Fix typo in comment.

explain better what's going on here.

Build the modules in two phases:
1. build the static modules first, before libpam so that the static
libpam can link against the module .a files.
2. build the modules after the dynamic libpam is build, so that the
dynamic modules can link against the dynamic libpam.

branches: 1.2.32;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- Create 3 new variables:
MAKELINKLIB that follows MKLINKLIB but can be overwritten by Makefiles
MAKESTATICLIB that follows MKSTATICLIB but can be overwritten by Makefiles
LINKINSTALL that follows MAKELINKLIB but can be overwritten by Makefiles
These give enough control to the module Makefiles so that they don't need
to override the default library install rules which break the debug sets.
- Remove /usr/libexec/named which duplicated /usr/lib/named

Fix fallout from NO_STATIC_MODULES -> OPENPAM_STATIC_MODULES changes;
libpam.a fails to load any modules and does not work at all.

At the moment, openpam_load.c at least must be compiled with and without
OPENPAM_STATIC_MODULES for static and shared libraries, respectively.

Therefore, use CSHLIBFLAGS again, in order to build objects for static and
shared libraries separately.

This may be ugly, but seems better for me than adding further hacks in
libpam/libpam/Makefile, which is already complicated enough...

Reverse sense of NO_STATIC_MODULES -> OPENPAM_STATIC_MODULES.

This avoids leaking NO_STATIC_MODULES into the public header, which
has led to considerable confusion and workarounds in pkgrsc.

PR security/39313
PR security/55216

ok christos

Bump version

branches: 1.17.16;
updates for new version

adjust for new openpam

branches: 1.15.6;
PR/45877 - Geoff C. Wing -- openpam modules need to be owned by root

undo the pam bump.

Move to the new version.

branches: 1.12.6;
if BSD_MK_COMPAT_FILE is defined, .include it.

rename LD32DIR to MLIBDIR.

bump libcrypto and friends; OpenSSL abi change: do_cipher last argument
changed from u_int to size_t. Affects _LP64 only.

bump shared libraries.

branches: 1.8.4; 1.8.8;
Recursively bump the major version number of the shared libraries
which use libcrypto (and those which use those libraries again),
as libcrypto's major number was recently bumped. The pam modules
share a major with libpam, so they are all bumped as well.

branches: 1.7.4; 1.7.6;
Remove static module defines; they are done in openpam.h now.

branches: 1.6.4;
Add new Makefile knob, USE_FORT, which extends USE_SSP by turning on the
FORTIFY_SOURCE feature of libssp, thus checking the size of arguments to
various string and memory copy and set functions (as well as a few system
calls and other miscellany) where known at function entry. RedHat has
evidently built all "core system packages" with this option for some time.

This option should be used at the top of Makefiles (or Makefile.inc where
this is used for subdirectories) but after any setting of LIB.

This is only useful for userland code, and cannot be used in libc or in
any code which includes the libc internals, because it overrides certain
libc functions with macros. Some effort has been made to make USE_FORT=yes
work correctly for a full-system build by having the bsd.sys.mk logic
disable the feature where it should not be used (libc, libssp iteself,
the kernel) but no attempt has been made to build the entire system with
USE_FORT and doing so will doubtless expose numerous bugs and misfeatures.

Adjust the system build so that all programs and libraries that are setuid,
directly handle network data (including serial comm data), perform
authentication, or appear likely to have (or have a history of having)
data-driven bugs (e.g. file(1)) are built with USE_FORT=yes by default,
with the exception of libc, which cannot use USE_FORT and thus uses
only USE_SSP by default. Tested on i386 with no ill results; USE_FORT=no
per-directory or in a system build will disable if desired.

define where the dynamic modules go.

Get rid of pam debugging.
XXX: We should do this on the 3.0 branch too.

branches: 1.3.2;
add -DDEBUG to the build for now

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- Create 3 new variables:
MAKELINKLIB that follows MKLINKLIB but can be overwritten by Makefiles
MAKESTATICLIB that follows MKSTATICLIB but can be overwritten by Makefiles
LINKINSTALL that follows MAKELINKLIB but can be overwritten by Makefiles
These give enough control to the module Makefiles so that they don't need
to override the default library install rules which break the debug sets.
- Remove /usr/libexec/named which duplicated /usr/lib/named

bsd.own.mk: rename GCC_NO_* to CC_WNO_*

Rename compiler-warning-disable variables from
GCC_NO_warning
to
CC_WNO_warning
where warning is the full warning name as used by the compiler.

GCC_NO_IMPLICIT_FALLTHRU is CC_WNO_IMPLICIT_FALLTHROUGH

Using the convention CC_compilerflag, where compilerflag
is based on the full compiler flag name.

Remove workaround, @rillig fixed the issue.

work around lint bug

cast from strchr fixed.

libpam: clean up LINTFLAGS

Warning 346 is new, the other suppressions are not needed anymore.

Fix fallout from NO_STATIC_MODULES -> OPENPAM_STATIC_MODULES changes;
libpam.a fails to load any modules and does not work at all.

At the moment, openpam_load.c at least must be compiled with and without
OPENPAM_STATIC_MODULES for static and shared libraries, respectively.

Therefore, use CSHLIBFLAGS again, in order to build objects for static and
shared libraries separately.

This may be ugly, but seems better for me than adding further hacks in
libpam/libpam/Makefile, which is already complicated enough...

Fix the vax build and explain why...

Reverse sense of NO_STATIC_MODULES -> OPENPAM_STATIC_MODULES.

This avoids leaking NO_STATIC_MODULES into the public header, which
has led to considerable confusion and workarounds in pkgrsc.

PR security/39313
PR security/55216

ok christos

Add debugging commented out.

use GCC_NO_CAST_FUNCTION_TYPE.

Only exclude gcc-8 warnings when the gcc we're using is gcc>=8

no error for function cast

branches: 1.19.10;
Remove MKCRYPTO option.

Originally, MKCRYPTO was introduced because the United States
classified cryptography as a munition and restricted its export. The
export controls were substantially relaxed fifteen years ago, and are
essentially irrelevant for software with published source code.

In the intervening time, nobody bothered to remove the option after
its motivation -- the US export restriction -- was eliminated. I'm
not aware of any other operating system that has a similar option; I
expect it is mainly out of apathy for churn that we still have it.
Today, cryptography is an essential part of modern computing -- you
can't use the internet responsibly without cryptography.

The position of the TNF board of directors is that TNF makes no
representation that MKCRYPTO=no satisfies any country's cryptography
regulations.

My personal position is that the availability of cryptography is a
basic human right; that any local laws restricting it to a privileged
few are fundamentally immoral; and that it is wrong for developers to
spend effort crippling cryptography to work around such laws.

As proposed on tech-crypto, tech-security, and tech-userlevel to no
objections:

https://mail-index.netbsd.org/tech-crypto/2017/05/06/msg000719.html
https://mail-index.netbsd.org/tech-security/2017/05/06/msg000928.html
https://mail-index.netbsd.org/tech-userlevel/2017/05/06/msg010547.html

P.S. Reviewing all the uses of MKCRYPTO in src revealed a lot of
*bad* crypto that was conditional on it, e.g. DES in telnet... That
should probably be removed too, but on the grounds that it is bad,
not on the grounds that it is (nominally) crypto.

When building with clang, make warnings about NULL checks of parameters
with attribute nonnull non-fatal.

pam library has moved and new files

branches: 1.16.4;
warns 6

adjust for new openpam

branches: 1.14.6;
Move to the new version.

branches: 1.13.2;
remove gcc-4.5 hacks

add some XXX'd -Wno-foo if HAVE_GCC >= 45.

XXX: someone should look at these.

branches: 1.11.4;
Revert last as gcc(1) checks for -r to disable passing down --relax e.g.
on Sparc.

Explicitly pass down -r as linker option.

Merge from matt-nb5-mips64

branches: 1.8.8;
XXX: fix compat/libpam static build -- find the right libc via _CURDIR
XXX: not .CURDIR, if _CURDIR exists.

Install a new include file.

branches: 1.6.10;
Add all the modules to the static pam. This is required, otherwise pam does
not work on non pic builds because it does not find modules listed in
/etc/pam.d.

branches: 1.5.2; 1.5.4;
Build openpam_free_envlist as part of libpam, and install it's man
page. This is required for ports not yet supporting shared libraries.

Back out previous, now that make is fixed.

Work around a suffix search problem with .MADE. Work-around suggested
by Christos.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

branches: 1.2.4;
updates for new version

branches: 1.1.2;
adjust for new openpam

branches: 1.1.4;
libpam: Add expected symbols list.

PR lib/58838: shared libraries in base should all have expsym lists

- reverse the order of printf formatting to make it easier for compilers to
check printf arguments
- add compiler checking for printf formats and fix broken ones.
From joerg@

branches: 1.3.34;
Remove unneeded #include of <libgen.h>
From: Slava Semushin <php-coder@altlinux.ru>

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- reverse the order of printf formatting to make it easier for compilers to
check printf arguments
- add compiler checking for printf formats and fix broken ones.
From joerg@

branches: 1.3.48;
s/__function__/__func__/

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Remove MKCRYPTO option.

Originally, MKCRYPTO was introduced because the United States
classified cryptography as a munition and restricted its export. The
export controls were substantially relaxed fifteen years ago, and are
essentially irrelevant for software with published source code.

In the intervening time, nobody bothered to remove the option after
its motivation -- the US export restriction -- was eliminated. I'm
not aware of any other operating system that has a similar option; I
expect it is mainly out of apathy for churn that we still have it.
Today, cryptography is an essential part of modern computing -- you
can't use the internet responsibly without cryptography.

The position of the TNF board of directors is that TNF makes no
representation that MKCRYPTO=no satisfies any country's cryptography
regulations.

My personal position is that the availability of cryptography is a
basic human right; that any local laws restricting it to a privileged
few are fundamentally immoral; and that it is wrong for developers to
spend effort crippling cryptography to work around such laws.

As proposed on tech-crypto, tech-security, and tech-userlevel to no
objections:

https://mail-index.netbsd.org/tech-crypto/2017/05/06/msg000719.html
https://mail-index.netbsd.org/tech-security/2017/05/06/msg000928.html
https://mail-index.netbsd.org/tech-userlevel/2017/05/06/msg010547.html

P.S. Reviewing all the uses of MKCRYPTO in src revealed a lot of
*bad* crypto that was conditional on it, e.g. DES in telnet... That
should probably be removed too, but on the grounds that it is bad,
not on the grounds that it is (nominally) crypto.

Don't try to clean/build or install a library here, there are only
subdirectories.

Also, bsd.lib.mk requires a defined LIB, otherwise it will generate
unwanted commands during clean. It even failed on netbsd-4 where
'rm -f' needs at least one parameter which is missing due to recent
corrections in make/vars.c.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

Remove old kerberos library (Jukka Salmi)

pam_afslog is used in conjunction with pam_krb5 to obtain AFS tokens and
create a PAG if necessary.

Especially important for home directories on AFS.

branches: 1.8.2;
Add an S/Key PAM module.

Add pam_radius.

Build & install pam_ssh.so.0 now that libssh is available for use.

re-add inclusion of <bsd.lib.mk> for LIBDPLIBS optimization, with an
empty libinstall rule so Things Work.

Remove the inclusion of <bsd.lib.mk>. There are no libraries in this
directory, only its subdirectories.

Use LIBDPLIBS to provide the list of libraries for the modules to depend
upon, because:
* it's MUCH quicker; no need to calculate the OBJDIRS of every library
we might require in every subdir.
(make obj drops from 21s to 3s on my system.)
* it's more robust when building to a fresh DESTDIR.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- Create 3 new variables:
MAKELINKLIB that follows MKLINKLIB but can be overwritten by Makefiles
MAKESTATICLIB that follows MKSTATICLIB but can be overwritten by Makefiles
LINKINSTALL that follows MAKELINKLIB but can be overwritten by Makefiles
These give enough control to the module Makefiles so that they don't need
to override the default library install rules which break the debug sets.
- Remove /usr/libexec/named which duplicated /usr/lib/named

Fix fallout from NO_STATIC_MODULES -> OPENPAM_STATIC_MODULES changes;
libpam.a fails to load any modules and does not work at all.

At the moment, openpam_load.c at least must be compiled with and without
OPENPAM_STATIC_MODULES for static and shared libraries, respectively.

Therefore, use CSHLIBFLAGS again, in order to build objects for static and
shared libraries separately.

This may be ugly, but seems better for me than adding further hacks in
libpam/libpam/Makefile, which is already complicated enough...

Reverse sense of NO_STATIC_MODULES -> OPENPAM_STATIC_MODULES.

This avoids leaking NO_STATIC_MODULES into the public header, which
has led to considerable confusion and workarounds in pkgrsc.

PR security/39313
PR security/55216

ok christos

one more level down

probably fix previous: it wants mod.mk's PARSEDIR/.., not ../..,
so it picks up the libpam/Makefile.inc.

Handle pam modules that are not in this subtree.

branches: 1.12.26;
warns 6

branches: 1.11.6;
remove unneeded change

Use -X so that the link-set symbols are not stripped.

branches: 1.9.6;
Build the modules in two phases:
1. build the static modules first, before libpam so that the static
libpam can link against the module .a files.
2. build the modules after the dynamic libpam is build, so that the
dynamic modules can link against the dynamic libpam.

make the dependency to libpam, explicit. Fixes afpd in pkgsrc. From Mark Davies
XXX: Should be pulled up to 4.x and 5.x.

rename LD32DIR to MLIBDIR.

branches: 1.6.2; 1.6.8;
don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

Don't try to build PIC stuff if we cannot do PIC.

Use LIBDPLIBS to provide the list of libraries for the modules to depend
upon, because:
* it's MUCH quicker; no need to calculate the OBJDIRS of every library
we might require in every subdir.
(make obj drops from 21s to 3s on my system.)
* it's more robust when building to a fresh DESTDIR.

Link with libraries from the source build directory.

Install modules into /usr/lib/security

- NetBSD build glue
- Warning fixes
- RCSID's

Get ready to handle the openssl move from bsd -> apache2

branches: 1.7.16;
switch everyone to openssl.old

Upgrade Heimdal to 1.5pre1 by switching the build from crypto/dist/heimdal
to crypto/external/bsd/heimdal. The latter was just imported as the head
of the Heimdal tree as of a few days ago.

use the proper libcrypto

use LIBDPLIBS+= not =.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

branches: 1.2.6;
Goodbye KerberosIV

pam_afslog is used in conjunction with pam_krb5 to obtain AFS tokens and
create a PAG if necessary.

Especially important for home directories on AFS.

branches: 1.2.6;
Remove trailing whitespace. Punctuation nits. Use .Nm more.
Use .An. Sort SEE ALSO.

pam_afslog is used in conjunction with pam_krb5 to obtain AFS tokens and
create a PAG if necessary.

Especially important for home directories on AFS.

branches: 1.2.6;
Declare what we services provide, otherwise pam assumes that we provide
everything and this breaks static linking.

pam_afslog is used in conjunction with pam_krb5 to obtain AFS tokens and
create a PAG if necessary.

Especially important for home directories on AFS.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

avoid using %m in format.

branches: 1.4.42;
check for pwd != in getpw*_r functions.

Use getpwnam_r().

branches: 1.2.2;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Whitespace and markup improvements.
Bump date for previous.

Add Edgar Fuss's patch to pam_deny, to allow users to be able to change their
LDAP password with "passwd".

branches: 1.3.48; 1.3.54;
Minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

remove useless variable

Add Edgar Fuss's patch to pam_deny, to allow users to be able to change their
LDAP password with "passwd".

branches: 1.2.48; 1.2.54;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Mask %U

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Sort SEE ALSO.

Merge PAM20050226.
XXX Hack here until we import OpenPAM Feterita.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

pam_exec: Convert realloc(x * y) to reallocarr.

Eliminate a now-redundant temporary variable.

Fix incorrect types

branches: 1.6.6;
avoid using %m in format.

branches: 1.5.4;
PR/44505: Mark Davies: pam_exec fails to realloc enough space, while
there add a volatile variable (From FreeBSD)

branches: 1.4.44;
Remove local copy of openpam_free_envlist.

Merge PAM20050226.
XXX Hack here until we import OpenPAM Feterita.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Improve wording of the BUGS section to make it easier to understand.
Ok'd by christos.

Bump date for previous. Remove trailing whitespace. Sort SEE ALSO.
Remove superfluous .Pp.

Document that this is broken and not used.

Minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

avoid using %m in format.

branches: 1.5.42;
Fix getgrnam -> getgrnam_r

check for pwd != in getpw*_r functions.

Use getpwnam_r().

branches: 1.2.2;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

use LIBDPLIBS+= not =.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

pam_group needs libutil & libcrypt

branches: 1.2.16; 1.2.22;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

We have 2005.

Add a new option "authenticate" that requires the user to enter his own
password to login.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

consistency in password prompt setting code (and with ssh)

custom password prompt that displays the user.

branches: 1.10.26;
don't include syslog.h if you are not going to use it.

fix getgrnam -> getgrnam_r and add a forgotten getpwnam -> gepwnam_r
From john nemeth

check for pwd != in getpw*_r functions.

Don't print an error if we are doing authentication.

Use getpwnam_r().

branches: 1.5.2;
Free the prompt response.

If authentication failed because the user was not in wheel, say so like
the old su did. From John Nemeth

Add a new option "authenticate" that requires the user to enter his own
password to login.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Sort SEE ALSO.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Get ready to handle the openssl move from bsd -> apache2

branches: 1.12.16;
switch everyone to openssl.old

Default to -Wno-sign-compare -Wno-pointer-sign for clang.
Push -Wno-array-bounds down to the cases that depend on it.
Selectively disable warnings for 3rd party software or non-trivial
issues to be reviewed later to get clang -Werror to build most of the
tree.

Upgrade Heimdal to 1.5pre1 by switching the build from crypto/dist/heimdal
to crypto/external/bsd/heimdal. The latter was just imported as the head
of the Heimdal tree as of a few days ago.

use the proper libcrypto

use LIBDPLIBS+= not =.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

Remove CPPFLAGS

Add ${DESTDIR}/usr/include/krb5 to CPPFLAGS so <parse_units.h> can be found.

Use LIBDPLIBS to provide the list of libraries for the modules to depend
upon, because:
* it's MUCH quicker; no need to calculate the OBJDIRS of every library
we might require in every subdir.
(make obj drops from 21s to 3s on my system.)
* it's more robust when building to a fresh DESTDIR.

Link with libraries from the source build directory.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

pam_krb5: Refuse to operate without a key to verify tickets.

New allow_kdc_spoof overrides this to restore previous behaviour
which was vulnerable to KDC spoofing, because without a host or
service key, pam_krb5 can't distinguish the legitimate KDC from a
spoofed one.

This way, having pam_krb5 enabled isn't dangerous even if you create
an empty /etc/krb5.conf to use client SSO without any host services.

Perhaps this should use krb5_verify_init_creds(3) instead, and
thereby respect the rather obscurely named krb5.conf option
verify_ap_req_nofail like the Linux pam_krb5 does, but:

- verify_ap_req_nofail is default-off (i.e., vulnerable by default),
- changing verify_ap_req_nofail to default-on would probably affect
more things and therefore be riskier,
- allow_kdc_spoof is a much clearer way to spell the idea,
- this patch is a smaller semantic change and thus less risky, and
- a security change with compatibility issues shouldn't have a
workaround that might introduce potentially worse security issues
or more compatibility issues.

Perhaps this should use krb5_verify_user(3) with secure=1 instead,
for simplicity, but it's not clear how to do that without first
prompting for the password -- which we shouldn't do at all if we
later decide we won't be able to use it anyway -- and without
repeating a bunch of the logic here anyway to pick the service name.

References about verify_ap_req_nofail:
- mit-krb5 discussion about verify_ap_req_nofail:
https://mailman.mit.edu/pipermail/krbdev/2011-January/009778.html
- Oracle has the default-secure setting in their krb5 system:
https://docs.oracle.com/cd/E26505_01/html/E27224/setup-148.html
https://docs.oracle.com/cd/E26505_01/html/816-5174/krb5.conf-4.html#REFMAN4krb5.conf-4
https://docs.oracle.com/cd/E19253-01/816-4557/gihyu/
- Heimdal issue on verify_ap_req_nofail default:
https://github.com/heimdal/heimdal/issues/1129

branches: 1.12.8; 1.12.16;
Remove workaround for ancient HTML generation code.

branches: 1.11.40;
Add missing copyright and license.

This license is identical to that on the pam_krb5.c file minus the
other copyrights and the unrelated contract attribution.

From email communication with the author, Frank Cusack.

eg -> e.g.

branches: 1.9.4;
bump date

tyop

PR/35968: Jukka Salmi: add option to pam_krb5(8) to request renewable tickets

Bump date for new SECURITY CONSIDERATIONS section.

Add a SECURITY CONSIDERATIONS section.

Wording consistency nits.

<> -> \*[Lt]\*[Gt].

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

pam_krb5: Fix PR lib/57631.

Loose ends in the fix for NetBSD-SA2023-006 that weren't caught by
review or, somehow, by my own testing. Evidently we need automatic
tests for this pam business.

XXX pullup-10
XXX pullup-9
XXX pullup-8

pam_krb5: Refuse to operate without a key to verify tickets.

New allow_kdc_spoof overrides this to restore previous behaviour
which was vulnerable to KDC spoofing, because without a host or
service key, pam_krb5 can't distinguish the legitimate KDC from a
spoofed one.

This way, having pam_krb5 enabled isn't dangerous even if you create
an empty /etc/krb5.conf to use client SSO without any host services.

Perhaps this should use krb5_verify_init_creds(3) instead, and
thereby respect the rather obscurely named krb5.conf option
verify_ap_req_nofail like the Linux pam_krb5 does, but:

- verify_ap_req_nofail is default-off (i.e., vulnerable by default),
- changing verify_ap_req_nofail to default-on would probably affect
more things and therefore be riskier,
- allow_kdc_spoof is a much clearer way to spell the idea,
- this patch is a smaller semantic change and thus less risky, and
- a security change with compatibility issues shouldn't have a
workaround that might introduce potentially worse security issues
or more compatibility issues.

Perhaps this should use krb5_verify_user(3) with secure=1 instead,
for simplicity, but it's not clear how to do that without first
prompting for the password -- which we shouldn't do at all if we
later decide we won't be able to use it anyway -- and without
repeating a bunch of the logic here anyway to pick the service name.

References about verify_ap_req_nofail:
- mit-krb5 discussion about verify_ap_req_nofail:
https://mailman.mit.edu/pipermail/krbdev/2011-January/009778.html
- Oracle has the default-secure setting in their krb5 system:
https://docs.oracle.com/cd/E26505_01/html/E27224/setup-148.html
https://docs.oracle.com/cd/E26505_01/html/816-5174/krb5.conf-4.html#REFMAN4krb5.conf-4
https://docs.oracle.com/cd/E19253-01/816-4557/gihyu/
- Heimdal issue on verify_ap_req_nofail default:
https://github.com/heimdal/heimdal/issues/1129

branches: 1.30.2;
libpam: remove stray semicolon

No binary change.

lib/libpam: Fix the possible -Werror=stringop-truncation

Replace strncpy(3) with the safer strlcpy(3) and adjust the code.

Error was reported when build.sh was run with MKLIBCSANITIZER=yes flag.

Reviewed by: kamil@, christos@

there is no potential overflow anymore (thanks Kamil)

stop using sprintf and check for buffer overflow.

branches: 1.26.18; 1.26.26; 1.26.28;
avoid using freed pointers and non-format strings

branches: 1.25.4; 1.25.10;
- make log_krb5 varyadic
- centralize error handling to one function
- check for NULL context

Remove use of functions marked as deprecated in Heimdal.

Fix misplaced parenthesis, from henning.petersen@t-online.de, thanks.

consistency in password prompt setting code (and with ssh)

branches: 1.21.12;
Fix compilation

branches: 1.20.4;
off by one, reported by jukka salmi.

PR/35968: Jukka Salmi: add option to pam_krb5(8) to request renewable tickets

init the syslog data.

use the re-entrant syslog functions so that we don't depend on the syslog
settings of the calling program.

Coverity CID 3783: Fix uninit variable.

Coverity CID 3677: Plug memory leak

Coverity CID 1909: Prevent memory leak.

Coverity CID 2480: Move variable initialization higher up to prevent
uninitialized access during error cleanup.

Coverity CID 2481: Move initialization of variable higher up to prevent
uninitialized access in error path.

Coverity CID 2595: Don't call cc_destroy after cc_close because cc_close
free's the second argument.

Implement PAM_REFRESH_CRED / PAM_REINITIALIZE_CRED
support in pam_sm_setcred()

With this and a suitably pam-aware screen locker (eg xscreensaver built
with PAM), you now get the nice Windows-style behavior of having
your tickets refreshed (and tokens, with pam_afslog) when you unlock
your screen.

getpw*_r() may return 0 and set pwd==NULL

check for pwd != in getpw*_r functions.

Use getpwnam_r().

branches: 1.6.2;
Place some limits on the creds acquired for password change. Other
minor cleanup inspired by passwd(1).

Use the more familar princ@realm style of password prompt.

Check for PAM_PRELIM_CHECK and simply do nothing. (Did this even work
in FreeBSD?)

Merge PAM20050226.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Get ready to handle the openssl move from bsd -> apache2

branches: 1.12.16;
switch everyone to openssl.old

Default to -Wno-sign-compare -Wno-pointer-sign for clang.
Push -Wno-array-bounds down to the cases that depend on it.
Selectively disable warnings for 3rd party software or non-trivial
issues to be reviewed later to get clang -Werror to build most of the
tree.

Upgrade Heimdal to 1.5pre1 by switching the build from crypto/dist/heimdal
to crypto/external/bsd/heimdal. The latter was just imported as the head
of the Heimdal tree as of a few days ago.

use the proper libcrypto

use LIBDPLIBS+= not =.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

Remove CPPFLAGS

Add ${DESTDIR}/usr/include/krb5 to CPPFLAGS so <parse_units.h> can be found.

Use LIBDPLIBS to provide the list of libraries for the modules to depend
upon, because:
* it's MUCH quicker; no need to calculate the OBJDIRS of every library
we might require in every subdir.
(make obj drops from 21s to 3s on my system.)
* it's more robust when building to a fresh DESTDIR.

Link with libraries from the source build directory.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Oops, one more nit.

Minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

pam_ksu(8): Allow homedir access during kuserok.

Otherwise, the default kuserok logic to look at ~targetuser/.k5login
would be blocked by the security measure to thwart NetBSD-SA2023-005.

(There are other ways, e.g. setting SYSTEM-K5LOGIN in /etc/krb5.conf
so the file is /etc/k5login.d/user instead of ~user/.k5login, but
that's not the default configuration and there are plenty of
deployments that rely on ~user/.k5login today.)

I reviewed libkrb5 for homedir access checks. There are three:

1. krb5_config_parse_file_multi, called only by:
- verify_krb5_conf -- not relevant
- krb5_config_parse_file -- not used here as far as I can tell,
only by libhdb ldap logic and test code in heimdal
- krb5_set_config_files -- used here only via krb5_init_context,
which is done at this point

2. plugin_get_hosts in krbhst.c, used to look up hosts for KDC I/O,
which shouldn't be happening at this point, so this is almost
certainly unreachable; also it only appears to control whether
some old plugin API can be used, long after we have read the krb5
config controlling which plugins are available, so this is
probably harmless

3. krb5_kuserok, which is the one we want to allow

Note: This will have to be updated again in the next Heimdal update,
which eliminates the global homedir access flag in favour of making
the default per-context homedir access flag conditional on !issuid.

XXX pullup-10
XXX pullup-9
XXX pullup-8

pam_ksu: No need for homedir access.

branches: 1.9.18; 1.9.28; 1.9.36;
Remove tautological check.

Fix incorrect types

avoid using freed pointers and non-format strings

branches: 1.6.4; 1.6.10;
fix pasto (of no consequence)

- make log_krb5 varyadic and merge the last error message.
- check for NULL context.
- print a more meaningful error when things go south

Stop using functions that are marked as deprecated in Heimdal.

consistency in password prompt setting code (and with ssh)

branches: 1.2.34;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

bsd.own.mk: rename GCC_NO_* to CC_WNO_*

Rename compiler-warning-disable variables from
GCC_NO_warning
to
CC_WNO_warning
where warning is the full warning name as used by the compiler.

GCC_NO_IMPLICIT_FALLTHRU is CC_WNO_IMPLICIT_FALLTHROUGH

Using the convention CC_compilerflag, where compilerflag
is based on the full compiler flag name.

introduce some common variables for use in GCC warning disables:

GCC_NO_FORMAT_TRUNCATION -Wno-format-truncation (GCC 7/8)
GCC_NO_STRINGOP_TRUNCATION -Wno-stringop-truncation (GCC 8)
GCC_NO_STRINGOP_OVERFLOW -Wno-stringop-overflow (GCC 8)
GCC_NO_CAST_FUNCTION_TYPE -Wno-cast-function-type (GCC 8)

use these to turn off warnings for most GCC-8 complaints. many
of these are false positives, most of the real bugs are already
commited, or are yet to come.


we plan to introduce versions of (some?) of these that use the
"-Wno-error=" form, which still displays the warnings but does
not make it an error, and all of the above will be re-considered
as either being "fix me" (warning still displayed) or "warning
is wrong."

Only exclude gcc-8 warnings if the gcc we're using is gcc>=8

don't warn for strncpy wtmp fields, they are not NUL terminated.

branches: 1.8.60;
use LIBDPLIBS+= not =.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

- Fix the quiet option; use login_cap to determine if we should print or not.
- Add nested user handling, including a no_nested option to control it.

Re-write to use both utmp and utmpx properly.

Use LIBDPLIBS to provide the list of libraries for the modules to depend
upon, because:
* it's MUCH quicker; no need to calculate the OBJDIRS of every library
we might require in every subdir.
(make obj drops from 21s to 3s on my system.)
* it's more robust when building to a fresh DESTDIR.

Link with libraries from the source build directory.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Document the no_nested option.

Merge PAM20050226.

Minor wording consistency nit.

Sort SEE ALSO, fix an xref, and s/FreeBSD/.Fx/.

Re-write to use both utmp and utmpx properly.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Annotate logit to provide transitive format string checks.

branches: 1.14.6;
avoid using %m in format.

branches: 1.13.8;
sign-compare fixes

init the syslog data.

use the re-entrant syslog functions so that we don't depend on the syslog
settings of the calling program.

Fix Coverity run 5, issue 2022 -- memory leak.
Approved by christos@.

PR/32870: Johan Veenhuizen: login(1) does not obey .hushlogin

check for pwd != in getpw*_r functions.

Use getpwnam_r().

branches: 1.6.2;
PR/29566: Izumi Tsutsui: login(1) shows wrong last-login-from host
Caused by improper initialization of struct lastlogx. Code has been
completely restructured, and we also now use pam_prompt() instead of
printf().
cvs: ----------------------------------------------------------------------

- Fix the quiet option; use login_cap to determine if we should print or not.
- Add nested user handling, including a no_nested option to control it.

Introduce a few more temporary variables, in order to avoid an ugly
double cast in the pam_get_item() invocations. The double cast
triggered a "discards qualifier" warning/error from gcc 2.95.3, while
trying to fix that by adding "cost" to the "void *" cast produced
a similar warning from gcc 3.3. This now compiles without warning
with both compilers.

Approved by christos

Re-write to use both utmp and utmpx properly.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Missing man page: login.access(5)

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

add missing word

branches: 1.1.1;
Initial revision

Annotate logit to provide transitive format string checks.

Fix incorrect types

branches: 1.6.6;
avoid using %m in format.

branches: 1.5.40;
init the syslog data.

don't include syslog.h if you are not going to use it.

Fix getgrnam -> getgrnam_r

branches: 1.2.2;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Minor grammar fix

Minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- reverse the order of printf formatting to make it easier for compilers to
check printf arguments
- add compiler checking for printf formats and fix broken ones.
From joerg@

branches: 1.3.40;
don't include syslog.h if you are not going to use it.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- Import freebsd's version of libpam as of today (20041212).
- Did not import opie, passwdqc, tacplus. We need to decide what to do
with them.
- Imported radius and ssh, although they will not work until we
import libradius and re-structure our tree to install libssh.

use LIBDPLIBS+= not =.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

Use LIBDPLIBS to provide the list of libraries for the modules to depend
upon, because:
* it's MUCH quicker; no need to calculate the OBJDIRS of every library
we might require in every subdir.
(make obj drops from 21s to 3s on my system.)
* it's more robust when building to a fresh DESTDIR.

Link with libraries from the source build directory.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

s!/var/run/nologin!/etc/nologin!g to match with the code.

branches: 1.4.2;
Minor wording consistency nit.

Fix Xref.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Fix incorrect types

use login_getpwclass() everywhere for consistency.

branches: 1.8.6; 1.8.12;
Close file handle after using it. Found by cppcheck.

Fix compilation

branches: 1.6.10;
Use the class of the user, not then default class, when checking for
nologin and ignorelogin login.conf(5) capabilities.

check for pwd != in getpw*_r functions.

Use getpwnam_r().

branches: 1.3.2;
Set correct default for the nologin file: /etc/nologin
Handle the ignorenologin capability

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Fix a markup bug and a minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

warns 6

branches: 1.6.18; 1.6.24;
use LIBDPLIBS+= not =.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

Use LIBDPLIBS to provide the list of libraries for the modules to depend
upon, because:
* it's MUCH quicker; no need to calculate the OBJDIRS of every library
we might require in every subdir.
(make obj drops from 21s to 3s on my system.)
* it's more robust when building to a fresh DESTDIR.

Link with libraries from the source build directory.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Merge riastradh-drm2 to HEAD.

Use Mt for email addresses.

branches: 1.5.48; 1.5.54; 1.5.60;
Add article.

Merge PAM20050226.

Minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Annotate logit to provide transitive format string checks.

branches: 1.7.40; 1.7.46;
init the syslog data.

use the re-entrant syslog functions so that we don't depend on the syslog
settings of the calling program.

Don't cast the lvalue; cast the rhs instead.

check for pwd != in getpw*_r functions.

Use getpwnam_r().

branches: 1.2.2;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

check for pwd != in getpw*_r functions.

Use getpwnam_r().

branches: 1.2.2;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

don't include syslog.h if you are not going to use it.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

init the syslog data.

use the re-entrant syslog functions so that we don't depend on the syslog
settings of the calling program.

PR/30923: Zafer Aydogan: pam too verbose

Syslog root login failures on insecure terminals.

Approved by christos@.

check for pwd != in getpw*_r functions.

Use getpwnam_r().

branches: 1.2.2;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

don't include syslog.h if you are not going to use it.

check for pwd != in getpw*_r functions.

Use getpwnam_r().

branches: 1.2.2;
- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

use LIBDPLIBS+= not =.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

Add an S/Key PAM module.

Convert TNF licenses to new 2 clause variant

branches: 1.1.24;
Add an S/Key PAM module.

Remove clause 3 and 4 from TNF licenses

branches: 1.2.18;
Make S/Key prompt compliant with RFC 2289. Patch supplied by Dave Huang
in PR bin/23167.

branches: 1.1.2;
Add an S/Key PAM module.

openssh: Do build and install compat libssh after all.

Even though it's not exposed for applications to _link_ against, it
is used by the dynamically _loadable_ pam_ssh module, which exists as
a compat module and therefore needs libssh as a compat library to be
installed somewhere. That somewhere will be
/usr/lib/${COMPAT_ARCH}/private.

Should fix problems like:

dependall ===> compat/sparc64/sparc/../../../lib/libpam/modules/pam_ssh
nbmake[11]: don't know how to make /home/source/ab/HEAD/src/crypto/external/bsd/openssh/lib/libssh.a. Stop

Verified in an amd64 build that the compat i386 pam_ssh.so is linked
correctly:

(chroot HEAD)# ldd /usr/lib/i386/security/pam_ssh.so.4
/usr/lib/i386/security/pam_ssh.so.4:
-lssh.50 => /usr/lib/i386/private/libssh.so.50
-lcrypto.16 => /usr/lib/i386/libcrypto.so.16
-lcrypt.1 => /usr/lib/i386/libcrypt.so.1
-lgcc_s.1 => /usr/lib/i386/libgcc_s.so.1
-lc.12 => /usr/lib/i386/libc.so.12
-lz.1 => /usr/lib/i386/libz.so.1

PR lib/58648: private shared libraries should go in /usr/lib/private,
not /usr/lib

Get ready to handle the openssl move from bsd -> apache2

branches: 1.13.10;
Redo the sshsk_sign() stuff properly, but putting the helper in libssh.so

Add the sign client part.

branches: 1.11.4; 1.11.6;
switch everyone to openssl.old

branches: 1.10.8; 1.10.14; 1.10.20;
use new openssh tree

use the proper libcrypto

build libnetpgp and libssh earlier.
look for libssh in the right place.

use LIBDPLIBS+= not =.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

Build & install pam_ssh.so.0 now that libssh is available for use.

Use LIBDPLIBS to provide the list of libraries for the modules to depend
upon, because:
* it's MUCH quicker; no need to calculate the OBJDIRS of every library
we might require in every subdir.
(make obj drops from 21s to 3s on my system.)
* it's more robust when building to a fresh DESTDIR.

Link with libraries from the source build directory.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Merge riastradh-drm2 to HEAD.

Use Mt for email addresses.

branches: 1.6.6; 1.6.10;
support ECDSA keys used by recent ssh

branches: 1.5.48;
Bump date for new SECURITY CONSIDERATIONS section.

Add a SECURITY CONSIDRATIONS section.

Minor wording consistency nit.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Adapt call of ssh_add_identity_constrained() after openssh update

Note, this commit log entry belongs to the previous commit (1.31)
and is to fix my screwup in the previous commit, Apologies all.

With the recent openssh update, ssh_add_identity_constrained() has had
its "maxsign" parameter removed. Adapt the mapping macro from
ssh_add_identity() -> ssh_add_identity_constrained() to cope.

While here, change the octal 0 (00) that was being passed to as the
final (size_t) arg to be a nice simple decimal 0 instead.

This should fix the current build breakage.

/* $NetBSD: pam_ssh.c,v 1.30 2022/06/15 08:31:34 hannken Exp $ */

/*-
* Copyright (c) 2003 Networks Associates Technology, Inc.
* All rights reserved.
*
* This software was developed for the FreeBSD Project by ThinkSec AS and
* NAI Labs, the Security Research Division of Network Associates, Inc.
* under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
* DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

#include <sys/cdefs.h>
#ifdef __FreeBSD__
__FBSDID("$FreeBSD: src/lib/libpam/modules/pam_ssh/pam_ssh.c,v 1.40 2004/02/10 10:13:21 des Exp $");
#else
__RCSID("$NetBSD: pam_ssh.c,v 1.30 2022/06/15 08:31:34 hannken Exp $");
#endif

#include <sys/param.h>
#include <sys/wait.h>

#include <errno.h>
#include <fcntl.h>
#include <paths.h>
#include <pwd.h>
#include <signal.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

#define PAM_SM_AUTH
#define PAM_SM_SESSION

#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <security/openpam.h>

#include <openssl/evp.h>

#include "sshkey.h"
#include "sshbuf.h"
#include "authfd.h"
#include "authfile.h"

#define ssh_add_identity(auth, key, comment) \
ssh_add_identity_constrained(auth, key, comment, 0, 0, NULL, NULL, 0)

extern char **environ;

struct pam_ssh_key {
struct sshkey *key;
char *comment;
};

static const char *pam_ssh_prompt = "SSH passphrase: ";
static const char *pam_ssh_have_keys = "pam_ssh_have_keys";

static const char *pam_ssh_keyfiles[] = {
".ssh/identity", /* SSH1 RSA key */
".ssh/id_rsa", /* SSH2 RSA key */
".ssh/id_dsa", /* SSH2 DSA key */
".ssh/id_ecdsa", /* SSH2 ECDSA key */
NULL
};

static const char *pam_ssh_agent = "/usr/bin/ssh-agent";
static const char *const pam_ssh_agent_argv[] = { "ssh_agent", "-s", NULL };
static const char *const pam_ssh_agent_envp[] = { NULL };

/*
* Attempts to load a private key from the specified file in the specified
* directory, using the specified passphrase. If successful, returns a
* struct pam_ssh_key containing the key and its comment.
*/
static struct pam_ssh_key *
pam_ssh_load_key(const char *dir, const char *kfn, const char *passphrase,
int nullok)
{
struct pam_ssh_key *psk;
char fn[PATH_MAX];
int r;
char *comment;
struct sshkey *key;

if (snprintf(fn, sizeof(fn), "%s/%s", dir, kfn) > (int)sizeof(fn))
return (NULL);
comment = NULL;
/*
* If the key is unencrypted, OpenSSL ignores the passphrase, so
* it will seem like the user typed in the right one. This allows
* a user to circumvent nullok by providing a dummy passphrase.
* Verify that the key really *is* encrypted by trying to load it
* with an empty passphrase, and if the key is not encrypted,
* accept only an empty passphrase.
*/
r = sshkey_load_private(fn, "", &key, &comment);
if (r == 0 && !(*passphrase == '\0' && nullok)) {
openpam_log(PAM_LOG_DEBUG, "rejected unencrypted key from %s", fn);
sshkey_free(key);
free(comment);
return (NULL);
}
if (r)
r = sshkey_load_private(fn, passphrase, &key, &comment);
if (r) {
openpam_log(PAM_LOG_DEBUG, "failed to load key from %s", fn);
if (comment != NULL)
free(comment);
return (NULL);
}

openpam_log(PAM_LOG_DEBUG, "loaded '%s' from %s", comment, fn);
if ((psk = malloc(sizeof(*psk))) == NULL) {
sshkey_free(key);
free(comment);
return (NULL);
}
psk->key = key;
psk->comment = comment;
return (psk);
}

/*
* Wipes a private key and frees the associated resources.
*/
static void
pam_ssh_free_key(pam_handle_t *pamh __unused,
void *data, int pam_err __unused)
{
struct pam_ssh_key *psk;

psk = data;
sshkey_free(psk->key);
free(psk->comment);
free(psk);
}

PAM_EXTERN int
pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
int argc __unused, const char *argv[] __unused)
{
const char **kfn, *passphrase, *user;
const void *item;
struct passwd *pwd, pwres;
struct pam_ssh_key *psk;
int nkeys, nullok, pam_err, pass;
char pwbuf[1024];

nullok = (openpam_get_option(pamh, "nullok") != NULL);

/* PEM is not loaded by default */
OpenSSL_add_all_algorithms();

/* get user name and home directory */
pam_err = pam_get_user(pamh, &user, NULL);
if (pam_err != PAM_SUCCESS)
return (pam_err);
if (getpwnam_r(user, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0 ||
pwd == NULL)
return (PAM_USER_UNKNOWN);
if (pwd->pw_dir == NULL)
return (PAM_AUTH_ERR);

nkeys = 0;
pass = (pam_get_item(pamh, PAM_AUTHTOK, &item) == PAM_SUCCESS &&
item != NULL);
load_keys:
/* get passphrase */
pam_err = pam_get_authtok(pamh, PAM_AUTHTOK,
&passphrase, pam_ssh_prompt);
if (pam_err != PAM_SUCCESS)
return (pam_err);

/* switch to user credentials */
pam_err = openpam_borrow_cred(pamh, pwd);
if (pam_err != PAM_SUCCESS)
return (pam_err);

/* try to load keys from all keyfiles we know of */
for (kfn = pam_ssh_keyfiles; *kfn != NULL; ++kfn) {
psk = pam_ssh_load_key(pwd->pw_dir, *kfn, passphrase, nullok);
if (psk != NULL) {
pam_set_data(pamh, *kfn, psk, pam_ssh_free_key);
++nkeys;
}
}

/* switch back to arbitrator credentials */
openpam_restore_cred(pamh);

/*
* If we tried an old token and didn't get anything, and
* try_first_pass was specified, try again after prompting the
* user for a new passphrase.
*/
if (nkeys == 0 && pass == 1 &&
openpam_get_option(pamh, "try_first_pass") != NULL) {
pam_set_item(pamh, PAM_AUTHTOK, NULL);
pass = 0;
goto load_keys;
}

/* no keys? */
if (nkeys == 0)
return (PAM_AUTH_ERR);

pam_set_data(pamh, pam_ssh_have_keys, NULL, NULL);
return (PAM_SUCCESS);
}

PAM_EXTERN int
pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
int argc __unused, const char *argv[] __unused)
{

return (PAM_SUCCESS);
}

/*
* Parses a line from ssh-agent's output.
*/
static void
pam_ssh_process_agent_output(pam_handle_t *pamh, FILE *f)
{
char *line, *p, *key, *val;
size_t len;

while ((line = fgetln(f, &len)) != NULL) {
if (len < 4 || strncmp(line, "SSH_", 4) != 0)
continue;

/* find equal sign at end of key */
for (p = key = line; p < line + len; ++p)
if (*p == '=')
break;
if (p == line + len || *p != '=')
continue;
*p = '\0';

/* find semicolon at end of value */
for (val = ++p; p < line + len; ++p)
if (*p == ';')
break;
if (p == line + len || *p != ';')
continue;
*p = '\0';

/* store key-value pair in environment */
openpam_log(PAM_LOG_DEBUG, "got %s: %s", key, val);
pam_setenv(pamh, key, val, 1);
}
}

/*
* Starts an ssh agent and stores the environment variables derived from
* its output.
*/
static int
pam_ssh_start_agent(pam_handle_t *pamh, struct passwd *pwd)
{
int agent_pipe[2];
pid_t pid;
FILE *f;

/* get a pipe which we will use to read the agent's output */
if (pipe(agent_pipe) == -1)
return (PAM_SYSTEM_ERR);

/* start the agent */
openpam_log(PAM_LOG_DEBUG, "starting an ssh agent");
pid = fork();
if (pid == (pid_t)-1) {
/* failed */
close(agent_pipe[0]);
close(agent_pipe[1]);
return (PAM_SYSTEM_ERR);
}
if (pid == 0) {
#ifndef F_CLOSEM
int fd;
#endif
/* child: drop privs, close fds and start agent */
if (setgid(pwd->pw_gid) == -1) {
openpam_log(PAM_LOG_DEBUG, "%s: Cannot setgid %d (%s)",
__func__, (int)pwd->pw_gid, strerror(errno));
goto done;
}
if (initgroups(pwd->pw_name, pwd->pw_gid) == -1) {
openpam_log(PAM_LOG_DEBUG,
"%s: Cannot initgroups for %s (%s)",
__func__, pwd->pw_name, strerror(errno));
goto done;
}
if (setuid(pwd->pw_uid) == -1) {
openpam_log(PAM_LOG_DEBUG, "%s: Cannot setuid %d (%s)",
__func__, (int)pwd->pw_uid, strerror(errno));
goto done;
}
(void)close(STDIN_FILENO);
(void)open(_PATH_DEVNULL, O_RDONLY);
(void)dup2(agent_pipe[1], STDOUT_FILENO);
(void)dup2(agent_pipe[1], STDERR_FILENO);
#ifdef F_CLOSEM
(void)fcntl(3, F_CLOSEM, 0);
#else
for (fd = 3; fd < getdtablesize(); ++fd)
(void)close(fd);
#endif
(void)execve(pam_ssh_agent,
(char **)__UNCONST(pam_ssh_agent_argv),
(char **)__UNCONST(pam_ssh_agent_envp));
done:
_exit(127);
}

/* parent */
close(agent_pipe[1]);
if ((f = fdopen(agent_pipe[0], "r")) == NULL)
return (PAM_SYSTEM_ERR);
pam_ssh_process_agent_output(pamh, f);
fclose(f);

return (PAM_SUCCESS);
}

/*
* Adds previously stored keys to a running agent.
*/
static int
pam_ssh_add_keys_to_agent(pam_handle_t *pamh)
{
const struct pam_ssh_key *psk;
const char **kfn;
char **envlist, **env;
int pam_err;
int agent_fd;

/* switch to PAM environment */
envlist = environ;
if ((environ = pam_getenvlist(pamh)) == NULL) {
openpam_log(PAM_LOG_DEBUG, "%s: cannot get envlist",
__func__);
environ = envlist;
return (PAM_SYSTEM_ERR);
}

/* get a connection to the agent */
if (ssh_get_authentication_socket(&agent_fd) != 0) {
openpam_log(PAM_LOG_DEBUG,
"%s: cannot get authentication connection",
__func__);
pam_err = PAM_SYSTEM_ERR;
agent_fd = -1;
goto end;
}

/* look for keys to add to it */
for (kfn = pam_ssh_keyfiles; *kfn != NULL; ++kfn) {
const void *vp;
pam_err = pam_get_data(pamh, *kfn, &vp);
psk = vp;
if (pam_err == PAM_SUCCESS && psk != NULL) {
if (ssh_add_identity(agent_fd, psk->key, psk->comment))
openpam_log(PAM_LOG_DEBUG,
"added %s to ssh agent", psk->comment);
else
openpam_log(PAM_LOG_DEBUG, "failed "
"to add %s to ssh agent", psk->comment);
/* we won't need the key again, so wipe it */
pam_set_data(pamh, *kfn, NULL, NULL);
}
}
pam_err = PAM_SUCCESS;
end:
/* disconnect from agent */
if (agent_fd != -1)
ssh_close_authentication_socket(agent_fd);

/* switch back to original environment */
for (env = environ; *env != NULL; ++env)
free(*env);
free(environ);
environ = envlist;

return (pam_err);
}

PAM_EXTERN int
pam_sm_open_session(pam_handle_t *pamh, int flags __unused,
int argc __unused, const char *argv[] __unused)
{
struct passwd *pwd, pwres;
const char *user;
const void *data;
int pam_err = PAM_SUCCESS;
char pwbuf[1024];

/* no keys, no work */
if (pam_get_data(pamh, pam_ssh_have_keys, &data) != PAM_SUCCESS &&
openpam_get_option(pamh, "want_agent") == NULL)
return (PAM_SUCCESS);

/* switch to user credentials */
pam_err = pam_get_user(pamh, &user, NULL);
if (pam_err != PAM_SUCCESS)
return (pam_err);
if (getpwnam_r(user, &pwres, pwbuf, sizeof(pwbuf), &pwd) != 0 ||
pwd == NULL)
return (PAM_USER_UNKNOWN);

/* start the agent */
pam_err = pam_ssh_start_agent(pamh, pwd);
if (pam_err != PAM_SUCCESS)
return pam_err;

pam_err = openpam_borrow_cred(pamh, pwd);
if (pam_err != PAM_SUCCESS)
return pam_err;

/* we have an agent, see if we can add any keys to it */
pam_err = pam_ssh_add_keys_to_agent(pamh);
if (pam_err != PAM_SUCCESS) {
/* XXX ignore failures */
openpam_log(PAM_LOG_DEBUG, "failed adding keys to ssh agent");
pam_err = PAM_SUCCESS;
}

openpam_restore_cred(pamh);
return pam_err;
}

PAM_EXTERN int
pam_sm_close_session(pam_handle_t *pamh, int flags __unused,
int argc __unused, const char *argv[] __unused)
{
const char *ssh_agent_pid;
char *end;
int status;
pid_t pid;

if ((ssh_agent_pid = pam_getenv(pamh, "SSH_AGENT_PID")) == NULL) {
openpam_log(PAM_LOG_DEBUG, "no ssh agent");
return (PAM_SUCCESS);
}
pid = (pid_t)strtol(ssh_agent_pid, &end, 10);
if (*ssh_agent_pid == '\0' || *end != '\0') {
openpam_log(PAM_LOG_DEBUG, "invalid ssh agent pid");
return (PAM_SESSION_ERR);
}
openpam_log(PAM_LOG_DEBUG, "killing ssh agent %d", (int)pid);
if (kill(pid, SIGTERM) == -1 ||
(waitpid(pid, &status, 0) == -1 && errno != ECHILD))
return (PAM_SYSTEM_ERR);
return (PAM_SUCCESS);
}

PAM_MODULE_ENTRY("pam_ssh");

Set provider to NULL -- "pam" is not a valid security key helper library.
Now ssh-agent no longer fails key addition with

error: Cannot add provider: RSA is not an authenticator-hosted key

Add constrain arguments

This takes a provider now

branches: 1.27.2;
Fix key loading logic and add log message when rejecting an unencrypted key.

adjust to new libssh api.

branches: 1.25.2;
fix and use the macro.

function grew an extra argument now.

branches: 1.23.14;
Adapt to the new API.

branches: 1.22.2; 1.22.8; 1.22.14; 1.22.18;
pull in from FreeBSD rev.1.41: Narrow the use of user credentials.
(call pam_get_authtok() with caller's rights rather than user's)

avoid using %m in format.

support ECDSA keys used by recent ssh

disallow empty passphrases per default, and implement the "nullok"
option to allow it if the administator wishes, from FreeBSD

-remove remainders of the misguided changes in revs 1.5-1.9
-iron out more unnecessary differences to FreeBSD

branches: 1.17.4;
remove excess newlines in debug output

Use ssh_add_identity_constrained() instead of ssh_add_identity()

Fix compilation

__FUNCTION__ -> __func__.

branches: 1.13.8;
new ssh import requires another include

Fix coverity run 5, issue 2018 -- memory leak.
Approved by christos.

check for pwd != in getpw*_r functions.

Use getpwnam_r().

remove debugging printf's

branches: 1.8.2;
remove code to deal with authorized keys. it has no place here.

Go back to rev-1.5. This is better than what was there before, but I am
still uncertain about the proper way to dealing what keys to accept.

Revert previous. This is not the right fix.

Do not let keys that are not listed in authorized_keys participate
in authentication. Problem reported by Maximum Entropy.

NetBSD does not allow setuid(user) when euid=user, and ruid=0. Change
the logic for setting the uid/gid/groups for the agent around and also
add error checking. I.e. Don't exec the agent, if we could not set
the proper environment for it. Add a few more debugging lines. Now ssh
authentication works through xdm.

s/ifndef/ifdef/ for __FreeBSD__

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

use LIBDPLIBS+= not =.

don't set LIBDPLIBS in libpam/modules/Makefile - it is not necessary
and it interferes with the compat lib build. don't use LIB_ROOT_DIR.

Set NOxxx before including <bsd.own.mk>; we can't rely upon ../mod.mk
in this situation.

Use LIBDPLIBS to provide the list of libraries for the modules to depend
upon, because:
* it's MUCH quicker; no need to calculate the OBJDIRS of every library
we might require in every subdir.
(make obj drops from 21s to 3s on my system.)
* it's more robust when building to a fresh DESTDIR.

Link with libraries from the source build directory.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

Simply Subsection headers

There was a formatting issue with mandoc showing the
literal "Ss" macros. I reported this bug to mandoc since groff
didn't have same formatting. It was recommended to simplify
the formatting due to the weird feature.
Note because of this for groff I didn't use the Ux macro but spelled
out UNIX literally for these subsection headers
(since the macro reset the subsection formatting which was why
the Ss macro was repeated before to reactivate it).

branches: 1.8.90;
Merge PAM20050226.

Drop trailing whitespace.

Bump date for previous.

Remove references to local_pass and nis_pass. Add description of
passwd_db option of the password management module.

Minor wording consistency nit.

Fix Xref.

- NetBSD build glue
- Warning fixes
- RCSID's

branches: 1.1.1;
Initial revision

nix double n, i or g in "ing", in comments and documentation.

fix various typos in comments and output/log messages.

Improve type safety by using the correct enum values.

branches: 1.16.24;
Fix incorrect types

use login_getpwclass() everywhere for consistency.

branches: 1.14.6; 1.14.12;
if changing the password, don't clear PAM_AUTHTOK at the beginning -- this
sabotages external password strength checkers

Restore the good old UNIX behavior of root password changing: only root
may change the root password.

(Checked that everybody else's password can be changed without any problem,
and checked that root can still change the root password.)

sign-compare fixes

branches: 1.11.4; 1.11.14; 1.11.26; 1.11.28;
PR/30730 force changing password via chsh fails
PR/33502 password aging not working
copy old_pwd to new_pwd before modifying

Fix Coverity run 5, issue 2498 -- uninitialized variable
Fix Coverity run 5, issue 707 -- unreachable code
Approved by Christos.

Safety boots: don't depend upon getpwnam_r() to set pwd to NULL on all
failures, especially if we're going to ignore the return result.

check for pwd != in getpw*_r functions.

Use getpwnam_r().

Clear the authorization token at the entry of each loop, so that
we get a chance to re-enter.

branches: 1.5.2;
Make sure to set yppwd.oldpass.

adapt to pw_gensalt() change.

eliminate the third copy of pwd_gensalt.

- NetBSD specific fixes.
- Changes from Jason to use our YP stuff.

branches: 1.1.1;
Initial revision

branches: 1.1.2;
Build the modules in two phases:
1. build the static modules first, before libpam so that the static
libpam can link against the module .a files.
2. build the modules after the dynamic libpam is build, so that the
dynamic modules can link against the dynamic libpam.