19a10bb17SJohn Polstra /*- 29a10bb17SJohn Polstra * Copyright 1998 Juniper Networks, Inc. 39a10bb17SJohn Polstra * All rights reserved. 49a10bb17SJohn Polstra * 59a10bb17SJohn Polstra * Redistribution and use in source and binary forms, with or without 69a10bb17SJohn Polstra * modification, are permitted provided that the following conditions 79a10bb17SJohn Polstra * are met: 89a10bb17SJohn Polstra * 1. Redistributions of source code must retain the above copyright 99a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer. 109a10bb17SJohn Polstra * 2. Redistributions in binary form must reproduce the above copyright 119a10bb17SJohn Polstra * notice, this list of conditions and the following disclaimer in the 129a10bb17SJohn Polstra * documentation and/or other materials provided with the distribution. 139a10bb17SJohn Polstra * 149a10bb17SJohn Polstra * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 159a10bb17SJohn Polstra * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 169a10bb17SJohn Polstra * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 179a10bb17SJohn Polstra * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 189a10bb17SJohn Polstra * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 199a10bb17SJohn Polstra * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 209a10bb17SJohn Polstra * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 219a10bb17SJohn Polstra * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 229a10bb17SJohn Polstra * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 239a10bb17SJohn Polstra * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 249a10bb17SJohn Polstra * SUCH DAMAGE. 259a10bb17SJohn Polstra * 269a10bb17SJohn Polstra * $FreeBSD$ 279a10bb17SJohn Polstra */ 289a10bb17SJohn Polstra 299a10bb17SJohn Polstra #include <sys/param.h> 309a10bb17SJohn Polstra 319a10bb17SJohn Polstra #include <pwd.h> 329a10bb17SJohn Polstra #include <stdlib.h> 339a10bb17SJohn Polstra #include <string.h> 349a10bb17SJohn Polstra #include <syslog.h> 359a10bb17SJohn Polstra #include <taclib.h> 369a10bb17SJohn Polstra #include <unistd.h> 379a10bb17SJohn Polstra 389a10bb17SJohn Polstra #define PAM_SM_AUTH 399a10bb17SJohn Polstra #include <security/pam_modules.h> 409a10bb17SJohn Polstra 419a10bb17SJohn Polstra #include "pam_mod_misc.h" 429a10bb17SJohn Polstra 439a10bb17SJohn Polstra /* Option names, including the "=" sign. */ 449a10bb17SJohn Polstra #define OPT_CONF "conf=" 459a10bb17SJohn Polstra #define OPT_TMPL "template_user=" 469a10bb17SJohn Polstra 479a10bb17SJohn Polstra typedef int (*set_func)(struct tac_handle *, const char *); 489a10bb17SJohn Polstra 499a10bb17SJohn Polstra static int do_item(pam_handle_t *, struct tac_handle *, int, 509a10bb17SJohn Polstra set_func, const char *); 519a10bb17SJohn Polstra static char *get_msg(struct tac_handle *); 529a10bb17SJohn Polstra static int set_msg(struct tac_handle *, const char *); 539a10bb17SJohn Polstra 549a10bb17SJohn Polstra static int 559a10bb17SJohn Polstra do_item(pam_handle_t *pamh, struct tac_handle *tach, int item, 569a10bb17SJohn Polstra set_func func, const char *funcname) 579a10bb17SJohn Polstra { 589a10bb17SJohn Polstra int retval; 599a10bb17SJohn Polstra const void *value; 609a10bb17SJohn Polstra 619a10bb17SJohn Polstra if ((retval = pam_get_item(pamh, item, &value)) != PAM_SUCCESS) 629a10bb17SJohn Polstra return retval; 639a10bb17SJohn Polstra if (value != NULL && (*func)(tach, (const char *)value) == -1) { 649a10bb17SJohn Polstra syslog(LOG_CRIT, "%s: %s", funcname, tac_strerror(tach)); 659a10bb17SJohn Polstra tac_close(tach); 669a10bb17SJohn Polstra return PAM_SERVICE_ERR; 679a10bb17SJohn Polstra } 689a10bb17SJohn Polstra return PAM_SUCCESS; 699a10bb17SJohn Polstra } 709a10bb17SJohn Polstra 719a10bb17SJohn Polstra static char * 729a10bb17SJohn Polstra get_msg(struct tac_handle *tach) 739a10bb17SJohn Polstra { 749a10bb17SJohn Polstra char *msg; 759a10bb17SJohn Polstra 769a10bb17SJohn Polstra if ((msg = tac_get_msg(tach)) == NULL) { 779a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_get_msg: %s", tac_strerror(tach)); 789a10bb17SJohn Polstra tac_close(tach); 799a10bb17SJohn Polstra return NULL; 809a10bb17SJohn Polstra } 819a10bb17SJohn Polstra return msg; 829a10bb17SJohn Polstra } 839a10bb17SJohn Polstra 849a10bb17SJohn Polstra static int 859a10bb17SJohn Polstra set_msg(struct tac_handle *tach, const char *msg) 869a10bb17SJohn Polstra { 879a10bb17SJohn Polstra if (tac_set_msg(tach, msg) == -1) { 889a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_set_msg: %s", tac_strerror(tach)); 899a10bb17SJohn Polstra tac_close(tach); 909a10bb17SJohn Polstra return -1; 919a10bb17SJohn Polstra } 929a10bb17SJohn Polstra return 0; 939a10bb17SJohn Polstra } 949a10bb17SJohn Polstra 959a10bb17SJohn Polstra PAM_EXTERN int 969a10bb17SJohn Polstra pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, 979a10bb17SJohn Polstra const char **argv) 989a10bb17SJohn Polstra { 999a10bb17SJohn Polstra int retval; 1009a10bb17SJohn Polstra struct tac_handle *tach; 1019a10bb17SJohn Polstra const char *conf_file = NULL; 1029a10bb17SJohn Polstra const char *template_user = NULL; 1039a10bb17SJohn Polstra int options = 0; 1049a10bb17SJohn Polstra int i; 1059a10bb17SJohn Polstra 1069a10bb17SJohn Polstra for (i = 0; i < argc; i++) { 1079a10bb17SJohn Polstra size_t len; 1089a10bb17SJohn Polstra 1099a10bb17SJohn Polstra pam_std_option(&options, argv[i]); 1109a10bb17SJohn Polstra if (strncmp(argv[i], OPT_CONF, (len = strlen(OPT_CONF))) == 0) 1119a10bb17SJohn Polstra conf_file = argv[i] + len; 1129a10bb17SJohn Polstra else if (strncmp(argv[i], OPT_TMPL, 1139a10bb17SJohn Polstra (len = strlen(OPT_TMPL))) == 0) 1149a10bb17SJohn Polstra template_user = argv[i] + len; 1159a10bb17SJohn Polstra } 1169a10bb17SJohn Polstra 1179a10bb17SJohn Polstra if ((tach = tac_open()) == NULL) { 1189a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_open failed"); 1199a10bb17SJohn Polstra return PAM_SERVICE_ERR; 1209a10bb17SJohn Polstra } 1219a10bb17SJohn Polstra if (tac_config(tach, conf_file) == -1) { 1229a10bb17SJohn Polstra syslog(LOG_ALERT, "tac_config: %s", tac_strerror(tach)); 1239a10bb17SJohn Polstra tac_close(tach); 1249a10bb17SJohn Polstra return PAM_SERVICE_ERR; 1259a10bb17SJohn Polstra } 1269a10bb17SJohn Polstra if (tac_create_authen(tach, TAC_AUTHEN_LOGIN, TAC_AUTHEN_TYPE_ASCII, 1279a10bb17SJohn Polstra TAC_AUTHEN_SVC_LOGIN) == -1) { 1289a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_create_authen: %s", tac_strerror(tach)); 1299a10bb17SJohn Polstra tac_close(tach); 1309a10bb17SJohn Polstra return PAM_SERVICE_ERR; 1319a10bb17SJohn Polstra } 1329a10bb17SJohn Polstra if ((retval = do_item(pamh, tach, PAM_USER, 1339a10bb17SJohn Polstra tac_set_user, "tac_set_user")) != PAM_SUCCESS) 1349a10bb17SJohn Polstra return retval; 1359a10bb17SJohn Polstra if ((retval = do_item(pamh, tach, PAM_TTY, 1369a10bb17SJohn Polstra tac_set_port, "tac_set_port")) != PAM_SUCCESS) 1379a10bb17SJohn Polstra return retval; 1389a10bb17SJohn Polstra if ((retval = do_item(pamh, tach, PAM_RHOST, 1399a10bb17SJohn Polstra tac_set_rem_addr, "tac_set_rem_addr")) != PAM_SUCCESS) 1409a10bb17SJohn Polstra return retval; 1419a10bb17SJohn Polstra for ( ; ; ) { 1429a10bb17SJohn Polstra char *srvr_msg; 1439a10bb17SJohn Polstra size_t msg_len; 1449a10bb17SJohn Polstra const char *user_msg; 1459a10bb17SJohn Polstra char *data_msg; 1469a10bb17SJohn Polstra int sflags; 1479a10bb17SJohn Polstra int status; 1489a10bb17SJohn Polstra int echo; 1499a10bb17SJohn Polstra 1509a10bb17SJohn Polstra if ((sflags = tac_send_authen(tach)) == -1) { 1519a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_send_authen: %s", 1529a10bb17SJohn Polstra tac_strerror(tach)); 1539a10bb17SJohn Polstra tac_close(tach); 1549a10bb17SJohn Polstra return PAM_AUTHINFO_UNAVAIL; 1559a10bb17SJohn Polstra } 1569a10bb17SJohn Polstra status = TAC_AUTHEN_STATUS(sflags); 1579a10bb17SJohn Polstra echo = TAC_AUTHEN_NOECHO(sflags) ? 0 : PAM_OPT_ECHO_PASS; 1589a10bb17SJohn Polstra switch (status) { 1599a10bb17SJohn Polstra 1609a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_PASS: 1619a10bb17SJohn Polstra tac_close(tach); 1629a10bb17SJohn Polstra if (template_user != NULL) { 1639a10bb17SJohn Polstra const void *item; 1649a10bb17SJohn Polstra const char *user; 1659a10bb17SJohn Polstra 1669a10bb17SJohn Polstra /* 1679a10bb17SJohn Polstra * If the given user name doesn't exist in 1689a10bb17SJohn Polstra * the local password database, change it 1699a10bb17SJohn Polstra * to the value given in the "template_user" 1709a10bb17SJohn Polstra * option. 1719a10bb17SJohn Polstra */ 1729a10bb17SJohn Polstra retval = pam_get_item(pamh, PAM_USER, &item); 1739a10bb17SJohn Polstra if (retval != PAM_SUCCESS) 1749a10bb17SJohn Polstra return retval; 1759a10bb17SJohn Polstra user = (const char *)item; 1769a10bb17SJohn Polstra if (getpwnam(user) == NULL) 1779a10bb17SJohn Polstra pam_set_item(pamh, PAM_USER, 1789a10bb17SJohn Polstra template_user); 1799a10bb17SJohn Polstra } 1809a10bb17SJohn Polstra return PAM_SUCCESS; 1819a10bb17SJohn Polstra 1829a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_FAIL: 1839a10bb17SJohn Polstra tac_close(tach); 1849a10bb17SJohn Polstra return PAM_AUTH_ERR; 1859a10bb17SJohn Polstra 1869a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETUSER: 1879a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETPASS: 1889a10bb17SJohn Polstra if ((srvr_msg = get_msg(tach)) == NULL) 1899a10bb17SJohn Polstra return PAM_SERVICE_ERR; 1909a10bb17SJohn Polstra if (status == TAC_AUTHEN_STATUS_GETUSER) 1919a10bb17SJohn Polstra retval = pam_get_user(pamh, &user_msg, 1929a10bb17SJohn Polstra srvr_msg[0] != '\0' ? srvr_msg : NULL); 1939a10bb17SJohn Polstra else if (status == TAC_AUTHEN_STATUS_GETPASS) 1949a10bb17SJohn Polstra retval = pam_get_pass(pamh, &user_msg, 1959a10bb17SJohn Polstra srvr_msg[0] != '\0' ? srvr_msg : 1969a10bb17SJohn Polstra "Password:", options | echo); 1979a10bb17SJohn Polstra free(srvr_msg); 1989a10bb17SJohn Polstra if (retval != PAM_SUCCESS) { 1999a10bb17SJohn Polstra /* XXX - send a TACACS+ abort packet */ 2009a10bb17SJohn Polstra tac_close(tach); 2019a10bb17SJohn Polstra return retval; 2029a10bb17SJohn Polstra } 2039a10bb17SJohn Polstra if (set_msg(tach, user_msg) == -1) 2049a10bb17SJohn Polstra return PAM_SERVICE_ERR; 2059a10bb17SJohn Polstra break; 2069a10bb17SJohn Polstra 2079a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_GETDATA: 2089a10bb17SJohn Polstra if ((srvr_msg = get_msg(tach)) == NULL) 2099a10bb17SJohn Polstra return PAM_SERVICE_ERR; 2109a10bb17SJohn Polstra retval = pam_prompt(pamh, 2119a10bb17SJohn Polstra (options|echo) & PAM_OPT_ECHO_PASS ? 2129a10bb17SJohn Polstra PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF, 2139a10bb17SJohn Polstra srvr_msg[0] != '\0' ? srvr_msg : "Data:", 2149a10bb17SJohn Polstra &data_msg); 2159a10bb17SJohn Polstra free(srvr_msg); 2169a10bb17SJohn Polstra if (retval != PAM_SUCCESS) { 2179a10bb17SJohn Polstra /* XXX - send a TACACS+ abort packet */ 2189a10bb17SJohn Polstra tac_close(tach); 2199a10bb17SJohn Polstra return retval; 2209a10bb17SJohn Polstra } 2219a10bb17SJohn Polstra retval = set_msg(tach, data_msg); 2229a10bb17SJohn Polstra memset(data_msg, 0, strlen(data_msg)); 2239a10bb17SJohn Polstra free(data_msg); 2249a10bb17SJohn Polstra if (retval == -1) 2259a10bb17SJohn Polstra return PAM_SERVICE_ERR; 2269a10bb17SJohn Polstra break; 2279a10bb17SJohn Polstra 2289a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_ERROR: 2299a10bb17SJohn Polstra srvr_msg = (char *)tac_get_data(tach, &msg_len); 2309a10bb17SJohn Polstra if (srvr_msg != NULL && msg_len != 0) { 2319a10bb17SJohn Polstra syslog(LOG_CRIT, "tac_send_authen:" 2329a10bb17SJohn Polstra " server detected error: %s", srvr_msg); 2339a10bb17SJohn Polstra free(srvr_msg); 2349a10bb17SJohn Polstra } else 2359a10bb17SJohn Polstra syslog(LOG_CRIT, 2369a10bb17SJohn Polstra "tac_send_authen: server detected error"); 2379a10bb17SJohn Polstra tac_close(tach); 2389a10bb17SJohn Polstra return PAM_AUTHINFO_UNAVAIL; 2399a10bb17SJohn Polstra break; 2409a10bb17SJohn Polstra 2419a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_RESTART: 2429a10bb17SJohn Polstra case TAC_AUTHEN_STATUS_FOLLOW: 2439a10bb17SJohn Polstra default: 2449a10bb17SJohn Polstra syslog(LOG_CRIT, 2459a10bb17SJohn Polstra "tac_send_authen: unexpected status %#x", status); 2469a10bb17SJohn Polstra tac_close(tach); 2479a10bb17SJohn Polstra return PAM_AUTHINFO_UNAVAIL; 2489a10bb17SJohn Polstra } 2499a10bb17SJohn Polstra } 2509a10bb17SJohn Polstra } 2519a10bb17SJohn Polstra 2529a10bb17SJohn Polstra PAM_EXTERN int 2539a10bb17SJohn Polstra pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv) 2549a10bb17SJohn Polstra { 2559a10bb17SJohn Polstra return PAM_SUCCESS; 2569a10bb17SJohn Polstra } 257