diff options
| -rw-r--r-- | server/responder/pam/pam_LOCAL_domain.c | 423 | ||||
| -rw-r--r-- | server/responder/pam/pam_LOCAL_domain.h | 4 | ||||
| -rw-r--r-- | server/responder/pam/pamsrv_cmd.c | 2 |
3 files changed, 309 insertions, 120 deletions
diff --git a/server/responder/pam/pam_LOCAL_domain.c b/server/responder/pam/pam_LOCAL_domain.c index 54b68307..8ebe1732 100644 --- a/server/responder/pam/pam_LOCAL_domain.c +++ b/server/responder/pam/pam_LOCAL_domain.c @@ -1,4 +1,6 @@ +#include <time.h> #include <security/pam_modules.h> +#include <ldb.h> #include "util/util.h" #include "responder/pam/pamsrv.h" @@ -27,7 +29,13 @@ struct LOCAL_request { struct cli_ctx *cctx; struct pam_data *pd; pam_dp_callback_t callback; - + struct sysdb_ctx *dbctx; + struct sss_domain_info *domain_info; + struct sysdb_attrs *mod_attrs; + struct sysdb_req *sysdb_req; + struct ldb_result *res; + int global_pam_status; + int callback_delay; }; struct callback_ctx { @@ -75,56 +83,270 @@ static void LOCAL_call_callback(struct tevent_context *ev, callback(cctx, pam_status, domain); } -static void LOCAL_pam_handler(struct tevent_context *ev, - struct tevent_timer *te, - struct timeval tv, void *pvt) +static void prepare_reply(struct LOCAL_request *lreq, const int pam_status) +{ + int ret; + struct callback_ctx *callback_ctx; + struct timeval tv; + struct tevent_timer *te; + + tv.tv_sec = 0; + tv.tv_usec = 0; + + if (lreq->callback_delay > 0) { + ret = gettimeofday(&tv, NULL); + if (ret != 0) { + DEBUG(1, ("gettimeofday failed, continuing.\n")); + } + tv.tv_sec += lreq->callback_delay; + tv.tv_usec = 0; + } + + callback_ctx = talloc(lreq->cctx, struct callback_ctx); + if (callback_ctx == NULL) { + DEBUG(1, ("Cannot prepare callback data.\n")); + return; + } + + callback_ctx->cctx = lreq->cctx; + callback_ctx->callback = lreq->callback; + callback_ctx->pam_status = (lreq->global_pam_status!=PAM_SUCCESS) ? + lreq->global_pam_status : + pam_status; + callback_ctx->domain = "LOCAL"; + + talloc_free(lreq); + + te = tevent_add_timer(callback_ctx->cctx->ev, callback_ctx->cctx, tv, + LOCAL_call_callback, callback_ctx); + if (te == NULL) { + DEBUG(1, ("Cannot add callback to event loop.\n")); + return; + } +} + +static void set_user_attr_callback(void *pvt, int ldb_status, struct ldb_result *res) +{ + int pam_status=PAM_SUCCESS; + struct LOCAL_request *lreq; + + DEBUG(4, ("entering set_user_attr_callback, status [%d][%s]\n", + ldb_status, ldb_strerror(ldb_status))); + + lreq = talloc_get_type(pvt, struct LOCAL_request); + + sysdb_transaction_done(lreq->sysdb_req, ldb_status); + + NEQ_CHECK_OR_JUMP(ldb_status, LDB_SUCCESS, ("set_user_attr failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + +done: + prepare_reply(lreq, pam_status); +} + +static void set_user_attr_req(struct sysdb_req *req, void *pvt) +{ + int ret; + int pam_status=PAM_SUCCESS; + struct LOCAL_request *lreq; + + DEBUG(4, ("entering set_user_attr_req\n")); + + lreq = talloc_get_type(pvt, struct LOCAL_request); + + lreq->sysdb_req = req; + + ret = sysdb_set_user_attr(req, lreq->dbctx, lreq->domain_info->name, + lreq->pd->user, lreq->mod_attrs, + set_user_attr_callback, lreq); + if (ret != EOK) sysdb_transaction_done(lreq->sysdb_req, ret); + NEQ_CHECK_OR_JUMP(ret, EOK, ("sysdb_set_user_attr failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + + return; +done: + prepare_reply(lreq, pam_status); +} + +static void do_successful_login(struct LOCAL_request *lreq) +{ + int ret; + int pam_status; + char *buffer; + + lreq->mod_attrs = sysdb_new_attrs(lreq); + NULL_CHECK_OR_JUMP(lreq->mod_attrs, ("sysdb_new_attrs failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + + buffer = talloc_asprintf(lreq, "%d", (int) time(NULL)); + NULL_CHECK_OR_JUMP(buffer, ("talloc_asprintf failed.\n"), pam_status, + PAM_SYSTEM_ERR, done); + + ret = sysdb_attrs_add_string(lreq->mod_attrs, SYSDB_USER_ATTR_LAST_LOGIN, buffer); + NEQ_CHECK_OR_JUMP(ret, EOK, ("sysdb_attrs_add_string failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + talloc_free(buffer); + + buffer = talloc_asprintf(lreq, "0"); + ret = sysdb_attrs_add_string(lreq->mod_attrs, "failedLoginAttempts", buffer); + NEQ_CHECK_OR_JUMP(ret, EOK, ("sysdb_attrs_add_string failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + talloc_free(buffer); + + ret = sysdb_transaction(lreq, lreq->dbctx, set_user_attr_req, lreq); + NEQ_CHECK_OR_JUMP(ret, EOK, ("sysdb_transaction failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + return; + +done: + + prepare_reply(lreq, pam_status); +} + +static void do_failed_login(struct LOCAL_request *lreq) +{ + int ret; + int pam_status; + char *buffer; + int failedLoginAttempts; + + lreq->global_pam_status = PAM_AUTH_ERR; +/* TODO: maybe add more inteligent delay calculation */ + lreq->callback_delay = 3; + + lreq->mod_attrs = sysdb_new_attrs(lreq); + NULL_CHECK_OR_JUMP(lreq->mod_attrs, ("sysdb_new_attrs failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + + buffer = talloc_asprintf(lreq, "%d", (int) time(NULL)); + NULL_CHECK_OR_JUMP(buffer, ("talloc_asprintf failed.\n"), pam_status, + PAM_SYSTEM_ERR, done); + + ret = sysdb_attrs_add_string(lreq->mod_attrs, "lastFailedLogin", buffer); + NEQ_CHECK_OR_JUMP(ret, EOK, ("sysdb_attrs_add_string failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + talloc_free(buffer); + + failedLoginAttempts = ldb_msg_find_attr_as_int(lreq->res->msgs[0], + "failedLoginAttempts", 0); + buffer = talloc_asprintf(lreq, "%d", ++failedLoginAttempts); + NULL_CHECK_OR_JUMP(buffer, ("talloc_asprintf failed.\n"), pam_status, + PAM_SYSTEM_ERR, done); + + ret = sysdb_attrs_add_string(lreq->mod_attrs, "failedLoginAttempts", buffer); + NEQ_CHECK_OR_JUMP(ret, EOK, ("sysdb_attrs_add_string failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + talloc_free(buffer); + + ret = sysdb_transaction(lreq, lreq->dbctx, set_user_attr_req, lreq); + NEQ_CHECK_OR_JUMP(ret, EOK, ("sysdb_transaction failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + return; + +done: + + prepare_reply(lreq, pam_status); +} + +static void do_pam_acct_mgmt(struct LOCAL_request *lreq) +{ + int pam_status=PAM_SUCCESS; + const char *disabled=NULL; + + disabled = ldb_msg_find_attr_as_string(lreq->res->msgs[0], + SYSDB_PW_DISABLED, NULL); + if (disabled != NULL && + strncasecmp(disabled, "false",5)!=0 && + strncasecmp(disabled, "no",2)!=0 ) { + lreq->global_pam_status = PAM_PERM_DENIED; + } + + prepare_reply(lreq, pam_status); +} + +static void do_pam_chauthtok(struct LOCAL_request *lreq) +{ + int ret; + int pam_status; + char *newauthtok; + char *salt; + char *new_hash; + char *timestamp; + + ret = authtok2str(lreq, lreq->pd->newauthtok, lreq->pd->newauthtok_size, + &newauthtok); + NEQ_CHECK_OR_JUMP(ret, EOK, ("authtok2str failed.\n"), pam_status, + PAM_SYSTEM_ERR, done); + memset(lreq->pd->newauthtok, 0, lreq->pd->newauthtok_size); + + salt = gen_salt(); + NULL_CHECK_OR_JUMP(salt, ("Salt generation failed.\n"), pam_status, + PAM_SYSTEM_ERR, done); + DEBUG(4, ("Using salt [%s]\n", salt)); + + new_hash = nss_sha512_crypt(newauthtok, salt); + NULL_CHECK_OR_JUMP(new_hash, ("Hash generation failed.\n"), pam_status, + PAM_SYSTEM_ERR, done); + DEBUG(4, ("New hash [%s]\n", new_hash)); + memset(newauthtok, 0, lreq->pd->newauthtok_size); + talloc_free(newauthtok); + + lreq->mod_attrs = sysdb_new_attrs(lreq); + NULL_CHECK_OR_JUMP(lreq->mod_attrs, ("sysdb_new_attrs failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + + ret = sysdb_attrs_add_string(lreq->mod_attrs, SYSDB_PW_PWD, new_hash); + NEQ_CHECK_OR_JUMP(ret, EOK, ("sysdb_attrs_add_string failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + + timestamp = talloc_asprintf(lreq, "%d", (int) time(NULL)); + NULL_CHECK_OR_JUMP(timestamp, ("talloc_asprintf failed.\n"), pam_status, + PAM_SYSTEM_ERR, done); + + ret = sysdb_attrs_add_string(lreq->mod_attrs, "lastPasswordChange", + timestamp); + NEQ_CHECK_OR_JUMP(ret, EOK, ("sysdb_attrs_add_string failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + talloc_free(timestamp); + + ret = sysdb_transaction(lreq, lreq->dbctx, set_user_attr_req, lreq); + NEQ_CHECK_OR_JUMP(ret, EOK, ("sysdb_transaction failed.\n"), + pam_status, PAM_SYSTEM_ERR, done); + return; +done: + + prepare_reply(lreq, pam_status); +} + +static void pam_handler_callback(void *pvt, int ldb_status, + struct ldb_result *res) { int ret; int pam_status = PAM_SUCCESS; struct LOCAL_request *lreq; - struct sysdb_ctx *dbctx=NULL; - struct ldb_result *res=NULL; - struct ldb_context *ldb_ctx; struct ldb_dn *user_base_dn=NULL; - struct ldb_message *msg; - const char *attrs[] = {SYSDB_PW_NAME, SYSDB_PW_PWD, SYSDB_PW_DISABLED, - NULL}; char *authtok=NULL; char *newauthtok=NULL; const char *username=NULL; const char *password=NULL; char *new_hash=NULL; - const char *disabled=NULL; - char *salt=NULL; - struct callback_ctx *callback_ctx; - int callback_delay; - DEBUG(4, ("LOCAL pam handler.\n")); lreq = talloc_get_type(pvt, struct LOCAL_request); - ret = sysdb_init(lreq, lreq->cctx->ev, lreq->cctx->nctx->cdb, NULL, &dbctx); - NEQ_CHECK_OR_JUMP(ret, EOK, ("Could not set up LOCAL db"), - pam_status, PAM_SYSTEM_ERR, done); - - ldb_ctx = sysdb_ctx_get_ldb(dbctx); + DEBUG(4, ("pam_handler_callback called with ldb_status [%d].\n", + ldb_status)); -/* FIXME: replace with proper sysdb calls */ - user_base_dn = ldb_dn_new_fmt(lreq, ldb_ctx, SYSDB_TMPL_USER_BASE, - "LOCAL"); - NULL_CHECK_OR_JUMP(user_base_dn, ("Could not set up user base dn"), - pam_status, PAM_SYSTEM_ERR, done); - - ret = ldb_search(ldb_ctx, lreq, &res, user_base_dn, LDB_SCOPE_SUBTREE, - attrs, SYSDB_PWNAM_FILTER, lreq->pd->user); - NEQ_CHECK_OR_JUMP(ret, LDB_SUCCESS, ("ldb_search failed"), + NEQ_CHECK_OR_JUMP(ldb_status,LDB_SUCCESS, ("ldb search failed.\n"), pam_status, PAM_SYSTEM_ERR, done); + if (res->count < 1) { - DEBUG(4, ("No user found with filter ["SYSDB_PWNAM_FILTER"]\n", lreq->pd->user)); + DEBUG(4, ("No user found with filter ["SYSDB_PWNAM_FILTER"]\n", + lreq->pd->user)); pam_status = PAM_USER_UNKNOWN; goto done; } else if (res->count > 1) { - DEBUG(4, ("More than one object found with filter ["SYSDB_PWNAM_FILTER"]\n", lreq->pd->user)); + DEBUG(4, ("More than one object found with filter ["SYSDB_PWNAM_FILTER"]\n")); pam_status = PAM_SYSTEM_ERR; goto done; } @@ -136,6 +358,8 @@ static void LOCAL_pam_handler(struct tevent_context *ev, goto done; } + lreq->res = res; + switch (lreq->pd->cmd) { case SSS_PAM_AUTHENTICATE: case SSS_PAM_CHAUTHTOK: @@ -143,11 +367,7 @@ static void LOCAL_pam_handler(struct tevent_context *ev, lreq->pd->authtok_size, &authtok); NEQ_CHECK_OR_JUMP(ret, EOK, ("authtok2str failed.\n"), pam_status, PAM_SYSTEM_ERR, done); - - ret = authtok2str(lreq, lreq->pd->newauthtok, - lreq->pd->newauthtok_size, &newauthtok); - NEQ_CHECK_OR_JUMP(ret, EOK, ("authtok2str failed.\n"), - pam_status, PAM_SYSTEM_ERR, done); + memset(lreq->pd->authtok, 0, lreq->pd->authtok_size); password = ldb_msg_find_attr_as_string(res->msgs[0], SYSDB_PW_PWD, NULL); NULL_CHECK_OR_JUMP(password, ("No password stored.\n"), @@ -155,62 +375,31 @@ static void LOCAL_pam_handler(struct tevent_context *ev, DEBUG(4, ("user: [%s], password hash: [%s]\n", username, password)); new_hash = nss_sha512_crypt(authtok, password); + memset(authtok, 0, lreq->pd->authtok_size); + talloc_free(authtok); + if (strcmp(new_hash, password) != 0) { DEBUG(1, ("Passwords do not match.\n")); - pam_status = PAM_AUTH_ERR; -/* TODO: maybe add more inteligent delay calculation */ - callback_delay = 3; - goto done; + do_failed_login(lreq); + return; } + pam_status = PAM_SUCCESS; break; } switch (lreq->pd->cmd) { case SSS_PAM_AUTHENTICATE: - /* already done */ + do_successful_login(lreq); + return; break; case SSS_PAM_CHAUTHTOK: - salt = gen_salt(); - NULL_CHECK_OR_JUMP(salt, ("Salt generation failed.\n"), - pam_status, PAM_SYSTEM_ERR, done); - DEBUG(4, ("Using salt [%s]\n", salt)); - - new_hash = nss_sha512_crypt(newauthtok, salt); - NULL_CHECK_OR_JUMP(new_hash, ("Hash generation failed.\n"), - pam_status, PAM_SYSTEM_ERR, done); - DEBUG(4, ("New hash [%s]\n", new_hash)); - - msg = ldb_msg_new(lreq); - msg->dn = res->msgs[0]->dn; - NULL_CHECK_OR_JUMP(msg, ("ldb_msg_new failed.\n"), - pam_status, PAM_SYSTEM_ERR, done); - - ret = ldb_msg_add_empty(msg, SYSDB_PW_PWD, LDB_FLAG_MOD_REPLACE, - NULL); - NEQ_CHECK_OR_JUMP(ret, LDB_SUCCESS, ("ldb_msg_add_empty failed.\n"), - pam_status, PAM_SYSTEM_ERR, done); - - ret = ldb_msg_add_string(msg, SYSDB_PW_PWD, new_hash); - NEQ_CHECK_OR_JUMP(ret, LDB_SUCCESS, ("ldb_msg_add_string failed.\n"), - pam_status, PAM_SYSTEM_ERR, done); - - ret = ldb_modify(ldb_ctx, msg); - NEQ_CHECK_OR_JUMP(ret, LDB_SUCCESS, ("ldb_modify failed.\n"), - pam_status, PAM_SYSTEM_ERR, done); - - pam_status = PAM_SUCCESS; + do_pam_chauthtok(lreq); + return; break; case SSS_PAM_ACCT_MGMT: - disabled = ldb_msg_find_attr_as_string(res->msgs[0], - SYSDB_PW_DISABLED, NULL); - if (disabled == NULL || - strncasecmp(disabled, "false",5)==0 || - strncasecmp(disabled, "no",2)==0 ) { - pam_status = PAM_SUCCESS; - } else { - pam_status = PAM_PERM_DENIED; - } + do_pam_acct_mgmt(lreq); + return; break; case SSS_PAM_SETCRED: pam_status = PAM_SUCCESS; @@ -237,42 +426,27 @@ done: memset(newauthtok, 0, lreq->pd->newauthtok_size); talloc_free(res); talloc_free(user_base_dn); - talloc_free(dbctx); - - callback_ctx = talloc(lreq->cctx, struct callback_ctx); - if (callback_ctx == NULL) { - DEBUG(1, ("Cannot prepare callback data.\n")); - return; - } - - callback_ctx->cctx = lreq->cctx; - callback_ctx->callback = lreq->callback; - callback_ctx->pam_status = pam_status; - callback_ctx->domain = "LOCAL"; - - talloc_free(lreq); - ret = gettimeofday(&tv, NULL); - if (ret != 0) { - DEBUG(1, ("gettimeofday failed, continuing.\n")); - } - tv.tv_sec += callback_delay; - tv.tv_usec = 0; - - te = tevent_add_timer(ev, callback_ctx->cctx, tv, LOCAL_call_callback, - callback_ctx); - if (te == NULL) { - DEBUG(1, ("Cannot add callback to event loop.\n")); - return; - } + prepare_reply(lreq, pam_status); } -int LOCAL_schedule_request(struct cli_ctx *cctx, pam_dp_callback_t callback, - struct pam_data *pd) +int LOCAL_pam_handler(struct cli_ctx *cctx, pam_dp_callback_t callback, + struct pam_data *pd) { - struct LOCAL_request *lreq; - struct tevent_timer *te; - struct timeval tv; + int ret; + struct LOCAL_request *lreq=NULL; + + static const char *attrs[] = {SYSDB_PW_NAME, + SYSDB_PW_PWD, + SYSDB_PW_DISABLED, + SYSDB_USER_ATTR_LAST_LOGIN, + "lastPasswordChange", + "accountExpires", + "failedLoginAttempts", + "passwordHint", + "passwordHistory", + "lastFailedLogin", + NULL}; lreq = talloc(cctx, struct LOCAL_request); if (!lreq) { @@ -281,15 +455,30 @@ int LOCAL_schedule_request(struct cli_ctx *cctx, pam_dp_callback_t callback, lreq->cctx = cctx; lreq->pd = pd; lreq->callback = callback; + lreq->global_pam_status = PAM_SUCCESS; + lreq->callback_delay = 0; - /* fire immediately */ - tv.tv_sec = 0; - tv.tv_usec = 0; - te = tevent_add_timer(cctx->ev, cctx, tv, LOCAL_pam_handler, lreq); - if (te == NULL) { - return EIO; + DEBUG(4, ("LOCAL pam handler.\n")); + + lreq->domain_info = btreemap_get_value(lreq->cctx->nctx->domain_map, + lreq->pd->domain); + NULL_CHECK_OR_JUMP(lreq->domain_info, ("Domain info not found.\n"), + ret, EINVAL, done); + + lreq->dbctx = lreq->cctx->nctx->sysdb; + + ret = sysdb_get_user_attr(lreq, lreq->dbctx, lreq->domain_info->name, + lreq->pd->user, attrs, 0, pam_handler_callback, + lreq); + + if(ret != EOK) { + DEBUG(1, ("sysdb_get_user_attr failed.\n")); + goto done; } return EOK; +done: + talloc_free(lreq); + return ret; } diff --git a/server/responder/pam/pam_LOCAL_domain.h b/server/responder/pam/pam_LOCAL_domain.h index a0a7ec5e..6cac6075 100644 --- a/server/responder/pam/pam_LOCAL_domain.h +++ b/server/responder/pam/pam_LOCAL_domain.h @@ -3,7 +3,7 @@ #include "responder/pam/pamsrv.h" -int LOCAL_schedule_request(struct cli_ctx *cctx, pam_dp_callback_t callback, - struct pam_data *pd); +int LOCAL_pam_handler(struct cli_ctx *cctx, pam_dp_callback_t callback, + struct pam_data *pd); #endif /* __PAM_LOCAL_DOMAIN_H__ */ diff --git a/server/responder/pam/pamsrv_cmd.c b/server/responder/pam/pamsrv_cmd.c index 6c518695..68a82472 100644 --- a/server/responder/pam/pamsrv_cmd.c +++ b/server/responder/pam/pamsrv_cmd.c @@ -160,7 +160,7 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd) } if ( strncasecmp(pd->domain,"LOCAL",5) == 0 ) { - return LOCAL_schedule_request(cctx, pam_reply, pd); + return LOCAL_pam_handler(cctx, pam_reply, pd); }; ret=pam_dp_send_req(cctx, pam_reply, PAM_DP_TIMEOUT, pd); |