19a10bb17SJohn Polstra /*- 29a10bb17SJohn Polstra * Copyright 1998 Juniper Networks, Inc. 39a10bb17SJohn Polstra * All rights reserved. 4111ccd25SDag-Erling Smørgrav * Copyright (c) 2001,2002 Networks Associates Technology, Inc. 58d3978c1SDag-Erling Smørgrav * All rights reserved. 68d3978c1SDag-Erling Smørgrav * 78d3978c1SDag-Erling Smørgrav * Portions of this software were developed for the FreeBSD Project by 88d3978c1SDag-Erling Smørgrav * ThinkSec AS and NAI Labs, the Security Research Division of Network 98d3978c1SDag-Erling Smørgrav * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 108d3978c1SDag-Erling Smørgrav * ("CBOSS"), as part of the DARPA CHATS research program. 119a10bb17SJohn Polstra * 129a10bb17SJohn Polstra * Redistribution and use in source and binary forms, with or without 139a10bb17SJohn Polstra * modification, are permitted provided that the following conditions 149a10bb17SJohn Polstra * are met: 159a10bb17SJohn Polstra * 1. Redistributions of source code must retain the above copyright 169a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer. 179a10bb17SJohn Polstra * 2. Redistributions in binary form must reproduce the above copyright 189a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer in the 199a10bb17SJohn Polstra * documentation and/or other materials provided with the distribution. 208d3978c1SDag-Erling Smørgrav * 3. The name of the author may not be used to endorse or promote 218d3978c1SDag-Erling Smørgrav * products derived from this software without specific prior written 228d3978c1SDag-Erling Smørgrav * permission. 239a10bb17SJohn Polstra * 249a10bb17SJohn Polstra * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 259a10bb17SJohn Polstra * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 269a10bb17SJohn Polstra * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 279a10bb17SJohn Polstra * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 289a10bb17SJohn Polstra * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 299a10bb17SJohn Polstra * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 309a10bb17SJohn Polstra * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 319a10bb17SJohn Polstra * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 329a10bb17SJohn Polstra * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 339a10bb17SJohn Polstra * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 349a10bb17SJohn Polstra * SUCH DAMAGE. 359a10bb17SJohn Polstra */ 369a10bb17SJohn Polstra 37ceaf33f5SMatthew Dillon #include <sys/cdefs.h> 38ceaf33f5SMatthew Dillon __FBSDID("$FreeBSD$"); 39ceaf33f5SMatthew Dillon 409a10bb17SJohn Polstra #include <sys/param.h> 419a10bb17SJohn Polstra 429a10bb17SJohn Polstra #include <pwd.h> 439a10bb17SJohn Polstra #include <stdlib.h> 449a10bb17SJohn Polstra #include <string.h> 459a10bb17SJohn Polstra #include <syslog.h> 469a10bb17SJohn Polstra #include <taclib.h> 479a10bb17SJohn Polstra #include <unistd.h> 489a10bb17SJohn Polstra 499a10bb17SJohn Polstra #define PAM_SM_AUTH 508d3978c1SDag-Erling Smørgrav 518c66575dSDag-Erling Smørgrav #include <security/pam_appl.h> 529a10bb17SJohn Polstra #include <security/pam_modules.h> 538c66575dSDag-Erling Smørgrav #include <security/pam_mod_misc.h> 549a10bb17SJohn Polstra 5524fe7ba0SDag-Erling Smørgrav enum { 5624fe7ba0SDag-Erling Smørgrav PAM_OPT_CONF = PAM_OPT_STD_MAX, 5724fe7ba0SDag-Erling Smørgrav PAM_OPT_TEMPLATE_USER 5824fe7ba0SDag-Erling Smørgrav }; 591642eb1aSMark Murray 601642eb1aSMark Murray static struct opttab other_options[] = { 611642eb1aSMark Murray { "conf", PAM_OPT_CONF }, 621642eb1aSMark Murray { "template_user", PAM_OPT_TEMPLATE_USER }, 631642eb1aSMark Murray { NULL, 0 } 641642eb1aSMark Murray }; 659a10bb17SJohn Polstra 669a10bb17SJohn Polstra typedef int (*set_func)(struct tac_handle *, const char *); 679a10bb17SJohn Polstra 689a10bb17SJohn Polstra static int do_item(pam_handle_t *, struct tac_handle *, int, 699a10bb17SJohn Polstra set_func, const char *); 709a10bb17SJohn Polstra static char *get_msg(struct tac_handle *); 719a10bb17SJohn Polstra static int set_msg(struct tac_handle *, const char *); 729a10bb17SJohn Polstra 739a10bb17SJohn Polstra static int 749a10bb17SJohn Polstra do_item(pam_handle_t *pamh, struct tac_handle *tach, int item, 759a10bb17SJohn Polstra set_func func, const char *funcname) 769a10bb17SJohn Polstra { 779a10bb17SJohn Polstra int retval; 789a10bb17SJohn Polstra const void *value; 799a10bb17SJohn Polstra 801642eb1aSMark Murray retval = pam_get_item(pamh, item, &value); 811642eb1aSMark Murray if (retval != PAM_SUCCESS) 829a10bb17SJohn Polstra return retval; 839a10bb17SJohn Polstra if (value != NULL && (*func)(tach, (const char *)value) == -1) { 849a10bb17SJohn Polstra syslog(LOG_CRIT, "%s: %s", funcname, tac_strerror(tach)); 859a10bb17SJohn Polstra tac_close(tach); 869a10bb17SJohn Polstra return PAM_SERVICE_ERR; 879a10bb17SJohn Polstra } 889a10bb17SJohn Polstra return PAM_SUCCESS; 899a10bb17SJohn Polstra } 909a10bb17SJohn Polstra 919a10bb17SJohn Polstra static char * 929a10bb17SJohn Polstra get_msg(struct tac_handle *tach) 939a10bb17SJohn Polstra { 949a10bb17SJohn Polstra char *msg; 959a10bb17SJohn Polstra 961642eb1aSMark Murray msg = tac_get_msg(tach); 971642eb1aSMark Murray if (msg == NULL) { 989a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_get_msg: %s", tac_strerror(tach)); 999a10bb17SJohn Polstra tac_close(tach); 1009a10bb17SJohn Polstra return NULL; 1019a10bb17SJohn Polstra } 1029a10bb17SJohn Polstra return msg; 1039a10bb17SJohn Polstra } 1049a10bb17SJohn Polstra 1059a10bb17SJohn Polstra static int 1069a10bb17SJohn Polstra set_msg(struct tac_handle *tach, const char *msg) 1079a10bb17SJohn Polstra { 1089a10bb17SJohn Polstra if (tac_set_msg(tach, msg) == -1) { 1099a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_set_msg: %s", tac_strerror(tach)); 1109a10bb17SJohn Polstra tac_close(tach); 1119a10bb17SJohn Polstra return -1; 1129a10bb17SJohn Polstra } 1139a10bb17SJohn Polstra return 0; 1149a10bb17SJohn Polstra } 1159a10bb17SJohn Polstra 1169a10bb17SJohn Polstra PAM_EXTERN int 11724fe7ba0SDag-Erling Smørgrav pam_sm_authenticate(pam_handle_t *pamh, int flags __unused, 11824fe7ba0SDag-Erling Smørgrav int argc, const char *argv[]) 1199a10bb17SJohn Polstra { 1201642eb1aSMark Murray struct options options; 1219a10bb17SJohn Polstra int retval; 1229a10bb17SJohn Polstra struct tac_handle *tach; 1231642eb1aSMark Murray char *conf_file; 1241642eb1aSMark Murray char *template_user; 1259a10bb17SJohn Polstra 1261642eb1aSMark Murray pam_std_option(&options, other_options, argc, argv); 1279a10bb17SJohn Polstra 1281642eb1aSMark Murray PAM_LOG("Options processed"); 1299a10bb17SJohn Polstra 1301642eb1aSMark Murray conf_file = NULL; 1311642eb1aSMark Murray pam_test_option(&options, PAM_OPT_CONF, &conf_file); 1321642eb1aSMark Murray template_user = NULL; 1331642eb1aSMark Murray pam_test_option(&options, PAM_OPT_TEMPLATE_USER, &template_user); 1341642eb1aSMark Murray 1351642eb1aSMark Murray tach = tac_open(); 1361642eb1aSMark Murray if (tach == NULL) { 1379a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_open failed"); 13824fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 1399a10bb17SJohn Polstra } 1409a10bb17SJohn Polstra if (tac_config(tach, conf_file) == -1) { 1419a10bb17SJohn Polstra syslog(LOG_ALERT, "tac_config: %s", tac_strerror(tach)); 1429a10bb17SJohn Polstra tac_close(tach); 14324fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 1449a10bb17SJohn Polstra } 1459a10bb17SJohn Polstra if (tac_create_authen(tach, TAC_AUTHEN_LOGIN, TAC_AUTHEN_TYPE_ASCII, 1469a10bb17SJohn Polstra TAC_AUTHEN_SVC_LOGIN) == -1) { 1479a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_create_authen: %s", tac_strerror(tach)); 1489a10bb17SJohn Polstra tac_close(tach); 14924fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 1509a10bb17SJohn Polstra } 1511642eb1aSMark Murray 1521642eb1aSMark Murray PAM_LOG("Done tac_open() ... tac_close()"); 1531642eb1aSMark Murray 1541642eb1aSMark Murray retval = do_item(pamh, tach, PAM_USER, tac_set_user, "tac_set_user"); 1551642eb1aSMark Murray if (retval != PAM_SUCCESS) 15624fe7ba0SDag-Erling Smørgrav return (retval); 1571642eb1aSMark Murray 1581642eb1aSMark Murray PAM_LOG("Done user"); 1591642eb1aSMark Murray 1601642eb1aSMark Murray retval = do_item(pamh, tach, PAM_TTY, tac_set_port, "tac_set_port"); 1611642eb1aSMark Murray if (retval != PAM_SUCCESS) 16224fe7ba0SDag-Erling Smørgrav return (retval); 1631642eb1aSMark Murray 1641642eb1aSMark Murray PAM_LOG("Done tty"); 1651642eb1aSMark Murray 1661642eb1aSMark Murray retval = do_item(pamh, tach, PAM_RHOST, tac_set_rem_addr, 1671642eb1aSMark Murray "tac_set_rem_addr"); 1681642eb1aSMark Murray if (retval != PAM_SUCCESS) 16924fe7ba0SDag-Erling Smørgrav return (retval); 1701642eb1aSMark Murray 1719a10bb17SJohn Polstra for (;;) { 1729a10bb17SJohn Polstra char *srvr_msg; 1739a10bb17SJohn Polstra size_t msg_len; 1749a10bb17SJohn Polstra const char *user_msg; 1759a10bb17SJohn Polstra char *data_msg; 1769a10bb17SJohn Polstra int sflags; 1779a10bb17SJohn Polstra int status; 1789a10bb17SJohn Polstra 1791642eb1aSMark Murray sflags = tac_send_authen(tach); 1801642eb1aSMark Murray if (sflags == -1) { 1819a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_send_authen: %s", 1829a10bb17SJohn Polstra tac_strerror(tach)); 1839a10bb17SJohn Polstra tac_close(tach); 18424fe7ba0SDag-Erling Smørgrav return (PAM_AUTHINFO_UNAVAIL); 1859a10bb17SJohn Polstra } 1869a10bb17SJohn Polstra status = TAC_AUTHEN_STATUS(sflags); 1871642eb1aSMark Murray if (!TAC_AUTHEN_NOECHO(sflags)) 1881642eb1aSMark Murray pam_set_option(&options, PAM_OPT_ECHO_PASS); 1899a10bb17SJohn Polstra switch (status) { 1909a10bb17SJohn Polstra 1919a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_PASS: 1929a10bb17SJohn Polstra tac_close(tach); 1939a10bb17SJohn Polstra if (template_user != NULL) { 1949a10bb17SJohn Polstra const void *item; 1959a10bb17SJohn Polstra const char *user; 1969a10bb17SJohn Polstra 1971642eb1aSMark Murray PAM_LOG("Trying template user: %s", 1981642eb1aSMark Murray template_user); 1991642eb1aSMark Murray 2009a10bb17SJohn Polstra /* 2019a10bb17SJohn Polstra * If the given user name doesn't exist in 2029a10bb17SJohn Polstra * the local password database, change it 2039a10bb17SJohn Polstra * to the value given in the "template_user" 2049a10bb17SJohn Polstra * option. 2059a10bb17SJohn Polstra */ 2069a10bb17SJohn Polstra retval = pam_get_item(pamh, PAM_USER, &item); 2079a10bb17SJohn Polstra if (retval != PAM_SUCCESS) 20824fe7ba0SDag-Erling Smørgrav return (retval); 2099a10bb17SJohn Polstra user = (const char *)item; 2101642eb1aSMark Murray if (getpwnam(user) == NULL) { 2119a10bb17SJohn Polstra pam_set_item(pamh, PAM_USER, 2129a10bb17SJohn Polstra template_user); 2131642eb1aSMark Murray PAM_LOG("Using template user"); 2149a10bb17SJohn Polstra } 2151642eb1aSMark Murray } 21624fe7ba0SDag-Erling Smørgrav return (PAM_SUCCESS); 2179a10bb17SJohn Polstra 2189a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_FAIL: 2199a10bb17SJohn Polstra tac_close(tach); 22065550d9bSMark Murray PAM_VERBOSE_ERROR("TACACS+ authentication failed"); 22124fe7ba0SDag-Erling Smørgrav return (PAM_AUTH_ERR); 2229a10bb17SJohn Polstra 2239a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETUSER: 2249a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETPASS: 2259a10bb17SJohn Polstra if ((srvr_msg = get_msg(tach)) == NULL) 22624fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 2279a10bb17SJohn Polstra if (status == TAC_AUTHEN_STATUS_GETUSER) 2289a10bb17SJohn Polstra retval = pam_get_user(pamh, &user_msg, 229111ccd25SDag-Erling Smørgrav *srvr_msg ? srvr_msg : NULL); 2309a10bb17SJohn Polstra else if (status == TAC_AUTHEN_STATUS_GETPASS) 231111ccd25SDag-Erling Smørgrav retval = pam_get_authtok(pamh, 232111ccd25SDag-Erling Smørgrav PAM_AUTHTOK, &user_msg, 233111ccd25SDag-Erling Smørgrav *srvr_msg ? srvr_msg : "Password:"); 2349a10bb17SJohn Polstra free(srvr_msg); 2359a10bb17SJohn Polstra if (retval != PAM_SUCCESS) { 2369a10bb17SJohn Polstra /* XXX - send a TACACS+ abort packet */ 2379a10bb17SJohn Polstra tac_close(tach); 23824fe7ba0SDag-Erling Smørgrav return (retval); 2399a10bb17SJohn Polstra } 2409a10bb17SJohn Polstra if (set_msg(tach, user_msg) == -1) 24124fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 2429a10bb17SJohn Polstra break; 2439a10bb17SJohn Polstra 2449a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETDATA: 2459a10bb17SJohn Polstra if ((srvr_msg = get_msg(tach)) == NULL) 24624fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 2479a10bb17SJohn Polstra retval = pam_prompt(pamh, 2481642eb1aSMark Murray pam_test_option(&options, PAM_OPT_ECHO_PASS, NULL) 2491642eb1aSMark Murray ? PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF, 250111ccd25SDag-Erling Smørgrav &data_msg, "%s", *srvr_msg ? srvr_msg : "Data:"); 2519a10bb17SJohn Polstra free(srvr_msg); 2529a10bb17SJohn Polstra if (retval != PAM_SUCCESS) { 2539a10bb17SJohn Polstra /* XXX - send a TACACS+ abort packet */ 2549a10bb17SJohn Polstra tac_close(tach); 25524fe7ba0SDag-Erling Smørgrav return (retval); 2569a10bb17SJohn Polstra } 2579a10bb17SJohn Polstra retval = set_msg(tach, data_msg); 2589a10bb17SJohn Polstra memset(data_msg, 0, strlen(data_msg)); 2599a10bb17SJohn Polstra free(data_msg); 2609a10bb17SJohn Polstra if (retval == -1) 26124fe7ba0SDag-Erling Smørgrav return (PAM_SERVICE_ERR); 2629a10bb17SJohn Polstra break; 2639a10bb17SJohn Polstra 2649a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_ERROR: 2659a10bb17SJohn Polstra srvr_msg = (char *)tac_get_data(tach, &msg_len); 2669a10bb17SJohn Polstra if (srvr_msg != NULL && msg_len != 0) { 2679a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_send_authen:" 2689a10bb17SJohn Polstra " server detected error: %s", srvr_msg); 2699a10bb17SJohn Polstra free(srvr_msg); 2701642eb1aSMark Murray } 2711642eb1aSMark Murray else 2729a10bb17SJohn Polstra syslog(LOG_CRIT, 2739a10bb17SJohn Polstra "tac_send_authen: server detected error"); 2749a10bb17SJohn Polstra tac_close(tach); 27524fe7ba0SDag-Erling Smørgrav return (PAM_AUTHINFO_UNAVAIL); 2769a10bb17SJohn Polstra break; 2779a10bb17SJohn Polstra 2789a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_RESTART: 2799a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_FOLLOW: 2809a10bb17SJohn Polstra default: 2819a10bb17SJohn Polstra syslog(LOG_CRIT, 2829a10bb17SJohn Polstra "tac_send_authen: unexpected status %#x", status); 2839a10bb17SJohn Polstra tac_close(tach); 28424fe7ba0SDag-Erling Smørgrav return (PAM_AUTHINFO_UNAVAIL); 2859a10bb17SJohn Polstra } 2869a10bb17SJohn Polstra } 2879a10bb17SJohn Polstra } 2889a10bb17SJohn Polstra 2899a10bb17SJohn Polstra PAM_EXTERN int 29024fe7ba0SDag-Erling Smørgrav pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused, 29124fe7ba0SDag-Erling Smørgrav int argc __unused, const char *argv[] __unused) 2929a10bb17SJohn Polstra { 2938d3978c1SDag-Erling Smørgrav 29424fe7ba0SDag-Erling Smørgrav return (PAM_IGNORE); 2959a10bb17SJohn Polstra } 2969294327dSJohn Polstra 2979294327dSJohn Polstra PAM_MODULE_ENTRY("pam_tacplus"); 298