|
 |
36e843 |
From 923dc05d68031a217684aba87acdadc7f711c88a Mon Sep 17 00:00:00 2001
|
|
|
36e843 |
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
|
|
36e843 |
Date: Thu, 10 Mar 2011 15:16:04 +0100
|
|
|
36e843 |
Subject: [PATCH] Set PAM_TTY and PAM_RHOST on PAM authentication
|
|
|
36e843 |
|
|
|
36e843 |
When loging to server, PAM can make decision on client network address, so set
|
|
|
36e843 |
it appropriately. Also some modules require non-empy console name, thus set
|
|
|
36e843 |
PAM_TTY to cvs PAM service name (`cvs').
|
|
|
36e843 |
|
|
|
36e843 |
PAM failure is reported back to client.
|
|
|
36e843 |
|
|
|
36e843 |
This code is back-ported from from upstream developemt tree (r1.489).
|
|
|
36e843 |
`peer' and `len' types fixed to cover any address family.
|
|
|
36e843 |
---
|
|
|
36e843 |
src/server.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++-
|
|
|
36e843 |
1 files changed, 46 insertions(+), 1 deletions(-)
|
|
|
36e843 |
|
|
|
36e843 |
diff --git a/src/server.c b/src/server.c
|
|
|
36e843 |
index 0505ab9..bc6f0d0 100644
|
|
|
36e843 |
--- a/src/server.c
|
|
|
36e843 |
+++ b/src/server.c
|
|
|
36e843 |
@@ -5799,18 +5799,61 @@ error 0 %s: no such user\n", username);
|
|
|
36e843 |
#if PAM_SUPPORT
|
|
|
36e843 |
pam_handle_t *pamh = NULL;
|
|
|
36e843 |
struct pam_conv conv;
|
|
|
36e843 |
+ char *pam_stage = "start";
|
|
|
36e843 |
+ struct sockaddr_storage peer;
|
|
|
36e843 |
+ socklen_t len;
|
|
|
36e843 |
+ char host[NI_MAXHOST];
|
|
|
36e843 |
int retval;
|
|
|
36e843 |
|
|
|
36e843 |
+ /* get the client's ip address */
|
|
|
36e843 |
+ len = sizeof (peer);
|
|
|
36e843 |
+ if (getpeername (STDIN_FILENO, (struct sockaddr *)&peer, &len) < 0)
|
|
|
36e843 |
+ {
|
|
|
36e843 |
+ printf ("E Fatal error, aborting.\n\
|
|
|
36e843 |
+error %s getpeername failed\n", strerror (errno));
|
|
|
36e843 |
+ exit (EXIT_FAILURE);
|
|
|
36e843 |
+ }
|
|
|
36e843 |
+
|
|
|
36e843 |
+ /* convert the ip address to text */
|
|
|
36e843 |
+ if (getnameinfo((struct sockaddr *)&peer, len, host, NI_MAXHOST,
|
|
|
36e843 |
+ NULL, 0, NI_NUMERICHOST) < 0)
|
|
|
36e843 |
+ {
|
|
|
36e843 |
+ printf ("E Fatal error, aborting.\n\
|
|
|
36e843 |
+error %s getnameinfo failed\n", strerror (errno));
|
|
|
36e843 |
+ exit (EXIT_FAILURE);
|
|
|
36e843 |
+ }
|
|
|
36e843 |
+
|
|
|
36e843 |
conv.conv = silent_conv;
|
|
|
36e843 |
conv.appdata_ptr = password;
|
|
|
36e843 |
|
|
|
36e843 |
- retval = pam_start("cvs", username, &conv, &pamh);
|
|
|
36e843 |
+#define PAM_SERVICE_NAME "cvs"
|
|
|
36e843 |
+ retval = pam_start(PAM_SERVICE_NAME, username, &conv, &pamh);
|
|
|
36e843 |
+
|
|
|
36e843 |
+ /* sets a dummy tty name which pam modules can check for */
|
|
|
36e843 |
+ if (retval == PAM_SUCCESS)
|
|
|
36e843 |
+ {
|
|
|
36e843 |
+ pam_stage = "set dummy tty";
|
|
|
36e843 |
+ retval = pam_set_item (pamh, PAM_TTY, PAM_SERVICE_NAME);
|
|
|
36e843 |
+ }
|
|
|
36e843 |
+#undef PAM_SERVICE_NAME
|
|
|
36e843 |
+
|
|
|
36e843 |
+ if (retval == PAM_SUCCESS)
|
|
|
36e843 |
+ {
|
|
|
36e843 |
+ pam_stage = "set remote host ip";
|
|
|
36e843 |
+ retval = pam_set_item (pamh, PAM_RHOST, host);
|
|
|
36e843 |
+ }
|
|
|
36e843 |
|
|
|
36e843 |
if (retval == PAM_SUCCESS)
|
|
|
36e843 |
+ {
|
|
|
36e843 |
+ pam_stage = "authenticate";
|
|
|
36e843 |
retval = pam_authenticate(pamh, 0); /* is user really user? */
|
|
|
36e843 |
+ }
|
|
|
36e843 |
|
|
|
36e843 |
if (retval == PAM_SUCCESS)
|
|
|
36e843 |
+ {
|
|
|
36e843 |
+ pam_stage = "account";
|
|
|
36e843 |
retval = pam_acct_mgmt(pamh, 0); /* permitted access? */
|
|
|
36e843 |
+ }
|
|
|
36e843 |
|
|
|
36e843 |
/* This is where we have been authorized or not. */
|
|
|
36e843 |
|
|
|
36e843 |
@@ -5818,6 +5861,8 @@ error 0 %s: no such user\n", username);
|
|
|
36e843 |
host_user = xstrdup (username);
|
|
|
36e843 |
} else {
|
|
|
36e843 |
host_user = NULL;
|
|
|
36e843 |
+ printf ("E PAM %s error: %s\n",
|
|
|
36e843 |
+ pam_stage, pam_strerror (pamh, retval));
|
|
|
36e843 |
}
|
|
|
36e843 |
|
|
|
36e843 |
if (pam_end(pamh,retval) != PAM_SUCCESS) { /* close Linux-PAM */
|
|
|
36e843 |
--
|
|
|
36e843 |
1.7.4
|
|
|
36e843 |
|