login.c revision 1.45 1 1.45 christos /* $NetBSD: login.c,v 1.45 1999/08/25 19:58:15 christos Exp $ */
2 1.12 jtc
3 1.1 cgd /*-
4 1.12 jtc * Copyright (c) 1980, 1987, 1988, 1991, 1993, 1994
5 1.10 brezak * The Regents of the University of California. All rights reserved.
6 1.1 cgd *
7 1.1 cgd * Redistribution and use in source and binary forms, with or without
8 1.1 cgd * modification, are permitted provided that the following conditions
9 1.1 cgd * are met:
10 1.1 cgd * 1. Redistributions of source code must retain the above copyright
11 1.1 cgd * notice, this list of conditions and the following disclaimer.
12 1.1 cgd * 2. Redistributions in binary form must reproduce the above copyright
13 1.1 cgd * notice, this list of conditions and the following disclaimer in the
14 1.1 cgd * documentation and/or other materials provided with the distribution.
15 1.1 cgd * 3. All advertising materials mentioning features or use of this software
16 1.1 cgd * must display the following acknowledgement:
17 1.1 cgd * This product includes software developed by the University of
18 1.1 cgd * California, Berkeley and its contributors.
19 1.1 cgd * 4. Neither the name of the University nor the names of its contributors
20 1.1 cgd * may be used to endorse or promote products derived from this software
21 1.1 cgd * without specific prior written permission.
22 1.1 cgd *
23 1.1 cgd * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24 1.1 cgd * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 1.1 cgd * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 1.1 cgd * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27 1.1 cgd * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 1.1 cgd * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 1.1 cgd * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 1.1 cgd * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 1.1 cgd * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 1.1 cgd * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 1.1 cgd * SUCH DAMAGE.
34 1.1 cgd */
35 1.1 cgd
36 1.24 lukem #include <sys/cdefs.h>
37 1.1 cgd #ifndef lint
38 1.24 lukem __COPYRIGHT(
39 1.12 jtc "@(#) Copyright (c) 1980, 1987, 1988, 1991, 1993, 1994\n\
40 1.24 lukem The Regents of the University of California. All rights reserved.\n");
41 1.1 cgd #endif /* not lint */
42 1.1 cgd
43 1.1 cgd #ifndef lint
44 1.12 jtc #if 0
45 1.12 jtc static char sccsid[] = "@(#)login.c 8.4 (Berkeley) 4/2/94";
46 1.12 jtc #endif
47 1.45 christos __RCSID("$NetBSD: login.c,v 1.45 1999/08/25 19:58:15 christos Exp $");
48 1.1 cgd #endif /* not lint */
49 1.1 cgd
50 1.1 cgd /*
51 1.1 cgd * login [ name ]
52 1.1 cgd * login -h hostname (for telnetd, etc.)
53 1.1 cgd * login -f name (for pre-authenticated login: datakit, xterm, etc.)
54 1.1 cgd */
55 1.1 cgd
56 1.1 cgd #include <sys/param.h>
57 1.1 cgd #include <sys/stat.h>
58 1.1 cgd #include <sys/time.h>
59 1.1 cgd #include <sys/resource.h>
60 1.1 cgd #include <sys/file.h>
61 1.38 mrg #include <sys/wait.h>
62 1.1 cgd
63 1.12 jtc #include <err.h>
64 1.5 cgd #include <errno.h>
65 1.1 cgd #include <grp.h>
66 1.1 cgd #include <pwd.h>
67 1.12 jtc #include <setjmp.h>
68 1.12 jtc #include <signal.h>
69 1.19 veego #include <stdio.h>
70 1.5 cgd #include <stdlib.h>
71 1.1 cgd #include <string.h>
72 1.12 jtc #include <syslog.h>
73 1.36 kleink #include <time.h>
74 1.12 jtc #include <ttyent.h>
75 1.12 jtc #include <tzfile.h>
76 1.12 jtc #include <unistd.h>
77 1.12 jtc #include <utmp.h>
78 1.13 jtc #include <util.h>
79 1.29 mycroft #ifdef SKEY
80 1.29 mycroft #include <skey.h>
81 1.29 mycroft #endif
82 1.25 mycroft #ifdef KERBEROS5
83 1.45 christos #include <krb5/krb5.h>
84 1.45 christos #include <kerberosIV/com_err.h>
85 1.25 mycroft #endif
86 1.25 mycroft
87 1.1 cgd #include "pathnames.h"
88 1.1 cgd
89 1.5 cgd void badlogin __P((char *));
90 1.5 cgd void checknologin __P((void));
91 1.5 cgd void dolastlog __P((int));
92 1.5 cgd void getloginname __P((void));
93 1.24 lukem int main __P((int, char *[]));
94 1.5 cgd void motd __P((void));
95 1.5 cgd int rootterm __P((char *));
96 1.5 cgd void sigint __P((int));
97 1.5 cgd void sleepexit __P((int));
98 1.39 mycroft const char *stypeof __P((const char *));
99 1.5 cgd void timedout __P((int));
100 1.10 brezak #if defined(KERBEROS) || defined(KERBEROS5)
101 1.5 cgd int klogin __P((struct passwd *, char *, char *, char *));
102 1.12 jtc void kdestroy __P((void));
103 1.12 jtc void dofork __P((void));
104 1.5 cgd #endif
105 1.44 aidan #ifdef KERBEROS5
106 1.44 aidan int k5_read_creds __P((char*));
107 1.44 aidan int k5_write_creds __P((void));
108 1.44 aidan #endif
109 1.12 jtc
110 1.1 cgd #define TTYGRPNAME "tty" /* name of group to own ttys */
111 1.1 cgd
112 1.1 cgd /*
113 1.1 cgd * This bounds the time given to login. Not a define so it can
114 1.1 cgd * be patched on machines where it's too small.
115 1.1 cgd */
116 1.12 jtc u_int timeout = 300;
117 1.5 cgd
118 1.10 brezak #if defined(KERBEROS) || defined(KERBEROS5)
119 1.1 cgd int notickets = 1;
120 1.1 cgd char *instance;
121 1.12 jtc char *krbtkfile_env;
122 1.1 cgd #endif
123 1.25 mycroft #ifdef KERBEROS5
124 1.25 mycroft extern krb5_context kcontext;
125 1.44 aidan extern int have_forward;
126 1.25 mycroft #endif
127 1.1 cgd
128 1.1 cgd struct passwd *pwd;
129 1.1 cgd int failures;
130 1.1 cgd char term[64], *envinit[1], *hostname, *username, *tty;
131 1.1 cgd
132 1.34 thorpej static const char copyrightstr[] = "\
133 1.41 lukem Copyright (c) 1996, 1997, 1998, 1999
134 1.34 thorpej \tThe NetBSD Foundation, Inc. All rights reserved.
135 1.34 thorpej Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
136 1.34 thorpej \tThe Regents of the University of California. All rights reserved.\n\n";
137 1.34 thorpej
138 1.5 cgd int
139 1.1 cgd main(argc, argv)
140 1.1 cgd int argc;
141 1.5 cgd char *argv[];
142 1.1 cgd {
143 1.5 cgd extern char **environ;
144 1.5 cgd struct group *gr;
145 1.5 cgd struct stat st;
146 1.5 cgd struct timeval tp;
147 1.5 cgd struct utmp utmp;
148 1.29 mycroft int ask, ch, cnt, fflag, hflag, pflag, sflag, quietlog, rootlogin, rval;
149 1.44 aidan int Fflag;
150 1.33 hubertf uid_t uid, saved_uid;
151 1.35 hubertf gid_t saved_gid, saved_gids[NGROUPS_MAX];
152 1.35 hubertf int nsaved_gids;
153 1.39 mycroft char *domain, *p, *ttyn, *pwprompt;
154 1.39 mycroft const char *salt;
155 1.1 cgd char tbuf[MAXPATHLEN + 2], tname[sizeof(_PATH_TTY) + 10];
156 1.37 mrg char localhost[MAXHOSTNAMELEN + 1];
157 1.29 mycroft int need_chpass, require_chpass;
158 1.25 mycroft #ifdef KERBEROS5
159 1.25 mycroft krb5_error_code kerror;
160 1.25 mycroft #endif
161 1.1 cgd
162 1.20 lukem tbuf[0] = '\0';
163 1.20 lukem rval = 0;
164 1.20 lukem pwprompt = NULL;
165 1.29 mycroft need_chpass = require_chpass = 0;
166 1.20 lukem
167 1.1 cgd (void)signal(SIGALRM, timedout);
168 1.12 jtc (void)alarm(timeout);
169 1.1 cgd (void)signal(SIGQUIT, SIG_IGN);
170 1.1 cgd (void)signal(SIGINT, SIG_IGN);
171 1.1 cgd (void)setpriority(PRIO_PROCESS, 0, 0);
172 1.1 cgd
173 1.1 cgd openlog("login", LOG_ODELAY, LOG_AUTH);
174 1.1 cgd
175 1.1 cgd /*
176 1.1 cgd * -p is used by getty to tell login not to destroy the environment
177 1.5 cgd * -f is used to skip a second login authentication
178 1.1 cgd * -h is used by other servers to pass the name of the remote
179 1.1 cgd * host to login so that it may be placed in utmp and wtmp
180 1.20 lukem * -s is used to force use of S/Key or equivalent.
181 1.1 cgd */
182 1.1 cgd domain = NULL;
183 1.1 cgd if (gethostname(localhost, sizeof(localhost)) < 0)
184 1.1 cgd syslog(LOG_ERR, "couldn't get local hostname: %m");
185 1.1 cgd else
186 1.12 jtc domain = strchr(localhost, '.');
187 1.37 mrg localhost[sizeof(localhost) - 1] = '\0';
188 1.1 cgd
189 1.44 aidan Fflag = fflag = hflag = pflag = sflag = 0;
190 1.44 aidan #ifdef KERBEROS5
191 1.44 aidan have_forward = 0;
192 1.44 aidan #endif
193 1.1 cgd uid = getuid();
194 1.44 aidan while ((ch = getopt(argc, argv, "Ffh:ps")) != -1)
195 1.1 cgd switch (ch) {
196 1.44 aidan case 'F':
197 1.44 aidan Fflag = 1;
198 1.44 aidan /* FALLTHROUGH */
199 1.1 cgd case 'f':
200 1.1 cgd fflag = 1;
201 1.1 cgd break;
202 1.1 cgd case 'h':
203 1.12 jtc if (uid)
204 1.12 jtc errx(1, "-h option: %s", strerror(EPERM));
205 1.1 cgd hflag = 1;
206 1.23 mikel if (domain && (p = strchr(optarg, '.')) != NULL &&
207 1.1 cgd strcasecmp(p, domain) == 0)
208 1.1 cgd *p = 0;
209 1.1 cgd hostname = optarg;
210 1.1 cgd break;
211 1.1 cgd case 'p':
212 1.1 cgd pflag = 1;
213 1.1 cgd break;
214 1.20 lukem case 's':
215 1.29 mycroft sflag = 1;
216 1.20 lukem break;
217 1.29 mycroft default:
218 1.1 cgd case '?':
219 1.1 cgd (void)fprintf(stderr,
220 1.29 mycroft "usage: login [-fps] [-h hostname] [username]\n");
221 1.1 cgd exit(1);
222 1.1 cgd }
223 1.1 cgd argc -= optind;
224 1.1 cgd argv += optind;
225 1.5 cgd
226 1.1 cgd if (*argv) {
227 1.1 cgd username = *argv;
228 1.1 cgd ask = 0;
229 1.1 cgd } else
230 1.1 cgd ask = 1;
231 1.1 cgd
232 1.1 cgd for (cnt = getdtablesize(); cnt > 2; cnt--)
233 1.5 cgd (void)close(cnt);
234 1.1 cgd
235 1.5 cgd ttyn = ttyname(STDIN_FILENO);
236 1.1 cgd if (ttyn == NULL || *ttyn == '\0') {
237 1.5 cgd (void)snprintf(tname, sizeof(tname), "%s??", _PATH_TTY);
238 1.1 cgd ttyn = tname;
239 1.1 cgd }
240 1.23 mikel if ((tty = strrchr(ttyn, '/')) != NULL)
241 1.1 cgd ++tty;
242 1.1 cgd else
243 1.1 cgd tty = ttyn;
244 1.25 mycroft
245 1.25 mycroft #ifdef KERBEROS5
246 1.25 mycroft kerror = krb5_init_context(&kcontext);
247 1.25 mycroft if (kerror) {
248 1.25 mycroft syslog(LOG_NOTICE, "%s when initializing Kerberos context",
249 1.25 mycroft error_message(kerror));
250 1.25 mycroft exit(1);
251 1.25 mycroft }
252 1.25 mycroft #endif KERBEROS5
253 1.1 cgd
254 1.1 cgd for (cnt = 0;; ask = 1) {
255 1.10 brezak #if defined(KERBEROS) || defined(KERBEROS5)
256 1.10 brezak kdestroy();
257 1.10 brezak #endif
258 1.1 cgd if (ask) {
259 1.1 cgd fflag = 0;
260 1.1 cgd getloginname();
261 1.1 cgd }
262 1.5 cgd rootlogin = 0;
263 1.29 mycroft #ifdef KERBEROS
264 1.29 mycroft if ((instance = strchr(username, '.')) != NULL)
265 1.1 cgd *instance++ = '\0';
266 1.29 mycroft else
267 1.1 cgd instance = "";
268 1.1 cgd #endif
269 1.10 brezak #ifdef KERBEROS5
270 1.29 mycroft if ((instance = strchr(username, '/')) != NULL)
271 1.10 brezak *instance++ = '\0';
272 1.29 mycroft else
273 1.10 brezak instance = "";
274 1.10 brezak #endif
275 1.16 sommerfe if (strlen(username) > MAXLOGNAME)
276 1.16 sommerfe username[MAXLOGNAME] = '\0';
277 1.1 cgd
278 1.1 cgd /*
279 1.1 cgd * Note if trying multiple user names; log failures for
280 1.1 cgd * previous user name, but don't bother logging one failure
281 1.1 cgd * for nonexistent name (mistyped username).
282 1.1 cgd */
283 1.1 cgd if (failures && strcmp(tbuf, username)) {
284 1.1 cgd if (failures > (pwd ? 0 : 1))
285 1.1 cgd badlogin(tbuf);
286 1.1 cgd failures = 0;
287 1.1 cgd }
288 1.17 mrg (void)strncpy(tbuf, username, sizeof(tbuf) - 1);
289 1.38 mrg tbuf[sizeof(tbuf) - 1] = '\0';
290 1.1 cgd
291 1.23 mikel if ((pwd = getpwnam(username)) != NULL)
292 1.1 cgd salt = pwd->pw_passwd;
293 1.1 cgd else
294 1.1 cgd salt = "xx";
295 1.1 cgd
296 1.1 cgd /*
297 1.1 cgd * if we have a valid account name, and it doesn't have a
298 1.1 cgd * password, or the -f option was specified and the caller
299 1.1 cgd * is root or the caller isn't changing their uid, don't
300 1.1 cgd * authenticate.
301 1.1 cgd */
302 1.7 mycroft if (pwd) {
303 1.7 mycroft if (pwd->pw_uid == 0)
304 1.7 mycroft rootlogin = 1;
305 1.7 mycroft
306 1.8 mycroft if (fflag && (uid == 0 || uid == pwd->pw_uid)) {
307 1.7 mycroft /* already authenticated */
308 1.44 aidan #ifdef KERBEROS5
309 1.44 aidan if (Fflag)
310 1.44 aidan k5_read_creds(username);
311 1.44 aidan #endif
312 1.7 mycroft break;
313 1.7 mycroft } else if (pwd->pw_passwd[0] == '\0') {
314 1.7 mycroft /* pretend password okay */
315 1.7 mycroft rval = 0;
316 1.7 mycroft goto ttycheck;
317 1.7 mycroft }
318 1.7 mycroft }
319 1.7 mycroft
320 1.1 cgd fflag = 0;
321 1.1 cgd
322 1.1 cgd (void)setpriority(PRIO_PROCESS, 0, -4);
323 1.1 cgd
324 1.27 mycroft #ifdef SKEY
325 1.29 mycroft if (skey_haskey(username) == 0) {
326 1.29 mycroft static char skprompt[80];
327 1.29 mycroft char *skinfo = skey_keyinfo(username);
328 1.20 lukem
329 1.29 mycroft (void)snprintf(skprompt, sizeof(skprompt)-1,
330 1.29 mycroft "Password [%s]:",
331 1.29 mycroft skinfo ? skinfo : "error getting challenge");
332 1.29 mycroft pwprompt = skprompt;
333 1.29 mycroft } else
334 1.27 mycroft #endif
335 1.29 mycroft pwprompt = "Password:";
336 1.27 mycroft
337 1.29 mycroft p = getpass(pwprompt);
338 1.1 cgd
339 1.29 mycroft if (pwd == NULL) {
340 1.29 mycroft rval = 1;
341 1.29 mycroft goto skip;
342 1.29 mycroft }
343 1.29 mycroft #ifdef KERBEROS
344 1.29 mycroft if (klogin(pwd, instance, localhost, p) == 0) {
345 1.29 mycroft rval = 0;
346 1.29 mycroft goto skip;
347 1.29 mycroft }
348 1.1 cgd #endif
349 1.29 mycroft #ifdef KERBEROS5
350 1.29 mycroft if (klogin(pwd, instance, localhost, p) == 0) {
351 1.29 mycroft rval = 0;
352 1.29 mycroft goto skip;
353 1.1 cgd }
354 1.29 mycroft #endif
355 1.20 lukem #ifdef SKEY
356 1.29 mycroft if (skey_haskey(username) == 0 &&
357 1.29 mycroft skey_passcheck(username, p) != -1) {
358 1.29 mycroft rval = 0;
359 1.29 mycroft goto skip;
360 1.29 mycroft }
361 1.20 lukem #endif
362 1.29 mycroft if (!sflag && *pwd->pw_passwd != '\0' &&
363 1.29 mycroft !strcmp(crypt(p, pwd->pw_passwd), pwd->pw_passwd)) {
364 1.29 mycroft rval = 0;
365 1.29 mycroft require_chpass = 1;
366 1.29 mycroft goto skip;
367 1.29 mycroft }
368 1.29 mycroft rval = 1;
369 1.29 mycroft
370 1.29 mycroft skip:
371 1.29 mycroft memset(p, 0, strlen(p));
372 1.1 cgd
373 1.1 cgd (void)setpriority(PRIO_PROCESS, 0, 0);
374 1.1 cgd
375 1.7 mycroft ttycheck:
376 1.1 cgd /*
377 1.1 cgd * If trying to log in as root without Kerberos,
378 1.1 cgd * but with insecure terminal, refuse the login attempt.
379 1.1 cgd */
380 1.7 mycroft if (pwd && !rval && rootlogin && !rootterm(tty)) {
381 1.1 cgd (void)fprintf(stderr,
382 1.1 cgd "%s login refused on this terminal.\n",
383 1.1 cgd pwd->pw_name);
384 1.1 cgd if (hostname)
385 1.1 cgd syslog(LOG_NOTICE,
386 1.1 cgd "LOGIN %s REFUSED FROM %s ON TTY %s",
387 1.1 cgd pwd->pw_name, hostname, tty);
388 1.1 cgd else
389 1.1 cgd syslog(LOG_NOTICE,
390 1.1 cgd "LOGIN %s REFUSED ON TTY %s",
391 1.1 cgd pwd->pw_name, tty);
392 1.1 cgd continue;
393 1.1 cgd }
394 1.1 cgd
395 1.1 cgd if (pwd && !rval)
396 1.1 cgd break;
397 1.1 cgd
398 1.1 cgd (void)printf("Login incorrect\n");
399 1.1 cgd failures++;
400 1.1 cgd /* we allow 10 tries, but after 3 we start backing off */
401 1.1 cgd if (++cnt > 3) {
402 1.1 cgd if (cnt >= 10) {
403 1.1 cgd badlogin(username);
404 1.1 cgd sleepexit(1);
405 1.1 cgd }
406 1.1 cgd sleep((u_int)((cnt - 3) * 5));
407 1.1 cgd }
408 1.1 cgd }
409 1.1 cgd
410 1.1 cgd /* committed to login -- turn off timeout */
411 1.1 cgd (void)alarm((u_int)0);
412 1.1 cgd
413 1.1 cgd endpwent();
414 1.1 cgd
415 1.1 cgd /* if user not super-user, check for disabled logins */
416 1.1 cgd if (!rootlogin)
417 1.1 cgd checknologin();
418 1.1 cgd
419 1.33 hubertf /* Temporarily give up special privileges so we can change */
420 1.33 hubertf /* into NFS-mounted homes that are exported for non-root */
421 1.33 hubertf /* access and have mode 7x0 */
422 1.33 hubertf saved_uid = geteuid();
423 1.35 hubertf saved_gid = getegid();
424 1.35 hubertf nsaved_gids = getgroups(NGROUPS_MAX, saved_gids);
425 1.35 hubertf
426 1.35 hubertf (void)setegid(pwd->pw_gid);
427 1.35 hubertf initgroups(username, pwd->pw_gid);
428 1.35 hubertf (void)seteuid(pwd->pw_uid);
429 1.33 hubertf
430 1.1 cgd if (chdir(pwd->pw_dir) < 0) {
431 1.1 cgd (void)printf("No home directory %s!\n", pwd->pw_dir);
432 1.1 cgd if (chdir("/"))
433 1.1 cgd exit(0);
434 1.1 cgd pwd->pw_dir = "/";
435 1.1 cgd (void)printf("Logging in with home = \"/\".\n");
436 1.1 cgd }
437 1.1 cgd
438 1.1 cgd quietlog = access(_PATH_HUSHLOGIN, F_OK) == 0;
439 1.33 hubertf
440 1.33 hubertf /* regain special privileges */
441 1.33 hubertf (void)seteuid(saved_uid);
442 1.35 hubertf setgroups(nsaved_gids, saved_gids);
443 1.35 hubertf (void)setegid(saved_gid);
444 1.1 cgd
445 1.1 cgd if (pwd->pw_change || pwd->pw_expire)
446 1.1 cgd (void)gettimeofday(&tp, (struct timezone *)NULL);
447 1.40 ross if (pwd->pw_expire) {
448 1.1 cgd if (tp.tv_sec >= pwd->pw_expire) {
449 1.1 cgd (void)printf("Sorry -- your account has expired.\n");
450 1.1 cgd sleepexit(1);
451 1.1 cgd } else if (pwd->pw_expire - tp.tv_sec <
452 1.21 lukem _PASSWORD_WARNDAYS * SECSPERDAY && !quietlog)
453 1.1 cgd (void)printf("Warning: your account expires on %s",
454 1.1 cgd ctime(&pwd->pw_expire));
455 1.40 ross }
456 1.40 ross if (pwd->pw_change) {
457 1.30 mycroft if (pwd->pw_change == _PASSWORD_CHGNOW)
458 1.30 mycroft need_chpass = 1;
459 1.31 mycroft else if (tp.tv_sec >= pwd->pw_change) {
460 1.31 mycroft (void)printf("Sorry -- your password has expired.\n");
461 1.31 mycroft sleepexit(1);
462 1.31 mycroft } else if (pwd->pw_change - tp.tv_sec <
463 1.30 mycroft _PASSWORD_WARNDAYS * SECSPERDAY && !quietlog)
464 1.30 mycroft (void)printf("Warning: your password expires on %s",
465 1.30 mycroft ctime(&pwd->pw_change));
466 1.1 cgd
467 1.40 ross }
468 1.5 cgd /* Nothing else left to fail -- really log in. */
469 1.12 jtc memset((void *)&utmp, 0, sizeof(utmp));
470 1.5 cgd (void)time(&utmp.ut_time);
471 1.5 cgd (void)strncpy(utmp.ut_name, username, sizeof(utmp.ut_name));
472 1.5 cgd if (hostname)
473 1.5 cgd (void)strncpy(utmp.ut_host, hostname, sizeof(utmp.ut_host));
474 1.5 cgd (void)strncpy(utmp.ut_line, tty, sizeof(utmp.ut_line));
475 1.5 cgd login(&utmp);
476 1.1 cgd
477 1.1 cgd dolastlog(quietlog);
478 1.1 cgd
479 1.1 cgd (void)chown(ttyn, pwd->pw_uid,
480 1.1 cgd (gr = getgrnam(TTYGRPNAME)) ? gr->gr_gid : pwd->pw_gid);
481 1.15 gwr
482 1.15 gwr if (ttyaction(ttyn, "login", pwd->pw_name))
483 1.15 gwr (void)printf("Warning: ttyaction failed.\n");
484 1.15 gwr
485 1.10 brezak #if defined(KERBEROS) || defined(KERBEROS5)
486 1.10 brezak /* Fork so that we can call kdestroy */
487 1.10 brezak if (krbtkfile_env)
488 1.29 mycroft dofork();
489 1.10 brezak #endif
490 1.1 cgd (void)setgid(pwd->pw_gid);
491 1.1 cgd
492 1.1 cgd initgroups(username, pwd->pw_gid);
493 1.1 cgd
494 1.1 cgd if (*pwd->pw_shell == '\0')
495 1.1 cgd pwd->pw_shell = _PATH_BSHELL;
496 1.1 cgd
497 1.5 cgd /* Destroy environment unless user has requested its preservation. */
498 1.1 cgd if (!pflag)
499 1.1 cgd environ = envinit;
500 1.1 cgd (void)setenv("HOME", pwd->pw_dir, 1);
501 1.1 cgd (void)setenv("SHELL", pwd->pw_shell, 1);
502 1.1 cgd if (term[0] == '\0')
503 1.5 cgd (void)strncpy(term, stypeof(tty), sizeof(term));
504 1.1 cgd (void)setenv("TERM", term, 0);
505 1.1 cgd (void)setenv("LOGNAME", pwd->pw_name, 1);
506 1.1 cgd (void)setenv("USER", pwd->pw_name, 1);
507 1.1 cgd (void)setenv("PATH", _PATH_DEFPATH, 0);
508 1.1 cgd #ifdef KERBEROS
509 1.1 cgd if (krbtkfile_env)
510 1.1 cgd (void)setenv("KRBTKFILE", krbtkfile_env, 1);
511 1.1 cgd #endif
512 1.10 brezak #ifdef KERBEROS5
513 1.10 brezak if (krbtkfile_env)
514 1.10 brezak (void)setenv("KRB5CCNAME", krbtkfile_env, 1);
515 1.10 brezak #endif
516 1.1 cgd
517 1.12 jtc if (tty[sizeof("tty")-1] == 'd')
518 1.12 jtc syslog(LOG_INFO, "DIALUP %s, %s", tty, pwd->pw_name);
519 1.12 jtc
520 1.5 cgd /* If fflag is on, assume caller/authenticator has logged root login. */
521 1.40 ross if (rootlogin && fflag == 0) {
522 1.1 cgd if (hostname)
523 1.1 cgd syslog(LOG_NOTICE, "ROOT LOGIN (%s) ON %s FROM %s",
524 1.1 cgd username, tty, hostname);
525 1.1 cgd else
526 1.40 ross syslog(LOG_NOTICE,
527 1.40 ross "ROOT LOGIN (%s) ON %s", username, tty);
528 1.40 ross }
529 1.1 cgd
530 1.10 brezak #if defined(KERBEROS) || defined(KERBEROS5)
531 1.1 cgd if (!quietlog && notickets == 1)
532 1.1 cgd (void)printf("Warning: no Kerberos tickets issued.\n");
533 1.1 cgd #endif
534 1.1 cgd
535 1.1 cgd if (!quietlog) {
536 1.34 thorpej (void)printf(copyrightstr);
537 1.1 cgd motd();
538 1.5 cgd (void)snprintf(tbuf,
539 1.5 cgd sizeof(tbuf), "%s/%s", _PATH_MAILDIR, pwd->pw_name);
540 1.1 cgd if (stat(tbuf, &st) == 0 && st.st_size != 0)
541 1.1 cgd (void)printf("You have %smail.\n",
542 1.1 cgd (st.st_mtime > st.st_atime) ? "new " : "");
543 1.1 cgd }
544 1.1 cgd
545 1.1 cgd (void)signal(SIGALRM, SIG_DFL);
546 1.1 cgd (void)signal(SIGQUIT, SIG_DFL);
547 1.1 cgd (void)signal(SIGINT, SIG_DFL);
548 1.1 cgd (void)signal(SIGTSTP, SIG_IGN);
549 1.1 cgd
550 1.1 cgd tbuf[0] = '-';
551 1.17 mrg (void)strncpy(tbuf + 1, (p = strrchr(pwd->pw_shell, '/')) ?
552 1.17 mrg p + 1 : pwd->pw_shell, sizeof(tbuf) - 2);
553 1.1 cgd
554 1.1 cgd if (setlogin(pwd->pw_name) < 0)
555 1.1 cgd syslog(LOG_ERR, "setlogin() failure: %m");
556 1.1 cgd
557 1.5 cgd /* Discard permissions last so can't get killed and drop core. */
558 1.1 cgd if (rootlogin)
559 1.24 lukem (void)setuid(0);
560 1.1 cgd else
561 1.24 lukem (void)setuid(pwd->pw_uid);
562 1.24 lukem
563 1.24 lukem /* Wait to change password until we're unprivileged */
564 1.24 lukem if (need_chpass) {
565 1.29 mycroft if (!require_chpass)
566 1.24 lukem (void)printf(
567 1.24 lukem "Warning: your password has expired. Please change it as soon as possible.\n");
568 1.29 mycroft else {
569 1.38 mrg int status;
570 1.38 mrg
571 1.29 mycroft (void)printf(
572 1.24 lukem "Your password has expired. Please choose a new one.\n");
573 1.38 mrg switch (fork()) {
574 1.38 mrg case -1:
575 1.38 mrg warn("fork");
576 1.29 mycroft sleepexit(1);
577 1.38 mrg case 0:
578 1.38 mrg execl(_PATH_BINPASSWD, "passwd", 0);
579 1.38 mrg _exit(1);
580 1.38 mrg default:
581 1.38 mrg if (wait(&status) == -1 ||
582 1.38 mrg WEXITSTATUS(status))
583 1.38 mrg sleepexit(1);
584 1.38 mrg }
585 1.29 mycroft }
586 1.24 lukem }
587 1.1 cgd
588 1.44 aidan #ifdef KERBEROS5
589 1.44 aidan k5_write_creds();
590 1.44 aidan #endif
591 1.1 cgd execlp(pwd->pw_shell, tbuf, 0);
592 1.12 jtc err(1, "%s", pwd->pw_shell);
593 1.1 cgd }
594 1.1 cgd
595 1.10 brezak #if defined(KERBEROS) || defined(KERBEROS5)
596 1.16 sommerfe #define NBUFSIZ (MAXLOGNAME + 1 + 5) /* .root suffix */
597 1.1 cgd #else
598 1.16 sommerfe #define NBUFSIZ (MAXLOGNAME + 1)
599 1.10 brezak #endif
600 1.10 brezak
601 1.10 brezak #if defined(KERBEROS) || defined(KERBEROS5)
602 1.10 brezak /*
603 1.10 brezak * This routine handles cleanup stuff, and the like.
604 1.10 brezak * It exists only in the child process.
605 1.10 brezak */
606 1.10 brezak #include <sys/wait.h>
607 1.10 brezak void
608 1.10 brezak dofork()
609 1.10 brezak {
610 1.38 mrg int child;
611 1.38 mrg
612 1.38 mrg if (!(child = fork()))
613 1.38 mrg return; /* Child process */
614 1.38 mrg
615 1.38 mrg /* Setup stuff? This would be things we could do in parallel with login */
616 1.38 mrg (void) chdir("/"); /* Let's not keep the fs busy... */
617 1.10 brezak
618 1.38 mrg /* If we're the parent, watch the child until it dies */
619 1.38 mrg while (wait(0) != child)
620 1.38 mrg ;
621 1.10 brezak
622 1.38 mrg /* Cleanup stuff */
623 1.38 mrg /* Run kdestroy to destroy tickets */
624 1.38 mrg kdestroy();
625 1.10 brezak
626 1.38 mrg /* Leave */
627 1.38 mrg exit(0);
628 1.10 brezak }
629 1.1 cgd #endif
630 1.1 cgd
631 1.5 cgd void
632 1.1 cgd getloginname()
633 1.1 cgd {
634 1.12 jtc int ch;
635 1.12 jtc char *p;
636 1.1 cgd static char nbuf[NBUFSIZ];
637 1.1 cgd
638 1.1 cgd for (;;) {
639 1.1 cgd (void)printf("login: ");
640 1.1 cgd for (p = nbuf; (ch = getchar()) != '\n'; ) {
641 1.1 cgd if (ch == EOF) {
642 1.1 cgd badlogin(username);
643 1.1 cgd exit(0);
644 1.1 cgd }
645 1.1 cgd if (p < nbuf + (NBUFSIZ - 1))
646 1.1 cgd *p++ = ch;
647 1.1 cgd }
648 1.40 ross if (p > nbuf) {
649 1.1 cgd if (nbuf[0] == '-')
650 1.1 cgd (void)fprintf(stderr,
651 1.1 cgd "login names may not start with '-'.\n");
652 1.1 cgd else {
653 1.1 cgd *p = '\0';
654 1.1 cgd username = nbuf;
655 1.1 cgd break;
656 1.1 cgd }
657 1.40 ross }
658 1.1 cgd }
659 1.1 cgd }
660 1.1 cgd
661 1.5 cgd int
662 1.1 cgd rootterm(ttyn)
663 1.1 cgd char *ttyn;
664 1.1 cgd {
665 1.1 cgd struct ttyent *t;
666 1.1 cgd
667 1.12 jtc return ((t = getttynam(ttyn)) && t->ty_status & TTY_SECURE);
668 1.1 cgd }
669 1.1 cgd
670 1.1 cgd jmp_buf motdinterrupt;
671 1.1 cgd
672 1.5 cgd void
673 1.1 cgd motd()
674 1.1 cgd {
675 1.12 jtc int fd, nchars;
676 1.1 cgd sig_t oldint;
677 1.1 cgd char tbuf[8192];
678 1.1 cgd
679 1.1 cgd if ((fd = open(_PATH_MOTDFILE, O_RDONLY, 0)) < 0)
680 1.1 cgd return;
681 1.1 cgd oldint = signal(SIGINT, sigint);
682 1.1 cgd if (setjmp(motdinterrupt) == 0)
683 1.1 cgd while ((nchars = read(fd, tbuf, sizeof(tbuf))) > 0)
684 1.1 cgd (void)write(fileno(stdout), tbuf, nchars);
685 1.1 cgd (void)signal(SIGINT, oldint);
686 1.1 cgd (void)close(fd);
687 1.1 cgd }
688 1.1 cgd
689 1.5 cgd /* ARGSUSED */
690 1.1 cgd void
691 1.5 cgd sigint(signo)
692 1.5 cgd int signo;
693 1.1 cgd {
694 1.38 mrg
695 1.1 cgd longjmp(motdinterrupt, 1);
696 1.1 cgd }
697 1.1 cgd
698 1.5 cgd /* ARGSUSED */
699 1.5 cgd void
700 1.5 cgd timedout(signo)
701 1.5 cgd int signo;
702 1.5 cgd {
703 1.38 mrg
704 1.5 cgd (void)fprintf(stderr, "Login timed out after %d seconds\n", timeout);
705 1.5 cgd exit(0);
706 1.5 cgd }
707 1.5 cgd
708 1.5 cgd void
709 1.1 cgd checknologin()
710 1.1 cgd {
711 1.12 jtc int fd, nchars;
712 1.1 cgd char tbuf[8192];
713 1.1 cgd
714 1.1 cgd if ((fd = open(_PATH_NOLOGIN, O_RDONLY, 0)) >= 0) {
715 1.1 cgd while ((nchars = read(fd, tbuf, sizeof(tbuf))) > 0)
716 1.1 cgd (void)write(fileno(stdout), tbuf, nchars);
717 1.1 cgd sleepexit(0);
718 1.1 cgd }
719 1.1 cgd }
720 1.1 cgd
721 1.5 cgd void
722 1.1 cgd dolastlog(quiet)
723 1.1 cgd int quiet;
724 1.1 cgd {
725 1.1 cgd struct lastlog ll;
726 1.1 cgd int fd;
727 1.1 cgd
728 1.1 cgd if ((fd = open(_PATH_LASTLOG, O_RDWR, 0)) >= 0) {
729 1.26 kleink (void)lseek(fd, (off_t)(pwd->pw_uid * sizeof(ll)), SEEK_SET);
730 1.1 cgd if (!quiet) {
731 1.1 cgd if (read(fd, (char *)&ll, sizeof(ll)) == sizeof(ll) &&
732 1.1 cgd ll.ll_time != 0) {
733 1.1 cgd (void)printf("Last login: %.*s ",
734 1.42 kim 24, (char *)ctime(&ll.ll_time));
735 1.1 cgd if (*ll.ll_host != '\0')
736 1.1 cgd (void)printf("from %.*s\n",
737 1.5 cgd (int)sizeof(ll.ll_host),
738 1.5 cgd ll.ll_host);
739 1.1 cgd else
740 1.1 cgd (void)printf("on %.*s\n",
741 1.5 cgd (int)sizeof(ll.ll_line),
742 1.5 cgd ll.ll_line);
743 1.1 cgd }
744 1.26 kleink (void)lseek(fd, (off_t)(pwd->pw_uid * sizeof(ll)),
745 1.26 kleink SEEK_SET);
746 1.1 cgd }
747 1.12 jtc memset((void *)&ll, 0, sizeof(ll));
748 1.1 cgd (void)time(&ll.ll_time);
749 1.5 cgd (void)strncpy(ll.ll_line, tty, sizeof(ll.ll_line));
750 1.1 cgd if (hostname)
751 1.5 cgd (void)strncpy(ll.ll_host, hostname, sizeof(ll.ll_host));
752 1.1 cgd (void)write(fd, (char *)&ll, sizeof(ll));
753 1.1 cgd (void)close(fd);
754 1.1 cgd }
755 1.1 cgd }
756 1.1 cgd
757 1.5 cgd void
758 1.1 cgd badlogin(name)
759 1.1 cgd char *name;
760 1.1 cgd {
761 1.1 cgd if (failures == 0)
762 1.1 cgd return;
763 1.1 cgd if (hostname) {
764 1.1 cgd syslog(LOG_NOTICE, "%d LOGIN FAILURE%s FROM %s",
765 1.1 cgd failures, failures > 1 ? "S" : "", hostname);
766 1.1 cgd syslog(LOG_AUTHPRIV|LOG_NOTICE,
767 1.1 cgd "%d LOGIN FAILURE%s FROM %s, %s",
768 1.1 cgd failures, failures > 1 ? "S" : "", hostname, name);
769 1.1 cgd } else {
770 1.1 cgd syslog(LOG_NOTICE, "%d LOGIN FAILURE%s ON %s",
771 1.1 cgd failures, failures > 1 ? "S" : "", tty);
772 1.1 cgd syslog(LOG_AUTHPRIV|LOG_NOTICE,
773 1.1 cgd "%d LOGIN FAILURE%s ON %s, %s",
774 1.1 cgd failures, failures > 1 ? "S" : "", tty, name);
775 1.1 cgd }
776 1.1 cgd }
777 1.1 cgd
778 1.1 cgd #undef UNKNOWN
779 1.1 cgd #define UNKNOWN "su"
780 1.1 cgd
781 1.39 mycroft const char *
782 1.1 cgd stypeof(ttyid)
783 1.39 mycroft const char *ttyid;
784 1.1 cgd {
785 1.1 cgd struct ttyent *t;
786 1.1 cgd
787 1.12 jtc return (ttyid && (t = getttynam(ttyid)) ? t->ty_type : UNKNOWN);
788 1.1 cgd }
789 1.1 cgd
790 1.5 cgd void
791 1.1 cgd sleepexit(eval)
792 1.1 cgd int eval;
793 1.1 cgd {
794 1.38 mrg
795 1.12 jtc (void)sleep(5);
796 1.1 cgd exit(eval);
797 1.1 cgd }
798