/src/dropbear/src/svr-auth.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Dropbear - a SSH2 server |
3 | | * |
4 | | * Copyright (c) 2002,2003 Matt Johnston |
5 | | * All rights reserved. |
6 | | * |
7 | | * Permission is hereby granted, free of charge, to any person obtaining a copy |
8 | | * of this software and associated documentation files (the "Software"), to deal |
9 | | * in the Software without restriction, including without limitation the rights |
10 | | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
11 | | * copies of the Software, and to permit persons to whom the Software is |
12 | | * furnished to do so, subject to the following conditions: |
13 | | * |
14 | | * The above copyright notice and this permission notice shall be included in |
15 | | * all copies or substantial portions of the Software. |
16 | | * |
17 | | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
18 | | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
19 | | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
20 | | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
21 | | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
22 | | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
23 | | * SOFTWARE. */ |
24 | | |
25 | | /* This file (auth.c) handles authentication requests, passing it to the |
26 | | * particular type (auth-passwd, auth-pubkey). */ |
27 | | |
28 | | |
29 | | #include "includes.h" |
30 | | #include "dbutil.h" |
31 | | #include "session.h" |
32 | | #include "buffer.h" |
33 | | #include "ssh.h" |
34 | | #include "packet.h" |
35 | | #include "auth.h" |
36 | | #include "runopts.h" |
37 | | #include "dbrandom.h" |
38 | | |
39 | | static int checkusername(const char *username, unsigned int userlen); |
40 | | |
41 | | /* initialise the first time for a session, resetting all parameters */ |
42 | 3.11k | void svr_authinitialise() { |
43 | 3.11k | memset(&ses.authstate, 0, sizeof(ses.authstate)); |
44 | 3.11k | #if DROPBEAR_SVR_PUBKEY_AUTH |
45 | 3.11k | ses.authstate.authtypes |= AUTH_TYPE_PUBKEY; |
46 | 3.11k | #endif |
47 | 3.11k | #if DROPBEAR_SVR_PASSWORD_AUTH || DROPBEAR_SVR_PAM_AUTH |
48 | 3.11k | if (!svr_opts.noauthpass) { |
49 | 3.11k | ses.authstate.authtypes |= AUTH_TYPE_PASSWORD; |
50 | 3.11k | } |
51 | 3.11k | #endif |
52 | 3.11k | } |
53 | | |
54 | | /* Send a banner message if specified to the client. The client might |
55 | | * ignore this, but possibly serves as a legal "no trespassing" sign */ |
56 | 0 | void send_msg_userauth_banner(const buffer *banner) { |
57 | |
|
58 | 0 | TRACE(("enter send_msg_userauth_banner")) |
59 | |
|
60 | 0 | CHECKCLEARTOWRITE(); |
61 | |
|
62 | 0 | buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_BANNER); |
63 | 0 | buf_putbufstring(ses.writepayload, banner); |
64 | 0 | buf_putstring(ses.writepayload, "en", 2); |
65 | |
|
66 | 0 | encrypt_packet(); |
67 | |
|
68 | 0 | TRACE(("leave send_msg_userauth_banner")) |
69 | 0 | } |
70 | | |
71 | | /* handle a userauth request, check validity, pass to password or pubkey |
72 | | * checking, and handle success or failure */ |
73 | 2.01k | void recv_msg_userauth_request() { |
74 | | |
75 | 2.01k | char *username = NULL, *servicename = NULL, *methodname = NULL; |
76 | 2.01k | unsigned int userlen, servicelen, methodlen; |
77 | 2.01k | int valid_user = 0; |
78 | | |
79 | 2.01k | TRACE(("enter recv_msg_userauth_request")) |
80 | | |
81 | | /* for compensating failure delay */ |
82 | 2.01k | gettime_wrapper(&ses.authstate.auth_starttime); |
83 | | |
84 | | /* ignore packets if auth is already done */ |
85 | 2.01k | if (ses.authstate.authdone == 1) { |
86 | 0 | TRACE(("leave recv_msg_userauth_request: authdone already")) |
87 | 0 | return; |
88 | 0 | } |
89 | | |
90 | | /* send the banner if it exists, it will only exist once */ |
91 | 2.01k | if (svr_opts.banner) { |
92 | 0 | send_msg_userauth_banner(svr_opts.banner); |
93 | 0 | buf_free(svr_opts.banner); |
94 | 0 | svr_opts.banner = NULL; |
95 | 0 | } |
96 | | |
97 | 2.01k | username = buf_getstring(ses.payload, &userlen); |
98 | 2.01k | servicename = buf_getstring(ses.payload, &servicelen); |
99 | 2.01k | methodname = buf_getstring(ses.payload, &methodlen); |
100 | | |
101 | | /* only handle 'ssh-connection' currently */ |
102 | 2.01k | if (servicelen != SSH_SERVICE_CONNECTION_LEN |
103 | 2.01k | && (strncmp(servicename, SSH_SERVICE_CONNECTION, |
104 | 152 | SSH_SERVICE_CONNECTION_LEN) != 0)) { |
105 | | |
106 | | /* TODO - disconnect here */ |
107 | 134 | m_free(username); |
108 | 134 | m_free(servicename); |
109 | 134 | m_free(methodname); |
110 | 134 | dropbear_exit("unknown service in auth"); |
111 | 134 | } |
112 | | |
113 | | /* check username is good before continuing. |
114 | | * the 'incrfail' varies depending on the auth method to |
115 | | * avoid giving away which users exist on the system through |
116 | | * the time delay. */ |
117 | 1.87k | if (checkusername(username, userlen) == DROPBEAR_SUCCESS) { |
118 | 714 | valid_user = 1; |
119 | 714 | } |
120 | | |
121 | | /* user wants to know what methods are supported */ |
122 | 1.87k | if (methodlen == AUTH_METHOD_NONE_LEN && |
123 | 1.87k | strncmp(methodname, AUTH_METHOD_NONE, |
124 | 385 | AUTH_METHOD_NONE_LEN) == 0) { |
125 | 233 | TRACE(("recv_msg_userauth_request: 'none' request")) |
126 | 233 | if (valid_user |
127 | 233 | && svr_opts.allowblankpass |
128 | 233 | && !svr_opts.noauthpass |
129 | 233 | && !(svr_opts.norootpass && ses.authstate.pw_uid == 0) |
130 | 233 | && ses.authstate.pw_passwd[0] == '\0') |
131 | 0 | { |
132 | 0 | dropbear_log(LOG_NOTICE, |
133 | 0 | "Auth succeeded with blank password for '%s' from %s", |
134 | 0 | ses.authstate.pw_name, |
135 | 0 | svr_ses.addrstring); |
136 | 0 | send_msg_userauth_success(); |
137 | 0 | goto out; |
138 | 0 | } |
139 | 233 | else |
140 | 233 | { |
141 | | /* 'none' has no failure delay */ |
142 | 233 | send_msg_userauth_failure(0, 0); |
143 | 233 | goto out; |
144 | 233 | } |
145 | 233 | } |
146 | | |
147 | 1.64k | #if DROPBEAR_SVR_PASSWORD_AUTH |
148 | 1.64k | if (!svr_opts.noauthpass && |
149 | 1.64k | !(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) { |
150 | | /* user wants to try password auth */ |
151 | 1.49k | if (methodlen == AUTH_METHOD_PASSWORD_LEN && |
152 | 1.49k | strncmp(methodname, AUTH_METHOD_PASSWORD, |
153 | 169 | AUTH_METHOD_PASSWORD_LEN) == 0) { |
154 | 68 | svr_auth_password(valid_user); |
155 | 68 | goto out; |
156 | 68 | } |
157 | 1.49k | } |
158 | 1.57k | #endif |
159 | | |
160 | | #if DROPBEAR_SVR_PAM_AUTH |
161 | | if (!svr_opts.noauthpass && |
162 | | !(svr_opts.norootpass && ses.authstate.pw_uid == 0) ) { |
163 | | /* user wants to try password auth */ |
164 | | if (methodlen == AUTH_METHOD_PASSWORD_LEN && |
165 | | strncmp(methodname, AUTH_METHOD_PASSWORD, |
166 | | AUTH_METHOD_PASSWORD_LEN) == 0) { |
167 | | svr_auth_pam(valid_user); |
168 | | goto out; |
169 | | } |
170 | | } |
171 | | #endif |
172 | | |
173 | 1.57k | #if DROPBEAR_SVR_PUBKEY_AUTH |
174 | | /* user wants to try pubkey auth */ |
175 | 1.57k | if (methodlen == AUTH_METHOD_PUBKEY_LEN && |
176 | 1.57k | strncmp(methodname, AUTH_METHOD_PUBKEY, |
177 | 921 | AUTH_METHOD_PUBKEY_LEN) == 0) { |
178 | 819 | svr_auth_pubkey(valid_user); |
179 | 819 | goto out; |
180 | 819 | } |
181 | 756 | #endif |
182 | | |
183 | | /* nothing matched, we just fail with a delay */ |
184 | 756 | send_msg_userauth_failure(0, 1); |
185 | | |
186 | 1.64k | out: |
187 | | |
188 | 1.64k | m_free(username); |
189 | 1.64k | m_free(servicename); |
190 | 1.64k | m_free(methodname); |
191 | 1.64k | } |
192 | | |
193 | | #ifdef HAVE_GETGROUPLIST |
194 | | /* returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */ |
195 | 0 | static int check_group_membership(gid_t check_gid, const char* username, gid_t user_gid) { |
196 | 0 | int ngroups, i, ret; |
197 | 0 | gid_t *grouplist = NULL; |
198 | 0 | int match = DROPBEAR_FAILURE; |
199 | |
|
200 | 0 | for (ngroups = 32; ngroups <= DROPBEAR_NGROUP_MAX; ngroups *= 2) { |
201 | 0 | grouplist = m_malloc(sizeof(gid_t) * ngroups); |
202 | | |
203 | | /* BSD returns ret==0 on success. Linux returns ret==ngroups on success */ |
204 | 0 | ret = getgrouplist(username, user_gid, grouplist, &ngroups); |
205 | 0 | if (ret >= 0) { |
206 | 0 | break; |
207 | 0 | } |
208 | 0 | m_free(grouplist); |
209 | 0 | grouplist = NULL; |
210 | 0 | } |
211 | |
|
212 | 0 | if (!grouplist) { |
213 | 0 | dropbear_log(LOG_ERR, "Too many groups for user '%s'", username); |
214 | 0 | return DROPBEAR_FAILURE; |
215 | 0 | } |
216 | | |
217 | 0 | for (i = 0; i < ngroups; i++) { |
218 | 0 | if (grouplist[i] == check_gid) { |
219 | 0 | match = DROPBEAR_SUCCESS; |
220 | 0 | break; |
221 | 0 | } |
222 | 0 | } |
223 | 0 | m_free(grouplist); |
224 | |
|
225 | 0 | return match; |
226 | 0 | } |
227 | | #endif |
228 | | |
229 | | /* Check that the username exists and isn't disallowed (root), and has a valid shell. |
230 | | * returns DROPBEAR_SUCCESS on valid username, DROPBEAR_FAILURE on failure */ |
231 | 1.86k | static int checkusername(const char *username, unsigned int userlen) { |
232 | | |
233 | 1.86k | char* listshell = NULL; |
234 | 1.86k | char* usershell = NULL; |
235 | 1.86k | uid_t uid; |
236 | | |
237 | 1.86k | TRACE(("enter checkusername")) |
238 | 1.86k | if (userlen > MAX_USERNAME_LEN) { |
239 | 67 | return DROPBEAR_FAILURE; |
240 | 67 | } |
241 | | |
242 | 1.80k | if (strlen(username) != userlen) { |
243 | 12 | dropbear_exit("Attempted username with a null byte"); |
244 | 12 | } |
245 | | |
246 | 1.79k | if (ses.authstate.username == NULL) { |
247 | | /* first request */ |
248 | 564 | fill_passwd(username); |
249 | 564 | ses.authstate.username = m_strdup(username); |
250 | 1.22k | } else { |
251 | | /* check username hasn't changed */ |
252 | 1.22k | if (strcmp(username, ses.authstate.username) != 0) { |
253 | 134 | dropbear_exit("Client trying multiple usernames"); |
254 | 134 | } |
255 | 1.22k | } |
256 | | |
257 | | /* avoids cluttering logs with repeated failure messages from |
258 | | consecutive authentication requests in a sesssion */ |
259 | 1.65k | if (ses.authstate.checkusername_failed) { |
260 | 404 | TRACE(("checkusername: returning cached failure")) |
261 | 404 | return DROPBEAR_FAILURE; |
262 | 404 | } |
263 | | |
264 | | /* check that user exists */ |
265 | 1.25k | if (!ses.authstate.pw_name) { |
266 | 538 | TRACE(("leave checkusername: user '%s' doesn't exist", username)) |
267 | 538 | dropbear_log(LOG_WARNING, |
268 | 538 | "Login attempt for nonexistent user"); |
269 | 538 | ses.authstate.checkusername_failed = 1; |
270 | 538 | return DROPBEAR_FAILURE; |
271 | 538 | } |
272 | | |
273 | | /* check if we are running as non-root, and login user is different from the server */ |
274 | 714 | uid = geteuid(); |
275 | 714 | if (!(DROPBEAR_SVR_MULTIUSER && uid == 0) && uid != ses.authstate.pw_uid) { |
276 | 0 | TRACE(("running as nonroot, only server uid is allowed")) |
277 | 0 | dropbear_log(LOG_WARNING, |
278 | 0 | "Login attempt with wrong user %s", |
279 | 0 | ses.authstate.pw_name); |
280 | 0 | ses.authstate.checkusername_failed = 1; |
281 | 0 | return DROPBEAR_FAILURE; |
282 | 0 | } |
283 | | |
284 | | /* check for non-root if desired */ |
285 | 714 | if (svr_opts.norootlogin && ses.authstate.pw_uid == 0) { |
286 | 0 | TRACE(("leave checkusername: root login disabled")) |
287 | 0 | dropbear_log(LOG_WARNING, "root login rejected"); |
288 | 0 | ses.authstate.checkusername_failed = 1; |
289 | 0 | return DROPBEAR_FAILURE; |
290 | 0 | } |
291 | | |
292 | | /* check for login restricted to certain group if desired */ |
293 | 714 | #ifdef HAVE_GETGROUPLIST |
294 | 714 | if (svr_opts.restrict_group) { |
295 | 0 | if (check_group_membership(svr_opts.restrict_group_gid, |
296 | 0 | ses.authstate.pw_name, ses.authstate.pw_gid) == DROPBEAR_FAILURE) { |
297 | 0 | dropbear_log(LOG_WARNING, |
298 | 0 | "Logins are restricted to the group %s but user '%s' is not a member", |
299 | 0 | svr_opts.restrict_group, ses.authstate.pw_name); |
300 | 0 | ses.authstate.checkusername_failed = 1; |
301 | 0 | return DROPBEAR_FAILURE; |
302 | 0 | } |
303 | 0 | } |
304 | 714 | #endif /* HAVE_GETGROUPLIST */ |
305 | | |
306 | 714 | TRACE(("shell is %s", ses.authstate.pw_shell)) |
307 | | |
308 | | /* check that the shell is set */ |
309 | 714 | usershell = ses.authstate.pw_shell; |
310 | 714 | if (usershell[0] == '\0') { |
311 | | /* empty shell in /etc/passwd means /bin/sh according to passwd(5) */ |
312 | 0 | usershell = "/bin/sh"; |
313 | 0 | } |
314 | | |
315 | | /* check the shell is valid. If /etc/shells doesn't exist, getusershell() |
316 | | * should return some standard shells like "/bin/sh" and "/bin/csh" (this |
317 | | * is platform-specific) */ |
318 | 714 | setusershell(); |
319 | 714 | while ((listshell = getusershell()) != NULL) { |
320 | 714 | TRACE(("test shell is '%s'", listshell)) |
321 | 714 | if (strcmp(listshell, usershell) == 0) { |
322 | | /* have a match */ |
323 | 714 | goto goodshell; |
324 | 714 | } |
325 | 714 | } |
326 | | /* no matching shell */ |
327 | 0 | endusershell(); |
328 | 0 | TRACE(("no matching shell")) |
329 | 0 | ses.authstate.checkusername_failed = 1; |
330 | 0 | dropbear_log(LOG_WARNING, "User '%s' has invalid shell, rejected", |
331 | 0 | ses.authstate.pw_name); |
332 | 0 | return DROPBEAR_FAILURE; |
333 | | |
334 | 714 | goodshell: |
335 | 714 | endusershell(); |
336 | 714 | TRACE(("matching shell")) |
337 | | |
338 | 714 | TRACE(("uid = %d", ses.authstate.pw_uid)) |
339 | 714 | TRACE(("leave checkusername")) |
340 | 714 | return DROPBEAR_SUCCESS; |
341 | 714 | } |
342 | | |
343 | | /* Send a failure message to the client, in responds to a userauth_request. |
344 | | * Partial indicates whether to set the "partial success" flag, |
345 | | * incrfail is whether to count this failure in the failure count (which |
346 | | * is limited. This function also handles disconnection after too many |
347 | | * failures */ |
348 | 1.65k | void send_msg_userauth_failure(int partial, int incrfail) { |
349 | | |
350 | 1.65k | buffer *typebuf = NULL; |
351 | | |
352 | 1.65k | TRACE(("enter send_msg_userauth_failure")) |
353 | | |
354 | 1.65k | CHECKCLEARTOWRITE(); |
355 | | |
356 | 1.65k | buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_FAILURE); |
357 | | |
358 | | /* put a list of allowed types */ |
359 | 1.65k | typebuf = buf_new(30); /* long enough for PUBKEY and PASSWORD */ |
360 | | |
361 | 1.65k | if (ses.authstate.authtypes & AUTH_TYPE_PUBKEY) { |
362 | 1.65k | buf_putbytes(typebuf, (const unsigned char *)AUTH_METHOD_PUBKEY, AUTH_METHOD_PUBKEY_LEN); |
363 | 1.65k | if (ses.authstate.authtypes & AUTH_TYPE_PASSWORD) { |
364 | 1.65k | buf_putbyte(typebuf, ','); |
365 | 1.65k | } |
366 | 1.65k | } |
367 | | |
368 | 1.65k | if (ses.authstate.authtypes & AUTH_TYPE_PASSWORD) { |
369 | 1.65k | buf_putbytes(typebuf, (const unsigned char *)AUTH_METHOD_PASSWORD, AUTH_METHOD_PASSWORD_LEN); |
370 | 1.65k | } |
371 | | |
372 | 1.65k | buf_putbufstring(ses.writepayload, typebuf); |
373 | | |
374 | 1.65k | TRACE(("auth fail: methods %d, '%.*s'", ses.authstate.authtypes, |
375 | 1.65k | typebuf->len, typebuf->data)) |
376 | | |
377 | 1.65k | buf_free(typebuf); |
378 | | |
379 | 1.65k | buf_putbyte(ses.writepayload, partial ? 1 : 0); |
380 | 1.65k | encrypt_packet(); |
381 | | |
382 | 1.65k | if (incrfail) { |
383 | | /* The SSH_MSG_AUTH_FAILURE response is delayed to attempt to |
384 | | avoid user enumeration and slow brute force attempts. |
385 | | The delay is adjusted by the time already spent in processing |
386 | | authentication (ses.authstate.auth_starttime timestamp). */ |
387 | | |
388 | | /* Desired total delay 300ms +-50ms (in nanoseconds). |
389 | | Beware of integer overflow if increasing these values */ |
390 | 671 | const unsigned int mindelay = 250000000; |
391 | 671 | const unsigned int vardelay = 100000000; |
392 | 671 | suseconds_t rand_delay; |
393 | 671 | struct timespec delay; |
394 | | |
395 | 671 | gettime_wrapper(&delay); |
396 | 671 | delay.tv_sec -= ses.authstate.auth_starttime.tv_sec; |
397 | 671 | delay.tv_nsec -= ses.authstate.auth_starttime.tv_nsec; |
398 | | |
399 | | /* carry */ |
400 | 671 | if (delay.tv_nsec < 0) { |
401 | 0 | delay.tv_nsec += 1000000000; |
402 | 0 | delay.tv_sec -= 1; |
403 | 0 | } |
404 | | |
405 | 671 | genrandom((unsigned char*)&rand_delay, sizeof(rand_delay)); |
406 | 671 | rand_delay = mindelay + (rand_delay % vardelay); |
407 | | |
408 | 671 | if (delay.tv_sec == 0 && delay.tv_nsec <= mindelay) { |
409 | | /* Compensate for elapsed time */ |
410 | 671 | delay.tv_nsec = rand_delay - delay.tv_nsec; |
411 | 671 | } else { |
412 | | /* No time left or time went backwards, just delay anyway */ |
413 | 0 | delay.tv_sec = 0; |
414 | 0 | delay.tv_nsec = rand_delay; |
415 | 0 | } |
416 | | |
417 | | |
418 | 671 | #if DROPBEAR_FUZZ |
419 | 671 | if (!fuzz.fuzzing) |
420 | 0 | #endif |
421 | 0 | { |
422 | 0 | while (nanosleep(&delay, &delay) == -1 && errno == EINTR) { /* Go back to sleep */ } |
423 | 0 | } |
424 | | |
425 | 671 | ses.authstate.failcount++; |
426 | 671 | } |
427 | | |
428 | 1.65k | if (ses.authstate.failcount >= svr_opts.maxauthtries) { |
429 | 3 | char * userstr; |
430 | | /* XXX - send disconnect ? */ |
431 | 3 | TRACE(("Max auth tries reached, exiting")) |
432 | | |
433 | 3 | if (ses.authstate.pw_name == NULL) { |
434 | 2 | userstr = "is invalid"; |
435 | 2 | } else { |
436 | 1 | userstr = ses.authstate.pw_name; |
437 | 1 | } |
438 | 3 | dropbear_exit("Max auth tries reached - user '%s'", |
439 | 3 | userstr); |
440 | 3 | } |
441 | | |
442 | 1.65k | TRACE(("leave send_msg_userauth_failure")) |
443 | 1.65k | } |
444 | | |
445 | | /* Send a success message to the user, and set the "authdone" flag */ |
446 | 0 | void send_msg_userauth_success() { |
447 | |
|
448 | 0 | TRACE(("enter send_msg_userauth_success")) |
449 | |
|
450 | 0 | CHECKCLEARTOWRITE(); |
451 | |
|
452 | 0 | buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_SUCCESS); |
453 | 0 | encrypt_packet(); |
454 | | |
455 | | /* authdone must be set after encrypt_packet() for |
456 | | * delayed-zlib mode */ |
457 | 0 | ses.authstate.authdone = 1; |
458 | 0 | ses.connect_time = 0; |
459 | | |
460 | |
|
461 | 0 | if (ses.authstate.pw_uid == 0) { |
462 | 0 | ses.allowprivport = 1; |
463 | 0 | } |
464 | | |
465 | | /* Remove from the list of pre-auth sockets. Should be m_close(), since if |
466 | | * we fail, we might end up leaking connection slots, and disallow new |
467 | | * logins - a nasty situation. */ |
468 | 0 | m_close(svr_ses.childpipe); |
469 | |
|
470 | 0 | TRACE(("leave send_msg_userauth_success")) |
471 | |
|
472 | 0 | } |