auth-rhosts.c

   1 /* $OpenBSD: auth-rhosts.c,v 1.38 2006/07/06 16:03:53 stevesk Exp $ */
   2 /*
   3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  * Rhosts authentication.  This file contains code to check whether to admit
   7  * the login based on rhosts authentication.  This file also processes
   8  * /etc/hosts.equiv.
   9  *
  10  * As far as I am concerned, the code I have written for this software
  11  * can be used freely for any purpose.  Any derived versions of this
  12  * software must be clearly marked as such, and if the derived work is
  13  * incompatible with the protocol description in the RFC file, it must be
  14  * called by a name other than "ssh" or "Secure Shell".
  15  */
  16
  17 #include "includes.h"
  18
  19 #include <sys/types.h>
  20 #include <sys/stat.h>
  21
  22 #ifdef HAVE_NETGROUP_H
  23 # include <netgroup.h>
  24 #endif
  25 #include <pwd.h>
  26
  27 #include "packet.h"
  28 #include "uidswap.h"
  29 #include "pathnames.h"
  30 #include "log.h"
  31 #include "servconf.h"
  32 #include "canohost.h"
  33 #include "auth.h"
  34
  35 /* import */
  36 extern ServerOptions options;
  37 extern int use_privsep;
  38
  39 /*
  40  * This function processes an rhosts-style file (.rhosts, .shosts, or
  41  * /etc/hosts.equiv).  This returns true if authentication can be granted
  42  * based on the file, and returns zero otherwise.
  43  */
  44
  45 static int
  46 check_rhosts_file(const char *filename, const char *hostname,
  47                   const char *ipaddr, const char *client_user,
  48                   const char *server_user)
  49 {
  50         FILE *f;
  51         char buf[1024]; /* Must not be larger than host, user, dummy below. */
  52
  53         /* Open the .rhosts file, deny if unreadable */
  54         f = fopen(filename, "r");
  55         if (!f)
  56                 return 0;
  57
  58         while (fgets(buf, sizeof(buf), f)) {
  59                 /* All three must be at least as big as buf to avoid overflows. */
  60                 char hostbuf[1024], userbuf[1024], dummy[1024], *host, *user, *cp;
  61                 int negated;
  62
  63                 for (cp = buf; *cp == ' ' || *cp == '\t'; cp++)
  64                         ;
  65                 if (*cp == '#' || *cp == '\n' || !*cp)
  66                         continue;
  67
  68                 /*
  69                  * NO_PLUS is supported at least on OSF/1.  We skip it (we
  70                  * don't ever support the plus syntax).
  71                  */
  72                 if (strncmp(cp, "NO_PLUS", 7) == 0)
  73                         continue;
  74
  75                 /*
  76                  * This should be safe because each buffer is as big as the
  77                  * whole string, and thus cannot be overwritten.
  78                  */
  79                 switch (sscanf(buf, "%1023s %1023s %1023s", hostbuf, userbuf,
  80                     dummy)) {
  81                 case 0:
  82                         auth_debug_add("Found empty line in %.100s.", filename);
  83                         continue;
  84                 case 1:
  85                         /* Host name only. */
  86                         strlcpy(userbuf, server_user, sizeof(userbuf));
  87                         break;
  88                 case 2:
  89                         /* Got both host and user name. */
  90                         break;
  91                 case 3:
  92                         auth_debug_add("Found garbage in %.100s.", filename);
  93                         continue;
  94                 default:
  95                         /* Weird... */
  96                         continue;
  97                 }
  98
  99                 host = hostbuf;
 100                 user = userbuf;
 101                 negated = 0;
 102
 103                 /* Process negated host names, or positive netgroups. */
 104                 if (host[0] == '-') {
 105                         negated = 1;
 106                         host++;
 107                 } else if (host[0] == '+')
 108                         host++;
 109
 110                 if (user[0] == '-') {
 111                         negated = 1;
 112                         user++;
 113                 } else if (user[0] == '+')
 114                         user++;
 115
 116                 /* Check for empty host/user names (particularly '+'). */
 117                 if (!host[0] || !user[0]) {
 118                         /* We come here if either was '+' or '-'. */
 119                         auth_debug_add("Ignoring wild host/user names in %.100s.",
 120                             filename);
 121                         continue;
 122                 }
 123                 /* Verify that host name matches. */
 124                 if (host[0] == '@') {
 125                         if (!innetgr(host + 1, hostname, NULL, NULL) &&
 126                             !innetgr(host + 1, ipaddr, NULL, NULL))
 127                                 continue;
 128                 } else if (strcasecmp(host, hostname) && strcmp(host, ipaddr) != 0)
 129                         continue;       /* Different hostname. */
 130
 131                 /* Verify that user name matches. */
 132                 if (user[0] == '@') {
 133                         if (!innetgr(user + 1, NULL, client_user, NULL))
 134                                 continue;
 135                 } else if (strcmp(user, client_user) != 0)
 136                         continue;       /* Different username. */
 137
 138                 /* Found the user and host. */
 139                 fclose(f);
 140
 141                 /* If the entry was negated, deny access. */
 142                 if (negated) {
 143                         auth_debug_add("Matched negative entry in %.100s.",
 144                             filename);
 145                         return 0;
 146                 }
 147                 /* Accept authentication. */
 148                 return 1;
 149         }
 150
 151         /* Authentication using this file denied. */
 152         fclose(f);
 153         return 0;
 154 }
 155
 156 /*
 157  * Tries to authenticate the user using the .shosts or .rhosts file. Returns
 158  * true if authentication succeeds.  If ignore_rhosts is true, only
 159  * /etc/hosts.equiv will be considered (.rhosts and .shosts are ignored).
 160  */
 161
 162 int
 163 auth_rhosts(struct passwd *pw, const char *client_user)
 164 {
 165         const char *hostname, *ipaddr;
 166
 167         hostname = get_canonical_hostname(options.use_dns);
 168         ipaddr = get_remote_ipaddr();
 169         return auth_rhosts2(pw, client_user, hostname, ipaddr);
 170 }
 171
 172 static int
 173 auth_rhosts2_raw(struct passwd *pw, const char *client_user, const char *hostname,
 174     const char *ipaddr)
 175 {
 176         char buf[1024];
 177         struct stat st;
 178         static const char *rhosts_files[] = {".shosts", ".rhosts", NULL};
 179         u_int rhosts_file_index;
 180
 181         debug2("auth_rhosts2: clientuser %s hostname %s ipaddr %s",
 182             client_user, hostname, ipaddr);
 183
 184         /* Switch to the user's uid. */
 185         temporarily_use_uid(pw);
 186         /*
 187          * Quick check: if the user has no .shosts or .rhosts files, return
 188          * failure immediately without doing costly lookups from name
 189          * servers.
 190          */
 191         for (rhosts_file_index = 0; rhosts_files[rhosts_file_index];
 192             rhosts_file_index++) {
 193                 /* Check users .rhosts or .shosts. */
 194                 snprintf(buf, sizeof buf, "%.500s/%.100s",
 195                          pw->pw_dir, rhosts_files[rhosts_file_index]);
 196                 if (stat(buf, &st) >= 0)
 197                         break;
 198         }
 199         /* Switch back to privileged uid. */
 200         restore_uid();
 201
 202         /* Deny if The user has no .shosts or .rhosts file and there are no system-wide files. */
 203         if (!rhosts_files[rhosts_file_index] &&
 204             stat(_PATH_RHOSTS_EQUIV, &st) < 0 &&
 205             stat(_PATH_SSH_HOSTS_EQUIV, &st) < 0)
 206                 return 0;
 207
 208         /* If not logging in as superuser, try /etc/hosts.equiv and shosts.equiv. */
 209         if (pw->pw_uid != 0) {
 210                 if (check_rhosts_file(_PATH_RHOSTS_EQUIV, hostname, ipaddr,
 211                     client_user, pw->pw_name)) {
 212                         auth_debug_add("Accepted for %.100s [%.100s] by /etc/hosts.equiv.",
 213                             hostname, ipaddr);
 214                         return 1;
 215                 }
 216                 if (check_rhosts_file(_PATH_SSH_HOSTS_EQUIV, hostname, ipaddr,
 217                     client_user, pw->pw_name)) {
 218                         auth_debug_add("Accepted for %.100s [%.100s] by %.100s.",
 219                             hostname, ipaddr, _PATH_SSH_HOSTS_EQUIV);
 220                         return 1;
 221                 }
 222         }
 223         /*
 224          * Check that the home directory is owned by root or the user, and is
 225          * not group or world writable.
 226          */
 227         if (stat(pw->pw_dir, &st) < 0) {
 228                 logit("Rhosts authentication refused for %.100s: "
 229                     "no home directory %.200s", pw->pw_name, pw->pw_dir);
 230                 auth_debug_add("Rhosts authentication refused for %.100s: "
 231                     "no home directory %.200s", pw->pw_name, pw->pw_dir);
 232                 return 0;
 233         }
 234         if (options.strict_modes &&
 235             ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
 236             (st.st_mode & 022) != 0)) {
 237                 logit("Rhosts authentication refused for %.100s: "
 238                     "bad ownership or modes for home directory.", pw->pw_name);
 239                 auth_debug_add("Rhosts authentication refused for %.100s: "
 240                     "bad ownership or modes for home directory.", pw->pw_name);
 241                 return 0;
 242         }
 243         /* Temporarily use the user's uid. */
 244         temporarily_use_uid(pw);
 245
 246         /* Check all .rhosts files (currently .shosts and .rhosts). */
 247         for (rhosts_file_index = 0; rhosts_files[rhosts_file_index];
 248             rhosts_file_index++) {
 249                 /* Check users .rhosts or .shosts. */
 250                 snprintf(buf, sizeof buf, "%.500s/%.100s",
 251                          pw->pw_dir, rhosts_files[rhosts_file_index]);
 252                 if (stat(buf, &st) < 0)
 253                         continue;
 254
 255                 /*
 256                  * Make sure that the file is either owned by the user or by
 257                  * root, and make sure it is not writable by anyone but the
 258                  * owner.  This is to help avoid novices accidentally
 259                  * allowing access to their account by anyone.
 260                  */
 261                 if (options.strict_modes &&
 262                     ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
 263                     (st.st_mode & 022) != 0)) {
 264                         logit("Rhosts authentication refused for %.100s: bad modes for %.200s",
 265                             pw->pw_name, buf);
 266                         auth_debug_add("Bad file modes for %.200s", buf);
 267                         continue;
 268                 }
 269                 /* Check if we have been configured to ignore .rhosts and .shosts files. */
 270                 if (options.ignore_rhosts) {
 271                         auth_debug_add("Server has been configured to ignore %.100s.",
 272                             rhosts_files[rhosts_file_index]);
 273                         continue;
 274                 }
 275                 /* Check if authentication is permitted by the file. */
 276                 if (check_rhosts_file(buf, hostname, ipaddr, client_user, pw->pw_name)) {
 277                         auth_debug_add("Accepted by %.100s.",
 278                             rhosts_files[rhosts_file_index]);
 279                         /* Restore the privileged uid. */
 280                         restore_uid();
 281                         auth_debug_add("Accepted host %s ip %s client_user %s server_user %s",
 282                                 hostname, ipaddr, client_user, pw->pw_name);
 283                         return 1;
 284                 }
 285         }
 286
 287         /* Restore the privileged uid. */
 288         restore_uid();
 289         return 0;
 290 }
 291
 292 int
 293 auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname,
 294     const char *ipaddr)
 295 {
 296         int ret;
 297
 298         auth_debug_reset();
 299         ret = auth_rhosts2_raw(pw, client_user, hostname, ipaddr);
 300         if (!use_privsep)
 301                 auth_debug_send();
 302         return ret;
 303 }