19a10bb17SJohn Polstra /*- 29a10bb17SJohn Polstra * Copyright 1998 Juniper Networks, Inc. 39a10bb17SJohn Polstra * All rights reserved. 49a10bb17SJohn Polstra * 59a10bb17SJohn Polstra * Redistribution and use in source and binary forms, with or without 69a10bb17SJohn Polstra * modification, are permitted provided that the following conditions 79a10bb17SJohn Polstra * are met: 89a10bb17SJohn Polstra * 1. Redistributions of source code must retain the above copyright 99a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer. 109a10bb17SJohn Polstra * 2. Redistributions in binary form must reproduce the above copyright 119a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer in the 129a10bb17SJohn Polstra * documentation and/or other materials provided with the distribution. 139a10bb17SJohn Polstra * 149a10bb17SJohn Polstra * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 159a10bb17SJohn Polstra * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 169a10bb17SJohn Polstra * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 179a10bb17SJohn Polstra * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 189a10bb17SJohn Polstra * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 199a10bb17SJohn Polstra * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 209a10bb17SJohn Polstra * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 219a10bb17SJohn Polstra * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 229a10bb17SJohn Polstra * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 239a10bb17SJohn Polstra * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 249a10bb17SJohn Polstra * SUCH DAMAGE. 259a10bb17SJohn Polstra * 269a10bb17SJohn Polstra * $FreeBSD$ 279a10bb17SJohn Polstra */ 289a10bb17SJohn Polstra 299a10bb17SJohn Polstra #include <sys/param.h> 309a10bb17SJohn Polstra 319a10bb17SJohn Polstra #include <pwd.h> 329a10bb17SJohn Polstra #include <stdlib.h> 339a10bb17SJohn Polstra #include <string.h> 349a10bb17SJohn Polstra #include <syslog.h> 359a10bb17SJohn Polstra #include <taclib.h> 369a10bb17SJohn Polstra #include <unistd.h> 379a10bb17SJohn Polstra 389a10bb17SJohn Polstra #define PAM_SM_AUTH 399a10bb17SJohn Polstra #include <security/pam_modules.h> 409a10bb17SJohn Polstra 419a10bb17SJohn Polstra #include "pam_mod_misc.h" 429a10bb17SJohn Polstra 431642eb1aSMark Murray enum { PAM_OPT_CONF=PAM_OPT_STD_MAX, PAM_OPT_TEMPLATE_USER }; 441642eb1aSMark Murray 451642eb1aSMark Murray static struct opttab other_options[] = { 461642eb1aSMark Murray { "conf", PAM_OPT_CONF }, 471642eb1aSMark Murray { "template_user", PAM_OPT_TEMPLATE_USER }, 481642eb1aSMark Murray { NULL, 0 } 491642eb1aSMark Murray }; 509a10bb17SJohn Polstra 519a10bb17SJohn Polstra typedef int (*set_func)(struct tac_handle *, const char *); 529a10bb17SJohn Polstra 539a10bb17SJohn Polstra static int do_item(pam_handle_t *, struct tac_handle *, int, 549a10bb17SJohn Polstra set_func, const char *); 559a10bb17SJohn Polstra static char *get_msg(struct tac_handle *); 569a10bb17SJohn Polstra static int set_msg(struct tac_handle *, const char *); 579a10bb17SJohn Polstra 589a10bb17SJohn Polstra static int 599a10bb17SJohn Polstra do_item(pam_handle_t *pamh, struct tac_handle *tach, int item, 609a10bb17SJohn Polstra set_func func, const char *funcname) 619a10bb17SJohn Polstra { 629a10bb17SJohn Polstra int retval; 639a10bb17SJohn Polstra const void *value; 649a10bb17SJohn Polstra 651642eb1aSMark Murray retval = pam_get_item(pamh, item, &value); 661642eb1aSMark Murray if (retval != PAM_SUCCESS) 679a10bb17SJohn Polstra return retval; 689a10bb17SJohn Polstra if (value != NULL && (*func)(tach, (const char *)value) == -1) { 699a10bb17SJohn Polstra syslog(LOG_CRIT, "%s: %s", funcname, tac_strerror(tach)); 709a10bb17SJohn Polstra tac_close(tach); 719a10bb17SJohn Polstra return PAM_SERVICE_ERR; 729a10bb17SJohn Polstra } 739a10bb17SJohn Polstra return PAM_SUCCESS; 749a10bb17SJohn Polstra } 759a10bb17SJohn Polstra 769a10bb17SJohn Polstra static char * 779a10bb17SJohn Polstra get_msg(struct tac_handle *tach) 789a10bb17SJohn Polstra { 799a10bb17SJohn Polstra char *msg; 809a10bb17SJohn Polstra 811642eb1aSMark Murray msg = tac_get_msg(tach); 821642eb1aSMark Murray if (msg == NULL) { 839a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_get_msg: %s", tac_strerror(tach)); 849a10bb17SJohn Polstra tac_close(tach); 859a10bb17SJohn Polstra return NULL; 869a10bb17SJohn Polstra } 879a10bb17SJohn Polstra return msg; 889a10bb17SJohn Polstra } 899a10bb17SJohn Polstra 909a10bb17SJohn Polstra static int 919a10bb17SJohn Polstra set_msg(struct tac_handle *tach, const char *msg) 929a10bb17SJohn Polstra { 939a10bb17SJohn Polstra if (tac_set_msg(tach, msg) == -1) { 949a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_set_msg: %s", tac_strerror(tach)); 959a10bb17SJohn Polstra tac_close(tach); 969a10bb17SJohn Polstra return -1; 979a10bb17SJohn Polstra } 989a10bb17SJohn Polstra return 0; 999a10bb17SJohn Polstra } 1009a10bb17SJohn Polstra 1019a10bb17SJohn Polstra PAM_EXTERN int 1029a10bb17SJohn Polstra pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, 1039a10bb17SJohn Polstra const char **argv) 1049a10bb17SJohn Polstra { 1051642eb1aSMark Murray struct options options; 1069a10bb17SJohn Polstra int retval; 1079a10bb17SJohn Polstra struct tac_handle *tach; 1081642eb1aSMark Murray char *conf_file; 1091642eb1aSMark Murray char *template_user; 1109a10bb17SJohn Polstra 1111642eb1aSMark Murray pam_std_option(&options, other_options, argc, argv); 1129a10bb17SJohn Polstra 1131642eb1aSMark Murray PAM_LOG("Options processed"); 1149a10bb17SJohn Polstra 1151642eb1aSMark Murray conf_file = NULL; 1161642eb1aSMark Murray pam_test_option(&options, PAM_OPT_CONF, &conf_file); 1171642eb1aSMark Murray template_user = NULL; 1181642eb1aSMark Murray pam_test_option(&options, PAM_OPT_TEMPLATE_USER, &template_user); 1191642eb1aSMark Murray 1201642eb1aSMark Murray tach = tac_open(); 1211642eb1aSMark Murray if (tach == NULL) { 1229a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_open failed"); 1231642eb1aSMark Murray PAM_RETURN(PAM_SERVICE_ERR); 1249a10bb17SJohn Polstra } 1259a10bb17SJohn Polstra if (tac_config(tach, conf_file) == -1) { 1269a10bb17SJohn Polstra syslog(LOG_ALERT, "tac_config: %s", tac_strerror(tach)); 1279a10bb17SJohn Polstra tac_close(tach); 1281642eb1aSMark Murray PAM_RETURN(PAM_SERVICE_ERR); 1299a10bb17SJohn Polstra } 1309a10bb17SJohn Polstra if (tac_create_authen(tach, TAC_AUTHEN_LOGIN, TAC_AUTHEN_TYPE_ASCII, 1319a10bb17SJohn Polstra TAC_AUTHEN_SVC_LOGIN) == -1) { 1329a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_create_authen: %s", tac_strerror(tach)); 1339a10bb17SJohn Polstra tac_close(tach); 1341642eb1aSMark Murray PAM_RETURN(PAM_SERVICE_ERR); 1359a10bb17SJohn Polstra } 1361642eb1aSMark Murray 1371642eb1aSMark Murray PAM_LOG("Done tac_open() ... tac_close()"); 1381642eb1aSMark Murray 1391642eb1aSMark Murray retval = do_item(pamh, tach, PAM_USER, tac_set_user, "tac_set_user"); 1401642eb1aSMark Murray if (retval != PAM_SUCCESS) 1411642eb1aSMark Murray PAM_RETURN(retval); 1421642eb1aSMark Murray 1431642eb1aSMark Murray PAM_LOG("Done user"); 1441642eb1aSMark Murray 1451642eb1aSMark Murray retval = do_item(pamh, tach, PAM_TTY, tac_set_port, "tac_set_port"); 1461642eb1aSMark Murray if (retval != PAM_SUCCESS) 1471642eb1aSMark Murray PAM_RETURN(retval); 1481642eb1aSMark Murray 1491642eb1aSMark Murray PAM_LOG("Done tty"); 1501642eb1aSMark Murray 1511642eb1aSMark Murray retval = do_item(pamh, tach, PAM_RHOST, tac_set_rem_addr, 1521642eb1aSMark Murray "tac_set_rem_addr"); 1531642eb1aSMark Murray if (retval != PAM_SUCCESS) 1541642eb1aSMark Murray PAM_RETURN(retval); 1551642eb1aSMark Murray 1569a10bb17SJohn Polstra for ( ; ; ) { 1579a10bb17SJohn Polstra char *srvr_msg; 1589a10bb17SJohn Polstra size_t msg_len; 1599a10bb17SJohn Polstra const char *user_msg; 1609a10bb17SJohn Polstra char *data_msg; 1619a10bb17SJohn Polstra int sflags; 1629a10bb17SJohn Polstra int status; 1639a10bb17SJohn Polstra 1641642eb1aSMark Murray sflags = tac_send_authen(tach); 1651642eb1aSMark Murray if (sflags == -1) { 1669a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_send_authen: %s", 1679a10bb17SJohn Polstra tac_strerror(tach)); 1689a10bb17SJohn Polstra tac_close(tach); 1691642eb1aSMark Murray PAM_RETURN(PAM_AUTHINFO_UNAVAIL); 1709a10bb17SJohn Polstra } 1719a10bb17SJohn Polstra status = TAC_AUTHEN_STATUS(sflags); 1721642eb1aSMark Murray if (!TAC_AUTHEN_NOECHO(sflags)) 1731642eb1aSMark Murray pam_set_option(&options, PAM_OPT_ECHO_PASS); 1749a10bb17SJohn Polstra switch (status) { 1759a10bb17SJohn Polstra 1769a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_PASS: 1779a10bb17SJohn Polstra tac_close(tach); 1789a10bb17SJohn Polstra if (template_user != NULL) { 1799a10bb17SJohn Polstra const void *item; 1809a10bb17SJohn Polstra const char *user; 1819a10bb17SJohn Polstra 1821642eb1aSMark Murray PAM_LOG("Trying template user: %s", 1831642eb1aSMark Murray template_user); 1841642eb1aSMark Murray 1859a10bb17SJohn Polstra /* 1869a10bb17SJohn Polstra * If the given user name doesn't exist in 1879a10bb17SJohn Polstra * the local password database, change it 1889a10bb17SJohn Polstra * to the value given in the "template_user" 1899a10bb17SJohn Polstra * option. 1909a10bb17SJohn Polstra */ 1919a10bb17SJohn Polstra retval = pam_get_item(pamh, PAM_USER, &item); 1929a10bb17SJohn Polstra if (retval != PAM_SUCCESS) 1931642eb1aSMark Murray PAM_RETURN(retval); 1949a10bb17SJohn Polstra user = (const char *)item; 1951642eb1aSMark Murray if (getpwnam(user) == NULL) { 1969a10bb17SJohn Polstra pam_set_item(pamh, PAM_USER, 1979a10bb17SJohn Polstra template_user); 1981642eb1aSMark Murray PAM_LOG("Using template user"); 1999a10bb17SJohn Polstra } 2001642eb1aSMark Murray } 2011642eb1aSMark Murray PAM_RETURN(PAM_SUCCESS); 2029a10bb17SJohn Polstra 2039a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_FAIL: 2049a10bb17SJohn Polstra tac_close(tach); 20565550d9bSMark Murray PAM_VERBOSE_ERROR("TACACS+ authentication failed"); 2061642eb1aSMark Murray PAM_RETURN(PAM_AUTH_ERR); 2079a10bb17SJohn Polstra 2089a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETUSER: 2099a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETPASS: 2109a10bb17SJohn Polstra if ((srvr_msg = get_msg(tach)) == NULL) 2111642eb1aSMark Murray PAM_RETURN(PAM_SERVICE_ERR); 2129a10bb17SJohn Polstra if (status == TAC_AUTHEN_STATUS_GETUSER) 2139a10bb17SJohn Polstra retval = pam_get_user(pamh, &user_msg, 2149a10bb17SJohn Polstra srvr_msg[0] != '\0' ? srvr_msg : NULL); 2159a10bb17SJohn Polstra else if (status == TAC_AUTHEN_STATUS_GETPASS) 2169a10bb17SJohn Polstra retval = pam_get_pass(pamh, &user_msg, 2179a10bb17SJohn Polstra srvr_msg[0] != '\0' ? srvr_msg : 2181642eb1aSMark Murray "Password:", &options); 2199a10bb17SJohn Polstra free(srvr_msg); 2209a10bb17SJohn Polstra if (retval != PAM_SUCCESS) { 2219a10bb17SJohn Polstra /* XXX - send a TACACS+ abort packet */ 2229a10bb17SJohn Polstra tac_close(tach); 2231642eb1aSMark Murray PAM_RETURN(retval); 2249a10bb17SJohn Polstra } 2259a10bb17SJohn Polstra if (set_msg(tach, user_msg) == -1) 2261642eb1aSMark Murray PAM_RETURN(PAM_SERVICE_ERR); 2279a10bb17SJohn Polstra break; 2289a10bb17SJohn Polstra 2299a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETDATA: 2309a10bb17SJohn Polstra if ((srvr_msg = get_msg(tach)) == NULL) 2311642eb1aSMark Murray PAM_RETURN(PAM_SERVICE_ERR); 2329a10bb17SJohn Polstra retval = pam_prompt(pamh, 2331642eb1aSMark Murray pam_test_option(&options, PAM_OPT_ECHO_PASS, NULL) 2341642eb1aSMark Murray ? PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF, 2359a10bb17SJohn Polstra srvr_msg[0] != '\0' ? srvr_msg : "Data:", 2369a10bb17SJohn Polstra &data_msg); 2379a10bb17SJohn Polstra free(srvr_msg); 2389a10bb17SJohn Polstra if (retval != PAM_SUCCESS) { 2399a10bb17SJohn Polstra /* XXX - send a TACACS+ abort packet */ 2409a10bb17SJohn Polstra tac_close(tach); 2411642eb1aSMark Murray PAM_RETURN(retval); 2429a10bb17SJohn Polstra } 2439a10bb17SJohn Polstra retval = set_msg(tach, data_msg); 2449a10bb17SJohn Polstra memset(data_msg, 0, strlen(data_msg)); 2459a10bb17SJohn Polstra free(data_msg); 2469a10bb17SJohn Polstra if (retval == -1) 2471642eb1aSMark Murray PAM_RETURN(PAM_SERVICE_ERR); 2489a10bb17SJohn Polstra break; 2499a10bb17SJohn Polstra 2509a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_ERROR: 2519a10bb17SJohn Polstra srvr_msg = (char *)tac_get_data(tach, &msg_len); 2529a10bb17SJohn Polstra if (srvr_msg != NULL && msg_len != 0) { 2539a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_send_authen:" 2549a10bb17SJohn Polstra " server detected error: %s", srvr_msg); 2559a10bb17SJohn Polstra free(srvr_msg); 2561642eb1aSMark Murray } 2571642eb1aSMark Murray else 2589a10bb17SJohn Polstra syslog(LOG_CRIT, 2599a10bb17SJohn Polstra "tac_send_authen: server detected error"); 2609a10bb17SJohn Polstra tac_close(tach); 2611642eb1aSMark Murray PAM_RETURN(PAM_AUTHINFO_UNAVAIL); 2629a10bb17SJohn Polstra break; 2639a10bb17SJohn Polstra 2649a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_RESTART: 2659a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_FOLLOW: 2669a10bb17SJohn Polstra default: 2679a10bb17SJohn Polstra syslog(LOG_CRIT, 2689a10bb17SJohn Polstra "tac_send_authen: unexpected status %#x", status); 2699a10bb17SJohn Polstra tac_close(tach); 2701642eb1aSMark Murray PAM_RETURN(PAM_AUTHINFO_UNAVAIL); 2719a10bb17SJohn Polstra } 2729a10bb17SJohn Polstra } 2739a10bb17SJohn Polstra } 2749a10bb17SJohn Polstra 2759a10bb17SJohn Polstra PAM_EXTERN int 2769a10bb17SJohn Polstra pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv) 2779a10bb17SJohn Polstra { 2789a10bb17SJohn Polstra return PAM_SUCCESS; 2799a10bb17SJohn Polstra } 2809294327dSJohn Polstra 2819294327dSJohn Polstra PAM_MODULE_ENTRY("pam_tacplus"); 282