summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDamien Miller <djm@mindrot.org>2003-01-22 15:42:26 +1100
committerDamien Miller <djm@mindrot.org>2003-01-22 15:42:26 +1100
commit2101bfc4e1dbe1dc475d71158b1c24c6d2e2e412 (patch)
treeb9012d184941802b5f9fa188a3a530410513c755
parent53d81483f0bcea8af2207583bb6e83c187d522fc (diff)
- (djm) Reorganise PAM & SIA password handling to eliminate some common code
-rw-r--r--ChangeLog3
-rw-r--r--auth-pam.c10
-rw-r--r--auth-passwd.c89
-rw-r--r--auth-sia.c2
4 files changed, 48 insertions, 56 deletions
diff --git a/ChangeLog b/ChangeLog
index ea91ef7a..f4c7704c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,7 @@
Add a -t life option to ssh-agent that set the default lifetime.
The default can still be overriden by using -t in ssh-add.
OK markus@
+ - (djm) Reorganise PAM & SIA password handling to eliminate some common code
20030120
- (djm) Fix compilation for NetBSD from dtucker@zip.com.au
@@ -1048,4 +1049,4 @@
save auth method before monitor_reset_key_state(); bugzilla bug #284;
ok provos@
-$Id: ChangeLog,v 1.2579 2003/01/22 00:47:19 djm Exp $
+$Id: ChangeLog,v 1.2580 2003/01/22 04:42:26 djm Exp $
diff --git a/auth-pam.c b/auth-pam.c
index 99b03f45..fe9570f9 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -38,7 +38,7 @@ extern char *__progname;
extern int use_privsep;
-RCSID("$Id: auth-pam.c,v 1.54 2002/07/28 20:24:08 stevesk Exp $");
+RCSID("$Id: auth-pam.c,v 1.55 2003/01/22 04:42:26 djm Exp $");
#define NEW_AUTHTOK_MSG \
"Warning: Your password has expired, please change it now."
@@ -210,14 +210,6 @@ int auth_pam_password(Authctxt *authctxt, const char *password)
do_pam_set_conv(&conv);
- /* deny if no user. */
- if (pw == NULL)
- return 0;
- if (pw->pw_uid == 0 && options.permit_root_login == PERMIT_NO_PASSWD)
- return 0;
- if (*password == '\0' && options.permit_empty_passwd == 0)
- return 0;
-
__pampasswd = password;
pamstate = INITIAL_LOGIN;
diff --git a/auth-passwd.c b/auth-passwd.c
index 185db7d6..cbf093f0 100644
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -92,52 +92,51 @@ extern char *aixloginmsg;
int
auth_password(Authctxt *authctxt, const char *password)
{
-#if defined(USE_PAM)
- if (*password == '\0' && options.permit_empty_passwd == 0)
- return 0;
- return auth_pam_password(authctxt, password);
-#elif defined(HAVE_OSF_SIA)
- if (*password == '\0' && options.permit_empty_passwd == 0)
- return 0;
- return auth_sia_password(authctxt, password);
-#else
+#if !defined(USE_PAM) && !defined(HAVE_OSF_SIA)
struct passwd * pw = authctxt->pw;
char *encrypted_password;
char *pw_password;
char *salt;
-#if defined(__hpux) || defined(HAVE_SECUREWARE)
+# if defined(__hpux) || defined(HAVE_SECUREWARE)
struct pr_passwd *spw;
-#endif /* __hpux || HAVE_SECUREWARE */
-#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
+# endif /* __hpux || HAVE_SECUREWARE */
+# if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
struct spwd *spw;
-#endif
-#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
+# endif
+# if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
struct passwd_adjunct *spw;
-#endif
-#ifdef WITH_AIXAUTHENTICATE
+# endif
+# ifdef WITH_AIXAUTHENTICATE
char *authmsg;
int authsuccess;
int reenter = 1;
-#endif
+# endif
+#endif /* !defined(USE_PAM) && !defined(HAVE_OSF_SIA) */
/* deny if no user. */
if (pw == NULL)
return 0;
#ifndef HAVE_CYGWIN
- if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
+ if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_NO_PASSWD)
return 0;
#endif
if (*password == '\0' && options.permit_empty_passwd == 0)
return 0;
-#ifdef KRB5
+
+#if defined(USE_PAM)
+ return auth_pam_password(authctxt, password);
+#elif defined(HAVE_OSF_SIA)
+ return auth_sia_password(authctxt, password);
+#else
+# ifdef KRB5
if (options.kerberos_authentication == 1) {
int ret = auth_krb5_password(authctxt, password);
if (ret == 1 || ret == 0)
return ret;
/* Fall back to ordinary passwd authentication. */
}
-#endif
-#ifdef HAVE_CYGWIN
+# endif
+# ifdef HAVE_CYGWIN
if (is_winnt) {
HANDLE hToken = cygwin_logon_user(pw, password);
@@ -146,8 +145,8 @@ auth_password(Authctxt *authctxt, const char *password)
cygwin_set_impersonation_token(hToken);
return 1;
}
-#endif
-#ifdef WITH_AIXAUTHENTICATE
+# endif
+# ifdef WITH_AIXAUTHENTICATE
authsuccess = (authenticate(pw->pw_name,password,&reenter,&authmsg) == 0);
if (authsuccess)
@@ -158,47 +157,47 @@ auth_password(Authctxt *authctxt, const char *password)
aixloginmsg = NULL;
return(authsuccess);
-#endif
-#ifdef KRB4
+# endif
+# ifdef KRB4
if (options.kerberos_authentication == 1) {
int ret = auth_krb4_password(authctxt, password);
if (ret == 1 || ret == 0)
return ret;
/* Fall back to ordinary passwd authentication. */
}
-#endif
-#ifdef BSD_AUTH
+# endif
+# ifdef BSD_AUTH
if (auth_userokay(pw->pw_name, authctxt->style, "auth-ssh",
(char *)password) == 0)
return 0;
else
return 1;
-#endif
+# endif
pw_password = pw->pw_passwd;
/*
* Various interfaces to shadow or protected password data
*/
-#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
+# if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
spw = getspnam(pw->pw_name);
if (spw != NULL)
pw_password = spw->sp_pwdp;
-#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
+# endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
-#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
+# if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
if (issecure() && (spw = getpwanam(pw->pw_name)) != NULL)
pw_password = spw->pwa_passwd;
-#endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */
+# endif /* defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) */
-#ifdef HAVE_SECUREWARE
+# ifdef HAVE_SECUREWARE
if ((spw = getprpwnam(pw->pw_name)) != NULL)
pw_password = spw->ufld.fd_encrypt;
-#endif /* HAVE_SECUREWARE */
+# endif /* HAVE_SECUREWARE */
-#if defined(__hpux) && !defined(HAVE_SECUREWARE)
+# if defined(__hpux) && !defined(HAVE_SECUREWARE)
if (iscomsec() && (spw = getprpwnam(pw->pw_name)) != NULL)
pw_password = spw->ufld.fd_encrypt;
-#endif /* defined(__hpux) && !defined(HAVE_SECUREWARE) */
+# endif /* defined(__hpux) && !defined(HAVE_SECUREWARE) */
/* Check for users with no password. */
if ((password[0] == '\0') && (pw_password[0] == '\0'))
@@ -209,25 +208,25 @@ auth_password(Authctxt *authctxt, const char *password)
else
salt = "xx";
-#ifdef HAVE_MD5_PASSWORDS
+# ifdef HAVE_MD5_PASSWORDS
if (is_md5_salt(salt))
encrypted_password = md5_crypt(password, salt);
else
encrypted_password = crypt(password, salt);
-#else /* HAVE_MD5_PASSWORDS */
-# if defined(__hpux) && !defined(HAVE_SECUREWARE)
+# else /* HAVE_MD5_PASSWORDS */
+# if defined(__hpux) && !defined(HAVE_SECUREWARE)
if (iscomsec())
encrypted_password = bigcrypt(password, salt);
else
encrypted_password = crypt(password, salt);
-# else
-# ifdef HAVE_SECUREWARE
- encrypted_password = bigcrypt(password, salt);
# else
+# ifdef HAVE_SECUREWARE
+ encrypted_password = bigcrypt(password, salt);
+# else
encrypted_password = crypt(password, salt);
-# endif /* HAVE_SECUREWARE */
-# endif /* __hpux && !defined(HAVE_SECUREWARE) */
-#endif /* HAVE_MD5_PASSWORDS */
+# endif /* HAVE_SECUREWARE */
+# endif /* __hpux && !defined(HAVE_SECUREWARE) */
+# endif /* HAVE_MD5_PASSWORDS */
/* Authentication is accepted if the encrypted passwords are identical. */
return (strcmp(encrypted_password, pw_password) == 0);
diff --git a/auth-sia.c b/auth-sia.c
index 58b17c16..071e154d 100644
--- a/auth-sia.c
+++ b/auth-sia.c
@@ -57,7 +57,7 @@ auth_sia_password(Authctxt *authctxt, char *pass)
host = get_canonical_hostname(options.verify_reverse_mapping);
- if (!user || !pass || pass[0] == '\0')
+ if (pass[0] == '\0')
return(0);
if (sia_ses_init(&ent, saved_argc, saved_argv, host, user, NULL, 0,