1 /* $OpenBSD: auth.c,v 1.113 2015/08/21 03:42:19 djm Exp $ */
2 /*
3  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include "includes.h"
27 
28 #include <sys/types.h>
29 #include <sys/stat.h>
30 
31 #include <netinet/in.h>
32 
33 #include <errno.h>
34 #include <fcntl.h>
35 #ifdef HAVE_PATHS_H
36 # include <paths.h>
37 #endif
38 #include <pwd.h>
39 #ifdef HAVE_LOGIN_H
40 #include <login.h>
41 #endif
42 #ifdef USE_SHADOW
43 #include <shadow.h>
44 #endif
45 #ifdef HAVE_LIBGEN_H
46 #include <libgen.h>
47 #endif
48 #include <stdarg.h>
49 #include <stdio.h>
50 #include <string.h>
51 #include <unistd.h>
52 #include <limits.h>
53 
54 #include "xmalloc.h"
55 #include "match.h"
56 #include "groupaccess.h"
57 #include "log.h"
58 #include "buffer.h"
59 #include "misc.h"
60 #include "servconf.h"
61 #include "key.h"
62 #include "hostfile.h"
63 #include "auth.h"
64 #include "auth-options.h"
65 #include "canohost.h"
66 #include "uidswap.h"
67 #include "packet.h"
68 #include "loginrec.h"
69 #ifdef GSSAPI
70 #include "ssh-gss.h"
71 #endif
72 #include "authfile.h"
73 #include "monitor_wrap.h"
74 #include "authfile.h"
75 #include "ssherr.h"
76 #include "compat.h"
77 
78 /* import */
79 extern ServerOptions options;
80 extern int use_privsep;
81 extern Buffer loginmsg;
82 extern struct passwd *privsep_pw;
83 
84 /* Debugging messages */
85 Buffer auth_debug;
86 int auth_debug_init;
87 
88 /*
89  * Check if the user is allowed to log in via ssh. If user is listed
90  * in DenyUsers or one of user's groups is listed in DenyGroups, false
91  * will be returned. If AllowUsers isn't empty and user isn't listed
92  * there, or if AllowGroups isn't empty and one of user's groups isn't
93  * listed there, false will be returned.
94  * If the user's shell is not executable, false will be returned.
95  * Otherwise true is returned.
96  */
97 int
allowed_user(struct passwd * pw)98 allowed_user(struct passwd * pw)
99 {
100 	struct stat st;
101 	const char *hostname = NULL, *ipaddr = NULL, *passwd = NULL;
102 	u_int i;
103 #ifdef USE_SHADOW
104 	struct spwd *spw = NULL;
105 #endif
106 
107 	/* Shouldn't be called if pw is NULL, but better safe than sorry... */
108 	if (!pw || !pw->pw_name)
109 		return 0;
110 
111 #ifdef USE_SHADOW
112 	if (!options.use_pam)
113 		spw = getspnam(pw->pw_name);
114 #ifdef HAS_SHADOW_EXPIRE
115 	if (!options.use_pam && spw != NULL && auth_shadow_acctexpired(spw))
116 		return 0;
117 #endif /* HAS_SHADOW_EXPIRE */
118 #endif /* USE_SHADOW */
119 
120 	/* grab passwd field for locked account check */
121 	passwd = pw->pw_passwd;
122 #ifdef USE_SHADOW
123 	if (spw != NULL)
124 #ifdef USE_LIBIAF
125 		passwd = get_iaf_password(pw);
126 #else
127 		passwd = spw->sp_pwdp;
128 #endif /* USE_LIBIAF */
129 #endif
130 
131 	/* check for locked account */
132 	if (!options.use_pam && passwd && *passwd) {
133 		int locked = 0;
134 
135 #ifdef LOCKED_PASSWD_STRING
136 		if (strcmp(passwd, LOCKED_PASSWD_STRING) == 0)
137 			 locked = 1;
138 #endif
139 #ifdef LOCKED_PASSWD_PREFIX
140 		if (strncmp(passwd, LOCKED_PASSWD_PREFIX,
141 		    strlen(LOCKED_PASSWD_PREFIX)) == 0)
142 			 locked = 1;
143 #endif
144 #ifdef LOCKED_PASSWD_SUBSTR
145 		if (strstr(passwd, LOCKED_PASSWD_SUBSTR))
146 			locked = 1;
147 #endif
148 #ifdef USE_LIBIAF
149 		free((void *) passwd);
150 #endif /* USE_LIBIAF */
151 		if (locked) {
152 			logit("User %.100s not allowed because account is locked",
153 			    pw->pw_name);
154 			return 0;
155 		}
156 	}
157 
158 	/*
159 	 * Deny if shell does not exist or is not executable unless we
160 	 * are chrooting.
161 	 */
162 	if (options.chroot_directory == NULL ||
163 	    strcasecmp(options.chroot_directory, "none") == 0) {
164 		char *shell = xstrdup((pw->pw_shell[0] == '\0') ?
165 		    _PATH_BSHELL : pw->pw_shell); /* empty = /bin/sh */
166 
167 		if (stat(shell, &st) != 0) {
168 			logit("User %.100s not allowed because shell %.100s "
169 			    "does not exist", pw->pw_name, shell);
170 			free(shell);
171 			return 0;
172 		}
173 		if (S_ISREG(st.st_mode) == 0 ||
174 		    (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)) == 0) {
175 			logit("User %.100s not allowed because shell %.100s "
176 			    "is not executable", pw->pw_name, shell);
177 			free(shell);
178 			return 0;
179 		}
180 		free(shell);
181 	}
182 
183 	if (options.num_deny_users > 0 || options.num_allow_users > 0 ||
184 	    options.num_deny_groups > 0 || options.num_allow_groups > 0) {
185 		hostname = get_canonical_hostname(options.use_dns);
186 		ipaddr = get_remote_ipaddr();
187 	}
188 
189 	/* Return false if user is listed in DenyUsers */
190 	if (options.num_deny_users > 0) {
191 		for (i = 0; i < options.num_deny_users; i++)
192 			if (match_user(pw->pw_name, hostname, ipaddr,
193 			    options.deny_users[i])) {
194 				logit("User %.100s from %.100s not allowed "
195 				    "because listed in DenyUsers",
196 				    pw->pw_name, hostname);
197 				return 0;
198 			}
199 	}
200 	/* Return false if AllowUsers isn't empty and user isn't listed there */
201 	if (options.num_allow_users > 0) {
202 		for (i = 0; i < options.num_allow_users; i++)
203 			if (match_user(pw->pw_name, hostname, ipaddr,
204 			    options.allow_users[i]))
205 				break;
206 		/* i < options.num_allow_users iff we break for loop */
207 		if (i >= options.num_allow_users) {
208 			logit("User %.100s from %.100s not allowed because "
209 			    "not listed in AllowUsers", pw->pw_name, hostname);
210 			return 0;
211 		}
212 	}
213 	if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
214 		/* Get the user's group access list (primary and supplementary) */
215 		if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
216 			logit("User %.100s from %.100s not allowed because "
217 			    "not in any group", pw->pw_name, hostname);
218 			return 0;
219 		}
220 
221 		/* Return false if one of user's groups is listed in DenyGroups */
222 		if (options.num_deny_groups > 0)
223 			if (ga_match(options.deny_groups,
224 			    options.num_deny_groups)) {
225 				ga_free();
226 				logit("User %.100s from %.100s not allowed "
227 				    "because a group is listed in DenyGroups",
228 				    pw->pw_name, hostname);
229 				return 0;
230 			}
231 		/*
232 		 * Return false if AllowGroups isn't empty and one of user's groups
233 		 * isn't listed there
234 		 */
235 		if (options.num_allow_groups > 0)
236 			if (!ga_match(options.allow_groups,
237 			    options.num_allow_groups)) {
238 				ga_free();
239 				logit("User %.100s from %.100s not allowed "
240 				    "because none of user's groups are listed "
241 				    "in AllowGroups", pw->pw_name, hostname);
242 				return 0;
243 			}
244 		ga_free();
245 	}
246 
247 #ifdef CUSTOM_SYS_AUTH_ALLOWED_USER
248 	if (!sys_auth_allowed_user(pw, &loginmsg))
249 		return 0;
250 #endif
251 
252 	/* We found no reason not to let this user try to log on... */
253 	return 1;
254 }
255 
256 void
auth_info(Authctxt * authctxt,const char * fmt,...)257 auth_info(Authctxt *authctxt, const char *fmt, ...)
258 {
259 	va_list ap;
260         int i;
261 
262 	free(authctxt->info);
263 	authctxt->info = NULL;
264 
265 	va_start(ap, fmt);
266 	i = vasprintf(&authctxt->info, fmt, ap);
267 	va_end(ap);
268 
269 	if (i < 0 || authctxt->info == NULL)
270 		fatal("vasprintf failed");
271 }
272 
273 void
auth_log(Authctxt * authctxt,int authenticated,int partial,const char * method,const char * submethod)274 auth_log(Authctxt *authctxt, int authenticated, int partial,
275     const char *method, const char *submethod)
276 {
277 	void (*authlog) (const char *fmt,...) = verbose;
278 	char *authmsg;
279 
280 	if (use_privsep && !mm_is_monitor() && !authctxt->postponed)
281 		return;
282 
283 	/* Raise logging level */
284 	if (authenticated == 1 ||
285 	    !authctxt->valid ||
286 	    authctxt->failures >= options.max_authtries / 2 ||
287 	    strcmp(method, "password") == 0)
288 		authlog = logit;
289 
290 	if (authctxt->postponed)
291 		authmsg = "Postponed";
292 	else if (partial)
293 		authmsg = "Partial";
294 	else
295 		authmsg = authenticated ? "Accepted" : "Failed";
296 
297 	authlog("%s %s%s%s for %s%.100s from %.200s port %d %s%s%s",
298 	    authmsg,
299 	    method,
300 	    submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod,
301 	    authctxt->valid ? "" : "invalid user ",
302 	    authctxt->user,
303 	    get_remote_ipaddr(),
304 	    get_remote_port(),
305 	    compat20 ? "ssh2" : "ssh1",
306 	    authctxt->info != NULL ? ": " : "",
307 	    authctxt->info != NULL ? authctxt->info : "");
308 	free(authctxt->info);
309 	authctxt->info = NULL;
310 
311 #ifdef CUSTOM_FAILED_LOGIN
312 	if (authenticated == 0 && !authctxt->postponed &&
313 	    (strcmp(method, "password") == 0 ||
314 	    strncmp(method, "keyboard-interactive", 20) == 0 ||
315 	    strcmp(method, "challenge-response") == 0))
316 		record_failed_login(authctxt->user,
317 		    get_canonical_hostname(options.use_dns), "ssh");
318 # ifdef WITH_AIXAUTHENTICATE
319 	if (authenticated)
320 		sys_auth_record_login(authctxt->user,
321 		    get_canonical_hostname(options.use_dns), "ssh", &loginmsg);
322 # endif
323 #endif
324 #ifdef SSH_AUDIT_EVENTS
325 	if (authenticated == 0 && !authctxt->postponed)
326 		audit_event(audit_classify_auth(method));
327 #endif
328 }
329 
330 
331 void
auth_maxtries_exceeded(Authctxt * authctxt)332 auth_maxtries_exceeded(Authctxt *authctxt)
333 {
334 	error("maximum authentication attempts exceeded for "
335 	    "%s%.100s from %.200s port %d %s",
336 	    authctxt->valid ? "" : "invalid user ",
337 	    authctxt->user,
338 	    get_remote_ipaddr(),
339 	    get_remote_port(),
340 	    compat20 ? "ssh2" : "ssh1");
341 	packet_disconnect("Too many authentication failures");
342 	/* NOTREACHED */
343 }
344 
345 /*
346  * Check whether root logins are disallowed.
347  */
348 int
auth_root_allowed(const char * method)349 auth_root_allowed(const char *method)
350 {
351 	switch (options.permit_root_login) {
352 	case PERMIT_YES:
353 		return 1;
354 	case PERMIT_NO_PASSWD:
355 		if (strcmp(method, "publickey") == 0 ||
356 		    strcmp(method, "hostbased") == 0 ||
357 		    strcmp(method, "gssapi-with-mic") == 0)
358 			return 1;
359 		break;
360 	case PERMIT_FORCED_ONLY:
361 		if (forced_command) {
362 			logit("Root login accepted for forced command.");
363 			return 1;
364 		}
365 		break;
366 	}
367 	logit("ROOT LOGIN REFUSED FROM %.200s", get_remote_ipaddr());
368 	return 0;
369 }
370 
371 
372 /*
373  * Given a template and a passwd structure, build a filename
374  * by substituting % tokenised options. Currently, %% becomes '%',
375  * %h becomes the home directory and %u the username.
376  *
377  * This returns a buffer allocated by xmalloc.
378  */
379 char *
expand_authorized_keys(const char * filename,struct passwd * pw)380 expand_authorized_keys(const char *filename, struct passwd *pw)
381 {
382 	char *file, ret[PATH_MAX];
383 	int i;
384 
385 	file = percent_expand(filename, "h", pw->pw_dir,
386 	    "u", pw->pw_name, (char *)NULL);
387 
388 	/*
389 	 * Ensure that filename starts anchored. If not, be backward
390 	 * compatible and prepend the '%h/'
391 	 */
392 	if (*file == '/')
393 		return (file);
394 
395 	i = snprintf(ret, sizeof(ret), "%s/%s", pw->pw_dir, file);
396 	if (i < 0 || (size_t)i >= sizeof(ret))
397 		fatal("expand_authorized_keys: path too long");
398 	free(file);
399 	return (xstrdup(ret));
400 }
401 
402 char *
authorized_principals_file(struct passwd * pw)403 authorized_principals_file(struct passwd *pw)
404 {
405 	if (options.authorized_principals_file == NULL)
406 		return NULL;
407 	return expand_authorized_keys(options.authorized_principals_file, pw);
408 }
409 
410 /* return ok if key exists in sysfile or userfile */
411 HostStatus
check_key_in_hostfiles(struct passwd * pw,Key * key,const char * host,const char * sysfile,const char * userfile)412 check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
413     const char *sysfile, const char *userfile)
414 {
415 	char *user_hostfile;
416 	struct stat st;
417 	HostStatus host_status;
418 	struct hostkeys *hostkeys;
419 	const struct hostkey_entry *found;
420 
421 	hostkeys = init_hostkeys();
422 	load_hostkeys(hostkeys, host, sysfile);
423 	if (userfile != NULL) {
424 		user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
425 		if (options.strict_modes &&
426 		    (stat(user_hostfile, &st) == 0) &&
427 		    ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
428 		    (st.st_mode & 022) != 0)) {
429 			logit("Authentication refused for %.100s: "
430 			    "bad owner or modes for %.200s",
431 			    pw->pw_name, user_hostfile);
432 			auth_debug_add("Ignored %.200s: bad ownership or modes",
433 			    user_hostfile);
434 		} else {
435 			temporarily_use_uid(pw);
436 			load_hostkeys(hostkeys, host, user_hostfile);
437 			restore_uid();
438 		}
439 		free(user_hostfile);
440 	}
441 	host_status = check_key_in_hostkeys(hostkeys, key, &found);
442 	if (host_status == HOST_REVOKED)
443 		error("WARNING: revoked key for %s attempted authentication",
444 		    found->host);
445 	else if (host_status == HOST_OK)
446 		debug("%s: key for %s found at %s:%ld", __func__,
447 		    found->host, found->file, found->line);
448 	else
449 		debug("%s: key for host %s not found", __func__, host);
450 
451 	free_hostkeys(hostkeys);
452 
453 	return host_status;
454 }
455 
456 /*
457  * Check a given path for security. This is defined as all components
458  * of the path to the file must be owned by either the owner of
459  * of the file or root and no directories must be group or world writable.
460  *
461  * XXX Should any specific check be done for sym links ?
462  *
463  * Takes a file name, its stat information (preferably from fstat() to
464  * avoid races), the uid of the expected owner, their home directory and an
465  * error buffer plus max size as arguments.
466  *
467  * Returns 0 on success and -1 on failure
468  */
469 int
auth_secure_path(const char * name,struct stat * stp,const char * pw_dir,uid_t uid,char * err,size_t errlen)470 auth_secure_path(const char *name, struct stat *stp, const char *pw_dir,
471     uid_t uid, char *err, size_t errlen)
472 {
473 	char buf[PATH_MAX], homedir[PATH_MAX];
474 	char *cp;
475 	int comparehome = 0;
476 	struct stat st;
477 
478 	if (realpath(name, buf) == NULL) {
479 		snprintf(err, errlen, "realpath %s failed: %s", name,
480 		    strerror(errno));
481 		return -1;
482 	}
483 	if (pw_dir != NULL && realpath(pw_dir, homedir) != NULL)
484 		comparehome = 1;
485 
486 	if (!S_ISREG(stp->st_mode)) {
487 		snprintf(err, errlen, "%s is not a regular file", buf);
488 		return -1;
489 	}
490 	if ((!platform_sys_dir_uid(stp->st_uid) && stp->st_uid != uid) ||
491 	    (stp->st_mode & 022) != 0) {
492 #if defined(ANDROID)
493 		/* needed to allow root login on Android. */
494 		if (getuid() != 0)
495 #endif
496 		{
497 		snprintf(err, errlen, "bad ownership or modes for file %s",
498 		    buf);
499 		return -1;
500 		}
501 	}
502 
503 	/* for each component of the canonical path, walking upwards */
504 	for (;;) {
505 		if ((cp = dirname(buf)) == NULL) {
506 			snprintf(err, errlen, "dirname() failed");
507 			return -1;
508 		}
509 		strlcpy(buf, cp, sizeof(buf));
510 
511 #if !defined(ANDROID)
512 		/* /data is owned by system user, which causes this check to fail */
513 		if (stat(buf, &st) < 0 ||
514 		    (!platform_sys_dir_uid(st.st_uid) && st.st_uid != uid) ||
515 		    (st.st_mode & 022) != 0) {
516 			snprintf(err, errlen,
517 			    "bad ownership or modes for directory %s", buf);
518 			return -1;
519 		}
520 #endif
521 
522 		/* If are past the homedir then we can stop */
523 		if (comparehome && strcmp(homedir, buf) == 0)
524 			break;
525 
526 		/*
527 		 * dirname should always complete with a "/" path,
528 		 * but we can be paranoid and check for "." too
529 		 */
530 		if ((strcmp("/", buf) == 0) || (strcmp(".", buf) == 0))
531 			break;
532 	}
533 	return 0;
534 }
535 
536 /*
537  * Version of secure_path() that accepts an open file descriptor to
538  * avoid races.
539  *
540  * Returns 0 on success and -1 on failure
541  */
542 static int
secure_filename(FILE * f,const char * file,struct passwd * pw,char * err,size_t errlen)543 secure_filename(FILE *f, const char *file, struct passwd *pw,
544     char *err, size_t errlen)
545 {
546 	struct stat st;
547 
548 	/* check the open file to avoid races */
549 	if (fstat(fileno(f), &st) < 0) {
550 		snprintf(err, errlen, "cannot stat file %s: %s",
551 		    file, strerror(errno));
552 		return -1;
553 	}
554 	return auth_secure_path(file, &st, pw->pw_dir, pw->pw_uid, err, errlen);
555 }
556 
557 static FILE *
auth_openfile(const char * file,struct passwd * pw,int strict_modes,int log_missing,char * file_type)558 auth_openfile(const char *file, struct passwd *pw, int strict_modes,
559     int log_missing, char *file_type)
560 {
561 	char line[1024];
562 	struct stat st;
563 	int fd;
564 	FILE *f;
565 
566 	if ((fd = open(file, O_RDONLY|O_NONBLOCK)) == -1) {
567 		if (log_missing || errno != ENOENT)
568 			debug("Could not open %s '%s': %s", file_type, file,
569 			   strerror(errno));
570 		return NULL;
571 	}
572 
573 	if (fstat(fd, &st) < 0) {
574 		close(fd);
575 		return NULL;
576 	}
577 	if (!S_ISREG(st.st_mode)) {
578 		logit("User %s %s %s is not a regular file",
579 		    pw->pw_name, file_type, file);
580 		close(fd);
581 		return NULL;
582 	}
583 	unset_nonblock(fd);
584 	if ((f = fdopen(fd, "r")) == NULL) {
585 		close(fd);
586 		return NULL;
587 	}
588 	if (strict_modes &&
589 	    secure_filename(f, file, pw, line, sizeof(line)) != 0) {
590 		fclose(f);
591 		logit("Authentication refused: %s", line);
592 		auth_debug_add("Ignored %s: %s", file_type, line);
593 		return NULL;
594 	}
595 
596 	return f;
597 }
598 
599 
600 FILE *
auth_openkeyfile(const char * file,struct passwd * pw,int strict_modes)601 auth_openkeyfile(const char *file, struct passwd *pw, int strict_modes)
602 {
603 	return auth_openfile(file, pw, strict_modes, 1, "authorized keys");
604 }
605 
606 FILE *
auth_openprincipals(const char * file,struct passwd * pw,int strict_modes)607 auth_openprincipals(const char *file, struct passwd *pw, int strict_modes)
608 {
609 	return auth_openfile(file, pw, strict_modes, 0,
610 	    "authorized principals");
611 }
612 
613 struct passwd *
getpwnamallow(const char * user)614 getpwnamallow(const char *user)
615 {
616 #ifdef HAVE_LOGIN_CAP
617 	extern login_cap_t *lc;
618 #ifdef BSD_AUTH
619 	auth_session_t *as;
620 #endif
621 #endif
622 	struct passwd *pw;
623 	struct connection_info *ci = get_connection_info(1, options.use_dns);
624 
625 	ci->user = user;
626 	parse_server_match_config(&options, ci);
627 
628 #if defined(_AIX) && defined(HAVE_SETAUTHDB)
629 	aix_setauthdb(user);
630 #endif
631 
632 #if defined(ANDROID)
633 	// Android has a fixed set of users. Any incoming user that we can't
634 	// identify should be authenticated as the shell user.
635 	if (strcmp(user, "root") && strcmp(user, "shell")) {
636 		logit("Login name %.100s forced to shell", user);
637 		user = "shell";
638 	}
639 #endif
640 	pw = getpwnam(user);
641 
642 #if defined(_AIX) && defined(HAVE_SETAUTHDB)
643 	aix_restoreauthdb();
644 #endif
645 #ifdef HAVE_CYGWIN
646 	/*
647 	 * Windows usernames are case-insensitive.  To avoid later problems
648 	 * when trying to match the username, the user is only allowed to
649 	 * login if the username is given in the same case as stored in the
650 	 * user database.
651 	 */
652 	if (pw != NULL && strcmp(user, pw->pw_name) != 0) {
653 		logit("Login name %.100s does not match stored username %.100s",
654 		    user, pw->pw_name);
655 		pw = NULL;
656 	}
657 #endif
658 	if (pw == NULL) {
659 		logit("Invalid user %.100s from %.100s",
660 		    user, get_remote_ipaddr());
661 #ifdef CUSTOM_FAILED_LOGIN
662 		record_failed_login(user,
663 		    get_canonical_hostname(options.use_dns), "ssh");
664 #endif
665 #ifdef SSH_AUDIT_EVENTS
666 		audit_event(SSH_INVALID_USER);
667 #endif /* SSH_AUDIT_EVENTS */
668 		return (NULL);
669 	}
670 	if (!allowed_user(pw))
671 		return (NULL);
672 #ifdef HAVE_LOGIN_CAP
673 	if ((lc = login_getclass(pw->pw_class)) == NULL) {
674 		debug("unable to get login class: %s", user);
675 		return (NULL);
676 	}
677 #ifdef BSD_AUTH
678 	if ((as = auth_open()) == NULL || auth_setpwd(as, pw) != 0 ||
679 	    auth_approval(as, lc, pw->pw_name, "ssh") <= 0) {
680 		debug("Approval failure for %s", user);
681 		pw = NULL;
682 	}
683 	if (as != NULL)
684 		auth_close(as);
685 #endif
686 #endif
687 	if (pw != NULL)
688 		return (pwcopy(pw));
689 	return (NULL);
690 }
691 
692 /* Returns 1 if key is revoked by revoked_keys_file, 0 otherwise */
693 int
auth_key_is_revoked(Key * key)694 auth_key_is_revoked(Key *key)
695 {
696 	char *fp = NULL;
697 	int r;
698 
699 	if (options.revoked_keys_file == NULL)
700 		return 0;
701 	if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,
702 	    SSH_FP_DEFAULT)) == NULL) {
703 		r = SSH_ERR_ALLOC_FAIL;
704 		error("%s: fingerprint key: %s", __func__, ssh_err(r));
705 		goto out;
706 	}
707 
708 	r = sshkey_check_revoked(key, options.revoked_keys_file);
709 	switch (r) {
710 	case 0:
711 		break; /* not revoked */
712 	case SSH_ERR_KEY_REVOKED:
713 		error("Authentication key %s %s revoked by file %s",
714 		    sshkey_type(key), fp, options.revoked_keys_file);
715 		goto out;
716 	default:
717 		error("Error checking authentication key %s %s in "
718 		    "revoked keys file %s: %s", sshkey_type(key), fp,
719 		    options.revoked_keys_file, ssh_err(r));
720 		goto out;
721 	}
722 
723 	/* Success */
724 	r = 0;
725 
726  out:
727 	free(fp);
728 	return r == 0 ? 0 : 1;
729 }
730 
731 void
auth_debug_add(const char * fmt,...)732 auth_debug_add(const char *fmt,...)
733 {
734 	char buf[1024];
735 	va_list args;
736 
737 	if (!auth_debug_init)
738 		return;
739 
740 	va_start(args, fmt);
741 	vsnprintf(buf, sizeof(buf), fmt, args);
742 	va_end(args);
743 	buffer_put_cstring(&auth_debug, buf);
744 }
745 
746 void
auth_debug_send(void)747 auth_debug_send(void)
748 {
749 	char *msg;
750 
751 	if (!auth_debug_init)
752 		return;
753 	while (buffer_len(&auth_debug)) {
754 		msg = buffer_get_string(&auth_debug, NULL);
755 		packet_send_debug("%s", msg);
756 		free(msg);
757 	}
758 }
759 
760 void
auth_debug_reset(void)761 auth_debug_reset(void)
762 {
763 	if (auth_debug_init)
764 		buffer_clear(&auth_debug);
765 	else {
766 		buffer_init(&auth_debug);
767 		auth_debug_init = 1;
768 	}
769 }
770 
771 struct passwd *
fakepw(void)772 fakepw(void)
773 {
774 	static struct passwd fake;
775 
776 	memset(&fake, 0, sizeof(fake));
777 	fake.pw_name = "NOUSER";
778 	fake.pw_passwd =
779 	    "$2a$06$r3.juUaHZDlIbQaO2dS9FuYxL1W9M81R1Tc92PoSNmzvpEqLkLGrK";
780 #ifdef HAVE_STRUCT_PASSWD_PW_GECOS
781 	fake.pw_gecos = "NOUSER";
782 #endif
783 	fake.pw_uid = privsep_pw == NULL ? (uid_t)-1 : privsep_pw->pw_uid;
784 	fake.pw_gid = privsep_pw == NULL ? (gid_t)-1 : privsep_pw->pw_gid;
785 #ifdef HAVE_STRUCT_PASSWD_PW_CLASS
786 	fake.pw_class = "";
787 #endif
788 	fake.pw_dir = "/nonexist";
789 	fake.pw_shell = "/nonexist";
790 
791 	return (&fake);
792 }
793