rooty/yubico-pam
1
0
Fork 0
mirror of https://github.com/Yubico/yubico-pam.git synced 2025-01-20 19:52:16 +01:00
Code Issues Projects Releases Wiki Activity
yubico-pam/pam_yubico.c
Mickaël Thomas fc3b1e0076 Compare OTP IDs against yubi_attr only 
Currently we trust the LDAP server to only return the `yubi_attr`
attribute, yet we loop over all possible attributes when there should
only be one.

Since the bundled test LDAP server ignores the requested attributes list,
we must make sure to only match against the `yubi_attr` attibute as
opposed to "all of them".

This also fixes an issue where AUTH_NOT_FOUND was returned instead
of AUTH_NO_TOKENS when there were no values returned for `yubi_attr`
but another attribute's value was considered as a candidate token.
2017-02-27 00:21:15 +01:00

1277 lines
35 KiB
C
Raw Blame History

/* Written by Simon Josefsson <simon@yubico.com>.
* Copyright (c) 2006-2016 Yubico AB
* Copyright (c) 2011 Tollef Fog Heen <tfheen@err.no>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are
* met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* * Redistributions in binary form must reproduce the above
* copyright notice, this list of conditions and the following
* disclaimer in the documentation and/or other materials provided
* with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <ctype.h>
#include <syslog.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include "util.h"
#include "drop_privs.h"
#include <ykclient.h>
#if HAVE_CR
/* for yubikey_hex_encode */
#include <yubikey.h>
/* for yubikey pbkdf2*/
#include <ykpbkdf2.h>
#endif /* HAVE_CR */
/* Libtool defines PIC for shared objects */
#ifndef PIC
#define PAM_STATIC
#endif
/* These #defines must be present according to PAM documentation. */
#define PAM_SM_AUTH
#ifdef HAVE_SECURITY_PAM_APPL_H
#include <security/pam_appl.h>
#endif
#ifdef HAVE_SECURITY_PAM_MODULES_H
#include <security/pam_modules.h>
#endif
#ifdef HAVE_LIBLDAP
/* Some functions like ldap_init, ldap_simple_bind_s, ldap_unbind are
deprecated but still available. We will drop support for 'ldapserver'
(in favour of 'ldap_uri' and update to using the new functions instead
soon.
*/
#define LDAP_DEPRECATED 1
#include <ldap.h>
#define PORT_NUMBER LDAP_PORT
#endif
#ifndef PAM_EXTERN
#ifdef PAM_STATIC
#define PAM_EXTERN static
#else
#define PAM_EXTERN extern
#endif
#endif
#define TOKEN_OTP_LEN 32u
#define MAX_TOKEN_ID_LEN 16u
#define DEFAULT_TOKEN_ID_LEN 12u
#define TMPFILE_SUFFIX ".XXXXXX"
enum key_mode {
CHRESP,
CLIENT
};
struct cfg
{
unsigned int client_id;
const char *client_key;
int debug;
int alwaysok;
int verbose_otp;
int try_first_pass;
int use_first_pass;
int nullok;
const char *auth_file;
const char *capath;
const char *cainfo;
const char *proxy;
const char *url;
const char *urllist;
const char *ldapserver;
const char *ldap_uri;
const char *ldap_bind_user;
const char *ldap_bind_password;
const char *ldap_filter;
const char *ldap_cacertfile;
const char *ldapdn;
const char *user_attr;
const char *yubi_attr;
const char *yubi_attr_prefix;
unsigned int token_id_length;
enum key_mode mode;
const char *chalresp_path;
FILE *debug_file;
};
#ifdef DBG
#undef DBG
#endif
#define DBG(x...) if (cfg->debug) { D(cfg->debug_file, x); }
/*
* Authorize authenticated OTP_ID for login as USERNAME using AUTHFILE.
*
* Returns one of AUTH_FOUND, AUTH_NOT_FOUND, AUTH_NO_TOKENS, AUTH_ERROR.
*/
static int
authorize_user_token (struct cfg *cfg,
const char *username,
const char *otp_id,
pam_handle_t *pamh)
{
int retval = AUTH_ERROR;
if (cfg->auth_file)
{
/* Administrator had configured the file and specified is name
as an argument for this module.
*/
DBG ("Using system-wide auth_file %s", cfg->auth_file);
retval = check_user_token (cfg->auth_file, username, otp_id, cfg->debug, cfg->debug_file);
}
else
{
char *userfile = NULL;
struct passwd pass, *p;
char buf[1024];
size_t buflen = sizeof(buf);
int pwres;
PAM_MODUTIL_DEF_PRIVS(privs);
pwres = getpwnam_r (username, &pass, buf, buflen, &p);
if (p == NULL) {
DBG ("getpwnam_r: %s", strerror(pwres));
return AUTH_ERROR;
}
/* Getting file from user home directory
..... i.e. ~/.yubico/authorized_yubikeys
*/
if (! get_user_cfgfile_path (NULL, "authorized_yubikeys", p, &userfile)) {
DBG ("Failed figuring out per-user cfgfile");
return AUTH_ERROR;
}
DBG ("Dropping privileges");
if(pam_modutil_drop_priv(pamh, &privs, p)) {
DBG ("could not drop privileges");
goto free_out;
}
retval = check_user_token (userfile, username, otp_id, cfg->debug, cfg->debug_file);
if(pam_modutil_regain_priv(pamh, &privs)) {
DBG ("could not restore privileges");
goto free_out;
}
free_out:
free (userfile);
}
return retval;
}
/*
* This function will look in ldap id the token correspond to the
* requested user.
*
* ldaps is only supported for ldap_uri based connections.
* ldap_cacertfile usually needs to be set for this to work.
*
* ldap serve can be on a remote host.
*
* You need the following parameters in you pam config:
* ldapserver= OR ldap_uri=
* ldapdn=
* user_attr=
* yubi_attr=
*
* If using ldap_uri, you can specify multiple failover hosts
* eg.
* ldap_uri=ldaps://host1.fqdn.example.com,ldaps://host2.fqdn.example.com
*
* Returns one of AUTH_FOUND, AUTH_NOT_FOUND, AUTH_NO_TOKENS, AUTH_ERROR.
*/
static int
authorize_user_token_ldap (struct cfg *cfg,
const char *user,
const char *token_id)
{
int retval = AUTH_ERROR;
#ifdef HAVE_LIBLDAP
/* LDAPv2 is historical -- RFC3494. */
int protocol = LDAP_VERSION3;
size_t yubi_attr_prefix_len = 0;
LDAP *ld = NULL;
LDAPMessage *result = NULL, *e;
BerElement *ber;
char *attr_name;
char *attrs[2] = {NULL, NULL};
struct berval **vals;
int rc;
size_t i;
char *filter = NULL;
char *find = NULL;
int scope = LDAP_SCOPE_BASE;
#endif
DBG(("called"));
#ifdef HAVE_LIBLDAP
if (cfg->yubi_attr == NULL) {
DBG (("Trying to look up user to YubiKey mapping in LDAP, but yubi_attr not set!"));
return 0;
}
if (cfg->user_attr && cfg->ldapdn == NULL) {
DBG (("Trying to look up user to YubiKey mapping in LDAP, user_attr set but ldapdn not set!"));
return 0;
}
/* Get a handle to an LDAP connection. */
if (cfg->ldap_uri)
{
rc = ldap_initialize (&ld, cfg->ldap_uri);
if (rc != LDAP_SUCCESS)
{
DBG ("ldap_initialize: %s", ldap_err2string (rc));
goto done;
}
}
else
{
if ((ld = ldap_init (cfg->ldapserver, PORT_NUMBER)) == NULL)
{
DBG ("ldap_init");
goto done;
}
}
ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &protocol);
if (cfg->ldap_uri && cfg->ldap_cacertfile) {
/* Set CA CERTFILE. This makes ldaps work when using ldap_uri */
ldap_set_option (0, LDAP_OPT_X_TLS_CACERTFILE, cfg->ldap_cacertfile);
}
/* Bind anonymously to the LDAP server. */
if (cfg->ldap_bind_user && cfg->ldap_bind_password) {
DBG ("try bind with: %s:[%s]", cfg->ldap_bind_user, cfg->ldap_bind_password);
rc = ldap_simple_bind_s (ld, cfg->ldap_bind_user, cfg->ldap_bind_password);
} else {
DBG ("try bind anonymous");
rc = ldap_simple_bind_s (ld, NULL, NULL);
}
if (rc != LDAP_SUCCESS)
{
DBG ("ldap_simple_bind_s: %s", ldap_err2string (rc));
goto done;
}
/* Allocation of memory for search strings depending on input size */
if (cfg->user_attr && cfg->yubi_attr && cfg->ldapdn) {
i = (strlen(cfg->user_attr) + strlen(cfg->ldapdn) + strlen(user) + 3) * sizeof(char);
if ((find = malloc(i)) == NULL) {
DBG ("Failed allocating %zu bytes", i);
goto done;
}
sprintf (find, "%s=%s,%s", cfg->user_attr, user, cfg->ldapdn);
filter = NULL;
} else if (cfg->ldapdn) {
find = strdup(cfg->ldapdn); /* allow free later */
}
if (cfg->ldap_filter) {
filter = filter_printf(cfg->ldap_filter, user);
scope = LDAP_SCOPE_SUBTREE;
}
attrs[0] = (char *) cfg->yubi_attr;
DBG("LDAP : look up object base='%s' filter='%s', ask for attribute '%s'", find,
filter ? filter:"(null)", cfg->yubi_attr);
/* Search for the entry. */
if ((rc = ldap_search_ext_s (ld, find, scope,
filter, attrs, 0, NULL, NULL, LDAP_NO_LIMIT,
LDAP_NO_LIMIT, &result)) != LDAP_SUCCESS)
{
DBG ("ldap_search_ext_s: %s", ldap_err2string (rc));
goto done;
}
/* Start looing for tokens */
retval = AUTH_NO_TOKENS;
e = ldap_first_entry (ld, result);
if (e == NULL)
{
DBG (("No result from LDAP search"));
}
else
{
/* Iterate through each returned attribute. */
for (attr_name = ldap_first_attribute (ld, e, &ber);
attr_name != NULL; attr_name = ldap_next_attribute (ld, e, ber))
{
if (strcmp(attr_name, cfg->yubi_attr) != 0) {
DBG("Ignored non-requested attribute: %s", attr_name);
continue;
}
if ((vals = ldap_get_values_len (ld, e, attr_name)) != NULL)
{
yubi_attr_prefix_len = cfg->yubi_attr_prefix ? strlen(cfg->yubi_attr_prefix) : 0;
DBG("LDAP : Found %i values for %s - checking if any of them match '%s:%s'",
ldap_count_values_len(vals),
attr_name,
cfg->yubi_attr_prefix ? cfg->yubi_attr_prefix : "",
token_id ? token_id : "(null)");
/* Compare each value for the attribute against the token id. */
for (i = 0; vals[i] != NULL; i++)
{
DBG("LDAP : Checking value %i: %s:%s",
i + 1,
cfg->yubi_attr_prefix ? cfg->yubi_attr_prefix : "",
vals[i]->bv_val);
/* Only values containing this prefix are considered. */
if ((!cfg->yubi_attr_prefix || !strncmp (cfg->yubi_attr_prefix, vals[i]->bv_val, yubi_attr_prefix_len)))
{
/* We have found at least one possible token ID so change the default return value to AUTH_NOT_FOUND */
if (retval == AUTH_NO_TOKENS)
{
retval = AUTH_NOT_FOUND;
}
if(token_id && !strncmp (token_id, vals[i]->bv_val + yubi_attr_prefix_len, strlen (vals[i]->bv_val + yubi_attr_prefix_len)))
{
DBG ("Token Found :: %s", vals[i]->bv_val);
retval = AUTH_FOUND;
}
}
}
ldap_value_free_len (vals);
}
ldap_memfree (attr_name);
}
if (ber != NULL)
ber_free (ber, 0);
}
done:
if (result != NULL)
ldap_msgfree (result);
if (ld != NULL)
ldap_unbind (ld);
/* free memory allocated for search strings */
if (find != NULL)
free(find);
if (filter != NULL)
free(filter);
#else
DBG (("Trying to use LDAP, but this function is not compiled in pam_yubico!!"));
DBG (("Install libldap-dev and then recompile pam_yubico."));
#endif
return retval;
}
#if HAVE_CR
static int
display_error(pam_handle_t *pamh, const char *message, struct cfg *cfg) {
struct pam_conv *conv;
const struct pam_message *pmsg[1];
struct pam_message msg[1];
struct pam_response *resp = NULL;
int retval;
retval = pam_get_item (pamh, PAM_CONV, (const void **) &conv);
if (retval != PAM_SUCCESS) {
DBG("get conv returned error: %s", pam_strerror (pamh, retval));
return retval;
}
if(!conv || !conv->conv){
DBG("conv() function invalid");
return PAM_CONV_ERR;
}
pmsg[0] = &msg[0];
msg[0].msg = (char *) message; /* on some systems, pam_message.msg isn't const */
msg[0].msg_style = PAM_ERROR_MSG;
retval = conv->conv(1, pmsg, &resp, conv->appdata_ptr);
if (retval != PAM_SUCCESS) {
DBG("conv returned error: %s", pam_strerror (pamh, retval));
return retval;
}
if (resp)
{
DBG("conv returned: '%s'", resp->resp);
if (resp->resp)
free (resp->resp);
free (resp);
}
return retval;
}
#endif /* HAVE_CR */
#if HAVE_CR
static int
do_challenge_response(pam_handle_t *pamh, struct cfg *cfg, const char *username)
{
char *userfile = NULL, *tmpfile = NULL;
FILE *f = NULL;
char buf[CR_RESPONSE_SIZE + 16], response_hex[CR_RESPONSE_SIZE * 2 + 1];
int ret, fd;
unsigned int response_len = 0;
YK_KEY *yk = NULL;
CR_STATE state;
const char *errstr = NULL;
struct passwd pass, *p;
char pwbuf[1024];
size_t pwbuflen = sizeof(pwbuf);
int pwres;
struct stat st;
/* we must declare two sepparate privs structures as they can't be reused */
PAM_MODUTIL_DEF_PRIVS(privs);
PAM_MODUTIL_DEF_PRIVS(privs2);
ret = PAM_AUTH_ERR;
if (! init_yubikey(&yk)) {
DBG("Failed initializing YubiKey");
goto out;
}
if (! check_firmware_version(yk, cfg->debug, true, cfg->debug_file)) {
DBG("YubiKey does not support Challenge-Response (version 2.2 required)");
goto out;
}
pwres = getpwnam_r (username, &pass, pwbuf, pwbuflen, &p);
if (p == NULL) {
DBG ("getpwnam_r: %s", strerror(pwres));
goto out;
}
if (! get_user_challenge_file (yk, cfg->chalresp_path, p, &userfile, cfg->debug_file)) {
DBG("Failed getting user challenge file for user %s", username);
goto out;
}
DBG("Loading challenge from file %s", userfile);
/* Drop privileges before opening user file (if we're not using system-wide dir). */
if (!cfg->chalresp_path) {
if (pam_modutil_drop_priv(pamh, &privs, p)) {
DBG ("could not drop privileges");
goto out;
}
}
fd = open(userfile, O_RDONLY, 0);
if (fd < 0) {
DBG ("Cannot open file: %s (%s)", userfile, strerror(errno));
goto restpriv_out;
}
if (fstat(fd, &st) < 0) {
DBG ("Cannot stat file: %s (%s)", userfile, strerror(errno));
close(fd);
goto restpriv_out;
}
if (!S_ISREG(st.st_mode)) {
DBG ("%s is not a regular file", userfile);
close(fd);
goto restpriv_out;
}
f = fdopen(fd, "r");
if (f == NULL) {
DBG ("fdopen: %s", strerror(errno));
close(fd);
goto restpriv_out;
}
if (! load_chalresp_state(f, &state, cfg->debug, cfg->debug_file))
goto restpriv_out;
if (fclose(f) < 0) {
f = NULL;
goto restpriv_out;
}
f = NULL;
if (!cfg->chalresp_path) {
if (pam_modutil_regain_priv(pamh, &privs)) {
DBG ("could not restore privileges");
goto out;
}
}
if (! challenge_response(yk, state.slot, state.challenge, state.challenge_len,
true, true, false,
buf, sizeof(buf), &response_len)) {
DBG("Challenge-response FAILED");
goto out;
}
/*
* Check YubiKey response against the expected response
*/
yubikey_hex_encode(response_hex, buf, response_len);
if(state.salt_len > 0) { /* the expected response has gone through pbkdf2 */
YK_PRF_METHOD prf_method = {20, yk_hmac_sha1};
yk_pbkdf2(response_hex, (unsigned char*)state.salt, state.salt_len, state.iterations,
(unsigned char*)buf, response_len, &prf_method);
}
if (memcmp(buf, state.response, state.response_len) == 0) {
ret = PAM_SUCCESS;
} else {
DBG("Unexpected C/R response : %s", response_hex);
goto out;
}
DBG("Got the expected response, generating new challenge (%u bytes).", CR_CHALLENGE_SIZE);
errstr = "Error generating new challenge, please check syslog or contact your system administrator";
if (generate_random(state.challenge, sizeof(state.challenge))) {
DBG("Failed generating new challenge!");
goto out;
}
errstr = "Error communicating with Yubikey, please check syslog or contact your system administrator";
if (! challenge_response(yk, state.slot, state.challenge, CR_CHALLENGE_SIZE,
true, true, false,
buf, sizeof(buf), &response_len)) {
DBG("Second challenge-response FAILED");
goto out;
}
/* There is a bug that makes the YubiKey 2.2 send the same response for all challenges
unless HMAC_LT64 is set, check for that here */
if (memcmp(buf, state.response, state.response_len) == 0) {
errstr = "Same response for second challenge, YubiKey should be reconfigured with the option HMAC_LT64";
goto out;
}
/* the yk_* functions leave 'junk' in errno */
errno = 0;
/*
* Write the challenge and response we will expect the next time to the state file.
*/
if (response_len > sizeof(state.response)) {
DBG("Got too long response ??? (%u/%zu)", response_len, sizeof(state.response));
goto out;
}
memcpy (state.response, buf, response_len);
state.response_len = response_len;
/* point to the fresh privs structure.. */
privs = privs2;
/* Drop privileges before creating new challenge file. */
if (!cfg->chalresp_path) {
if (pam_modutil_drop_priv(pamh, &privs, p)) {
DBG ("could not drop privileges");
goto out;
}
}
/* Write out the new file */
tmpfile = malloc(strlen(userfile) + 1 + strlen(TMPFILE_SUFFIX));
if (! tmpfile)
goto restpriv_out;
strcpy(tmpfile, userfile);
strcat(tmpfile, TMPFILE_SUFFIX);
fd = mkstemp(tmpfile);
if (fd < 0) {
DBG ("Cannot open file: %s (%s)", tmpfile, strerror(errno));
goto restpriv_out;
}
if (fchmod (fd, st.st_mode) != 0) {
DBG ("could not set correct file permissions");
goto restpriv_out;
}
if (fchown (fd, st.st_uid, st.st_gid) != 0) {
DBG ("could not set correct file ownership");
goto restpriv_out;
}
f = fdopen(fd, "w");
if (! f) {
close(fd);
goto restpriv_out;
}
errstr = "Error updating Yubikey challenge, please check syslog or contact your system administrator";
if (! write_chalresp_state (f, &state))
goto out;
if (fclose(f) < 0) {
f = NULL;
goto restpriv_out;
}
f = NULL;
if (rename(tmpfile, userfile) < 0) {
goto restpriv_out;
}
DBG(("Challenge-response success!"));
errstr = NULL;
errno = 0;
yk_errno = 0;
restpriv_out:
if (!cfg->chalresp_path) {
if (pam_modutil_regain_priv(pamh, &privs)) {
DBG (("could not restore privileges"));
}
}
out:
if (yk_errno) {
if (yk_errno == YK_EUSBERR) {
syslog(LOG_ERR, "USB error: %s", yk_usb_strerror());
DBG("USB error: %s", yk_usb_strerror());
} else {
syslog(LOG_ERR, "Yubikey core error: %s", yk_strerror(yk_errno));
DBG("Yubikey core error: %s", yk_strerror(yk_errno));
}
}
if (errstr)
display_error(pamh, errstr, cfg);
if (errno) {
syslog(LOG_ERR, "Challenge response failed: %s", strerror(errno));
DBG("Challenge response failed: %s", strerror(errno));
}
if (yk)
yk_close_key(yk);
yk_release();
if (f)
fclose(f);
free(userfile);
free(tmpfile);
return ret;
}
#endif /* HAVE_CR */
static void
parse_cfg (int flags, int argc, const char **argv, struct cfg *cfg)
{
int i;
memset (cfg, 0, sizeof(struct cfg));
cfg->client_id = 0;
cfg->token_id_length = DEFAULT_TOKEN_ID_LEN;
cfg->mode = CLIENT;
cfg->debug_file = stdout;
for (i = 0; i < argc; i++)
{
if (strncmp (argv[i], "id=", 3) == 0)
sscanf (argv[i], "id=%d", &cfg->client_id);
if (strncmp (argv[i], "key=", 4) == 0)
cfg->client_key = argv[i] + 4;
if (strcmp (argv[i], "debug") == 0)
cfg->debug = 1;
if (strcmp (argv[i], "alwaysok") == 0)
cfg->alwaysok = 1;
if (strcmp (argv[i], "verbose_otp") == 0)
cfg->verbose_otp = 1;
if (strcmp (argv[i], "try_first_pass") == 0)
cfg->try_first_pass = 1;
if (strcmp (argv[i], "use_first_pass") == 0)
cfg->use_first_pass = 1;
if (strcmp (argv[i], "nullok") == 0)
cfg->nullok = 1;
if (strncmp (argv[i], "authfile=", 9) == 0)
cfg->auth_file = argv[i] + 9;
if (strncmp (argv[i], "capath=", 7) == 0)
cfg->capath = argv[i] + 7;
if (strncmp (argv[i], "cainfo=", 7) == 0)
cfg->cainfo = argv[i] + 7;
if (strncmp (argv[i], "proxy=", 6) == 0)
cfg->proxy = argv[i] + 6;
if (strncmp (argv[i], "url=", 4) == 0)
cfg->url = argv[i] + 4;
if (strncmp (argv[i], "urllist=", 8) == 0)
cfg->urllist = argv[i] + 8;
if (strncmp (argv[i], "ldapserver=", 11) == 0)
cfg->ldapserver = argv[i] + 11;
if (strncmp (argv[i], "ldap_uri=", 9) == 0)
cfg->ldap_uri = argv[i] + 9;
if (strncmp (argv[i], "ldap_bind_user=", 15) == 0)
cfg->ldap_bind_user = argv[i] + 15;
if (strncmp (argv[i], "ldap_bind_password=", 19) == 0)
cfg->ldap_bind_password = argv[i] + 19;
if (strncmp (argv[i], "ldap_filter=", 12) == 0)
cfg->ldap_filter = argv[i] + 12;
if (strncmp (argv[i], "ldap_cacertfile=", 16) == 0)
cfg->ldap_cacertfile = argv[i] + 16;
if (strncmp (argv[i], "ldapdn=", 7) == 0)
cfg->ldapdn = argv[i] + 7;
if (strncmp (argv[i], "user_attr=", 10) == 0)
cfg->user_attr = argv[i] + 10;
if (strncmp (argv[i], "yubi_attr=", 10) == 0)
cfg->yubi_attr = argv[i] + 10;
if (strncmp (argv[i], "yubi_attr_prefix=", 17) == 0)
cfg->yubi_attr_prefix = argv[i] + 17;
if (strncmp (argv[i], "token_id_length=", 16) == 0)
sscanf (argv[i], "token_id_length=%u", &cfg->token_id_length);
if (strcmp (argv[i], "mode=challenge-response") == 0)
cfg->mode = CHRESP;
if (strcmp (argv[i], "mode=client") == 0)
cfg->mode = CLIENT;
if (strncmp (argv[i], "chalresp_path=", 14) == 0)
cfg->chalresp_path = argv[i] + 14;
if (strncmp (argv[i], "debug_file=", 11) == 0)
{
const char *filename = argv[i] + 11;
if(strncmp (filename, "stdout", 6) == 0)
{
cfg->debug_file = stdout;
}
else if(strncmp (filename, "stderr", 6) == 0)
{
cfg->debug_file = stderr;
}
else
{
struct stat st;
FILE *file;
if(lstat(filename, &st) == 0)
{
if(S_ISREG(st.st_mode))
{
file = fopen(filename, "a");
if(file)
{
cfg->debug_file = file;
}
}
}
}
}
}
DBG ("called.");
DBG ("flags %d argc %d", flags, argc);
for (i = 0; i < argc; i++)
DBG ("argv[%d]=%s", i, argv[i]);
DBG ("id=%u", cfg->client_id);
DBG ("key=%s", cfg->client_key ? cfg->client_key : "(null)");
DBG ("debug=%d", cfg->debug);
DBG ("debug_file=%d", fileno(cfg->debug_file));
DBG ("alwaysok=%d", cfg->alwaysok);
DBG ("verbose_otp=%d", cfg->verbose_otp);
DBG ("try_first_pass=%d", cfg->try_first_pass);
DBG ("use_first_pass=%d", cfg->use_first_pass);
DBG ("authfile=%s", cfg->auth_file ? cfg->auth_file : "(null)");
DBG ("ldapserver=%s", cfg->ldapserver ? cfg->ldapserver : "(null)");
DBG ("ldap_uri=%s", cfg->ldap_uri ? cfg->ldap_uri : "(null)");
DBG ("ldap_bind_user=%s", cfg->ldap_bind_user ? cfg->ldap_bind_user : "(null)");
DBG ("ldap_bind_password=%s", cfg->ldap_bind_password ? cfg->ldap_bind_password : "(null)");
DBG ("ldap_filter=%s", cfg->ldap_filter ? cfg->ldap_filter : "(null)");
DBG ("ldap_cacertfile=%s", cfg->ldap_cacertfile ? cfg->ldap_cacertfile : "(null)");
DBG ("ldapdn=%s", cfg->ldapdn ? cfg->ldapdn : "(null)");
DBG ("user_attr=%s", cfg->user_attr ? cfg->user_attr : "(null)");
DBG ("yubi_attr=%s", cfg->yubi_attr ? cfg->yubi_attr : "(null)");
DBG ("yubi_attr_prefix=%s", cfg->yubi_attr_prefix ? cfg->yubi_attr_prefix : "(null)");
DBG ("url=%s", cfg->url ? cfg->url : "(null)");
DBG ("urllist=%s", cfg->urllist ? cfg->urllist : "(null)");
DBG ("capath=%s", cfg->capath ? cfg->capath : "(null)");
DBG ("cainfo=%s", cfg->cainfo ? cfg->cainfo : "(null)");
DBG ("proxy=%s", cfg->proxy ? cfg->proxy : "(null)");
DBG ("token_id_length=%d", cfg->token_id_length);
DBG ("mode=%s", cfg->mode == CLIENT ? "client" : "chresp" );
DBG ("chalresp_path=%s", cfg->chalresp_path ? cfg->chalresp_path : "(null)");
}
PAM_EXTERN int
pam_sm_authenticate (pam_handle_t * pamh,
int flags, int argc, const char **argv)
{
int retval, rc;
const char *user = NULL;
const char *password = NULL;
char otp[MAX_TOKEN_ID_LEN + TOKEN_OTP_LEN + 1] = { 0 };
char otp_id[MAX_TOKEN_ID_LEN + 1] = { 0 };
size_t password_len = 0;
int skip_bytes = 0;
int valid_token = 0;
struct pam_conv *conv;
const struct pam_message *pmsg[1];
struct pam_message msg[1] = {{0}};
struct pam_response *resp = NULL;
int nargs = 1;
ykclient_t *ykc = NULL;
struct cfg cfg_st;
struct cfg *cfg = &cfg_st; /* for DBG macro */
size_t templates = 0;
char *urls[10];
char *tmpurl = NULL;
char *onlypasswd = NULL;
parse_cfg (flags, argc, argv, cfg);
DBG ("pam_yubico version: %s", VERSION);
if (cfg->token_id_length > MAX_TOKEN_ID_LEN)
{
DBG ("configuration error: token_id_length too long. Maximum acceptable value : %u", MAX_TOKEN_ID_LEN);
retval = PAM_AUTHINFO_UNAVAIL;
goto done;
}
retval = pam_get_user (pamh, &user, NULL);
if (retval != PAM_SUCCESS)
{
DBG ("get user returned error: %s", pam_strerror (pamh, retval));
goto done;
}
DBG ("get user returned: %s", user);
if (cfg->mode == CHRESP) {
#if HAVE_CR
retval = do_challenge_response(pamh, cfg, user);
#else
DBG ("no support for challenge/response");
retval = PAM_AUTH_ERR;
#endif
goto done;
}
if (cfg->try_first_pass || cfg->use_first_pass)
{
retval = pam_get_item (pamh, PAM_AUTHTOK, (const void **) &password);
if (retval != PAM_SUCCESS)
{
DBG ("get password returned error: %s",
pam_strerror (pamh, retval));
goto done;
}
DBG ("get password returned: %s", password);
}
if (cfg->use_first_pass && password == NULL)
{
DBG ("use_first_pass set and no password, giving up");
retval = PAM_AUTH_ERR;
goto done;
}
if(ykclient_global_init() != YKCLIENT_OK)
{
DBG ("Failed initializing ykclient library");
retval = PAM_AUTHINFO_UNAVAIL;
goto done;
}
rc = ykclient_init (&ykc);
if (rc != YKCLIENT_OK)
{
DBG ("ykclient_init() failed (%d): %s", rc, ykclient_strerror (rc));
retval = PAM_AUTHINFO_UNAVAIL;
goto done;
}
rc = ykclient_set_client_b64 (ykc, cfg->client_id, cfg->client_key);
if (rc != YKCLIENT_OK)
{
DBG ("ykclient_set_client_b64() failed (%d): %s",
rc, ykclient_strerror (rc));
retval = PAM_AUTHINFO_UNAVAIL;
goto done;
}
if (cfg->client_key)
ykclient_set_verify_signature (ykc, 1);
if (cfg->capath)
ykclient_set_ca_path (ykc, cfg->capath);
if (cfg->cainfo)
ykclient_set_ca_info (ykc, cfg->cainfo);
if (cfg->proxy)
ykclient_set_proxy (ykc, cfg->proxy);
if (cfg->url)
{
rc = ykclient_set_url_template (ykc, cfg->url);
if (rc != YKCLIENT_OK)
{
DBG ("ykclient_set_url_template() failed (%d): %s",
rc, ykclient_strerror (rc));
retval = PAM_AUTHINFO_UNAVAIL;
goto done;
}
}
if (cfg->urllist)
{
char *saveptr = NULL;
char *part = NULL;
tmpurl = strdup(cfg->urllist);
while ((part = strtok_r(templates == 0 ? tmpurl : NULL, ";", &saveptr)))
{
if(templates == 10)
{
DBG ("maximum 10 urls supported in list.");
retval = PAM_AUTHINFO_UNAVAIL;
goto done;
}
urls[templates] = strdup(part);
templates++;
}
rc = ykclient_set_url_bases (ykc, templates, (const char **)urls);
if (rc != YKCLIENT_OK)
{
DBG ("ykclient_set_url_bases() failed (%d): %s",
rc, ykclient_strerror (rc));
retval = PAM_AUTHINFO_UNAVAIL;
goto done;
}
}
/* check if the user has at least one associated token id */
/* we set otp_id to NULL so that no matches will ever be found
* but AUTH_NO_TOKENS will be returned if there are no tokens for the user */
if (cfg->ldapserver != NULL || cfg->ldap_uri != NULL)
valid_token = authorize_user_token_ldap (cfg, user, NULL);
else
valid_token = authorize_user_token (cfg, user, NULL, pamh);
switch(valid_token)
{
case AUTH_ERROR:
DBG ("Internal error while looking for user tokens");
retval = PAM_AUTHINFO_UNAVAIL;
goto done;
case AUTH_NOT_FOUND:
/* User has associated tokens, so continue */
DBG ("Tokens found for user");
break;
case AUTH_NO_TOKENS:
DBG ("No tokens found for user");
if (cfg->nullok) {
retval = PAM_IGNORE;
} else {
retval = PAM_USER_UNKNOWN;
}
goto done;
default:
DBG ("Unhandled value while looking for user tokens");
retval = PAM_AUTHINFO_UNAVAIL;
goto done;
}
if (password == NULL)
{
retval = pam_get_item (pamh, PAM_CONV, (const void **) &conv);
if (retval != PAM_SUCCESS)
{
DBG ("get conv returned error: %s", pam_strerror (pamh, retval));
goto done;
}
pmsg[0] = &msg[0];
{
#define QUERY_TEMPLATE "YubiKey for `%s': "
size_t len = strlen (QUERY_TEMPLATE) + strlen (user);
int wrote;
msg[0].msg = malloc (len);
if (!msg[0].msg)
{
retval = PAM_BUF_ERR;
goto done;
}
wrote = snprintf ((char *) msg[0].msg, len, QUERY_TEMPLATE, user);
if (wrote < 0 || wrote >= len)
{
retval = PAM_BUF_ERR;
goto done;
}
}
msg[0].msg_style = cfg->verbose_otp ? PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF;
retval = conv->conv (nargs, pmsg, &resp, conv->appdata_ptr);
if (retval != PAM_SUCCESS)
{
DBG ("conv returned error: %s", pam_strerror (pamh, retval));
goto done;
}
if (resp->resp == NULL)
{
DBG ("conv returned NULL passwd?");
retval = PAM_AUTH_ERR;
goto done;
}
DBG ("conv returned %zu bytes", strlen(resp->resp));
password = resp->resp;
}
password_len = strlen (password);
/* In case the input was systempassword+YubiKeyOTP, we want to skip over
"systempassword" when copying the token_id and OTP to separate buffers */
if(password_len > cfg->token_id_length + TOKEN_OTP_LEN)
{
skip_bytes = password_len - (cfg->token_id_length + TOKEN_OTP_LEN);
}
DBG ("Skipping first %i bytes. Length is %zu, token_id set to %u and token OTP always %u.",
skip_bytes, password_len, cfg->token_id_length, TOKEN_OTP_LEN);
/* Copy full YubiKey output (public ID + OTP) into otp */
strncpy (otp, password + skip_bytes, sizeof (otp) - 1);
/* Copy only public ID into otp_id. Destination buffer is zeroed. */
strncpy (otp_id, password + skip_bytes, cfg->token_id_length);
DBG ("OTP: %s ID: %s ", otp, otp_id);
/* user entered their system password followed by generated OTP? */
if (password_len > TOKEN_OTP_LEN + cfg->token_id_length)
{
onlypasswd = strdup (password);
if (! onlypasswd) {
retval = PAM_BUF_ERR;
goto done;
}
onlypasswd[password_len - (TOKEN_OTP_LEN + cfg->token_id_length)] = '\0';
DBG ("Extracted a probable system password entered before the OTP - "
"setting item PAM_AUTHTOK");
retval = pam_set_item (pamh, PAM_AUTHTOK, onlypasswd);
if (retval != PAM_SUCCESS)
{
DBG ("set_item returned error: %s", pam_strerror (pamh, retval));
goto done;
}
}
else
password = NULL;
/* authorize the user with supplied token id */
if (cfg->ldapserver != NULL || cfg->ldap_uri != NULL)
valid_token = authorize_user_token_ldap (cfg, user, otp_id);
else
valid_token = authorize_user_token (cfg, user, otp_id, pamh);
switch(valid_token)
{
case AUTH_FOUND:
DBG ("Token is associated to the user. Validating the OTP...");
rc = ykclient_request (ykc, otp);
DBG ("ykclient return value (%d): %s", rc, ykclient_strerror (rc));
DBG ("ykclient url used: %s", ykclient_get_last_url(ykc));
switch (rc)
{
case YKCLIENT_OK:
retval = PAM_SUCCESS;
break;
case YKCLIENT_BAD_OTP:
case YKCLIENT_REPLAYED_OTP:
retval = PAM_AUTH_ERR;
break;
default:
retval = PAM_AUTHINFO_UNAVAIL;
break;
}
break;
case AUTH_ERROR:
DBG ("Internal error while looking for user tokens");
retval = PAM_AUTHINFO_UNAVAIL;
break;
case AUTH_NOT_FOUND:
DBG ("Unauthorized token for this user");
retval = PAM_AUTH_ERR;
break;
case AUTH_NO_TOKENS:
DBG ("No tokens found for user");
if (cfg->nullok) {
retval = PAM_IGNORE;
} else {
retval = PAM_USER_UNKNOWN;
}
break;
default:
DBG ("Unhandled value for token-user validation");
retval = PAM_AUTHINFO_UNAVAIL;
break;
}
done:
if (onlypasswd)
free(onlypasswd);
if (templates > 0)
{
size_t i;
for(i = 0; i < templates; i++)
{
free(urls[i]);
}
}
if (tmpurl)
free(tmpurl);
if (ykc)
{
ykclient_done (&ykc);
ykclient_global_done();
}
if (cfg->alwaysok && retval != PAM_SUCCESS)
{
DBG ("alwaysok needed (otherwise return with %d)", retval);
retval = PAM_SUCCESS;
}
DBG ("done. [%s]", pam_strerror (pamh, retval));
pam_set_data (pamh, "yubico_setcred_return", (void*)(intptr_t)retval, NULL);
if (resp)
{
if (resp->resp)
free (resp->resp);
free (resp);
}
if(msg[0].msg)
{
free((char*)msg[0].msg);
}
if(cfg->debug_file != stderr && cfg->debug_file != stdout)
{
fclose(cfg->debug_file);
}
return retval;
}
PAM_EXTERN int
pam_sm_setcred (
pam_handle_t *pamh __attribute__((unused)), int flags __attribute__((unused)),
int argc __attribute__((unused)), const char *argv[] __attribute__((unused)))
{
return PAM_SUCCESS;
}
PAM_EXTERN int
pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
struct cfg cfg_st;
struct cfg *cfg = &cfg_st; /* for DBG macro */
int retval;
int rc = pam_get_data(pamh, "yubico_setcred_return", (const void**)&retval);
parse_cfg (flags, argc, argv, cfg);
if (rc == PAM_SUCCESS && retval == PAM_SUCCESS) {
DBG ("pam_sm_acct_mgmt returning PAM_SUCCESS");
retval = PAM_SUCCESS;
} else {
DBG ("pam_sm_acct_mgmt returning PAM_AUTH_ERR:%d", rc);
retval = PAM_AUTH_ERR;
}
if(cfg->debug_file != stderr && cfg->debug_file != stdout) {
fclose(cfg->debug_file);
}
return retval;
}
PAM_EXTERN int
pam_sm_open_session(
pam_handle_t *pamh __attribute__((unused)), int flags __attribute__((unused)),
int argc __attribute__((unused)), const char *argv[] __attribute__((unused)))
{
return (PAM_SUCCESS);
}
PAM_EXTERN int
pam_sm_close_session(
pam_handle_t *pamh __attribute__((unused)), int flags __attribute__((unused)),
int argc __attribute__((unused)), const char *argv[] __attribute__((unused)))
{
return (PAM_SUCCESS);
}
PAM_EXTERN int
pam_sm_chauthtok(
pam_handle_t *pamh __attribute__((unused)), int flags __attribute__((unused)),
int argc __attribute__((unused)), const char *argv[] __attribute__((unused)))
{
return (PAM_SERVICE_ERR);
}
#ifdef PAM_STATIC
struct pam_module _pam_yubico_modstruct = {
"pam_yubico",
pam_sm_authenticate,
pam_sm_setcred,
pam_sm_acct_mgmt,
pam_sm_open_session,
pam_sm_close_session,
pam_sm_chauthtok
};
#endif
Reference in New Issue View Git Blame Copy Permalink