You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
317 lines
8.0 KiB
317 lines
8.0 KiB
/**
|
|
* xrdp: A Remote Desktop Protocol server.
|
|
*
|
|
* Copyright (C) Jay Sorg 2004-2013
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
/**
|
|
*
|
|
* @file verify_user_pam.c
|
|
* @brief Authenticate user using pam
|
|
* @author Jay Sorg
|
|
*
|
|
*/
|
|
|
|
#if defined(HAVE_CONFIG_H)
|
|
#include <config_ac.h>
|
|
#endif
|
|
|
|
#include "arch.h"
|
|
#include "os_calls.h"
|
|
|
|
#include <stdio.h>
|
|
#include <security/pam_appl.h>
|
|
|
|
struct t_user_pass
|
|
{
|
|
char user[256];
|
|
char pass[256];
|
|
};
|
|
|
|
struct t_auth_info
|
|
{
|
|
struct t_user_pass user_pass;
|
|
int session_opened;
|
|
int did_setcred;
|
|
struct pam_conv pamc;
|
|
pam_handle_t *ph;
|
|
};
|
|
|
|
/******************************************************************************/
|
|
static int
|
|
verify_pam_conv(int num_msg, const struct pam_message **msg,
|
|
struct pam_response **resp, void *appdata_ptr)
|
|
{
|
|
int i;
|
|
struct pam_response *reply;
|
|
struct t_user_pass *user_pass;
|
|
|
|
reply = g_new0(struct pam_response, num_msg);
|
|
|
|
for (i = 0; i < num_msg; i++)
|
|
{
|
|
switch (msg[i]->msg_style)
|
|
{
|
|
case PAM_PROMPT_ECHO_ON: /* username */
|
|
user_pass = (struct t_user_pass *) appdata_ptr;
|
|
reply[i].resp = g_strdup(user_pass->user);
|
|
reply[i].resp_retcode = PAM_SUCCESS;
|
|
break;
|
|
case PAM_PROMPT_ECHO_OFF: /* password */
|
|
user_pass = (struct t_user_pass *) appdata_ptr;
|
|
reply[i].resp = g_strdup(user_pass->pass);
|
|
reply[i].resp_retcode = PAM_SUCCESS;
|
|
break;
|
|
default:
|
|
g_printf("unknown in verify_pam_conv\r\n");
|
|
g_free(reply);
|
|
return PAM_CONV_ERR;
|
|
}
|
|
}
|
|
|
|
*resp = reply;
|
|
return PAM_SUCCESS;
|
|
}
|
|
|
|
/******************************************************************************/
|
|
static void
|
|
get_service_name(char *service_name)
|
|
{
|
|
service_name[0] = 0;
|
|
|
|
if (g_file_exist("/etc/pam.d/xrdp-sesman") ||
|
|
g_file_exist(XRDP_SYSCONF_PATH "/pam.d/xrdp-sesman"))
|
|
{
|
|
g_strncpy(service_name, "xrdp-sesman", 255);
|
|
}
|
|
else
|
|
{
|
|
g_strncpy(service_name, "gdm", 255);
|
|
}
|
|
}
|
|
|
|
/******************************************************************************/
|
|
/* returns long, zero is no go
|
|
Stores the detailed error code in the errorcode variable*/
|
|
|
|
long
|
|
auth_userpass(const char *user, const char *pass, int *errorcode)
|
|
{
|
|
int error;
|
|
struct t_auth_info *auth_info;
|
|
char service_name[256];
|
|
|
|
get_service_name(service_name);
|
|
auth_info = g_new0(struct t_auth_info, 1);
|
|
g_strncpy(auth_info->user_pass.user, user, 255);
|
|
g_strncpy(auth_info->user_pass.pass, pass, 255);
|
|
auth_info->pamc.conv = &verify_pam_conv;
|
|
auth_info->pamc.appdata_ptr = &(auth_info->user_pass);
|
|
error = pam_start(service_name, 0, &(auth_info->pamc), &(auth_info->ph));
|
|
|
|
if (error != PAM_SUCCESS)
|
|
{
|
|
if (errorcode != NULL)
|
|
{
|
|
*errorcode = error;
|
|
}
|
|
g_printf("pam_start failed: %s\r\n", pam_strerror(auth_info->ph, error));
|
|
pam_end(auth_info->ph, error);
|
|
g_free(auth_info);
|
|
return 0;
|
|
}
|
|
|
|
error = pam_set_item(auth_info->ph, PAM_TTY, service_name);
|
|
if (error != PAM_SUCCESS)
|
|
{
|
|
g_printf("pam_set_item failed: %s\r\n",
|
|
pam_strerror(auth_info->ph, error));
|
|
}
|
|
|
|
error = pam_authenticate(auth_info->ph, 0);
|
|
|
|
if (error != PAM_SUCCESS)
|
|
{
|
|
if (errorcode != NULL)
|
|
{
|
|
*errorcode = error;
|
|
}
|
|
g_printf("pam_authenticate failed: %s\r\n",
|
|
pam_strerror(auth_info->ph, error));
|
|
pam_end(auth_info->ph, error);
|
|
g_free(auth_info);
|
|
return 0;
|
|
}
|
|
/* From man page:
|
|
The pam_acct_mgmt function is used to determine if the users account is
|
|
valid. It checks for authentication token and account expiration and
|
|
verifies access restrictions. It is typically called after the user has
|
|
been authenticated.
|
|
*/
|
|
error = pam_acct_mgmt(auth_info->ph, 0);
|
|
|
|
if (error != PAM_SUCCESS)
|
|
{
|
|
if (errorcode != NULL)
|
|
{
|
|
*errorcode = error;
|
|
}
|
|
g_printf("pam_acct_mgmt failed: %s\r\n",
|
|
pam_strerror(auth_info->ph, error));
|
|
pam_end(auth_info->ph, error);
|
|
g_free(auth_info);
|
|
return 0;
|
|
}
|
|
|
|
return (long)auth_info;
|
|
}
|
|
|
|
/******************************************************************************/
|
|
/* returns error */
|
|
int
|
|
auth_start_session(long in_val, int in_display)
|
|
{
|
|
struct t_auth_info *auth_info;
|
|
int error;
|
|
char display[256];
|
|
|
|
g_sprintf(display, ":%d", in_display);
|
|
auth_info = (struct t_auth_info *)in_val;
|
|
error = pam_set_item(auth_info->ph, PAM_TTY, display);
|
|
|
|
if (error != PAM_SUCCESS)
|
|
{
|
|
g_printf("pam_set_item failed: %s\r\n", pam_strerror(auth_info->ph, error));
|
|
return 1;
|
|
}
|
|
|
|
error = pam_setcred(auth_info->ph, PAM_ESTABLISH_CRED);
|
|
|
|
if (error != PAM_SUCCESS)
|
|
{
|
|
g_printf("pam_setcred failed: %s\r\n", pam_strerror(auth_info->ph, error));
|
|
return 1;
|
|
}
|
|
|
|
auth_info->did_setcred = 1;
|
|
error = pam_open_session(auth_info->ph, 0);
|
|
|
|
if (error != PAM_SUCCESS)
|
|
{
|
|
g_printf("pam_open_session failed: %s\r\n",
|
|
pam_strerror(auth_info->ph, error));
|
|
return 1;
|
|
}
|
|
|
|
auth_info->session_opened = 1;
|
|
return 0;
|
|
}
|
|
|
|
/******************************************************************************/
|
|
/* returns error */
|
|
int
|
|
auth_stop_session(long in_val)
|
|
{
|
|
struct t_auth_info *auth_info;
|
|
int error;
|
|
|
|
auth_info = (struct t_auth_info *)in_val;
|
|
error = pam_close_session(auth_info->ph, 0);
|
|
if (error != PAM_SUCCESS)
|
|
{
|
|
g_printf("pam_close_session failed: %s\r\n",
|
|
pam_strerror(auth_info->ph, error));
|
|
return 1;
|
|
}
|
|
auth_info->session_opened = 0;
|
|
return 0;
|
|
}
|
|
|
|
/******************************************************************************/
|
|
/* returns error */
|
|
/* cleanup */
|
|
int
|
|
auth_end(long in_val)
|
|
{
|
|
struct t_auth_info *auth_info;
|
|
|
|
auth_info = (struct t_auth_info *)in_val;
|
|
|
|
if (auth_info != 0)
|
|
{
|
|
if (auth_info->ph != 0)
|
|
{
|
|
if (auth_info->session_opened)
|
|
{
|
|
pam_close_session(auth_info->ph, 0);
|
|
}
|
|
|
|
if (auth_info->did_setcred)
|
|
{
|
|
pam_setcred(auth_info->ph, PAM_DELETE_CRED);
|
|
}
|
|
|
|
pam_end(auth_info->ph, PAM_SUCCESS);
|
|
auth_info->ph = 0;
|
|
}
|
|
}
|
|
|
|
g_free(auth_info);
|
|
return 0;
|
|
}
|
|
|
|
/******************************************************************************/
|
|
/* returns error */
|
|
/* set any pam env vars */
|
|
int
|
|
auth_set_env(long in_val)
|
|
{
|
|
struct t_auth_info *auth_info;
|
|
char **pam_envlist;
|
|
char **pam_env;
|
|
char item[256];
|
|
char value[256];
|
|
int eq_pos;
|
|
|
|
auth_info = (struct t_auth_info *)in_val;
|
|
|
|
if (auth_info != 0)
|
|
{
|
|
/* export PAM environment */
|
|
pam_envlist = pam_getenvlist(auth_info->ph);
|
|
|
|
if (pam_envlist != NULL)
|
|
{
|
|
for (pam_env = pam_envlist; *pam_env != NULL; ++pam_env)
|
|
{
|
|
eq_pos = g_pos(*pam_env, "=");
|
|
|
|
if (eq_pos >= 0 && eq_pos < 250)
|
|
{
|
|
g_strncpy(item, *pam_env, eq_pos);
|
|
g_strncpy(value, (*pam_env) + eq_pos + 1, 255);
|
|
g_setenv(item, value, 1);
|
|
}
|
|
|
|
g_free(*pam_env);
|
|
}
|
|
|
|
g_free(pam_envlist);
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|