1 /* pam_access module */
4 * Written by Alexei Nogin <alexei@nogin.dnttm.ru> 1997/06/15
5 * (I took login_access from logdaemon-5.6 and converted it to PAM
6 * using parts of pam_time code.)
8 ************************************************************************
9 * Copyright message from logdaemon-5.6 (original file name DISCLAIMER)
10 ************************************************************************
11 * Copyright 1995 by Wietse Venema. All rights reserved. Individual files
12 * may be covered by other copyrights (as noted in the file itself.)
14 * This material was originally written and compiled by Wietse Venema at
15 * Eindhoven University of Technology, The Netherlands, in 1990, 1991,
16 * 1992, 1993, 1994 and 1995.
18 * Redistribution and use in source and binary forms are permitted
19 * provided that this entire copyright notice is duplicated in all such
22 * This software is provided "as is" and without any expressed or implied
23 * warranties, including, without limitation, the implied warranties of
24 * merchantibility and fitness for any particular purpose.
25 *************************************************************************
37 #include <sys/types.h>
43 #include <sys/utsname.h>
44 #include <arpa/inet.h>
46 #include <sys/socket.h>
47 #ifdef HAVE_RPCSVC_YPCLNT_H
48 #include <rpcsvc/ypclnt.h>
55 * here, we make definitions for the externally accessible functions
56 * in this file (these definitions are required for static modules
57 * but strongly encouraged generally) they are used to instruct the
58 * modules include file to define their prototypes.
62 #define PAM_SM_ACCOUNT
63 #define PAM_SM_SESSION
64 #define PAM_SM_PASSWORD
66 #include <security/_pam_macros.h>
67 #include <security/pam_modules.h>
68 #include <security/pam_modutil.h>
69 #include <security/pam_ext.h>
71 /* login_access.c from logdaemon-5.6 with several changes by A.Nogin: */
74 * This module implements a simple but effective form of login access
75 * control based on login names and on host (or domain) names, internet
76 * addresses (or network numbers), or on terminal line names in case of
77 * non-networked logins. Diagnostics are reported through syslog(3).
79 * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
82 #if !defined(MAXHOSTNAMELEN) || (MAXHOSTNAMELEN < 64)
84 #define MAXHOSTNAMELEN 256
87 /* Delimiters for fields and for lists of users, ttys or hosts. */
95 * A structure to bundle up all login-related information to keep the
96 * functional interfaces as generic as possible.
99 const struct passwd *user;
101 const char *config_file;
102 const char *hostname;
103 int debug; /* Print debugging messages. */
104 int only_new_group_syntax; /* Only allow group entries of the form "(xyz)" */
105 int noaudit; /* Do not audit denials */
106 const char *fs; /* field separator */
107 const char *sep; /* list-element separator */
108 int from_remote_host; /* If PAM_RHOST was used for from */
111 /* Parse module config arguments */
114 parse_args(pam_handle_t *pamh, struct login_info *loginfo,
115 int argc, const char **argv)
119 loginfo->noaudit = NO;
121 loginfo->only_new_group_syntax = NO;
123 loginfo->sep = ", \t";
124 for (i=0; i<argc; ++i) {
125 if (!strncmp("fieldsep=", argv[i], 9)) {
127 /* the admin wants to override the default field separators */
128 loginfo->fs = argv[i]+9;
130 } else if (!strncmp("listsep=", argv[i], 8)) {
132 /* the admin wants to override the default list separators */
133 loginfo->sep = argv[i]+8;
135 } else if (!strncmp("accessfile=", argv[i], 11)) {
136 FILE *fp = fopen(11 + argv[i], "r");
139 loginfo->config_file = 11 + argv[i];
142 pam_syslog(pamh, LOG_ERR,
143 "failed to open accessfile=[%s]: %m", 11 + argv[i]);
147 } else if (strcmp (argv[i], "debug") == 0) {
148 loginfo->debug = YES;
149 } else if (strcmp (argv[i], "nodefgroup") == 0) {
150 loginfo->only_new_group_syntax = YES;
151 } else if (strcmp (argv[i], "noaudit") == 0) {
152 loginfo->noaudit = YES;
154 pam_syslog(pamh, LOG_ERR, "unrecognized option [%s]", argv[i]);
161 /* --- static functions for checking whether the user should be let in --- */
163 typedef int match_func (pam_handle_t *, char *, struct login_info *);
165 static int list_match (pam_handle_t *, char *, char *, struct login_info *,
167 static int user_match (pam_handle_t *, char *, struct login_info *);
168 static int group_match (pam_handle_t *, const char *, const char *, int);
169 static int from_match (pam_handle_t *, char *, struct login_info *);
170 static int string_match (pam_handle_t *, const char *, const char *, int);
171 static int network_netmask_match (pam_handle_t *, const char *, const char *, int);
174 /* isipaddr - find out if string provided is an IP address or not */
177 isipaddr (const char *string, int *addr_type,
178 struct sockaddr_storage *addr)
180 struct sockaddr_storage local_addr;
183 /* We use struct sockaddr_storage addr because
184 * struct in_addr/in6_addr is an integral part
185 * of struct sockaddr and we doesn't want to
192 memset(addr, 0, sizeof(struct sockaddr_storage));
195 if (inet_pton(AF_INET, string, addr) > 0)
197 if (addr_type != NULL)
198 *addr_type = AF_INET;
202 else if (inet_pton(AF_INET6, string, addr) > 0)
204 if (addr_type != NULL) {
205 *addr_type = AF_INET6;
216 /* are_addresses_equal - translate IP address strings to real IP
217 * addresses and compare them to find out if they are equal.
218 * If netmask was provided it will be used to focus comparation to
222 are_addresses_equal (const char *ipaddr0, const char *ipaddr1,
225 struct sockaddr_storage addr0;
226 struct sockaddr_storage addr1;
230 if (isipaddr (ipaddr0, &addr_type0, &addr0) == NO)
233 if (isipaddr (ipaddr1, &addr_type1, &addr1) == NO)
236 if (addr_type0 != addr_type1)
237 /* different address types */
240 if (netmask != NULL) {
241 /* Got a netmask, so normalize addresses? */
242 struct sockaddr_storage nmask;
243 unsigned char *byte_a, *byte_nm;
245 memset(&nmask, 0, sizeof(struct sockaddr_storage));
246 if (inet_pton(addr_type0, netmask, (void *)&nmask) > 0) {
248 byte_a = (unsigned char *)(&addr0);
249 byte_nm = (unsigned char *)(&nmask);
250 for (i=0; i<sizeof(struct sockaddr_storage); i++) {
251 byte_a[i] = byte_a[i] & byte_nm[i];
254 byte_a = (unsigned char *)(&addr1);
255 byte_nm = (unsigned char *)(&nmask);
256 for (i=0; i<sizeof(struct sockaddr_storage); i++) {
257 byte_a[i] = byte_a[i] & byte_nm[i];
263 /* Are the two addresses equal? */
264 if (memcmp((void *)&addr0, (void *)&addr1,
265 sizeof(struct sockaddr_storage)) == 0) {
273 number_to_netmask (long netmask, int addr_type,
274 char *ipaddr_buf, size_t ipaddr_buf_len)
276 /* We use struct sockaddr_storage addr because
277 * struct in_addr/in6_addr is an integral part
278 * of struct sockaddr and we doesn't want to
281 struct sockaddr_storage nmask;
282 unsigned char *byte_nm;
283 const char *ipaddr_dst = NULL;
287 /* mask 0 is the same like no mask */
291 memset(&nmask, 0, sizeof(struct sockaddr_storage));
292 if (addr_type == AF_INET6) {
293 /* ipv6 address mask */
296 /* default might be an ipv4 address mask */
301 byte_nm = (unsigned char *)(&nmask);
302 /* translate number to mask */
303 for (i=0; i<ip_bytes; i++) {
309 byte_nm[i] = 0xff << (8 - netmask);
317 /* now generate netmask address string */
318 ipaddr_dst = inet_ntop(addr_type, &nmask, ipaddr_buf, ipaddr_buf_len);
319 if (ipaddr_dst == ipaddr_buf) {
326 /* login_access - match username/group and host/tty with access control file */
329 login_access (pam_handle_t *pamh, struct login_info *item)
333 char *perm; /* becomes permission field */
334 char *users; /* becomes list of login names */
335 char *froms; /* becomes list of terminals or hosts */
337 int nonall_match = NO;
339 int lineno = 0; /* for diagnostics */
343 pam_syslog (pamh, LOG_DEBUG,
344 "login_access: user=%s, from=%s, file=%s",
346 item->from, item->config_file);
349 * Process the table one line at a time and stop at the first match.
350 * Blank lines and lines that begin with a '#' character are ignored.
351 * Non-comment lines are broken at the ':' character. All fields are
352 * mandatory. The first field should be a "+" or "-" character. A
353 * non-existing table means no access control.
356 if ((fp = fopen(item->config_file, "r"))!=NULL) {
357 while (!match && fgets(line, sizeof(line), fp)) {
359 if (line[end = strlen(line) - 1] != '\n') {
360 pam_syslog(pamh, LOG_ERR,
361 "%s: line %d: missing newline or line too long",
362 item->config_file, lineno);
366 continue; /* comment line */
367 while (end > 0 && isspace(line[end - 1]))
369 line[end] = 0; /* strip trailing whitespace */
370 if (line[0] == 0) /* skip blank lines */
373 /* Allow field seperator in last field of froms */
374 if (!(perm = strtok_r(line, item->fs, &sptr))
375 || !(users = strtok_r(NULL, item->fs, &sptr))
376 || !(froms = strtok_r(NULL, "\n", &sptr))) {
377 pam_syslog(pamh, LOG_ERR, "%s: line %d: bad field count",
378 item->config_file, lineno);
381 if (perm[0] != '+' && perm[0] != '-') {
382 pam_syslog(pamh, LOG_ERR, "%s: line %d: bad first field",
383 item->config_file, lineno);
387 pam_syslog (pamh, LOG_DEBUG,
388 "line %d: %s : %s : %s", lineno, perm, users, froms);
389 match = list_match(pamh, users, NULL, item, user_match);
391 pam_syslog (pamh, LOG_DEBUG, "user_match=%d, \"%s\"",
392 match, item->user->pw_name);
394 match = list_match(pamh, froms, NULL, item, from_match);
395 if (!match && perm[0] == '+') {
399 pam_syslog (pamh, LOG_DEBUG,
400 "from_match=%d, \"%s\"", match, item->from);
404 } else if (errno == ENOENT) {
405 /* This is no error. */
406 pam_syslog(pamh, LOG_WARNING, "warning: cannot open %s: %m",
409 pam_syslog(pamh, LOG_ERR, "cannot open %s: %m", item->config_file);
413 if (!item->noaudit && line[0] == '-' && (match == YES || (match == ALL &&
414 nonall_match == YES))) {
415 pam_modutil_audit_write(pamh, AUDIT_ANOM_LOGIN_LOCATION,
419 return (match == NO || (line[0] == '+'));
423 /* list_match - match an item against a list of tokens with exceptions */
426 list_match(pam_handle_t *pamh, char *list, char *sptr,
427 struct login_info *item, match_func *match_fn)
432 if (item->debug && list != NULL)
433 pam_syslog (pamh, LOG_DEBUG,
434 "list_match: list=%s, item=%s", list, item->user->pw_name);
437 * Process tokens one at a time. We have exhausted all possible matches
438 * when we reach an "EXCEPT" token or the end of the list. If we do find
439 * a match, look for an "EXCEPT" list and recurse to determine whether
440 * the match is affected by any exceptions.
443 for (tok = strtok_r(list, item->sep, &sptr); tok != 0;
444 tok = strtok_r(NULL, item->sep, &sptr)) {
445 if (strcasecmp(tok, "EXCEPT") == 0) /* EXCEPT: give up */
447 if ((match = (*match_fn) (pamh, tok, item))) /* YES */
450 /* Process exceptions to matches. */
453 while ((tok = strtok_r(NULL, item->sep, &sptr)) && strcasecmp(tok, "EXCEPT"))
457 if (list_match(pamh, NULL, sptr, item, match_fn) == NO)
458 return YES; /* drop special meaning of ALL */
463 /* netgroup_match - match group against machine or user */
466 netgroup_match (pam_handle_t *pamh, const char *netgroup,
467 const char *machine, const char *user, int debug)
470 char *mydomain = NULL;
472 #ifdef HAVE_YP_GET_DEFAUTL_DOMAIN
473 yp_get_default_domain(&mydomain);
474 #elif defined(HAVE_GETDOMAINNAME)
475 char domainname_res[256];
477 if (getdomainname (domainname_res, sizeof (domainname_res)) == 0)
479 if (strcmp (domainname_res, "(none)") == 0)
481 /* If domainname is not set, some systems will return "(none)" */
482 domainname_res[0] = '\0';
484 mydomain = domainname_res;
489 retval = innetgr (netgroup, machine, user, mydomain);
492 pam_syslog (pamh, LOG_ERR, "pam_access does not have netgroup support");
495 pam_syslog (pamh, LOG_DEBUG,
496 "netgroup_match: %d (netgroup=%s, machine=%s, user=%s, domain=%s)",
497 retval, netgroup ? netgroup : "NULL",
498 machine ? machine : "NULL",
499 user ? user : "NULL", mydomain ? mydomain : "NULL");
503 /* user_match - match a username against one token */
506 user_match (pam_handle_t *pamh, char *tok, struct login_info *item)
508 char *string = item->user->pw_name;
509 struct login_info fake_item;
514 pam_syslog (pamh, LOG_DEBUG,
515 "user_match: tok=%s, item=%s", tok, string);
518 * If a token has the magic value "ALL" the match always succeeds.
519 * Otherwise, return YES if the token fully matches the username, if the
520 * token is a group that contains the username, or if the token is the
521 * name of the user's primary group.
524 if (tok[0] != '@' && (at = strchr(tok + 1, '@')) != 0) {
525 /* split user@host pattern */
526 if (item->hostname == NULL)
528 memcpy (&fake_item, item, sizeof(fake_item));
529 fake_item.from = item->hostname;
531 return (user_match (pamh, tok, item) &&
532 from_match (pamh, at + 1, &fake_item));
533 } else if (tok[0] == '@') { /* netgroup */
534 const char *hostname = NULL;
535 if (tok[1] == '@') { /* add hostname to netgroup match */
536 if (item->hostname == NULL)
539 hostname = item->hostname;
541 return (netgroup_match (pamh, tok + 1, hostname, string, item->debug));
542 } else if (tok[0] == '(' && tok[strlen(tok) - 1] == ')')
543 return (group_match (pamh, tok, string, item->debug));
544 else if ((rv=string_match (pamh, tok, string, item->debug)) != NO) /* ALL or exact match */
546 else if (item->only_new_group_syntax == NO &&
547 pam_modutil_user_in_group_nam_nam (pamh,
548 item->user->pw_name, tok))
549 /* try group membership */
556 /* group_match - match a username against token named group */
559 group_match (pam_handle_t *pamh, const char *tok, const char* usr,
565 pam_syslog (pamh, LOG_DEBUG,
566 "group_match: grp=%s, user=%s", grptok, usr);
571 /* token is recieved under the format '(...)' */
572 memset(grptok, 0, BUFSIZ);
573 strncpy(grptok, tok + 1, strlen(tok) - 2);
575 if (pam_modutil_user_in_group_nam_nam(pamh, usr, grptok))
582 /* from_match - match a host or tty against a list of tokens */
585 from_match (pam_handle_t *pamh UNUSED, char *tok, struct login_info *item)
587 const char *string = item->from;
593 pam_syslog (pamh, LOG_DEBUG,
594 "from_match: tok=%s, item=%s", tok, string);
597 * If a token has the magic value "ALL" the match always succeeds. Return
598 * YES if the token fully matches the string. If the token is a domain
599 * name, return YES if it matches the last fields of the string. If the
600 * token has the magic value "LOCAL", return YES if the from field was
601 * not taken by PAM_RHOST. If the token is a network number, return YES
602 * if it matches the head of the string.
605 if (string == NULL) {
607 } else if (tok[0] == '@') { /* netgroup */
608 return (netgroup_match (pamh, tok + 1, string, (char *) 0, item->debug));
609 } else if ((rv = string_match(pamh, tok, string, item->debug)) != NO) {
610 /* ALL or exact match */
612 } else if (tok[0] == '.') { /* domain: match last fields */
613 if ((str_len = strlen(string)) > (tok_len = strlen(tok))
614 && strcasecmp(tok, string + str_len - tok_len) == 0)
616 } else if (strcasecmp(tok, "LOCAL") == 0) { /* local: no PAM_RHOSTS */
617 if (item->from_remote_host == 0)
619 } else if (tok[(tok_len = strlen(tok)) - 1] == '.') {
620 struct addrinfo *res;
621 struct addrinfo hint;
623 memset (&hint, '\0', sizeof (hint));
624 hint.ai_flags = AI_CANONNAME;
625 hint.ai_family = AF_INET;
627 if (getaddrinfo (string, NULL, &hint, &res) != 0)
631 struct addrinfo *runp = res;
635 char buf[INET_ADDRSTRLEN+2];
637 if (runp->ai_family == AF_INET)
639 inet_ntop (runp->ai_family,
640 &((struct sockaddr_in *) runp->ai_addr)->sin_addr,
645 if (strncmp(tok, buf, tok_len) == 0)
651 runp = runp->ai_next;
656 /* Assume network/netmask with a IP of a host. */
657 if (network_netmask_match(pamh, tok, string, item->debug))
664 /* string_match - match a string against one token */
667 string_match (pam_handle_t *pamh, const char *tok, const char *string,
672 pam_syslog (pamh, LOG_DEBUG,
673 "string_match: tok=%s, item=%s", tok, string);
676 * If the token has the magic value "ALL" the match always succeeds.
677 * Otherwise, return YES if the token fully matches the string.
678 * "NONE" token matches NULL string.
681 if (strcasecmp(tok, "ALL") == 0) { /* all: always matches */
683 } else if (string != NULL) {
684 if (strcasecmp(tok, string) == 0) { /* try exact match */
687 } else if (strcasecmp(tok, "NONE") == 0) {
694 /* network_netmask_match - match a string against one token
695 * where string is a hostname or ip (v4,v6) address and tok
696 * represents either a single ip (v4,v6) address or a network/netmask
699 network_netmask_match (pam_handle_t *pamh,
700 const char *tok, const char *string, int debug)
703 char netmask_string[MAXHOSTNAMELEN + 1];
707 pam_syslog (pamh, LOG_DEBUG,
708 "network_netmask_match: tok=%s, item=%s", tok, string);
709 /* OK, check if tok is of type addr/mask */
710 if ((netmask_ptr = strchr(tok, '/')) != NULL)
718 if (isipaddr(tok, &addr_type, NULL) == NO)
724 if (isipaddr(netmask_ptr, NULL, NULL) == NO)
725 { /* netmask as integre value */
727 netmask = strtol(netmask_ptr, &endptr, 0);
728 if ((endptr == NULL) || (*endptr != '\0'))
729 { /* invalid netmask value */
732 if ((netmask < 0) || (netmask >= 128))
733 { /* netmask value out of range */
737 netmask_ptr = number_to_netmask(netmask, addr_type,
738 netmask_string, MAXHOSTNAMELEN);
742 /* NO, then check if it is only an addr */
743 if (isipaddr(tok, NULL, NULL) != YES)
748 if (isipaddr(string, NULL, NULL) != YES)
750 /* Assume network/netmask with a name of a host. */
751 struct addrinfo *res;
752 struct addrinfo hint;
754 memset (&hint, '\0', sizeof (hint));
755 hint.ai_flags = AI_CANONNAME;
756 hint.ai_family = AF_UNSPEC;
758 if (getaddrinfo (string, NULL, &hint, &res) != 0)
762 struct addrinfo *runp = res;
766 char buf[INET6_ADDRSTRLEN];
768 inet_ntop (runp->ai_family,
769 runp->ai_family == AF_INET
770 ? (void *) &((struct sockaddr_in *) runp->ai_addr)->sin_addr
771 : (void *) &((struct sockaddr_in6 *) runp->ai_addr)->sin6_addr,
774 if (are_addresses_equal(buf, tok, netmask_ptr))
779 runp = runp->ai_next;
785 return (are_addresses_equal(string, tok, netmask_ptr));
791 /* --- public PAM management functions --- */
794 pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
795 int argc, const char **argv)
797 struct login_info loginfo;
798 const char *user=NULL;
799 const void *void_from=NULL;
801 struct passwd *user_pw;
802 char hostname[MAXHOSTNAMELEN + 1];
807 if (pam_get_user(pamh, &user, NULL) != PAM_SUCCESS || user == NULL
809 pam_syslog(pamh, LOG_ERR, "cannot determine the user's name");
810 return PAM_USER_UNKNOWN;
813 if ((user_pw=pam_modutil_getpwnam(pamh, user))==NULL)
814 return (PAM_USER_UNKNOWN);
817 * Bundle up the arguments to avoid unnecessary clumsiness later on.
819 loginfo.user = user_pw;
820 loginfo.config_file = PAM_ACCESS_CONFIG;
822 /* parse the argument list */
824 if (!parse_args(pamh, &loginfo, argc, argv)) {
825 pam_syslog(pamh, LOG_ERR, "failed to parse the module arguments");
829 /* remote host name */
831 if (pam_get_item(pamh, PAM_RHOST, &void_from)
833 pam_syslog(pamh, LOG_ERR, "cannot find the remote host name");
838 if ((from==NULL) || (*from=='\0')) {
840 /* local login, set tty name */
842 loginfo.from_remote_host = 0;
844 if (pam_get_item(pamh, PAM_TTY, &void_from) != PAM_SUCCESS
845 || void_from == NULL) {
846 D(("PAM_TTY not set, probing stdin"));
847 from = ttyname(STDIN_FILENO);
849 if (pam_set_item(pamh, PAM_TTY, from) != PAM_SUCCESS)
850 pam_syslog(pamh, LOG_WARNING, "couldn't set tty name");
852 if (pam_get_item(pamh, PAM_SERVICE, &void_from) != PAM_SUCCESS
853 || void_from == NULL) {
854 pam_syslog (pamh, LOG_ERR,
855 "cannot determine remote host, tty or service name");
860 pam_syslog (pamh, LOG_DEBUG,
861 "cannot determine tty or remote hostname, using service %s",
868 if (from[0] == '/') { /* full path, remove device path. */
871 if ((f = strchr(from, '/')) != NULL) {
877 loginfo.from_remote_host = 1;
881 hostname[sizeof(hostname)-1] = '\0';
882 if (gethostname(hostname, sizeof(hostname)-1) == 0)
883 loginfo.hostname = hostname;
885 pam_syslog (pamh, LOG_ERR, "gethostname failed: %m");
886 loginfo.hostname = NULL;
889 if (login_access(pamh, &loginfo)) {
890 return (PAM_SUCCESS);
892 pam_syslog(pamh, LOG_ERR,
893 "access denied for user `%s' from `%s'",user,from);
894 return (PAM_PERM_DENIED);
899 pam_sm_setcred (pam_handle_t *pamh UNUSED, int flags UNUSED,
900 int argc UNUSED, const char **argv UNUSED)
906 pam_sm_acct_mgmt (pam_handle_t *pamh, int flags,
907 int argc, const char **argv)
909 return pam_sm_authenticate (pamh, flags, argc, argv);
913 pam_sm_open_session(pam_handle_t *pamh, int flags,
914 int argc, const char **argv)
916 return pam_sm_authenticate(pamh, flags, argc, argv);
920 pam_sm_close_session(pam_handle_t *pamh, int flags,
921 int argc, const char **argv)
923 return pam_sm_authenticate(pamh, flags, argc, argv);
927 pam_sm_chauthtok(pam_handle_t *pamh, int flags,
928 int argc, const char **argv)
930 return pam_sm_authenticate(pamh, flags, argc, argv);
933 /* end of module definition */
937 /* static module data */
939 struct pam_module _pam_access_modstruct = {
945 pam_sm_close_session,