2 * session.c - PPP session control.
4 * Copyright (c) 2007 Diego Rivera. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. The name(s) of the authors of this software must not be used to
14 * endorse or promote products derived from this software without
15 * prior written permission.
17 * 3. Redistributions of any form whatsoever must retain the following
19 * "This product includes software developed by Paul Mackerras
20 * <paulus@samba.org>".
22 * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
23 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
24 * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
25 * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
26 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
27 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
28 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
30 * Derived from auth.c, which is:
32 * Copyright (c) 1984-2000 Carnegie Mellon University. All rights reserved.
34 * Redistribution and use in source and binary forms, with or without
35 * modification, are permitted provided that the following conditions
38 * 1. Redistributions of source code must retain the above copyright
39 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in
43 * the documentation and/or other materials provided with the
46 * 3. The name "Carnegie Mellon University" must not be used to
47 * endorse or promote products derived from this software without
48 * prior written permission. For permission or any legal
49 * details, please contact
50 * Office of Technology Transfer
51 * Carnegie Mellon University
53 * Pittsburgh, PA 15213-3890
54 * (412) 268-4387, fax: (412) 268-7395
55 * tech-transfer@andrew.cmu.edu
57 * 4. Redistributions of any form whatsoever must retain the following
59 * "This product includes software developed by Computing Services
60 * at Carnegie Mellon University (http://www.cmu.edu/computing/)."
62 * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
63 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
64 * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
65 * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
66 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
67 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
68 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
85 #include <security/pam_appl.h>
86 #endif /* #ifdef USE_PAM */
88 #define SET_MSG(var, msg) if (var != NULL) { var[0] = msg; }
89 #define COPY_STRING(s) ((s) ? strdup(s) : NULL)
91 #define SUCCESS_MSG "Session started successfully"
92 #define ABORT_MSG "Session can't be started without a username"
93 #define SERVICE_NAME "ppp"
95 #define SESSION_FAILED 0
98 /* We have successfully started a session */
99 static bool logged_in = 0;
103 * Static variables used to communicate between the conversation function
104 * and the server_login function
106 static const char *PAM_username;
107 static const char *PAM_password;
108 static int PAM_session = 0;
109 static pam_handle_t *pamh = NULL;
111 /* PAM conversation function
112 * Here we assume (for now, at least) that echo on means login name, and
113 * echo off means password.
116 static int conversation (int num_msg,
120 struct pam_message **msg,
121 struct pam_response **resp, void *appdata_ptr)
124 struct pam_response *reply = NULL;
126 reply = malloc(sizeof(struct pam_response) * num_msg);
127 if (!reply) return PAM_CONV_ERR;
129 for (replies = 0; replies < num_msg; replies++) {
130 switch (msg[replies]->msg_style) {
131 case PAM_PROMPT_ECHO_ON:
132 reply[replies].resp_retcode = PAM_SUCCESS;
133 reply[replies].resp = COPY_STRING(PAM_username);
136 case PAM_PROMPT_ECHO_OFF:
137 reply[replies].resp_retcode = PAM_SUCCESS;
138 reply[replies].resp = COPY_STRING(PAM_password);
144 /* ignore it, but pam still wants a NULL response... */
145 reply[replies].resp_retcode = PAM_SUCCESS;
146 reply[replies].resp = NULL;
149 /* Must be an error of some sort... */
158 static struct pam_conv pam_conv_data = {
162 #endif /* #ifdef USE_PAM */
165 session_start(flags, user, passwd, ttyName, msg)
176 bool try_session = 0;
177 #else /* #ifdef USE_PAM */
181 struct spwd *getspnam();
183 #endif /* #ifdef HAS_SHADOW */
184 #endif /* #ifdef USE_PAM */
186 SET_MSG(msg, SUCCESS_MSG);
188 /* If no verification is requested, then simply return an OK */
189 if (!(SESS_ALL & flags)) {
194 SET_MSG(msg, ABORT_MSG);
195 return SESSION_FAILED;
199 /* Find the '\\' in the username */
200 /* This needs to be fixed to support different username schemes */
201 if ((usr = strchr(user, '\\')) == NULL)
208 PAM_password = passwd;
210 dbglog("Initializing PAM (%d) for user %s", flags, usr);
211 pam_error = pam_start (SERVICE_NAME, usr, &pam_conv_data, &pamh);
212 dbglog("---> PAM INIT Result = %d", pam_error);
213 ok = (pam_error == PAM_SUCCESS);
216 ok = (pam_set_item(pamh, PAM_TTY, ttyName) == PAM_SUCCESS) &&
217 (pam_set_item(pamh, PAM_RHOST, ifname) == PAM_SUCCESS);
220 if (ok && (SESS_AUTH & flags)) {
221 dbglog("Attempting PAM authentication");
222 pam_error = pam_authenticate (pamh, PAM_SILENT);
223 if (pam_error == PAM_SUCCESS) {
224 /* PAM auth was OK */
225 dbglog("PAM Authentication OK for %s", user);
227 /* No matter the reason, we fail because we're authenticating */
229 if (pam_error == PAM_USER_UNKNOWN) {
230 dbglog("User unknown, failing PAM authentication");
231 SET_MSG(msg, "User unknown - cannot authenticate via PAM");
233 /* Any other error means authentication was bad */
234 dbglog("PAM Authentication failed: %d: %s", pam_error,
235 pam_strerror(pamh, pam_error));
236 SET_MSG(msg, (char *) pam_strerror (pamh, pam_error));
241 if (ok && (SESS_ACCT & flags)) {
242 dbglog("Attempting PAM account checks");
243 pam_error = pam_acct_mgmt (pamh, PAM_SILENT);
244 if (pam_error == PAM_SUCCESS) {
246 * PAM account was OK, set the flag which indicates that we should
247 * try to perform the session checks.
250 dbglog("PAM Account OK for %s", user);
253 * If the account checks fail, then we should not try to perform
254 * the session check, because they don't make sense.
257 if (pam_error == PAM_USER_UNKNOWN) {
259 * We're checking the account, so it's ok to not have one
260 * because the user might come from the secrets files, or some
263 dbglog("User unknown, ignoring PAM restrictions");
264 SET_MSG(msg, "User unknown - ignoring PAM restrictions");
266 /* Any other error means session is rejected */
268 dbglog("PAM Account checks failed: %d: %s", pam_error,
269 pam_strerror(pamh, pam_error));
270 SET_MSG(msg, (char *) pam_strerror (pamh, pam_error));
275 if (ok && try_session && (SESS_ACCT & flags)) {
276 /* Only open a session if the user's account was found */
277 pam_error = pam_open_session (pamh, PAM_SILENT);
278 if (pam_error == PAM_SUCCESS) {
279 dbglog("PAM Session opened for user %s", user);
282 dbglog("PAM Session denied for user %s", user);
283 SET_MSG(msg, (char *) pam_strerror (pamh, pam_error));
288 /* This is needed because apparently the PAM stuff closes the log */
291 /* If our PAM checks have already failed, then we must return a failure */
292 if (!ok) return SESSION_FAILED;
294 #else /* #ifdef USE_PAM */
297 * Use the non-PAM methods directly. 'pw' will remain NULL if the user
298 * has not been authenticated using local UNIX system services.
302 if ((SESS_AUTH & flags)) {
307 * Here, we bail if we have no user account, because there is nothing
311 return SESSION_FAILED;
315 spwd = getspnam(user);
319 * If there is no shadow entry for the user, then we can't verify the
323 return SESSION_FAILED;
326 * We check validity all the time, because if the password has expired,
327 * then clearly we should not authenticate against it (if we're being
328 * called for authentication only). Thus, in this particular instance,
329 * there is no real difference between using the AUTH, SESS or ACCT
330 * flags, or combinations thereof.
332 now = time(NULL) / 86400L;
333 if ((spwd->sp_expire > 0 && now >= spwd->sp_expire)
334 || ((spwd->sp_max >= 0 && spwd->sp_max < 10000)
335 && spwd->sp_lstchg >= 0
336 && now >= spwd->sp_lstchg + spwd->sp_max)) {
337 warn("Password for %s has expired", user);
338 return SESSION_FAILED;
341 /* We have a valid shadow entry, keep the password */
342 pw->pw_passwd = spwd->sp_pwdp;
344 #endif /* #ifdef HAS_SHADOW */
347 * If no passwd, don't let them login if we're authenticating.
349 if (pw->pw_passwd == NULL || strlen(pw->pw_passwd) < 2
350 || strcmp(crypt(passwd, pw->pw_passwd), pw->pw_passwd) != 0)
351 return SESSION_FAILED;
354 #endif /* #ifdef USE_PAM */
357 * Write a wtmp entry for this user.
360 if (SESS_ACCT & flags) {
361 if (strncmp(ttyName, "/dev/", 5) == 0)
363 logwtmp(ttyName, user, ifname); /* Add wtmp login entry */
366 #if defined(_PATH_LASTLOG) && !defined(USE_PAM)
368 * Enter the user in lastlog only if he has been authenticated using
369 * local system services. If he has not, then we don't know what his
370 * UID might be, and lastlog is indexed by UID.
376 if ((fd = open(_PATH_LASTLOG, O_RDWR, 0)) >= 0) {
377 (void)lseek(fd, (off_t)(pw->pw_uid * sizeof(ll)), SEEK_SET);
378 memset((void *)&ll, 0, sizeof(ll));
379 (void)time(&ll.ll_time);
380 (void)strncpy(ll.ll_line, ttyName, sizeof(ll.ll_line));
381 (void)strncpy(ll.ll_host, ifname, sizeof(ll.ll_host));
382 (void)write(fd, (char *)&ll, sizeof(ll));
386 #endif /* _PATH_LASTLOG and not USE_PAM */
387 info("user %s logged in on tty %s intf %s", user, ttyName, ifname);
394 * session_end - Logout the user.
397 session_end(const char* ttyName)
400 int pam_error = PAM_SUCCESS;
403 if (PAM_session) pam_error = pam_close_session (pamh, PAM_SILENT);
405 pam_end (pamh, pam_error);
407 /* Apparently the pam stuff does closelog(). */
412 if (strncmp(ttyName, "/dev/", 5) == 0)
414 logwtmp(ttyName, "", ""); /* Wipe out utmp logout entry */