usr/src/lib/pam_modules/dhkeys/dhkeys.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25
  26 #include <stdlib.h>
  27 #include <syslog.h>
  28 #include <errno.h>
  29 #include <string.h>
  30 #include <rpc/rpc.h>
  31 #include <unistd.h>
  32 #include <assert.h>
  33 #include <stdarg.h>
  34 #include <sys/types.h>
  35 #include <sys/wait.h>
  36 #include <limits.h>
  37 #include <signal.h>
  38 #include <pthread.h>
  39 #include <synch.h>
  40
  41 #include <rpcsvc/nis.h>
  42 #include <rpcsvc/yppasswd.h>
  43 #include <rpcsvc/ypclnt.h>
  44 #include <rpc/key_prot.h>
  45 #include <rpc/rpc.h>
  46 #include <nfs/nfs.h>
  47 #include <nfs/nfssys.h>
  48 #include <nss_dbdefs.h>
  49 #include <nsswitch.h>
  50 #include <rpcsvc/nis_dhext.h>
  51
  52 #include <security/pam_appl.h>
  53 #include <security/pam_modules.h>
  54 #include <security/pam_impl.h>
  55
  56 #include <libintl.h>
  57
  58 #include <sys/mman.h>
  59
  60 #include <passwdutil.h>
  61
  62 #include "key_call_uid.h"
  63 #include <shadow.h>
  64
  65 extern  int     _nfssys(int, void *);
  66
  67 /*
  68  * int msg(pamh, ...)
  69  *
  70  * display message to the user
  71  */
  72 /*PRINTFLIKE2*/
  73 static int
  74 msg(pam_handle_t *pamh, char *fmt, ...)
  75 {
  76         va_list ap;
  77         char    messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
  78
  79         va_start(ap, fmt);
  80         (void) vsnprintf(messages[0], sizeof (messages[0]), fmt, ap);
  81         va_end(ap);
  82
  83         return (__pam_display_msg(pamh, PAM_ERROR_MSG, 1, messages, NULL));
  84 }
  85
  86
  87 /*
  88  * Get the secret key for the given netname, key length, and algorithm
  89  * type and send it to keyserv if the given pw decrypts it.  Update the
  90  * following counter args as necessary: get_seckey_cnt, good_pw_cnt, and
  91  * set_seckey_cnt.
  92  *
  93  * Returns 0 on malloc failure, else 1.
  94  */
  95 static int
  96 get_and_set_seckey(
  97         pam_handle_t    *pamh,                  /* in */
  98         const char      *netname,               /* in */
  99         keylen_t        keylen,                 /* in */
 100         algtype_t       algtype,                /* in */
 101         const char      *pw,                    /* in */
 102         uid_t           uid,                    /* in */
 103         gid_t           gid,                    /* in */
 104         int             *get_seckey_cnt,        /* out */
 105         int             *good_pw_cnt,           /* out */
 106         int             *set_seckey_cnt,        /* out */
 107         int             flags,                  /* in */
 108         int             debug)                  /* in */
 109 {
 110         char    *skey;
 111         int     skeylen;
 112         char    messages[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
 113
 114         skeylen = BITS2NIBBLES(keylen) + 1;
 115
 116         if ((skey = malloc(skeylen)) == NULL) {
 117                 return (0);
 118         }
 119
 120         if (getsecretkey_g(netname, keylen, algtype, skey, skeylen, pw)) {
 121                 (*get_seckey_cnt)++;
 122
 123                 if (skey[0]) {
 124                         /* password does decrypt secret key */
 125                         (*good_pw_cnt)++;
 126                         if (key_setnet_g_uid(netname, skey, keylen, NULL, 0,
 127                             algtype, uid, gid) >= 0) {
 128                                 (*set_seckey_cnt)++;
 129                         } else {
 130                                 if (debug)
 131                                         syslog(LOG_DEBUG, "pam_dhkeys: "
 132                                             "get_and_set_seckey: could not "
 133                                             "set secret key for keytype "
 134                                             "%d-%d", keylen, algtype);
 135                         }
 136                 } else {
 137                         if (pamh && !(flags & PAM_SILENT)) {
 138                                 (void) snprintf(messages[0],
 139                                     sizeof (messages[0]),
 140                                     dgettext(TEXT_DOMAIN,
 141                                     "Password does not "
 142                                     "decrypt secret key (type = %d-%d) "
 143                                     "for '%s'."), keylen, algtype, netname);
 144                                 (void) __pam_display_msg(pamh, PAM_ERROR_MSG, 1,
 145                                     messages, NULL);
 146                         }
 147                 }
 148         } else {
 149                 if (debug)
 150                         syslog(LOG_DEBUG, "pam_dhkeys: get_and_set_seckey: "
 151                             "could not get secret key for keytype %d-%d",
 152                             keylen, algtype);
 153         }
 154
 155         free(skey);
 156
 157         return (1);
 158 }
 159
 160 /*
 161  * int establish_key(pamh, flags, debug, netname)
 162  *
 163  * This routine establishes the Secure RPC Credentials for the
 164  * user specified in PAM_USER, using the password in PAM_AUTHTOK.
 165  *
 166  * Establishing RPC credentials is considered a "helper" function for the PAM
 167  * stack so we should only return failures or PAM_IGNORE. Returning PAM_SUCCESS
 168  * may short circuit the stack and circumvent later critical checks.
 169  *
 170  * we are called from pam_sm_setcred:
 171  *      1. if we are root (uid == 0), we do nothing and return
 172  *         PAM_IGNORE.
 173  *      2. else, we try to establish credentials.
 174  *
 175  * We return framework errors as appropriate such as PAM_USER_UNKNOWN,
 176  * PAM_BUF_ERR, PAM_PERM_DENIED.
 177  *
 178  * If we succeed in establishing credentials we return PAM_IGNORE.
 179  *
 180  * If we fail to establish credentials then we return:
 181  *    - PAM_SERVICE_ERR (credentials needed) or PAM_SYSTEM_ERR
 182  *      (credentials not needed) if netname could not be created;
 183  *    - PAM_AUTH_ERR (credentials needed) or PAM_IGNORE (credentials
 184  *      not needed) if no credentials were retrieved;
 185  *    - PAM_AUTH_ERR if the password didn't decrypt the cred;
 186  *    - PAM_SYSTEM_ERR if the cred's could not be stored.
 187  *
 188  * This routine returns the user's netname in "netname".
 189  *
 190  * All tools--but the PAM stack--currently use getpass() to obtain
 191  * the user's secure RPC password. We must make sure we don't use more than
 192  * the first des_block (eight) characters of whatever is handed down to us.
 193  * Therefore, we use a local variable "short_pass" to hold those 8 char's.
 194  */
 195 static int
 196 establish_key(pam_handle_t *pamh, int flags, int debug, char *netname)
 197 {
 198         char    *user;
 199         char    *passwd;
 200         char    short_pass[sizeof (des_block)+1], *short_passp;
 201         int     result;
 202         uid_t   uid;
 203         gid_t   gid;
 204         int     err;
 205
 206         struct passwd pw;       /* Needed to obtain uid */
 207         struct passwd *pwp;
 208         char    *scratch;
 209         int     scratchlen;
 210
 211         mechanism_t     **mechs;
 212         mechanism_t     **mpp;
 213         int     get_seckey_cnt = 0;
 214         int     set_seckey_cnt = 0;
 215         int     good_pw_cnt = 0;
 216         int     valid_mech_cnt = 0;
 217
 218         (void) pam_get_item(pamh, PAM_USER, (void **)&user);
 219
 220         if (user == NULL || *user == '\0') {
 221                 if (debug)
 222                         syslog(LOG_DEBUG, "pam_dhkeys: user NULL or empty");
 223                 return (PAM_USER_UNKNOWN);
 224         }
 225
 226         (void) pam_get_item(pamh, PAM_AUTHTOK, (void **)&passwd);
 227
 228         scratchlen = sysconf(_SC_GETPW_R_SIZE_MAX);
 229         if ((scratch = malloc(scratchlen)) == NULL)
 230                 return (PAM_BUF_ERR);
 231
 232         getpwnam_r(user, &pw, scratch, scratchlen, &pwp);
 233         if (!pwp) {
 234                 result = PAM_USER_UNKNOWN;
 235                 goto out;
 236         }
 237
 238         uid = pw.pw_uid;
 239         gid = pw.pw_gid;
 240
 241         /*
 242          * We don't set credentials when root logs in.
 243          */
 244         if (uid == 0) {
 245                 result = PAM_IGNORE;
 246                 goto out;
 247         }
 248
 249         err = user2netname(netname, uid, NULL);
 250
 251         if (err != 1) {
 252                 if (debug)
 253                         syslog(LOG_DEBUG, "pam_dhkeys: user2netname failed");
 254                 result = PAM_SYSTEM_ERR;
 255                 goto out;
 256         }
 257
 258         /* passwd can be NULL (no passwd or su as root) */
 259         if (passwd) {
 260                 (void) strlcpy(short_pass, passwd, sizeof (short_pass));
 261                 short_passp = short_pass;
 262         } else
 263                 short_passp = NULL;
 264
 265         if (mechs = __nis_get_mechanisms(FALSE)) {
 266
 267                 for (mpp = mechs; *mpp; mpp++) {
 268                         mechanism_t *mp = *mpp;
 269
 270                         if (AUTH_DES_COMPAT_CHK(mp))
 271                                 break;  /* fall through to AUTH_DES below */
 272
 273                         if (!VALID_MECH_ENTRY(mp))
 274                                 continue;
 275
 276                         if (debug)
 277                                 syslog(LOG_DEBUG, "pam_dhkeys: trying "
 278                                     "key type = %d-%d", mp->keylen,
 279                                     mp->algtype);
 280                         valid_mech_cnt++;
 281                         if (!get_and_set_seckey(pamh, netname, mp->keylen,
 282                             mp->algtype, short_passp, uid, gid,
 283                             &get_seckey_cnt, &good_pw_cnt, &set_seckey_cnt,
 284                             flags, debug)) {
 285                                 result = PAM_BUF_ERR;
 286                                 goto out;
 287                         }
 288                 }
 289                 __nis_release_mechanisms(mechs);
 290                 /* fall through to AUTH_DES below */
 291         } else {
 292                 /*
 293                  * No usable mechs found in security congifuration file thus
 294                  * fallback to AUTH_DES compat.
 295                  */
 296                 if (debug)
 297                         syslog(LOG_DEBUG, "pam_dhkeys: no valid mechs "
 298                             "found. Trying AUTH_DES.");
 299         }
 300
 301         /*
 302          * We always perform AUTH_DES for the benefit of services like NFS
 303          * that may depend on the classic des 192bit key being set.
 304          */
 305         if (!get_and_set_seckey(pamh, netname, AUTH_DES_KEYLEN,
 306             AUTH_DES_ALGTYPE, short_passp, uid, gid, &get_seckey_cnt,
 307             &good_pw_cnt, &set_seckey_cnt, flags, debug)) {
 308                 result = PAM_BUF_ERR;
 309                 goto out;
 310         }
 311
 312         if (debug) {
 313                 syslog(LOG_DEBUG, "pam_dhkeys: mech key totals:\n");
 314                 syslog(LOG_DEBUG, "pam_dhkeys: %d valid mechanism(s)",
 315                     valid_mech_cnt);
 316                 syslog(LOG_DEBUG, "pam_dhkeys: %d secret key(s) retrieved",
 317                     get_seckey_cnt);
 318                 syslog(LOG_DEBUG, "pam_dhkeys: %d passwd decrypt successes",
 319                     good_pw_cnt);
 320                 syslog(LOG_DEBUG, "pam_dhkeys: %d secret key(s) set",
 321                     set_seckey_cnt);
 322         }
 323
 324         if (get_seckey_cnt == 0) {              /* No credentials */
 325                 result = PAM_IGNORE;
 326                 goto out;
 327         }
 328
 329         if (good_pw_cnt == 0) {                 /* wrong password */
 330                 result = PAM_AUTH_ERR;
 331                 goto out;
 332         }
 333
 334         if (set_seckey_cnt == 0) {
 335                 result = PAM_SYSTEM_ERR;
 336                 goto out;
 337         }
 338         /* Credentials have been successfully established, return PAM_IGNORE */
 339         result = PAM_IGNORE;
 340 out:
 341         /*
 342          * If we are authenticating we attempt to establish credentials
 343          * where appropriate. Failure to do so is only an error if we
 344          * definitely needed them. Thus always return PAM_IGNORE
 345          * if we are authenticating and credentials were not needed.
 346          */
 347         free(scratch);
 348
 349         (void) memset(short_pass, '\0', sizeof (short_pass));
 350
 351         return (result);
 352 }
 353
 354 /*ARGSUSED*/
 355 int
 356 pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv)
 357 {
 358         return (PAM_IGNORE);
 359 }
 360
 361
 362 typedef struct argres {
 363         uid_t uid;
 364         int result;
 365 } argres_t;
 366
 367 /*
 368  * Revoke NFS DES credentials.
 369  * NFS may not be installed so we need to deal with SIGSYS
 370  * when we call _nfssys(); we thus call _nfssys() in a seperate thread that
 371  * is created specifically for this call. The thread specific signalmask
 372  * is set to ignore SIGSYS. After the call to _nfssys(), the thread
 373  * ceases to exist.
 374  */
 375 static void *
 376 revoke_nfs_cred(void *ap)
 377 {
 378         struct nfs_revauth_args nra;
 379         sigset_t isigset;
 380         argres_t *argres = (argres_t *)ap;
 381
 382         nra.authtype = AUTH_DES;
 383         nra.uid = argres->uid;
 384
 385         (void) sigemptyset(&isigset);
 386         (void) sigaddset(&isigset, SIGSYS);
 387
 388         if (pthread_sigmask(SIG_BLOCK, &isigset, NULL) == 0) {
 389                 argres->result = _nfssys(NFS_REVAUTH, &nra);
 390                 if (argres->result < 0 && errno == ENOSYS) {
 391                         argres->result = 0;
 392                 }
 393         } else {
 394                 argres->result = -1;
 395         }
 396         return (NULL);
 397 }
 398
 399 static int
 400 remove_key(pam_handle_t *pamh, int flags, int debug)
 401 {
 402         int result;
 403         char *uname;
 404         attrlist attr_pw[2];
 405         struct pam_repository *auth_rep = NULL;
 406         pwu_repository_t *pwu_rep;
 407         uid_t uid;
 408         gid_t gid;
 409         argres_t argres;
 410         pthread_t tid;
 411
 412         (void) pam_get_item(pamh, PAM_USER, (void **)&uname);
 413         if (uname == NULL || *uname == '\0') {
 414                 if (debug)
 415                         syslog(LOG_DEBUG,
 416                             "pam_dhkeys: user NULL or empty in remove_key()");
 417                 return (PAM_USER_UNKNOWN);
 418         }
 419
 420         if (strcmp(uname, "root") == 0) {
 421                 if ((flags & PAM_SILENT) == 0) {
 422                         char msg[3][PAM_MAX_MSG_SIZE];
 423                         (void) snprintf(msg[0], sizeof (msg[0]),
 424                             dgettext(TEXT_DOMAIN,
 425                             "removing root credentials would"
 426                             " break the rpc services that"));
 427                         (void) snprintf(msg[1], sizeof (msg[1]),
 428                             dgettext(TEXT_DOMAIN,
 429                             "use secure rpc on this host!"));
 430                         (void) snprintf(msg[2], sizeof (msg[2]),
 431                             dgettext(TEXT_DOMAIN,
 432                             "root may use keylogout -f to do"
 433                             " this (at your own risk)!"));
 434                         (void) __pam_display_msg(pamh, PAM_ERROR_MSG, 3,
 435                             msg, NULL);
 436                 }
 437                 return (PAM_PERM_DENIED);
 438         }
 439
 440         (void) pam_get_item(pamh, PAM_REPOSITORY, (void **)&auth_rep);
 441         if (auth_rep != NULL) {
 442                 if ((pwu_rep = calloc(1, sizeof (*pwu_rep))) == NULL)
 443                         return (PAM_BUF_ERR);
 444                 pwu_rep->type = auth_rep->type;
 445                 pwu_rep->scope = auth_rep->scope;
 446                 pwu_rep->scope_len = auth_rep->scope_len;
 447         } else
 448                 pwu_rep = PWU_DEFAULT_REP;
 449
 450         /* Retrieve user's uid/gid from the password repository */
 451         attr_pw[0].type = ATTR_UID; attr_pw[0].next = &attr_pw[1];
 452         attr_pw[1].type = ATTR_GID; attr_pw[1].next = NULL;
 453
 454         result = __get_authtoken_attr(uname, pwu_rep, attr_pw);
 455
 456         if (pwu_rep != PWU_DEFAULT_REP)
 457                 free(pwu_rep);
 458
 459         if (result == PWU_NOT_FOUND)
 460                 return (PAM_USER_UNKNOWN);
 461         if (result == PWU_DENIED)
 462                 return (PAM_PERM_DENIED);
 463         if (result != PWU_SUCCESS)
 464                 return (PAM_SYSTEM_ERR);
 465
 466         uid = (uid_t)attr_pw[0].data.val_i;
 467         gid = (gid_t)attr_pw[1].data.val_i;
 468
 469         (void) key_removesecret_g_uid(uid, gid);
 470
 471         argres.uid = uid;
 472         argres.result = -1;
 473
 474         if (pthread_create(&tid, NULL, revoke_nfs_cred, (void *)&argres) == 0)
 475                 (void) pthread_join(tid, NULL);
 476
 477         if (argres.result < 0) {
 478                 if ((flags & PAM_SILENT) == 0) {
 479                         (void) msg(pamh, dgettext(TEXT_DOMAIN,
 480                             "Warning: NFS credentials not destroyed"));
 481                 }
 482                 return (PAM_AUTH_ERR);
 483         }
 484
 485         return (PAM_IGNORE);
 486 }
 487
 488 int
 489 pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv)
 490 {
 491         int     i;
 492         int     debug = 0;
 493         int     result;
 494         char    netname[MAXNETNAMELEN + 1];
 495
 496         for (i = 0; i < argc; i++) {
 497                 if (strcmp(argv[i], "debug") == 0)
 498                         debug = 1;
 499                 else if (strcmp(argv[i], "nowarn") == 0)
 500                         flags |= PAM_SILENT;
 501         }
 502
 503         /* Check for invalid flags */
 504         if (flags && (flags & PAM_ESTABLISH_CRED) == 0 &&
 505             (flags & PAM_REINITIALIZE_CRED) == 0 &&
 506             (flags & PAM_REFRESH_CRED) == 0 &&
 507             (flags & PAM_DELETE_CRED) == 0 &&
 508             (flags & PAM_SILENT) == 0) {
 509                 syslog(LOG_ERR, "pam_dhkeys: pam_setcred: illegal flags %d",
 510                     flags);
 511                 return (PAM_SYSTEM_ERR);
 512         }
 513
 514
 515         if ((flags & PAM_REINITIALIZE_CRED) || (flags & PAM_REFRESH_CRED)) {
 516                 /* doesn't apply to UNIX */
 517                 if (debug)
 518                         syslog(LOG_DEBUG, "pam_dhkeys: cred reinit/refresh "
 519                             "ignored\n");
 520                 return (PAM_IGNORE);
 521         }
 522
 523         if (flags & PAM_DELETE_CRED) {
 524                 if (debug)
 525                         syslog(LOG_DEBUG, "pam_dhkeys: removing creds\n");
 526                 result = remove_key(pamh, flags, debug);
 527         } else {
 528                 result = establish_key(pamh, flags, debug, netname);
 529                 /* Some diagnostics */
 530                 if ((flags & PAM_SILENT) == 0) {
 531                         if (result == PAM_AUTH_ERR)
 532                                 (void) msg(pamh, dgettext(TEXT_DOMAIN,
 533                                     "Password does not decrypt any secret "
 534                                     "keys for %s."), netname);
 535                         else if (result == PAM_SYSTEM_ERR && netname[0])
 536                                 (void) msg(pamh, dgettext(TEXT_DOMAIN,
 537                                     "Could not set secret key(s) for %s. "
 538                                     "The key server may be down."), netname);
 539                 }
 540
 541                 /* Not having credentials set is not an error... */
 542                 result = PAM_IGNORE;
 543         }
 544
 545         return (result);
 546 }
 547
 548 /*ARGSUSED*/
 549 void
 550 rpc_cleanup(pam_handle_t *pamh, void *data, int pam_status)
 551 {
 552         if (data) {
 553                 (void) memset(data, 0, strlen(data));
 554                 free(data);
 555         }
 556 }
 557
 558 /*ARGSUSED*/
 559 int
 560 pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv)
 561 {
 562         return (PAM_IGNORE);
 563 }