mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-20 00:33:57 +00:00
Add a pam_rhosts module, loosely based on code submitted by Danny Braniss.
Submitted by: Danny Braniss <danny@cs.huji.ac.il> Sponsored by: DARPA, NAI Labs
This commit is contained in:
parent
fd994fa945
commit
95ca4cb3f6
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=94551
|
@ -17,6 +17,7 @@ MODULES += pam_opieaccess
|
||||||
#MODULES += pam_passwdqc
|
#MODULES += pam_passwdqc
|
||||||
MODULES += pam_permit
|
MODULES += pam_permit
|
||||||
MODULES += pam_radius
|
MODULES += pam_radius
|
||||||
|
MODULES += pam_rhosts
|
||||||
MODULES += pam_rootok
|
MODULES += pam_rootok
|
||||||
MODULES += pam_securetty
|
MODULES += pam_securetty
|
||||||
MODULES += pam_self
|
MODULES += pam_self
|
||||||
|
|
7
lib/libpam/modules/pam_rhosts/Makefile
Normal file
7
lib/libpam/modules/pam_rhosts/Makefile
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
# $FreeBSD$
|
||||||
|
|
||||||
|
LIB= pam_rhosts
|
||||||
|
SRCS= pam_rhosts.c
|
||||||
|
MAN= pam_rhosts.8
|
||||||
|
|
||||||
|
.include <bsd.lib.mk>
|
95
lib/libpam/modules/pam_rhosts/pam_rhosts.8
Normal file
95
lib/libpam/modules/pam_rhosts/pam_rhosts.8
Normal file
|
@ -0,0 +1,95 @@
|
||||||
|
.\" Copyright (c) 2001 Mark R V Murray
|
||||||
|
.\" All rights reserved.
|
||||||
|
.\" Copyright (c) 2001 Networks Associates Technology, Inc.
|
||||||
|
.\" All rights reserved.
|
||||||
|
.\"
|
||||||
|
.\" Portions of this software were developed for the FreeBSD Project by
|
||||||
|
.\" ThinkSec AS and NAI Labs, the Security Research Division of Network
|
||||||
|
.\" Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
|
||||||
|
.\" ("CBOSS"), as part of the DARPA CHATS research program.
|
||||||
|
.\"
|
||||||
|
.\" Redistribution and use in source and binary forms, with or without
|
||||||
|
.\" modification, are permitted provided that the following conditions
|
||||||
|
.\" are met:
|
||||||
|
.\" 1. Redistributions of source code must retain the above copyright
|
||||||
|
.\" notice, this list of conditions and the following disclaimer.
|
||||||
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||||||
|
.\" notice, this list of conditions and the following disclaimer in the
|
||||||
|
.\" documentation and/or other materials provided with the distribution.
|
||||||
|
.\" 3. The name of the author may not be used to endorse or promote
|
||||||
|
.\" products derived from this software without specific prior written
|
||||||
|
.\" permission.
|
||||||
|
.\"
|
||||||
|
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||||
|
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||||
|
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||||
|
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||||
|
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||||
|
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||||
|
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||||
|
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||||
|
.\" SUCH DAMAGE.
|
||||||
|
.\"
|
||||||
|
.\" $FreeBSD$
|
||||||
|
.\"
|
||||||
|
.Dd December 5, 2001
|
||||||
|
.Dt PAM_RHOSTS 8
|
||||||
|
.Os
|
||||||
|
.Sh NAME
|
||||||
|
.Nm pam_rhosts
|
||||||
|
.Nd Rhosts PAM module
|
||||||
|
.Sh SYNOPSIS
|
||||||
|
.Op Ar service-name
|
||||||
|
.Ar module-type
|
||||||
|
.Ar control-flag
|
||||||
|
.Pa pam_rhosts
|
||||||
|
.Op Ar options
|
||||||
|
.Sh DESCRIPTION
|
||||||
|
The rhosts authentication service module for PAM,
|
||||||
|
.Nm
|
||||||
|
provides functionality for only one PAM category:
|
||||||
|
authentication.
|
||||||
|
In terms of the
|
||||||
|
.Ar module-type
|
||||||
|
parameter, this is the
|
||||||
|
.Dq Li auth
|
||||||
|
feature.
|
||||||
|
.Ss Rhosts Authentication Module
|
||||||
|
The Rhosts authentication component
|
||||||
|
.Pq Fn pam_sm_authenticate ,
|
||||||
|
returns success if and only if the target user's UID is not 0 and the
|
||||||
|
remote host and user are listed in
|
||||||
|
.Pa /etc/hosts.equiv
|
||||||
|
or in the target user's
|
||||||
|
.Pa ~/.rhosts .
|
||||||
|
.Pp
|
||||||
|
The following options may be passed to the authentication module:
|
||||||
|
.Bl -tag -width ".Cm allow_root"
|
||||||
|
.It Cm debug
|
||||||
|
.Xr syslog 3
|
||||||
|
debugging information at
|
||||||
|
.Dv LOG_DEBUG
|
||||||
|
level.
|
||||||
|
.It Cm no_warn
|
||||||
|
suppress warning messages to the user.
|
||||||
|
These messages include reasons why the user's authentication attempt
|
||||||
|
was declined.
|
||||||
|
.It Cm allow_root
|
||||||
|
do not automatically fail if the target user's UID is 0.
|
||||||
|
.El
|
||||||
|
.Sh SEE ALSO
|
||||||
|
.Xr hosts.equiv 5 ,
|
||||||
|
.Xr pam.conf 5 ,
|
||||||
|
.Xr pam 8
|
||||||
|
.Sh AUTHORS
|
||||||
|
The
|
||||||
|
.Nm
|
||||||
|
module and this manual page were developed for the
|
||||||
|
.Fx
|
||||||
|
Project by
|
||||||
|
ThinkSec AS and NAI Labs, the Security Research Division of Network
|
||||||
|
Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
|
||||||
|
.Pq Dq CBOSS ,
|
||||||
|
as part of the DARPA CHATS research program.
|
93
lib/libpam/modules/pam_rhosts/pam_rhosts.c
Normal file
93
lib/libpam/modules/pam_rhosts/pam_rhosts.c
Normal file
|
@ -0,0 +1,93 @@
|
||||||
|
/*-
|
||||||
|
* Copyright (c) 2002 Danny Braniss
|
||||||
|
* All rights reserved.
|
||||||
|
* Copyright (c) 2001,2002 Networks Associates Technology, Inc.
|
||||||
|
* All rights reserved.
|
||||||
|
*
|
||||||
|
* Portions of this software were developed for the FreeBSD Project by
|
||||||
|
* ThinkSec AS and NAI Labs, the Security Research Division of Network
|
||||||
|
* Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
|
||||||
|
* ("CBOSS"), as part of the DARPA CHATS research program.
|
||||||
|
*
|
||||||
|
* Redistribution and use in source and binary forms, with or without
|
||||||
|
* modification, are permitted provided that the following conditions
|
||||||
|
* are met:
|
||||||
|
* 1. Redistributions of source code must retain the above copyright
|
||||||
|
* notice, this list of conditions and the following disclaimer.
|
||||||
|
* 2. Redistributions in binary form must reproduce the above copyright
|
||||||
|
* notice, this list of conditions and the following disclaimer in the
|
||||||
|
* documentation and/or other materials provided with the distribution.
|
||||||
|
* 3. The name of the author may not be used to endorse or promote
|
||||||
|
* products derived from this software without specific prior written
|
||||||
|
* permission.
|
||||||
|
*
|
||||||
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||||
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||||
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||||
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||||
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||||
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||||
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||||
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||||
|
* SUCH DAMAGE.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <sys/cdefs.h>
|
||||||
|
__FBSDID("$FreeBSD$");
|
||||||
|
|
||||||
|
#include <pwd.h>
|
||||||
|
#include <stddef.h>
|
||||||
|
#include <unistd.h>
|
||||||
|
|
||||||
|
#define PAM_SM_AUTH
|
||||||
|
#include <security/pam_appl.h>
|
||||||
|
#include <security/pam_modules.h>
|
||||||
|
#include <security/pam_mod_misc.h>
|
||||||
|
|
||||||
|
#define OPT_ALLOW_ROOT "allow_root"
|
||||||
|
|
||||||
|
PAM_EXTERN int
|
||||||
|
pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
|
||||||
|
int argc __unused, const char *argv[] __unused)
|
||||||
|
{
|
||||||
|
struct passwd *pw;
|
||||||
|
const char *user, *ruser, *rhost;
|
||||||
|
int err, superuser;
|
||||||
|
|
||||||
|
err = pam_get_user(pamh, &user, NULL);
|
||||||
|
if (err != PAM_SUCCESS)
|
||||||
|
return (err);
|
||||||
|
|
||||||
|
if ((pw = getpwnam(user)) == NULL)
|
||||||
|
return (PAM_USER_UNKNOWN);
|
||||||
|
if (pw->pw_uid == 0 &&
|
||||||
|
openpam_get_option(pamh, OPT_ALLOW_ROOT) == NULL)
|
||||||
|
return (PAM_AUTH_ERR);
|
||||||
|
|
||||||
|
err = pam_get_item(pamh, PAM_RUSER, (const void **)&ruser);
|
||||||
|
if (err != PAM_SUCCESS)
|
||||||
|
return (PAM_AUTH_ERR);
|
||||||
|
|
||||||
|
err = pam_get_item(pamh, PAM_RHOST, (const void **)&rhost);
|
||||||
|
if (err != PAM_SUCCESS)
|
||||||
|
return (PAM_AUTH_ERR);
|
||||||
|
|
||||||
|
superuser = (strcmp(user, "root") == 0);
|
||||||
|
err = ruserok(rhost, superuser, ruser, user);
|
||||||
|
if (err != 0)
|
||||||
|
return (PAM_AUTH_ERR);
|
||||||
|
|
||||||
|
return (PAM_SUCCESS);
|
||||||
|
}
|
||||||
|
|
||||||
|
PAM_EXTERN int
|
||||||
|
pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
|
||||||
|
int argc __unused, const char *argv[] __unused)
|
||||||
|
{
|
||||||
|
|
||||||
|
return (PAM_SUCCESS);
|
||||||
|
}
|
||||||
|
|
||||||
|
PAM_MODULE_ENTRY("pam_rhosts");
|
Loading…
Reference in a new issue