Changeset View
Changeset View
Standalone View
Standalone View
auth-rhosts.c
/* $OpenBSD: auth-rhosts.c,v 1.49 2018/07/09 21:35:50 markus Exp $ */ | /* $OpenBSD: auth-rhosts.c,v 1.52 2020/04/17 03:30:05 djm Exp $ */ | ||||
/* | /* | ||||
* Author: Tatu Ylonen <ylo@cs.hut.fi> | * Author: Tatu Ylonen <ylo@cs.hut.fi> | ||||
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | ||||
* All rights reserved | * All rights reserved | ||||
* Rhosts authentication. This file contains code to check whether to admit | * Rhosts authentication. This file contains code to check whether to admit | ||||
* the login based on rhosts authentication. This file also processes | * the login based on rhosts authentication. This file also processes | ||||
* /etc/hosts.equiv. | * /etc/hosts.equiv. | ||||
* | * | ||||
Show All 23 Lines | |||||
#include "uidswap.h" | #include "uidswap.h" | ||||
#include "pathnames.h" | #include "pathnames.h" | ||||
#include "log.h" | #include "log.h" | ||||
#include "misc.h" | #include "misc.h" | ||||
#include "sshbuf.h" | #include "sshbuf.h" | ||||
#include "sshkey.h" | #include "sshkey.h" | ||||
#include "servconf.h" | #include "servconf.h" | ||||
#include "canohost.h" | #include "canohost.h" | ||||
#include "sshkey.h" | |||||
#include "hostfile.h" | #include "hostfile.h" | ||||
#include "auth.h" | #include "auth.h" | ||||
/* import */ | /* import */ | ||||
extern ServerOptions options; | extern ServerOptions options; | ||||
extern int use_privsep; | extern int use_privsep; | ||||
/* | /* | ||||
▲ Show 20 Lines • Show All 167 Lines • ▼ Show 20 Lines | auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, | ||||
/* Switch back to privileged uid. */ | /* Switch back to privileged uid. */ | ||||
restore_uid(); | restore_uid(); | ||||
/* | /* | ||||
* Deny if The user has no .shosts or .rhosts file and there | * Deny if The user has no .shosts or .rhosts file and there | ||||
* are no system-wide files. | * are no system-wide files. | ||||
*/ | */ | ||||
if (!rhosts_files[rhosts_file_index] && | if (!rhosts_files[rhosts_file_index] && | ||||
stat(_PATH_RHOSTS_EQUIV, &st) < 0 && | stat(_PATH_RHOSTS_EQUIV, &st) == -1 && | ||||
stat(_PATH_SSH_HOSTS_EQUIV, &st) < 0) { | stat(_PATH_SSH_HOSTS_EQUIV, &st) == -1) { | ||||
debug3("%s: no hosts access files exist", __func__); | debug3("%s: no hosts access files exist", __func__); | ||||
return 0; | return 0; | ||||
} | } | ||||
/* | /* | ||||
* If not logging in as superuser, try /etc/hosts.equiv and | * If not logging in as superuser, try /etc/hosts.equiv and | ||||
* shosts.equiv. | * shosts.equiv. | ||||
*/ | */ | ||||
Show All 13 Lines | if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr, | ||||
return 1; | return 1; | ||||
} | } | ||||
} | } | ||||
/* | /* | ||||
* Check that the home directory is owned by root or the user, and is | * Check that the home directory is owned by root or the user, and is | ||||
* not group or world writable. | * not group or world writable. | ||||
*/ | */ | ||||
if (stat(pw->pw_dir, &st) < 0) { | if (stat(pw->pw_dir, &st) == -1) { | ||||
logit("Rhosts authentication refused for %.100s: " | logit("Rhosts authentication refused for %.100s: " | ||||
"no home directory %.200s", pw->pw_name, pw->pw_dir); | "no home directory %.200s", pw->pw_name, pw->pw_dir); | ||||
auth_debug_add("Rhosts authentication refused for %.100s: " | auth_debug_add("Rhosts authentication refused for %.100s: " | ||||
"no home directory %.200s", pw->pw_name, pw->pw_dir); | "no home directory %.200s", pw->pw_name, pw->pw_dir); | ||||
return 0; | return 0; | ||||
} | } | ||||
if (options.strict_modes && | if (options.strict_modes && | ||||
((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | ||||
(st.st_mode & 022) != 0)) { | (st.st_mode & 022) != 0)) { | ||||
logit("Rhosts authentication refused for %.100s: " | logit("Rhosts authentication refused for %.100s: " | ||||
"bad ownership or modes for home directory.", pw->pw_name); | "bad ownership or modes for home directory.", pw->pw_name); | ||||
auth_debug_add("Rhosts authentication refused for %.100s: " | auth_debug_add("Rhosts authentication refused for %.100s: " | ||||
"bad ownership or modes for home directory.", pw->pw_name); | "bad ownership or modes for home directory.", pw->pw_name); | ||||
return 0; | return 0; | ||||
} | } | ||||
/* Temporarily use the user's uid. */ | /* Temporarily use the user's uid. */ | ||||
temporarily_use_uid(pw); | temporarily_use_uid(pw); | ||||
/* Check all .rhosts files (currently .shosts and .rhosts). */ | /* Check all .rhosts files (currently .shosts and .rhosts). */ | ||||
for (rhosts_file_index = 0; rhosts_files[rhosts_file_index]; | for (rhosts_file_index = 0; rhosts_files[rhosts_file_index]; | ||||
rhosts_file_index++) { | rhosts_file_index++) { | ||||
/* Check users .rhosts or .shosts. */ | /* Check users .rhosts or .shosts. */ | ||||
snprintf(buf, sizeof buf, "%.500s/%.100s", | snprintf(buf, sizeof buf, "%.500s/%.100s", | ||||
pw->pw_dir, rhosts_files[rhosts_file_index]); | pw->pw_dir, rhosts_files[rhosts_file_index]); | ||||
if (stat(buf, &st) < 0) | if (stat(buf, &st) == -1) | ||||
continue; | continue; | ||||
/* | /* | ||||
* Make sure that the file is either owned by the user or by | * Make sure that the file is either owned by the user or by | ||||
* root, and make sure it is not writable by anyone but the | * root, and make sure it is not writable by anyone but the | ||||
* owner. This is to help avoid novices accidentally | * owner. This is to help avoid novices accidentally | ||||
* allowing access to their account by anyone. | * allowing access to their account by anyone. | ||||
*/ | */ | ||||
if (options.strict_modes && | if (options.strict_modes && | ||||
((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | ((st.st_uid != 0 && st.st_uid != pw->pw_uid) || | ||||
(st.st_mode & 022) != 0)) { | (st.st_mode & 022) != 0)) { | ||||
logit("Rhosts authentication refused for %.100s: bad modes for %.200s", | logit("Rhosts authentication refused for %.100s: bad modes for %.200s", | ||||
pw->pw_name, buf); | pw->pw_name, buf); | ||||
auth_debug_add("Bad file modes for %.200s", buf); | auth_debug_add("Bad file modes for %.200s", buf); | ||||
continue; | continue; | ||||
} | } | ||||
/* | /* | ||||
* Check if we have been configured to ignore .rhosts | * Check if we have been configured to ignore .rhosts | ||||
* and .shosts files. | * and .shosts files. | ||||
*/ | */ | ||||
if (options.ignore_rhosts) { | if (options.ignore_rhosts == IGNORE_RHOSTS_YES || | ||||
(options.ignore_rhosts == IGNORE_RHOSTS_SHOSTS && | |||||
strcmp(rhosts_files[rhosts_file_index], ".shosts") != 0)) { | |||||
auth_debug_add("Server has been configured to " | auth_debug_add("Server has been configured to " | ||||
"ignore %.100s.", rhosts_files[rhosts_file_index]); | "ignore %.100s.", rhosts_files[rhosts_file_index]); | ||||
continue; | continue; | ||||
} | } | ||||
/* Check if authentication is permitted by the file. */ | /* Check if authentication is permitted by the file. */ | ||||
if (check_rhosts_file(buf, hostname, ipaddr, | if (check_rhosts_file(buf, hostname, ipaddr, | ||||
client_user, pw->pw_name)) { | client_user, pw->pw_name)) { | ||||
auth_debug_add("Accepted by %.100s.", | auth_debug_add("Accepted by %.100s.", | ||||
Show All 14 Lines |