was bad */
229 dbglog("PAM Authentication failed: %d: %s", pam_error,
230 pam_strerror(pamh, pam_error));
231 SET_MSG(msg, (char *) pam_strerror (pamh, pam_error));
236 if (ok && (SESS_ACCT & flags)) {
237 dbglog("Attempting PAM account checks");
238 pam_error = pam_acct_mgmt (pamh, PAM_SILENT);
239 if (pam_error == PAM_SUCCESS) {
241 * PAM account was OK, set the flag which indicates that we should
242 * try to perform the session checks.
245 dbglog("PAM Account OK for %s", user);
248 * If the account checks fail, then we should not try to perform
249 * the session check, because they don't make sense.
252 if (pam_error == PAM_USER_UNKNOWN) {
254 * We're checking the account, so it's ok to not have one
255 * because the user might come from the secrets files, or some
258 dbglog("User unknown, ignoring PAM restrictions");
259 SET_MSG(msg, "User unknown - ignoring PAM restrictions");
261 /* Any other error means session is rejected */
263 dbglog("PAM Account checks failed: %d: %s", pam_error,
264 pam_strerror(pamh, pam_error));
265 SET_MSG(msg, (char *) pam_strerror (pamh, pam_error));
270 if (ok && try_session && (SESS_ACCT & flags)) {
271 /* Only open a session if the user's account was found */
272 pam_error = pam_open_session (pamh, PAM_SILENT);
273 if (pam_error == PAM_SUCCESS) {
274 dbglog("PAM Session opened for user %s", user);
277 dbglog("PAM Session denied for user %s", user);
278 SET_MSG(msg, (char *) pam_strerror (pamh, pam_error));
283 /* This is needed because apparently the PAM stuff closes the log */
286 /* If our PAM checks have already failed, then we must return a failure */
287 if (!ok) return SESSION_FAILED;
289 #else /* #ifdef USE_PAM */
292 * Use the non-PAM methods directly. 'pw' will remain NULL if the user
293 * has not been authenticated using local UNIX system services.
297 if ((SESS_AUTH & flags)) {
302 * Here, we bail if we have no user account, because there is nothing
306 return SESSION_FAILED;
310 spwd = getspnam(user);
314 * If there is no shadow entry for the user, then we can't verify the
318 return SESSION_FAILED;
321 * We check validity all the time, because if the password has expired,
322 * then clearly we should not authenticate against it (if we're being
323 * called for authentication only). Thus, in this particular instance,
324 * there is no real difference between using the AUTH, SESS or ACCT
325 * flags, or combinations thereof.
327 now = time(NULL) / 86400L;
328 if ((spwd->sp_expire > 0 && now >= spwd->sp_expire)
329 || ((spwd->sp_max >= 0 && spwd->sp_max < 10000)
330 && spwd->sp_lstchg >= 0
331 && now >= spwd->sp_lstchg + spwd->sp_max)) {
332 warn("Password for %s has expired", user);
333 return SESSION_FAILED;
336 /* We have a valid shadow entry, keep the password */
337 pw->pw_passwd = spwd->sp_pwdp;
339 #endif /* #ifdef HAS_SHADOW */
342 * If no passwd, don't let them login if we're authenticating.
344 if (pw->pw_passwd == NULL || strlen(pw->pw_passwd) < 2)
345 return SESSION_FAILED;
346 cbuf = crypt(passwd, pw->pw_passwd);
347 if (!cbuf || strcmp(cbuf, pw->pw_passwd) != 0)
348 return SESSION_FAILED;
351 #endif /* #ifdef USE_PAM */
354 * Write a wtmp entry for this user.
357 if (SESS_ACCT & flags) {
358 if (strncmp(ttyName, "/dev/", 5) == 0)
360 logwtmp(ttyName, user, ifname); /* Add wtmp login entry */
363 #if defined(_PATH_LASTLOG) && !defined(USE_PAM)
365 * Enter the user in lastlog only if he has been authenticated using
366 * local system services. If he has not, then we don't know what his
367 * UID might be, and lastlog is indexed by UID.
374 if ((fd = open(_PATH_LASTLOG, O_RDWR, 0)) >= 0) {
375 (void)lseek(fd, (off_t)(pw->pw_uid * sizeof(ll)), SEEK_SET);
376 memset((void *)&ll, 0, sizeof(ll));
379 strlcpy(ll.ll_line, ttyName, sizeof(ll.ll_line));
380 strlcpy(ll.ll_host, ifname, sizeof(ll.ll_host));
381 (void)write(fd, (char *)&ll, sizeof(ll));
385 #endif /* _PATH_LASTLOG and not USE_PAM */
386 info("user %s logged in on tty %s intf %s", user, ttyName, ifname);
393 * session_end - Logout the user.
396 session_end(const char* ttyName)
399 int pam_error = PAM_SUCCESS;
402 if (PAM_session) pam_error = pam_close_session (pamh, PAM_SILENT);
404 pam_end (pamh, pam_error);
406 /* Apparently the pam stuff does closelog(). */
411 if (strncmp(ttyName, "/dev/", 5) == 0)
413 logwtmp(ttyName, "", ""); /* Wipe out utmp logout entry */