Home | History | Annotate | Line # | Download | only in skeyinit
skeyinit.c revision 1.14 
      1 /*	$NetBSD: skeyinit.c,v 1.14 2000/07/28 19:19:23 thorpej Exp $	*/
      2 
      3 /* S/KEY v1.1b (skeyinit.c)
      4  *
      5  * Authors:
      6  *          Neil M. Haller <nmh (at) thumper.bellcore.com>
      7  *          Philip R. Karn <karn (at) chicago.qualcomm.com>
      8  *          John S. Walden <jsw (at) thumper.bellcore.com>
      9  *          Scott Chasin <chasin (at) crimelab.com>
     10  *
     11  * Modifications:
     12  *          Todd C. Miller <Todd.Miller (at) courtesan.com>
     13  *
     14  * S/KEY initialization and seed update
     15  */
     16 
     17 #include <sys/param.h>
     18 #include <sys/time.h>
     19 #include <sys/resource.h>
     20 
     21 #include <ctype.h>
     22 #include <err.h>
     23 #include <errno.h>
     24 #include <fcntl.h>
     25 #include <pwd.h>
     26 #include <stdio.h>
     27 #include <stdlib.h>
     28 #include <string.h>
     29 #include <time.h>
     30 #include <unistd.h>
     31 #include <utmp.h>
     32 
     33 #include <skey.h>
     34 
     35 #ifndef SKEY_NAMELEN
     36 #define SKEY_NAMELEN    4
     37 #endif
     38 
     39 int main __P((int, char **));
     40 
     41 int main(int argc, char **argv)
     42 {
     43 	int     rval, nn, i, l;
     44 	int n = 0, defaultsetup = 1, zerokey = 0, hexmode = 0;
     45 	time_t  now;
     46 	char	hostname[MAXHOSTNAMELEN + 1];
     47 	char    seed[SKEY_MAX_PW_LEN+2], key[SKEY_BINKEY_SIZE], defaultseed[SKEY_MAX_SEED_LEN+1];
     48 	char    passwd[SKEY_MAX_PW_LEN+2], passwd2[SKEY_MAX_PW_LEN+2], tbuf[27], buf[80];
     49 	char    lastc, me[UT_NAMESIZE+1], *p, *pw, *ht = NULL;
     50 	const	char *salt;
     51 	struct	skey skey;
     52 	struct	passwd *pp;
     53 	struct	tm *tm;
     54 	int c;
     55 
     56 	if (geteuid() != 0)
     57 		errx(1, "must be setuid root.");
     58 
     59 	if (gethostname(hostname, sizeof(hostname)) < 0)
     60 		err(1, "gethostname");
     61 
     62 	/*
     63 	 * Copy the hostname into the default seed, eliminating any
     64 	 * non alpha-numeric characters.
     65 	 */
     66 	for (i = 0, l = 0; l < sizeof(defaultseed); i++) {
     67 		if (hostname[i] == '\0') {
     68 			defaultseed[l] = hostname[i];
     69 			break;
     70 		}
     71 		if (isalnum(hostname[i]))
     72 			defaultseed[l++] = hostname[i];
     73 	}
     74 
     75 	defaultseed[SKEY_NAMELEN] = '\0';
     76 	(void)time(&now);
     77 	(void)sprintf(tbuf, "%05ld", (long) (now % 100000));
     78 	(void)strncat(defaultseed, tbuf, sizeof(defaultseed) - 5);
     79 
     80 	if ((pp = getpwuid(getuid())) == NULL)
     81 		err(1, "no user with uid %ld", (u_long)getuid());
     82 	(void)strncpy(me, pp->pw_name, sizeof(me) - 1);
     83 
     84 	if ((pp = getpwnam(me)) == NULL)
     85 		err(1, "Who are you?");
     86 	salt = pp->pw_passwd;
     87 
     88 	while((c = getopt(argc, argv, "n:t:sxz")) != -1) {
     89 		switch(c) {
     90 			case 'n':
     91 				n = atoi(optarg);
     92 				if(n < 1 || n > SKEY_MAX_SEQ)
     93 					errx(1, "count must be between 1 and %d", SKEY_MAX_SEQ);
     94 				break;
     95 			case 't':
     96 				if(skey_set_algorithm(optarg) == NULL)
     97 					errx(1, "Unknown hash algorithm %s", optarg);
     98 				ht = optarg;
     99 				break;
    100 			case 's':
    101 				defaultsetup = 0;
    102 				break;
    103 			case 'x':
    104 				hexmode = 1;
    105 				break;
    106 			case 'z':
    107 				zerokey = 1;
    108 				break;
    109 			default:
    110 				err(1, "Usage: %s [-n count] [-t md4|md5|sha1] [-s] [-x] [-z] [user]\n", argv[0]);
    111 		}
    112 	}
    113 
    114 	if(argc > optind) {
    115 		pp = getpwnam(argv[optind]);
    116 		if (pp == NULL)
    117 			errx(1, "User %s unknown", argv[optind]);
    118 		}
    119 
    120 	if (strcmp(pp->pw_name, me) != 0) {
    121 		if (getuid() != 0) {
    122 			/* Only root can change other's passwds */
    123 			errx(1, "Permission denied.");
    124 		}
    125 	}
    126 
    127 	if (getuid() != 0) {
    128 		pw = getpass("Password:");
    129 		p = crypt(pw, salt);
    130 
    131 		if (strcmp(p, pp->pw_passwd)) {
    132 			errx(1, "Password incorrect.");
    133 		}
    134 	}
    135 
    136 	rval = skeylookup(&skey, pp->pw_name);
    137 	switch (rval) {
    138 	case -1:
    139 		err(1, "cannot open database");
    140 	case 0:
    141 		/* comment out user if asked to */
    142 		if (zerokey)
    143 			exit(skeyzero(&skey, pp->pw_name));
    144 
    145 		printf("[Updating %s]\n", pp->pw_name);
    146 		printf("Old key: [%s] %s\n", skey_get_algorithm(), skey.seed);
    147 
    148 		/*
    149 		 * lets be nice if they have a skey.seed that
    150 		 * ends in 0-8 just add one
    151 		 */
    152 		l = strlen(skey.seed);
    153 		if (l > 0) {
    154 			lastc = skey.seed[l - 1];
    155 			if (isdigit((unsigned char)lastc) && lastc != '9') {
    156 				(void)strncpy(defaultseed, skey.seed,
    157 				    sizeof(defaultseed) - 1);
    158 				defaultseed[l - 1] = lastc + 1;
    159 			}
    160 			if (isdigit((unsigned char)lastc) && lastc == '9' &&
    161 			    l < 16) {
    162 				(void)strncpy(defaultseed, skey.seed,
    163 				    sizeof(defaultseed) - 1);
    164 				defaultseed[l - 1] = '0';
    165 				defaultseed[l] = '0';
    166 				defaultseed[l + 1] = '\0';
    167 			}
    168 		}
    169 		break;
    170 	case 1:
    171 		if (zerokey)
    172 			errx(1, "You have no entry to zero.");
    173 		printf("[Adding %s]\n", pp->pw_name);
    174 		break;
    175 	}
    176 
    177 	if(n==0)
    178 		n = 99;
    179 
    180 	/* Set hash type if asked to */
    181 	if (ht) {
    182 		/* Need to zero out old key when changing algorithm */
    183 		if (strcmp(ht, skey_get_algorithm()) && skey_set_algorithm(ht))
    184 			zerokey = 1;
    185 	}
    186 
    187 	if (!defaultsetup) {
    188 		printf("You need the 6 english words generated from the \"skey\" command.\n");
    189 		for (i = 0;; i++) {
    190 			if (i >= 2)
    191 				exit(1);
    192 			printf("Enter sequence count from 1 to %d: ", SKEY_MAX_SEQ);
    193 			fgets(buf, sizeof(buf), stdin);
    194 			n = atoi(buf);
    195 			if (n > 0 && n < SKEY_MAX_SEQ)
    196 				break;	/* Valid range */
    197 			printf("\nError: Count must be between 0 and %d\n", SKEY_MAX_SEQ);
    198 		}
    199 
    200 		for (i = 0;; i++) {
    201 			if (i >= 2)
    202 				exit(1);
    203 
    204 			printf("Enter new seed [default %s]: ", defaultseed);
    205 			fflush(stdout);
    206 			fgets(seed, sizeof(seed), stdin);
    207 			rip(seed);
    208 			for (p = seed; *p; p++) {
    209 				if (isalpha(*p)) {
    210 					if (isupper(*p))
    211 						*p = tolower(*p);
    212 				} else if (!isdigit(*p)) {
    213 					(void)puts("Error: seed may only contain alphanumeric characters");
    214 					break;
    215 				}
    216 			}
    217 			if (*p == '\0')
    218 				break;  /* Valid seed */
    219 		}
    220 		if (strlen(seed) > SKEY_MAX_SEED_LEN) {
    221 			printf("Notice: Seed truncated to %d characters.\n", SKEY_MAX_SEED_LEN);
    222 			seed[SKEY_MAX_SEED_LEN] = '\0';
    223 		}
    224 		if (seed[0] == '\0')
    225 			(void)strcpy(seed, defaultseed);
    226 
    227 		for (i = 0;; i++) {
    228 			if (i >= 2)
    229 				exit(1);
    230 
    231 			printf("otp-%s %d %s\ns/key access password: ",
    232 				skey_get_algorithm(), n, seed);
    233 			fgets(buf, sizeof(buf), stdin);
    234 			rip(buf);
    235 			backspace(buf);
    236 
    237 			if (buf[0] == '?') {
    238 				puts("Enter 6 English words from secure S/Key calculation.");
    239 				continue;
    240 			} else if (buf[0] == '\0') {
    241 				exit(1);
    242 			}
    243 			if (etob(key, buf) == 1 || atob8(key, buf) == 0)
    244 				break;	/* Valid format */
    245 			(void)puts("Invalid format - try again with 6 English words.");
    246 		}
    247 	} else {
    248 	/* Get user's secret password */
    249 	puts("Reminder - Only use this method if you are directly connected\n"
    250 	      "           or have an encrypted channel. If you are using telnet\n"
    251 	      "           or rlogin, exit with no password and use skeyinit -s.\n");
    252 
    253 	for (i = 0;; i++) {
    254 			if (i >= 2)
    255 				exit(1);
    256 
    257 			printf("Enter secret password: ");
    258 			readpass(passwd, sizeof(passwd));
    259 			if (passwd[0] == '\0')
    260 				exit(1);
    261 
    262 			if (strlen(passwd) < SKEY_MIN_PW_LEN) {
    263 				(void)fprintf(stderr,
    264 				    "Your password must be at least %d characters long.\n", SKEY_MIN_PW_LEN);
    265 				continue;
    266 			} else if (strcmp(passwd, pp->pw_name) == 0) {
    267 				(void)fputs("Your password may not be the same as your user name.\n", stderr);
    268 				continue;
    269 			}
    270 #if 0
    271 			else if (strspn(passwd, "abcdefghijklmnopqrstuvwxyz") == strlen(passwd)) {
    272 				(void)fputs("Your password must contain more than just lower case letters.\n"
    273 					    "Whitespace, numbers, and puctuation are suggested.\n", stderr);
    274 				continue;
    275 			}
    276 #endif
    277 			printf("Again secret password: ");
    278 			readpass(passwd2, sizeof(passwd));
    279 			if (passwd2[0] == '\0')
    280 				exit(1);
    281 
    282 			if (strcmp(passwd, passwd2) == 0)
    283 				break;
    284 
    285 			puts("Passwords do not match.");
    286 		}
    287 
    288 		/* Crunch seed and password into starting key */
    289 		(void)strcpy(seed, defaultseed);
    290 		if (keycrunch(key, seed, passwd) != 0)
    291 			err(2, "key crunch failed");
    292 		nn = n;
    293 		while (nn-- != 0)
    294 			f(key);
    295 	}
    296 	(void)time(&now);
    297 	tm = localtime(&now);
    298 	(void)strftime(tbuf, sizeof(tbuf), " %b %d,%Y %T", tm);
    299 
    300 	if ((skey.val = (char *)malloc(16 + 1)) == NULL)
    301 		err(1, "Can't allocate memory");
    302 
    303 	/* Zero out old key if necesary (entry would change size) */
    304 	if (zerokey) {
    305 		(void)skeyzero(&skey, pp->pw_name);
    306 		/* Re-open keys file and seek to the end */
    307 		if (skeylookup(&skey, pp->pw_name) == -1)
    308 			err(1, "cannot open database");
    309 	}
    310 
    311 	btoa8(skey.val, key);
    312 
    313 	/*
    314 	 * Obtain an exclusive lock on the key file so we don't
    315 	 * clobber someone authenticating themselves at the same time.
    316 	 */
    317 	for (i = 0; i < 300; i++) {
    318 		if ((rval = flock(fileno(skey.keyfile), LOCK_EX|LOCK_NB)) == 0
    319 		    || errno != EWOULDBLOCK)
    320 			break;
    321 		usleep(100000);			/* Sleep for 0.1 seconds */
    322 	}
    323 	if (rval == -1)	{			/* Can't get exclusive lock */
    324 		errno = EAGAIN;
    325 		err(1, "cannot open database");
    326 	}
    327 
    328 	/* Don't save algorithm type for md4 (keep record length same) */
    329 	if (strcmp(skey_get_algorithm(), "md4") == 0)
    330 		(void)fprintf(skey.keyfile, "%s %04d %-16s %s %-21s\n",
    331 		    pp->pw_name, n, seed, skey.val, tbuf);
    332 	else
    333 		(void)fprintf(skey.keyfile, "%s %s %04d %-16s %s %-21s\n",
    334 		    pp->pw_name, skey_get_algorithm(), n, seed, skey.val, tbuf);
    335 
    336 	(void)fclose(skey.keyfile);
    337 
    338 	(void)printf("\nID %s skey is otp-%s %d %s\n", pp->pw_name,
    339 		     skey_get_algorithm(), n, seed);
    340 	(void)printf("Next login password: %s\n\n",
    341 		     hexmode ? put8(buf, key) : btoe(buf, key));
    342 
    343 	return(0);
    344 }
    345