19a10bb17SJohn Polstra /*-
25e53a4f9SPedro F. Giffuni * SPDX-License-Identifier: BSD-3-Clause
35e53a4f9SPedro F. Giffuni *
49a10bb17SJohn Polstra * Copyright 1998 Juniper Networks, Inc.
59a10bb17SJohn Polstra * All rights reserved.
64d6991c6SDag-Erling Smørgrav * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
78d3978c1SDag-Erling Smørgrav * All rights reserved.
88d3978c1SDag-Erling Smørgrav *
98d3978c1SDag-Erling Smørgrav * Portions of this software were developed for the FreeBSD Project by
108d3978c1SDag-Erling Smørgrav * ThinkSec AS and NAI Labs, the Security Research Division of Network
118d3978c1SDag-Erling Smørgrav * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
128d3978c1SDag-Erling Smørgrav * ("CBOSS"), as part of the DARPA CHATS research program.
139a10bb17SJohn Polstra *
149a10bb17SJohn Polstra * Redistribution and use in source and binary forms, with or without
159a10bb17SJohn Polstra * modification, are permitted provided that the following conditions
169a10bb17SJohn Polstra * are met:
179a10bb17SJohn Polstra * 1. Redistributions of source code must retain the above copyright
189a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer.
199a10bb17SJohn Polstra * 2. Redistributions in binary form must reproduce the above copyright
209a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer in the
219a10bb17SJohn Polstra * documentation and/or other materials provided with the distribution.
228d3978c1SDag-Erling Smørgrav * 3. The name of the author may not be used to endorse or promote
238d3978c1SDag-Erling Smørgrav * products derived from this software without specific prior written
248d3978c1SDag-Erling Smørgrav * permission.
259a10bb17SJohn Polstra *
269a10bb17SJohn Polstra * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
279a10bb17SJohn Polstra * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
289a10bb17SJohn Polstra * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
299a10bb17SJohn Polstra * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
309a10bb17SJohn Polstra * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
319a10bb17SJohn Polstra * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
329a10bb17SJohn Polstra * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
339a10bb17SJohn Polstra * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
349a10bb17SJohn Polstra * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
359a10bb17SJohn Polstra * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
369a10bb17SJohn Polstra * SUCH DAMAGE.
379a10bb17SJohn Polstra */
389a10bb17SJohn Polstra
399a10bb17SJohn Polstra #include <sys/param.h>
409a10bb17SJohn Polstra
419a10bb17SJohn Polstra #include <pwd.h>
429a10bb17SJohn Polstra #include <stdlib.h>
439a10bb17SJohn Polstra #include <string.h>
449a10bb17SJohn Polstra #include <syslog.h>
459a10bb17SJohn Polstra #include <taclib.h>
469a10bb17SJohn Polstra #include <unistd.h>
479a10bb17SJohn Polstra
489a10bb17SJohn Polstra #define PAM_SM_AUTH
498d3978c1SDag-Erling Smørgrav
508c66575dSDag-Erling Smørgrav #include <security/pam_appl.h>
519a10bb17SJohn Polstra #include <security/pam_modules.h>
528c66575dSDag-Erling Smørgrav #include <security/pam_mod_misc.h>
539a10bb17SJohn Polstra
54545aa471SDag-Erling Smørgrav #define PAM_OPT_CONF "conf"
55545aa471SDag-Erling Smørgrav #define PAM_OPT_TEMPLATE_USER "template_user"
569a10bb17SJohn Polstra
579a10bb17SJohn Polstra typedef int (*set_func)(struct tac_handle *, const char *);
589a10bb17SJohn Polstra
599a10bb17SJohn Polstra static int do_item(pam_handle_t *, struct tac_handle *, int,
609a10bb17SJohn Polstra set_func, const char *);
619a10bb17SJohn Polstra static char *get_msg(struct tac_handle *);
629a10bb17SJohn Polstra static int set_msg(struct tac_handle *, const char *);
639a10bb17SJohn Polstra
649a10bb17SJohn Polstra static int
do_item(pam_handle_t * pamh,struct tac_handle * tach,int item,set_func func,const char * funcname)659a10bb17SJohn Polstra do_item(pam_handle_t *pamh, struct tac_handle *tach, int item,
669a10bb17SJohn Polstra set_func func, const char *funcname)
679a10bb17SJohn Polstra {
689a10bb17SJohn Polstra int retval;
699a10bb17SJohn Polstra const void *value;
709a10bb17SJohn Polstra
711642eb1aSMark Murray retval = pam_get_item(pamh, item, &value);
721642eb1aSMark Murray if (retval != PAM_SUCCESS)
739a10bb17SJohn Polstra return retval;
749a10bb17SJohn Polstra if (value != NULL && (*func)(tach, (const char *)value) == -1) {
759a10bb17SJohn Polstra syslog(LOG_CRIT, "%s: %s", funcname, tac_strerror(tach));
769a10bb17SJohn Polstra tac_close(tach);
779a10bb17SJohn Polstra return PAM_SERVICE_ERR;
789a10bb17SJohn Polstra }
799a10bb17SJohn Polstra return PAM_SUCCESS;
809a10bb17SJohn Polstra }
819a10bb17SJohn Polstra
829a10bb17SJohn Polstra static char *
get_msg(struct tac_handle * tach)839a10bb17SJohn Polstra get_msg(struct tac_handle *tach)
849a10bb17SJohn Polstra {
859a10bb17SJohn Polstra char *msg;
869a10bb17SJohn Polstra
871642eb1aSMark Murray msg = tac_get_msg(tach);
881642eb1aSMark Murray if (msg == NULL) {
899a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_get_msg: %s", tac_strerror(tach));
909a10bb17SJohn Polstra tac_close(tach);
919a10bb17SJohn Polstra return NULL;
929a10bb17SJohn Polstra }
939a10bb17SJohn Polstra return msg;
949a10bb17SJohn Polstra }
959a10bb17SJohn Polstra
969a10bb17SJohn Polstra static int
set_msg(struct tac_handle * tach,const char * msg)979a10bb17SJohn Polstra set_msg(struct tac_handle *tach, const char *msg)
989a10bb17SJohn Polstra {
999a10bb17SJohn Polstra if (tac_set_msg(tach, msg) == -1) {
1009a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_set_msg: %s", tac_strerror(tach));
1019a10bb17SJohn Polstra tac_close(tach);
1029a10bb17SJohn Polstra return -1;
1039a10bb17SJohn Polstra }
1049a10bb17SJohn Polstra return 0;
1059a10bb17SJohn Polstra }
1069a10bb17SJohn Polstra
1079a10bb17SJohn Polstra PAM_EXTERN int
pam_sm_authenticate(pam_handle_t * pamh,int flags __unused,int argc __unused,const char * argv[]__unused)10824fe7ba0SDag-Erling Smørgrav pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
109545aa471SDag-Erling Smørgrav int argc __unused, const char *argv[] __unused)
1109a10bb17SJohn Polstra {
1119a10bb17SJohn Polstra int retval;
1129a10bb17SJohn Polstra struct tac_handle *tach;
113545aa471SDag-Erling Smørgrav const char *conf_file, *template_user;
1149a10bb17SJohn Polstra
115545aa471SDag-Erling Smørgrav conf_file = openpam_get_option(pamh, PAM_OPT_CONF);
116545aa471SDag-Erling Smørgrav template_user = openpam_get_option(pamh, PAM_OPT_TEMPLATE_USER);
1171642eb1aSMark Murray
1181642eb1aSMark Murray tach = tac_open();
1191642eb1aSMark Murray if (tach == NULL) {
1209a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_open failed");
12124fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR);
1229a10bb17SJohn Polstra }
1239a10bb17SJohn Polstra if (tac_config(tach, conf_file) == -1) {
1249a10bb17SJohn Polstra syslog(LOG_ALERT, "tac_config: %s", tac_strerror(tach));
1259a10bb17SJohn Polstra tac_close(tach);
12624fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR);
1279a10bb17SJohn Polstra }
1289a10bb17SJohn Polstra if (tac_create_authen(tach, TAC_AUTHEN_LOGIN, TAC_AUTHEN_TYPE_ASCII,
1299a10bb17SJohn Polstra TAC_AUTHEN_SVC_LOGIN) == -1) {
1309a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_create_authen: %s", tac_strerror(tach));
1319a10bb17SJohn Polstra tac_close(tach);
13224fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR);
1339a10bb17SJohn Polstra }
1341642eb1aSMark Murray
1351642eb1aSMark Murray PAM_LOG("Done tac_open() ... tac_close()");
1361642eb1aSMark Murray
1371642eb1aSMark Murray retval = do_item(pamh, tach, PAM_USER, tac_set_user, "tac_set_user");
1381642eb1aSMark Murray if (retval != PAM_SUCCESS)
13924fe7ba0SDag-Erling Smørgrav return (retval);
1401642eb1aSMark Murray
1411642eb1aSMark Murray PAM_LOG("Done user");
1421642eb1aSMark Murray
1431642eb1aSMark Murray retval = do_item(pamh, tach, PAM_TTY, tac_set_port, "tac_set_port");
1441642eb1aSMark Murray if (retval != PAM_SUCCESS)
14524fe7ba0SDag-Erling Smørgrav return (retval);
1461642eb1aSMark Murray
1471642eb1aSMark Murray PAM_LOG("Done tty");
1481642eb1aSMark Murray
1491642eb1aSMark Murray retval = do_item(pamh, tach, PAM_RHOST, tac_set_rem_addr,
1501642eb1aSMark Murray "tac_set_rem_addr");
1511642eb1aSMark Murray if (retval != PAM_SUCCESS)
15224fe7ba0SDag-Erling Smørgrav return (retval);
1531642eb1aSMark Murray
1549a10bb17SJohn Polstra for (;;) {
1559a10bb17SJohn Polstra char *srvr_msg;
1569a10bb17SJohn Polstra size_t msg_len;
1579a10bb17SJohn Polstra const char *user_msg;
1589a10bb17SJohn Polstra char *data_msg;
1599a10bb17SJohn Polstra int sflags;
1609a10bb17SJohn Polstra int status;
1619a10bb17SJohn Polstra
1621642eb1aSMark Murray sflags = tac_send_authen(tach);
1631642eb1aSMark Murray if (sflags == -1) {
1649a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_send_authen: %s",
1659a10bb17SJohn Polstra tac_strerror(tach));
1669a10bb17SJohn Polstra tac_close(tach);
16724fe7ba0SDag-Erling Smørgrav return (PAM_AUTHINFO_UNAVAIL);
1689a10bb17SJohn Polstra }
1699a10bb17SJohn Polstra status = TAC_AUTHEN_STATUS(sflags);
170545aa471SDag-Erling Smørgrav openpam_set_option(pamh, PAM_OPT_ECHO_PASS,
171545aa471SDag-Erling Smørgrav TAC_AUTHEN_NOECHO(sflags) ? NULL : "");
1729a10bb17SJohn Polstra switch (status) {
1739a10bb17SJohn Polstra
1749a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_PASS:
1759a10bb17SJohn Polstra tac_close(tach);
1769a10bb17SJohn Polstra if (template_user != NULL) {
1779a10bb17SJohn Polstra const void *item;
1789a10bb17SJohn Polstra const char *user;
1799a10bb17SJohn Polstra
1801642eb1aSMark Murray PAM_LOG("Trying template user: %s",
1811642eb1aSMark Murray template_user);
1821642eb1aSMark Murray
1839a10bb17SJohn Polstra /*
1849a10bb17SJohn Polstra * If the given user name doesn't exist in
1859a10bb17SJohn Polstra * the local password database, change it
1869a10bb17SJohn Polstra * to the value given in the "template_user"
1879a10bb17SJohn Polstra * option.
1889a10bb17SJohn Polstra */
1899a10bb17SJohn Polstra retval = pam_get_item(pamh, PAM_USER, &item);
1909a10bb17SJohn Polstra if (retval != PAM_SUCCESS)
19124fe7ba0SDag-Erling Smørgrav return (retval);
1929a10bb17SJohn Polstra user = (const char *)item;
1931642eb1aSMark Murray if (getpwnam(user) == NULL) {
1949a10bb17SJohn Polstra pam_set_item(pamh, PAM_USER,
1959a10bb17SJohn Polstra template_user);
1961642eb1aSMark Murray PAM_LOG("Using template user");
1979a10bb17SJohn Polstra }
1981642eb1aSMark Murray }
19924fe7ba0SDag-Erling Smørgrav return (PAM_SUCCESS);
2009a10bb17SJohn Polstra
2019a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_FAIL:
2029a10bb17SJohn Polstra tac_close(tach);
20365550d9bSMark Murray PAM_VERBOSE_ERROR("TACACS+ authentication failed");
20424fe7ba0SDag-Erling Smørgrav return (PAM_AUTH_ERR);
2059a10bb17SJohn Polstra
2069a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETUSER:
2079a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETPASS:
2089a10bb17SJohn Polstra if ((srvr_msg = get_msg(tach)) == NULL)
20924fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR);
2109a10bb17SJohn Polstra if (status == TAC_AUTHEN_STATUS_GETUSER)
2119a10bb17SJohn Polstra retval = pam_get_user(pamh, &user_msg,
212111ccd25SDag-Erling Smørgrav *srvr_msg ? srvr_msg : NULL);
2139a10bb17SJohn Polstra else if (status == TAC_AUTHEN_STATUS_GETPASS)
214111ccd25SDag-Erling Smørgrav retval = pam_get_authtok(pamh,
215111ccd25SDag-Erling Smørgrav PAM_AUTHTOK, &user_msg,
216111ccd25SDag-Erling Smørgrav *srvr_msg ? srvr_msg : "Password:");
2179a10bb17SJohn Polstra free(srvr_msg);
2189a10bb17SJohn Polstra if (retval != PAM_SUCCESS) {
2199a10bb17SJohn Polstra /* XXX - send a TACACS+ abort packet */
2209a10bb17SJohn Polstra tac_close(tach);
22124fe7ba0SDag-Erling Smørgrav return (retval);
2229a10bb17SJohn Polstra }
2239a10bb17SJohn Polstra if (set_msg(tach, user_msg) == -1)
22424fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR);
2259a10bb17SJohn Polstra break;
2269a10bb17SJohn Polstra
2279a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETDATA:
2289a10bb17SJohn Polstra if ((srvr_msg = get_msg(tach)) == NULL)
22924fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR);
2309a10bb17SJohn Polstra retval = pam_prompt(pamh,
231545aa471SDag-Erling Smørgrav openpam_get_option(pamh, PAM_OPT_ECHO_PASS) ?
232545aa471SDag-Erling Smørgrav PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF,
233111ccd25SDag-Erling Smørgrav &data_msg, "%s", *srvr_msg ? srvr_msg : "Data:");
2349a10bb17SJohn Polstra free(srvr_msg);
2359a10bb17SJohn Polstra if (retval != PAM_SUCCESS) {
2369a10bb17SJohn Polstra /* XXX - send a TACACS+ abort packet */
2379a10bb17SJohn Polstra tac_close(tach);
23824fe7ba0SDag-Erling Smørgrav return (retval);
2399a10bb17SJohn Polstra }
2409a10bb17SJohn Polstra retval = set_msg(tach, data_msg);
2419a10bb17SJohn Polstra memset(data_msg, 0, strlen(data_msg));
2429a10bb17SJohn Polstra free(data_msg);
2439a10bb17SJohn Polstra if (retval == -1)
24424fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR);
2459a10bb17SJohn Polstra break;
2469a10bb17SJohn Polstra
2479a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_ERROR:
2489a10bb17SJohn Polstra srvr_msg = (char *)tac_get_data(tach, &msg_len);
2499a10bb17SJohn Polstra if (srvr_msg != NULL && msg_len != 0) {
2509a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_send_authen:"
2519a10bb17SJohn Polstra " server detected error: %s", srvr_msg);
2529a10bb17SJohn Polstra free(srvr_msg);
2531642eb1aSMark Murray }
2541642eb1aSMark Murray else
2559a10bb17SJohn Polstra syslog(LOG_CRIT,
2569a10bb17SJohn Polstra "tac_send_authen: server detected error");
2579a10bb17SJohn Polstra tac_close(tach);
25824fe7ba0SDag-Erling Smørgrav return (PAM_AUTHINFO_UNAVAIL);
2599a10bb17SJohn Polstra break;
2609a10bb17SJohn Polstra
2619a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_RESTART:
2629a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_FOLLOW:
2639a10bb17SJohn Polstra default:
2649a10bb17SJohn Polstra syslog(LOG_CRIT,
2659a10bb17SJohn Polstra "tac_send_authen: unexpected status %#x", status);
2669a10bb17SJohn Polstra tac_close(tach);
26724fe7ba0SDag-Erling Smørgrav return (PAM_AUTHINFO_UNAVAIL);
2689a10bb17SJohn Polstra }
2699a10bb17SJohn Polstra }
2709a10bb17SJohn Polstra }
2719a10bb17SJohn Polstra
2729a10bb17SJohn Polstra PAM_EXTERN int
pam_sm_setcred(pam_handle_t * pamh __unused,int flags __unused,int argc __unused,const char * argv[]__unused)27324fe7ba0SDag-Erling Smørgrav pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
27424fe7ba0SDag-Erling Smørgrav int argc __unused, const char *argv[] __unused)
2759a10bb17SJohn Polstra {
2768d3978c1SDag-Erling Smørgrav
27724fe7ba0SDag-Erling Smørgrav return (PAM_IGNORE);
2789a10bb17SJohn Polstra }
2799294327dSJohn Polstra
2809294327dSJohn Polstra PAM_MODULE_ENTRY("pam_tacplus");
281