granicus.if.org Git - linux-pam/blob - modules/pam_unix/pam_unix_passwd.c

   1 /*
   2  * Main coding by Elliot Lee <sopwith@redhat.com>, Red Hat Software.
   3  * Copyright (C) 1996.
   4  * Copyright (c) Jan Rêkorajski, 1999.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, and the entire permission notice in its entirety,
  11  *    including the disclaimer of warranties.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. The name of the author may not be used to endorse or promote
  16  *    products derived from this software without specific prior
  17  *    written permission.
  18  *
  19  * ALTERNATIVELY, this product may be distributed under the terms of
  20  * the GNU Public License, in which case the provisions of the GPL are
  21  * required INSTEAD OF the above restrictions.  (This clause is
  22  * necessary due to a potential bad interaction between the GPL and
  23  * the restrictions contained in a BSD-style copyright.)
  24  *
  25  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  26  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  27  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  28  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  29  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  30  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  31  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  33  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  35  * OF THE POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38 #include <security/_pam_aconf.h>
  39
  40 #include <stdio.h>
  41 #include <stdlib.h>
  42 #include <stdarg.h>
  43 #include <string.h>
  44 #include <malloc.h>
  45 #include <unistd.h>
  46 #include <errno.h>
  47 #include <sys/types.h>
  48 #include <pwd.h>
  49 #include <syslog.h>
  50 #include <shadow.h>
  51 #include <time.h>               /* for time() */
  52 #include <fcntl.h>
  53 #include <ctype.h>
  54 #include <sys/time.h>
  55 #include <sys/stat.h>
  56 #include <rpc/rpc.h>
  57 #include <rpcsvc/yp_prot.h>
  58 #include <rpcsvc/ypclnt.h>
  59
  60 #ifdef USE_CRACKLIB
  61 #include <crack.h>
  62 #endif
  63
  64 #include <security/_pam_macros.h>
  65
  66 /* indicate the following groups are defined */
  67
  68 #define PAM_SM_PASSWORD
  69
  70 #include <security/pam_modules.h>
  71
  72 #ifndef LINUX_PAM
  73 #include <security/pam_appl.h>
  74 #endif                          /* LINUX_PAM */
  75
  76 #include "yppasswd.h"
  77 #include "md5.h"
  78 #include "support.h"
  79
  80 #if !((__GLIBC__ == 2) && (__GLIBC_MINOR__ >= 1))
  81 extern int getrpcport(const char *host, unsigned long prognum,
  82                       unsigned long versnum, unsigned int proto);
  83 #endif                          /* GNU libc 2.1 */
  84
  85 /*
  86  * PAM framework looks for these entry-points to pass control to the
  87  * password changing module.
  88  */
  89
  90 #ifdef NEED_LCKPWDF
  91 #include "./lckpwdf.-c"
  92 #endif
  93
  94 extern char *bigcrypt(const char *key, const char *salt);
  95
  96 /*
  97    How it works:
  98    Gets in username (has to be done) from the calling program
  99    Does authentication of user (only if we are not running as root)
 100    Gets new password/checks for sanity
 101    Sets it.
 102  */
 103
 104 /* passwd/salt conversion macros */
 105
 106 #define ascii_to_bin(c) ((c)>='a'?(c-59):(c)>='A'?((c)-53):(c)-'.')
 107 #define bin_to_ascii(c) ((c)>=38?((c)-38+'a'):(c)>=12?((c)-12+'A'):(c)+'.')
 108
 109 /* data tokens */
 110
 111 #define _UNIX_OLD_AUTHTOK       "-UN*X-OLD-PASS"
 112 #define _UNIX_NEW_AUTHTOK       "-UN*X-NEW-PASS"
 113
 114 #define MAX_PASSWD_TRIES        3
 115 #define PW_TMPFILE              "/etc/npasswd"
 116 #define SH_TMPFILE              "/etc/nshadow"
 117 #define CRACKLIB_DICTS          "/usr/share/dict/cracklib_dict"
 118 #define OPW_TMPFILE             "/etc/security/nopasswd"
 119 #define OLD_PASSWORDS_FILE      "/etc/security/opasswd"
 120
 121 /*
 122  * i64c - convert an integer to a radix 64 character
 123  */
 124 static int i64c(int i)
 125 {
 126         if (i < 0)
 127                 return ('.');
 128         else if (i > 63)
 129                 return ('z');
 130         if (i == 0)
 131                 return ('.');
 132         if (i == 1)
 133                 return ('/');
 134         if (i >= 2 && i <= 11)
 135                 return ('0' - 2 + i);
 136         if (i >= 12 && i <= 37)
 137                 return ('A' - 12 + i);
 138         if (i >= 38 && i <= 63)
 139                 return ('a' - 38 + i);
 140         return ('\0');
 141 }
 142
 143 static char *crypt_md5_wrapper(const char *pass_new)
 144 {
 145         /*
 146          * Code lifted from Marek Michalkiewicz's shadow suite. (CG)
 147          * removed use of static variables (AGM)
 148          */
 149
 150         struct timeval tv;
 151         MD5_CTX ctx;
 152         unsigned char result[16];
 153         char *cp = (char *) result;
 154         unsigned char tmp[16];
 155         int i;
 156         char *x = NULL;
 157
 158         GoodMD5Init(&ctx);
 159         gettimeofday(&tv, (struct timezone *) 0);
 160         GoodMD5Update(&ctx, (void *) &tv, sizeof tv);
 161         i = getpid();
 162         GoodMD5Update(&ctx, (void *) &i, sizeof i);
 163         i = clock();
 164         GoodMD5Update(&ctx, (void *) &i, sizeof i);
 165         GoodMD5Update(&ctx, result, sizeof result);
 166         GoodMD5Final(tmp, &ctx);
 167         strcpy(cp, "$1$");      /* magic for the MD5 */
 168         cp += strlen(cp);
 169         for (i = 0; i < 8; i++)
 170                 *cp++ = i64c(tmp[i] & 077);
 171         *cp = '\0';
 172
 173         /* no longer need cleartext */
 174         x = Goodcrypt_md5(pass_new, (const char *) result);
 175
 176         return x;
 177 }
 178
 179 static char *getNISserver(pam_handle_t *pamh)
 180 {
 181         char *master;
 182         char *domainname;
 183         int port, err;
 184
 185         if ((err = yp_get_default_domain(&domainname)) != 0) {
 186                 _log_err(LOG_WARNING, pamh, "can't get local yp domain: %s\n",
 187                          yperr_string(err));
 188                 return NULL;
 189         }
 190         if ((err = yp_master(domainname, "passwd.byname", &master)) != 0) {
 191                 _log_err(LOG_WARNING, pamh, "can't find the master ypserver: %s\n",
 192                          yperr_string(err));
 193                 return NULL;
 194         }
 195         port = getrpcport(master, YPPASSWDPROG, YPPASSWDPROC_UPDATE, IPPROTO_UDP);
 196         if (port == 0) {
 197                 _log_err(LOG_WARNING, pamh,
 198                          "yppasswdd not running on NIS master host\n");
 199                 return NULL;
 200         }
 201         if (port >= IPPORT_RESERVED) {
 202                 _log_err(LOG_WARNING, pamh,
 203                          "yppasswd daemon running on illegal port.\n");
 204                 return NULL;
 205         }
 206         return master;
 207 }
 208
 209 static int check_old_password(const char *forwho, const char *newpass)
 210 {
 211         static char buf[16384];
 212         char *s_luser, *s_uid, *s_npas, *s_pas;
 213         int retval = PAM_SUCCESS;
 214         FILE *opwfile;
 215
 216         opwfile = fopen(OLD_PASSWORDS_FILE, "r");
 217         if (opwfile == NULL)
 218                 return PAM_AUTHTOK_ERR;
 219
 220         while (fgets(buf, 16380, opwfile)) {
 221                 if (!strncmp(buf, forwho, strlen(forwho))) {
 222                         buf[strlen(buf) - 1] = '\0';
 223                         s_luser = strtok(buf, ":,");
 224                         s_uid = strtok(NULL, ":,");
 225                         s_npas = strtok(NULL, ":,");
 226                         s_pas = strtok(NULL, ":,");
 227                         while (s_pas != NULL) {
 228                                 char *md5pass = Goodcrypt_md5(newpass, s_pas);
 229                                 if (!strcmp(md5pass, s_pas)) {
 230                                         _pam_delete(md5pass);
 231                                         retval = PAM_AUTHTOK_ERR;
 232                                         break;
 233                                 }
 234                                 s_pas = strtok(NULL, ":,");
 235                                 _pam_delete(md5pass);
 236                         }
 237                         break;
 238                 }
 239         }
 240         fclose(opwfile);
 241
 242         return retval;
 243 }
 244
 245 static int save_old_password(const char *forwho, const char *oldpass,
 246                              int howmany)
 247 {
 248     static char buf[16384];
 249     static char nbuf[16384];
 250     char *s_luser, *s_uid, *s_npas, *s_pas, *pass;
 251     int npas;
 252     FILE *pwfile, *opwfile;
 253     int err = 0;
 254     int oldmask;
 255     int found = 0;
 256     struct passwd *pwd = NULL;
 257
 258     if (howmany < 0) {
 259         return PAM_SUCCESS;
 260     }
 261
 262     if (oldpass == NULL) {
 263         return PAM_SUCCESS;
 264     }
 265
 266     oldmask = umask(077);
 267     pwfile = fopen(OPW_TMPFILE, "w");
 268     umask(oldmask);
 269     if (pwfile == NULL) {
 270         return PAM_AUTHTOK_ERR;
 271     }
 272
 273     opwfile = fopen(OLD_PASSWORDS_FILE, "r");
 274     if (opwfile == NULL) {
 275         fclose(pwfile);
 276         return PAM_AUTHTOK_ERR;
 277     }
 278
 279     chown(OPW_TMPFILE, 0, 0);
 280     chmod(OPW_TMPFILE, 0600);
 281
 282     while (fgets(buf, 16380, opwfile)) {
 283         if (!strncmp(buf, forwho, strlen(forwho))) {
 284             buf[strlen(buf) - 1] = '\0';
 285             s_luser = strtok(buf, ":");
 286             s_uid = strtok(NULL, ":");
 287             s_npas = strtok(NULL, ":");
 288             s_pas = strtok(NULL, ":");
 289             npas = strtol(s_npas, NULL, 10) + 1;
 290             while (npas > howmany) {
 291                 s_pas = strpbrk(s_pas, ",");
 292                 if (s_pas != NULL)
 293                     s_pas++;
 294                 npas--;
 295             }
 296             pass = crypt_md5_wrapper(oldpass);
 297             if (s_pas == NULL)
 298                 snprintf(nbuf, sizeof(nbuf), "%s:%s:%d:%s\n",
 299                          s_luser, s_uid, npas, pass);
 300             else
 301                 snprintf(nbuf, sizeof(nbuf),"%s:%s:%d:%s,%s\n",
 302                          s_luser, s_uid, npas, s_pas, pass);
 303             _pam_delete(pass);
 304             if (fputs(nbuf, pwfile) < 0) {
 305                 err = 1;
 306                 break;
 307             }
 308             found = 1;
 309         } else if (fputs(buf, pwfile) < 0) {
 310             err = 1;
 311             break;
 312         }
 313     }
 314     fclose(opwfile);
 315
 316     if (!found) {
 317         pwd = getpwnam(forwho);
 318         if (pwd == NULL) {
 319             err = 1;
 320         } else {
 321             pass = crypt_md5_wrapper(oldpass);
 322             snprintf(nbuf, sizeof(nbuf), "%s:%d:1:%s\n",
 323                      forwho, pwd->pw_uid, pass);
 324             _pam_delete(pass);
 325             if (fputs(nbuf, pwfile) < 0) {
 326                 err = 1;
 327             }
 328         }
 329     }
 330
 331     if (fclose(pwfile)) {
 332         D(("error writing entries to old passwords file: %s\n",
 333            strerror(errno)));
 334         err = 1;
 335     }
 336
 337     if (!err) {
 338         rename(OPW_TMPFILE, OLD_PASSWORDS_FILE);
 339         return PAM_SUCCESS;
 340     } else {
 341         unlink(OPW_TMPFILE);
 342         return PAM_AUTHTOK_ERR;
 343     }
 344 }
 345
 346 static int _update_passwd(const char *forwho, const char *towhat)
 347 {
 348     struct passwd *tmpent = NULL;
 349     FILE *pwfile, *opwfile;
 350     int err = 1;
 351     int oldmask;
 352
 353     oldmask = umask(077);
 354     pwfile = fopen(PW_TMPFILE, "w");
 355     umask(oldmask);
 356     if (pwfile == NULL) {
 357         return PAM_AUTHTOK_ERR;
 358     }
 359
 360     opwfile = fopen("/etc/passwd", "r");
 361     if (opwfile == NULL) {
 362         fclose(pwfile);
 363         return PAM_AUTHTOK_ERR;
 364     }
 365
 366     chown(PW_TMPFILE, 0, 0);
 367     chmod(PW_TMPFILE, 0644);
 368     tmpent = fgetpwent(opwfile);
 369     while (tmpent) {
 370         if (!strcmp(tmpent->pw_name, forwho)) {
 371             /* To shut gcc up */
 372             union {
 373                 const char *const_charp;
 374                 char *charp;
 375             } assigned_passwd;
 376             assigned_passwd.const_charp = towhat;
 377
 378             tmpent->pw_passwd = assigned_passwd.charp;
 379             err = 0;
 380         }
 381         if (putpwent(tmpent, pwfile)) {
 382             D(("error writing entry to password file: %s\n", strerror(errno)));
 383             err = 1;
 384             break;
 385         }
 386         tmpent = fgetpwent(opwfile);
 387     }
 388     fclose(opwfile);
 389
 390     if (fclose(pwfile)) {
 391         D(("error writing entries to password file: %s\n", strerror(errno)));
 392         err = 1;
 393     }
 394
 395     if (!err) {
 396         rename(PW_TMPFILE, "/etc/passwd");
 397         return PAM_SUCCESS;
 398     } else {
 399         unlink(PW_TMPFILE);
 400         return PAM_AUTHTOK_ERR;
 401     }
 402 }
 403
 404 static int _update_shadow(const char *forwho, char *towhat)
 405 {
 406     struct spwd *spwdent = NULL, *stmpent = NULL;
 407     FILE *pwfile, *opwfile;
 408     int err = 1;
 409     int oldmask;
 410
 411     spwdent = getspnam(forwho);
 412     if (spwdent == NULL) {
 413         return PAM_USER_UNKNOWN;
 414     }
 415     oldmask = umask(077);
 416     pwfile = fopen(SH_TMPFILE, "w");
 417     umask(oldmask);
 418     if (pwfile == NULL) {
 419         return PAM_AUTHTOK_ERR;
 420     }
 421
 422     opwfile = fopen("/etc/shadow", "r");
 423     if (opwfile == NULL) {
 424         fclose(pwfile);
 425         return PAM_AUTHTOK_ERR;
 426     }
 427
 428     chown(SH_TMPFILE, 0, 0);
 429     chmod(SH_TMPFILE, 0600);
 430     stmpent = fgetspent(opwfile);
 431     while (stmpent) {
 432
 433         if (!strcmp(stmpent->sp_namp, forwho)) {
 434             stmpent->sp_pwdp = towhat;
 435             stmpent->sp_lstchg = time(NULL) / (60 * 60 * 24);
 436             err = 0;
 437             D(("Set password %s for %s", stmpent->sp_pwdp, forwho));
 438         }
 439
 440         if (putspent(stmpent, pwfile)) {
 441             D(("error writing entry to shadow file: %s\n", strerror(errno)));
 442             err = 1;
 443             break;
 444         }
 445
 446         stmpent = fgetspent(opwfile);
 447     }
 448     fclose(opwfile);
 449
 450     if (fclose(pwfile)) {
 451         D(("error writing entries to shadow file: %s\n", strerror(errno)));
 452         err = 1;
 453     }
 454
 455     if (!err) {
 456         rename(SH_TMPFILE, "/etc/shadow");
 457         return PAM_SUCCESS;
 458     } else {
 459         unlink(SH_TMPFILE);
 460         return PAM_AUTHTOK_ERR;
 461     }
 462 }
 463
 464 static int _do_setpass(pam_handle_t* pamh, const char *forwho, char *fromwhat,
 465                        char *towhat, unsigned int ctrl, int remember)
 466 {
 467         struct passwd *pwd = NULL;
 468         int retval = 0;
 469
 470         D(("called"));
 471
 472         setpwent();
 473         pwd = getpwnam(forwho);
 474         endpwent();
 475
 476         if (pwd == NULL)
 477                 return PAM_AUTHTOK_ERR;
 478
 479         if (on(UNIX_NIS, ctrl)) {
 480                 struct timeval timeout;
 481                 struct yppasswd yppwd;
 482                 CLIENT *clnt;
 483                 char *master;
 484                 int status;
 485                 int err = 0;
 486
 487                 /* Make RPC call to NIS server */
 488                 if ((master = getNISserver(pamh)) == NULL)
 489                         return PAM_TRY_AGAIN;
 490
 491                 /* Initialize password information */
 492                 yppwd.newpw.pw_passwd = pwd->pw_passwd;
 493                 yppwd.newpw.pw_name = pwd->pw_name;
 494                 yppwd.newpw.pw_uid = pwd->pw_uid;
 495                 yppwd.newpw.pw_gid = pwd->pw_gid;
 496                 yppwd.newpw.pw_gecos = pwd->pw_gecos;
 497                 yppwd.newpw.pw_dir = pwd->pw_dir;
 498                 yppwd.newpw.pw_shell = pwd->pw_shell;
 499                 yppwd.oldpass = fromwhat;
 500                 yppwd.newpw.pw_passwd = towhat;
 501
 502                 D(("Set password %s for %s", yppwd.newpw.pw_passwd, forwho));
 503
 504                 /* The yppasswd.x file said `unix authentication required',
 505                  * so I added it. This is the only reason it is in here.
 506                  * My yppasswdd doesn't use it, but maybe some others out there
 507                  * do.                                        --okir
 508                  */
 509                 clnt = clnt_create(master, YPPASSWDPROG, YPPASSWDVERS, "udp");
 510                 clnt->cl_auth = authunix_create_default();
 511                 memset((char *) &status, '\0', sizeof(status));
 512                 timeout.tv_sec = 25;
 513                 timeout.tv_usec = 0;
 514                 err = clnt_call(clnt, YPPASSWDPROC_UPDATE,
 515                                 (xdrproc_t) xdr_yppasswd, (char *) &yppwd,
 516                                 (xdrproc_t) xdr_int, (char *) &status,
 517                                 timeout);
 518
 519                 if (err) {
 520                         clnt_perrno(err);
 521                         retval = PAM_TRY_AGAIN;
 522                 } else if (status) {
 523                         D(("Error while changing NIS password.\n"));
 524                         retval = PAM_TRY_AGAIN;
 525                 }
 526                 D(("The password has%s been changed on %s.",
 527                    (err || status) ? " not" : "", master));
 528
 529                 auth_destroy(clnt->cl_auth);
 530                 clnt_destroy(clnt);
 531                 if ((err || status) != 0) {
 532                         retval = PAM_TRY_AGAIN;
 533                 }
 534 #ifdef DEBUG
 535                 sleep(5);
 536 #endif
 537                 return retval;
 538         }
 539         /* first, save old password */
 540         if (save_old_password(forwho, fromwhat, remember)) {
 541                 return PAM_AUTHTOK_ERR;
 542         }
 543         if (on(UNIX_SHADOW, ctrl) || (strcmp(pwd->pw_passwd, "x") == 0)) {
 544                 retval = _update_shadow(forwho, towhat);
 545                 if (retval == PAM_SUCCESS)
 546                         retval = _update_passwd(forwho, "x");
 547         } else {
 548                 retval = _update_passwd(forwho, towhat);
 549         }
 550
 551         return retval;
 552 }
 553
 554 static int _unix_verify_shadow(const char *user, unsigned int ctrl)
 555 {
 556         struct passwd *pwd = NULL;      /* Password and shadow password */
 557         struct spwd *spwdent = NULL;    /* file entries for the user */
 558         time_t curdays;
 559         int retval = PAM_SUCCESS;
 560
 561         /* UNIX passwords area */
 562         setpwent();
 563         pwd = getpwnam(user);   /* Get password file entry... */
 564         endpwent();
 565         if (pwd == NULL)
 566                 return PAM_AUTHINFO_UNAVAIL;    /* We don't need to do the rest... */
 567
 568         if (strcmp(pwd->pw_passwd, "x") == 0) {
 569                 /* ...and shadow password file entry for this user, if shadowing
 570                    is enabled */
 571                 setspent();
 572                 spwdent = getspnam(user);
 573                 endspent();
 574
 575                 if (spwdent == NULL)
 576                         return PAM_AUTHINFO_UNAVAIL;
 577         } else {
 578                 if (strcmp(pwd->pw_passwd,"*NP*") == 0) { /* NIS+ */
 579                         uid_t save_uid;
 580
 581                         save_uid = geteuid();
 582                         seteuid (pwd->pw_uid);
 583                         spwdent = getspnam( user );
 584                         seteuid (save_uid);
 585
 586                         if (spwdent == NULL)
 587                                 return PAM_AUTHINFO_UNAVAIL;
 588                 } else
 589                         spwdent = NULL;
 590         }
 591
 592         if (spwdent != NULL) {
 593                 /* We have the user's information, now let's check if their account
 594                    has expired (60 * 60 * 24 = number of seconds in a day) */
 595
 596                 if (off(UNIX__IAMROOT, ctrl)) {
 597                         /* Get the current number of days since 1970 */
 598                         curdays = time(NULL) / (60 * 60 * 24);
 599                         if ((curdays < (spwdent->sp_lstchg + spwdent->sp_min))
 600                             && (spwdent->sp_min != -1))
 601                                 retval = PAM_AUTHTOK_ERR;
 602                         else if ((curdays > (spwdent->sp_lstchg + spwdent->sp_max + spwdent->sp_inact))
 603                                  && (spwdent->sp_max != -1) && (spwdent->sp_inact != -1)
 604                                  && (spwdent->sp_lstchg != 0))
 605                                 /*
 606                                  * Their password change has been put off too long,
 607                                  */
 608                                 retval = PAM_ACCT_EXPIRED;
 609                         else if ((curdays > spwdent->sp_expire) && (spwdent->sp_expire != -1)
 610                                  && (spwdent->sp_lstchg != 0))
 611                                 /*
 612                                  * OR their account has just plain expired
 613                                  */
 614                                 retval = PAM_ACCT_EXPIRED;
 615                 }
 616         }
 617         return retval;
 618 }
 619
 620 static int _pam_unix_approve_pass(pam_handle_t * pamh
 621                                   ,unsigned int ctrl
 622                                   ,const char *pass_old
 623                                   ,const char *pass_new)
 624 {
 625         const char *user;
 626         const char *remark = NULL;
 627         int retval = PAM_SUCCESS;
 628
 629         D(("&new=%p, &old=%p", pass_old, pass_new));
 630         D(("new=[%s]", pass_new));
 631         D(("old=[%s]", pass_old));
 632
 633         if (pass_new == NULL || (pass_old && !strcmp(pass_old, pass_new))) {
 634                 if (on(UNIX_DEBUG, ctrl)) {
 635                         _log_err(LOG_DEBUG, pamh, "bad authentication token");
 636                 }
 637                 _make_remark(pamh, ctrl, PAM_ERROR_MSG, pass_new == NULL ?
 638                           "No password supplied" : "Password unchanged");
 639                 return PAM_AUTHTOK_ERR;
 640         }
 641         /*
 642          * if one wanted to hardwire authentication token strength
 643          * checking this would be the place - AGM
 644          */
 645
 646         retval = pam_get_item(pamh, PAM_USER, (const void **) &user);
 647         if (retval != PAM_SUCCESS) {
 648                 if (on(UNIX_DEBUG, ctrl)) {
 649                         _log_err(LOG_ERR, pamh, "Can not get username");
 650                         return PAM_AUTHTOK_ERR;
 651                 }
 652         }
 653         if (off(UNIX__IAMROOT, ctrl)) {
 654 #ifdef USE_CRACKLIB
 655                 remark = FascistCheck(pass_new, CRACKLIB_DICTS);
 656                 D(("called cracklib [%s]", remark));
 657 #else
 658                 if (strlen(pass_new) < 6)
 659                         remark = "You must choose a longer password";
 660                 D(("lenth check [%s]", remark));
 661 #endif
 662                 if (on(UNIX_REMEMBER_PASSWD, ctrl))
 663                         if ((retval = check_old_password(user, pass_new)) != PAM_SUCCESS)
 664                                 remark = "Password has been already used. Choose another.";
 665         }
 666         if (remark) {
 667                 _make_remark(pamh, ctrl, PAM_ERROR_MSG, remark);
 668                 retval = PAM_AUTHTOK_ERR;
 669         }
 670         return retval;
 671 }
 672
 673
 674 PAM_EXTERN int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
 675                                 int argc, const char **argv)
 676 {
 677         unsigned int ctrl, lctrl;
 678         int retval, i;
 679         int remember = -1;
 680
 681         /* <DO NOT free() THESE> */
 682         const char *user;
 683         char *pass_old, *pass_new;
 684         /* </DO NOT free() THESE> */
 685
 686         D(("called."));
 687
 688 #ifdef USE_LCKPWDF
 689         /* our current locking system requires that we lock the
 690            entire password database.  This avoids both livelock
 691            and deadlock. */
 692         /* These values for the number of attempts and the sleep time
 693            are, of course, completely arbitrary.
 694            My reading of the PAM docs is that, once pam_chauthtok() has been
 695            called with PAM_UPDATE_AUTHTOK, we are obliged to take any
 696            reasonable steps to make sure the token is updated; so retrying
 697            for 1/10 sec. isn't overdoing it.
 698            The other possibility is to call lckpwdf() on the first
 699            pam_chauthtok() pass, and hold the lock until released in the
 700            second pass--but is this guaranteed to work? -SRL */
 701         i=0;
 702         while((retval = lckpwdf()) != 0 && i < 100) {
 703                 usleep(1000);
 704         }
 705         if(retval != 0) {
 706                 return PAM_AUTHTOK_LOCK_BUSY;
 707         }
 708 #endif
 709         ctrl = _set_ctrl(pamh, flags, &remember, argc, argv);
 710
 711         /*
 712          * First get the name of a user
 713          */
 714         retval = pam_get_user(pamh, &user, "Username: ");
 715         if (retval == PAM_SUCCESS) {
 716                 /*
 717                  * Various libraries at various times have had bugs related to
 718                  * '+' or '-' as the first character of a user name. Don't take
 719                  * any chances here. Require that the username starts with an
 720                  * alphanumeric character.
 721                  */
 722                 if (user == NULL || !isalnum(*user)) {
 723                         _log_err(LOG_ERR, pamh, "bad username [%s]", user);
 724 #ifdef USE_LCKPWDF
 725                         ulckpwdf();
 726 #endif
 727                         return PAM_USER_UNKNOWN;
 728                 }
 729                 if (retval == PAM_SUCCESS && on(UNIX_DEBUG, ctrl))
 730                         _log_err(LOG_DEBUG, pamh, "username [%s] obtained",
 731                                  user);
 732         } else {
 733                 if (on(UNIX_DEBUG, ctrl))
 734                         _log_err(LOG_DEBUG, pamh,
 735                                  "password - could not identify user");
 736 #ifdef USE_LCKPWDF
 737                 ulckpwdf();
 738 #endif
 739                 return retval;
 740         }
 741
 742         D(("Got username of %s", user));
 743
 744         /*
 745          * This is not an AUTH module!
 746          */
 747         if (on(UNIX__NONULL, ctrl))
 748                 set(UNIX__NULLOK, ctrl);
 749
 750         if (on(UNIX__PRELIM, ctrl)) {
 751                 /*
 752                  * obtain and verify the current password (OLDAUTHTOK) for
 753                  * the user.
 754                  */
 755                 char *Announce;
 756
 757                 D(("prelim check"));
 758
 759                 if (_unix_blankpasswd(ctrl, user)) {
 760 #ifdef USE_LCKPWDF
 761                         ulckpwdf();
 762 #endif
 763                         return PAM_SUCCESS;
 764                 } else if (off(UNIX__IAMROOT, ctrl)) {
 765
 766                         /* instruct user what is happening */
 767 #define greeting "Changing password for "
 768                         Announce = (char *) malloc(sizeof(greeting) + strlen(user));
 769                         if (Announce == NULL) {
 770                                 _log_err(LOG_CRIT, pamh,
 771                                          "password - out of memory");
 772 #ifdef USE_LCKPWDF
 773                                 ulckpwdf();
 774 #endif
 775                                 return PAM_BUF_ERR;
 776                         }
 777                         (void) strcpy(Announce, greeting);
 778                         (void) strcpy(Announce + sizeof(greeting) - 1, user);
 779 #undef greeting
 780
 781                         lctrl = ctrl;
 782                         set(UNIX__OLD_PASSWD, lctrl);
 783                         retval = _unix_read_password(pamh, lctrl
 784                                                      ,Announce
 785                                              ,"(current) UNIX password: "
 786                                                      ,NULL
 787                                                      ,_UNIX_OLD_AUTHTOK
 788                                              ,(const char **) &pass_old);
 789                         free(Announce);
 790
 791                         if (retval != PAM_SUCCESS) {
 792                                 _log_err(LOG_NOTICE, pamh
 793                                  ,"password - (old) token not obtained");
 794 #ifdef USE_LCKPWDF
 795                                 ulckpwdf();
 796 #endif
 797                                 return retval;
 798                         }
 799                         /* verify that this is the password for this user */
 800
 801                         retval = _unix_verify_password(pamh, user, pass_old, ctrl);
 802                 } else {
 803                         D(("process run by root so do nothing this time around"));
 804                         pass_old = NULL;
 805                         retval = PAM_SUCCESS;   /* root doesn't have too */
 806                 }
 807
 808                 if (retval != PAM_SUCCESS) {
 809                         D(("Authentication failed"));
 810                         pass_old = NULL;
 811 #ifdef USE_LCKPWDF
 812                         ulckpwdf();
 813 #endif
 814                         return retval;
 815                 }
 816                 retval = pam_set_item(pamh, PAM_OLDAUTHTOK, (const void *) pass_old);
 817                 pass_old = NULL;
 818                 if (retval != PAM_SUCCESS) {
 819                         _log_err(LOG_CRIT, pamh,
 820                                  "failed to set PAM_OLDAUTHTOK");
 821                 }
 822                 retval = _unix_verify_shadow(user, ctrl);
 823                 if (retval == PAM_AUTHTOK_ERR) {
 824                         if (off(UNIX__IAMROOT, ctrl))
 825                                 _make_remark(pamh, ctrl, PAM_ERROR_MSG,
 826                                             "You must wait longer to change your password");
 827                         else
 828                                 retval = PAM_SUCCESS;
 829                 }
 830         } else if (on(UNIX__UPDATE, ctrl)) {
 831                 /*
 832                  * tpass is used below to store the _pam_md() return; it
 833                  * should be _pam_delete()'d.
 834                  */
 835
 836                 char *tpass = NULL;
 837                 int retry = 0;
 838
 839                 /*
 840                  * obtain the proposed password
 841                  */
 842
 843                 D(("do update"));
 844
 845                 /*
 846                  * get the old token back. NULL was ok only if root [at this
 847                  * point we assume that this has already been enforced on a
 848                  * previous call to this function].
 849                  */
 850
 851                 if (off(UNIX_NOT_SET_PASS, ctrl)) {
 852                         retval = pam_get_item(pamh, PAM_OLDAUTHTOK
 853                                               ,(const void **) &pass_old);
 854                 } else {
 855                         retval = pam_get_data(pamh, _UNIX_OLD_AUTHTOK
 856                                               ,(const void **) &pass_old);
 857                         if (retval == PAM_NO_MODULE_DATA) {
 858                                 retval = PAM_SUCCESS;
 859                                 pass_old = NULL;
 860                         }
 861                 }
 862                 D(("pass_old [%s]", pass_old));
 863
 864                 if (retval != PAM_SUCCESS) {
 865                         _log_err(LOG_NOTICE, pamh, "user not authenticated");
 866 #ifdef USE_LCKPWDF
 867                         ulckpwdf();
 868 #endif
 869                         return retval;
 870                 }
 871                 retval = _unix_verify_shadow(user, ctrl);
 872                 if (retval != PAM_SUCCESS) {
 873                         _log_err(LOG_NOTICE, pamh, "user not authenticated 2");
 874 #ifdef USE_LCKPWDF
 875                         ulckpwdf();
 876 #endif
 877                         return retval;
 878                 }
 879                 D(("get new password now"));
 880
 881                 lctrl = ctrl;
 882
 883                 if (on(UNIX_USE_AUTHTOK, lctrl)) {
 884                         set(UNIX_USE_FIRST_PASS, lctrl);
 885                 }
 886                 retry = 0;
 887                 retval = PAM_AUTHTOK_ERR;
 888                 while ((retval != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
 889                         /*
 890                          * use_authtok is to force the use of a previously entered
 891                          * password -- needed for pluggable password strength checking
 892                          */
 893
 894                         retval = _unix_read_password(pamh, lctrl
 895                                                      ,NULL
 896                                              ,"Enter new UNIX password: "
 897                                             ,"Retype new UNIX password: "
 898                                                      ,_UNIX_NEW_AUTHTOK
 899                                              ,(const char **) &pass_new);
 900
 901                         if (retval != PAM_SUCCESS) {
 902                                 if (on(UNIX_DEBUG, ctrl)) {
 903                                         _log_err(LOG_ALERT, pamh
 904                                                  ,"password - new password not obtained");
 905                                 }
 906                                 pass_old = NULL;        /* tidy up */
 907 #ifdef USE_LCKPWDF
 908                                 ulckpwdf();
 909 #endif
 910                                 return retval;
 911                         }
 912                         D(("returned to _unix_chauthtok"));
 913
 914                         /*
 915                          * At this point we know who the user is and what they
 916                          * propose as their new password. Verify that the new
 917                          * password is acceptable.
 918                          */
 919
 920                         if (pass_new[0] == '\0') {      /* "\0" password = NULL */
 921                                 pass_new = NULL;
 922                         }
 923                         retval = _pam_unix_approve_pass(pamh, ctrl, pass_old, pass_new);
 924                 }
 925
 926                 if (retval != PAM_SUCCESS) {
 927                         _log_err(LOG_NOTICE, pamh,
 928                                  "new password not acceptable");
 929                         pass_new = pass_old = NULL;     /* tidy up */
 930 #ifdef USE_LCKPWDF
 931                         ulckpwdf();
 932 #endif
 933                         return retval;
 934                 }
 935                 /*
 936                  * By reaching here we have approved the passwords and must now
 937                  * rebuild the password database file.
 938                  */
 939
 940                 /*
 941                  * First we encrypt the new password.
 942                  */
 943
 944                 if (on(UNIX_MD5_PASS, ctrl)) {
 945                         tpass = crypt_md5_wrapper(pass_new);
 946                 } else {
 947                         /*
 948                          * Salt manipulation is stolen from Rick Faith's passwd
 949                          * program.  Sorry Rick :) -- alex
 950                          */
 951
 952                         time_t tm;
 953                         char salt[3];
 954
 955                         time(&tm);
 956                         salt[0] = bin_to_ascii(tm & 0x3f);
 957                         salt[1] = bin_to_ascii((tm >> 6) & 0x3f);
 958                         salt[2] = '\0';
 959
 960                         if (off(UNIX_BIGCRYPT, ctrl) && strlen(pass_new) > 8) {
 961                                 /*
 962                                  * to avoid using the _extensions_ of the bigcrypt()
 963                                  * function we truncate the newly entered password
 964                                  */
 965                                 char *temp = malloc(9);
 966
 967                                 if (temp == NULL) {
 968                                         _log_err(LOG_CRIT, pamh,
 969                                                  "out of memory for password");
 970                                         pass_new = pass_old = NULL;     /* tidy up */
 971 #ifdef USE_LCKPWDF
 972                                         ulckpwdf();
 973 #endif
 974                                         return PAM_BUF_ERR;
 975                                 }
 976                                 /* copy first 8 bytes of password */
 977                                 strncpy(temp, pass_new, 8);
 978                                 temp[8] = '\0';
 979
 980                                 /* no longer need cleartext */
 981                                 tpass = bigcrypt(temp, salt);
 982
 983                                 _pam_delete(temp);      /* tidy up */
 984                         } else {
 985                                 tpass = bigcrypt(pass_new, salt);
 986                         }
 987                 }
 988
 989                 D(("password processed"));
 990
 991                 /* update the password database(s) -- race conditions..? */
 992
 993                 retval = _do_setpass(pamh, user, pass_old, tpass, ctrl,
 994                                      remember);
 995                 _pam_delete(tpass);
 996                 pass_old = pass_new = NULL;
 997         } else {                /* something has broken with the module */
 998                 _log_err(LOG_ALERT, pamh,
 999                          "password received unknown request");
1000                 retval = PAM_ABORT;
1001         }
1002
1003         D(("retval was %d", retval));
1004
1005 #ifdef USE_LCKPWDF
1006         ulckpwdf();
1007 #endif
1008         return retval;
1009 }
1010
1011
1012 /* static module data */
1013 #ifdef PAM_STATIC
1014 struct pam_module _pam_unix_passwd_modstruct = {
1015     "pam_unix_passwd",
1016     NULL,
1017     NULL,
1018     NULL,
1019     NULL,
1020     NULL,
1021     pam_sm_chauthtok,
1022 };
1023 #endif
1024