tac_pam.c

   1 /* tac_pam.auth.c
   2  * A simple pam authentication  routine written by
   3  * Max Liccardo <ravel@tiscalinet.it>
   4  * PAM_RUSER=username/rem_addr.
   5  */
   6
   7 /*
   8     This program was contributed by Shane Watts
   9     [modifications by AGM]
  10
  11     You need to add the following (or equivalent) to the /etc/pam.conf file.
  12     # check authorization
  13     check_user   auth       required     /usr/lib/security/pam_unix_auth.so
  14     check_user   account    required     /usr/lib/security/pam_unix_acct.so
  15 */
  16
  17
  18 #include "tac_plus.h"
  19
  20 #ifdef USE_PAM
  21
  22 #include <stdio.h>
  23 #include <stdlib.h>
  24 #include <string.h>
  25 #include <security/pam_appl.h>
  26
  27 #include "tac_pam.h"
  28 #include "report.h"
  29 #include "utils.h"
  30 #include "choose_authen.h"              /* for "struct authen_data" */
  31 #include "do_author.h"                  /* for "struct identity" */
  32 #include "main.h"
  33
  34
  35 typedef struct {
  36     const char *UserName;
  37     const char *Passwd;
  38 } UserCred;
  39
  40
  41 static int fconv TAC_ARGS((int num_msg, const struct pam_message **msg, struct pam_response **resp, void *appdata_ptr));
  42
  43 static int fconv(num_msg, msg, resp, appdata_ptr)
  44 int num_msg;
  45 const struct pam_message **msg;
  46 struct pam_response **resp;
  47 void *appdata_ptr;
  48 {
  49     int i;
  50     UserCred *lUserCred;
  51
  52
  53     lUserCred = appdata_ptr;
  54
  55     if(lUserCred == NULL) {
  56         report(LOG_ERR,"argh....maybe a SunOs 5.6 ???");
  57         return(PAM_CONV_ERR);
  58     }
  59
  60     *resp = (struct pam_response *) tac_malloc(num_msg * sizeof(struct pam_response));
  61
  62     for (i=0; i<num_msg; i++) {
  63         switch(msg[i]->msg_style) {
  64
  65         case PAM_PROMPT_ECHO_OFF:
  66             resp[i]->resp = strdup(lUserCred->Passwd);
  67             break;
  68
  69         case PAM_PROMPT_ECHO_ON:
  70             resp[i]->resp = strdup(lUserCred->UserName);
  71             break;
  72
  73         default:
  74             resp[i]->resp = NULL;
  75             report(LOG_DEBUG,"conv default");
  76             break;
  77         }
  78         resp[i]->resp_retcode = 0;
  79     }
  80
  81     return(PAM_SUCCESS);
  82 }
  83
  84
  85 int tac_pam_auth TAC_ARGS((const char *aszUserName, const char *aszPassword, struct authen_data *data, const char *aszService));
  86
  87 int
  88 tac_pam_auth(aszUserName, aszPassword, data, aszService)
  89 const char *aszUserName;
  90 const char *aszPassword;
  91 struct authen_data *data;
  92 const char *aszService;
  93 {
  94     pam_handle_t *pamh = NULL;
  95     int retval;
  96     char *lpszRemoteUser;                       /* Username/NAC address */
  97     struct pam_conv s_conv;
  98     UserCred s_UserCred;
  99
 100
 101     s_UserCred.UserName = aszUserName;
 102     s_UserCred.Passwd   = aszPassword;
 103
 104     s_conv.conv = fconv;
 105     s_conv.appdata_ptr = (void *) &s_UserCred;
 106
 107
 108     lpszRemoteUser = tac_malloc((strlen(aszUserName)+1+strlen(data->NAS_id->NAC_address)+1) * sizeof(char));
 109
 110     retval = pam_start(aszService,aszUserName , &s_conv, &pamh);
 111
 112     if (retval != PAM_SUCCESS) {
 113         report(LOG_ERR, "cannot start pam-authentication");
 114         free(lpszRemoteUser);
 115         pamh = NULL;
 116         return(1);
 117     }
 118
 119     sprintf(lpszRemoteUser,"%s:%s",aszUserName,data->NAS_id->NAC_address);
 120
 121     pam_set_item(pamh,PAM_RUSER,lpszRemoteUser);
 122     pam_set_item(pamh,PAM_RHOST,data->NAS_id->NAS_name);
 123     pam_set_item(pamh,PAM_TTY,data->NAS_id->NAS_port);
 124
 125     free(lpszRemoteUser);
 126
 127     retval = pam_authenticate(pamh,0);                  /* is user really user? */
 128
 129     if(retval != PAM_SUCCESS)
 130         report(LOG_ERR, "%s",pam_strerror(pamh,retval));
 131
 132     if (pam_end(pamh,retval) != PAM_SUCCESS) {          /* close Linux-PAM */
 133         pamh = NULL;
 134         return(1);
 135     }
 136
 137     return ( retval == PAM_SUCCESS ? 0:1 );             /* indicate success */
 138 }
 139
 140
 141 /* PAM authorization rotine written by
 142  * Devrim SERAL <devrim@tef.gazi.edu.tr>
 143 */
 144
 145 int tac_pam_authorization TAC_ARGS((const char *aszUserName, struct author_data *data, const char *aszService));
 146
 147 int
 148 tac_pam_authorization(aszUserName, data, aszService)
 149 const char *aszUserName;
 150 struct author_data *data;
 151 const char *aszService;
 152 {
 153     pam_handle_t *pamh = NULL;
 154     int retval;
 155     char *lpszRemoteUser;                       /* Username/NAC address */
 156     struct pam_conv s_conv;
 157     UserCred s_UserCred;
 158
 159
 160     s_UserCred.UserName = aszUserName;
 161
 162     s_conv.conv = fconv;
 163     s_conv.appdata_ptr = (void *) &s_UserCred;
 164
 165     if (aszService== NULL) {
 166         report(LOG_ERR,"Service Name doesn't available So authorize him");
 167         return(0);
 168     }
 169
 170     lpszRemoteUser = tac_malloc((strlen(aszUserName)+strlen(data->id->NAC_address)+2) * sizeof(char));
 171
 172     retval = pam_start(aszService,aszUserName , &s_conv, &pamh);
 173
 174     if (retval != PAM_SUCCESS) {
 175         report(LOG_ERR, "cannot start pam-authentication");
 176         free(lpszRemoteUser);
 177         pamh = NULL;
 178         return(1);
 179     }
 180
 181     sprintf(lpszRemoteUser,"%s:%s",aszUserName,data->id->NAC_address);
 182
 183     pam_set_item(pamh,PAM_RUSER,lpszRemoteUser);
 184     pam_set_item(pamh,PAM_RHOST,data->id->NAS_name);
 185     pam_set_item(pamh,PAM_TTY,data->id->NAS_port);
 186
 187     free(lpszRemoteUser);
 188
 189     retval = pam_acct_mgmt(pamh, 0);            /* Is user permit to gain access system */
 190
 191     if (retval != PAM_SUCCESS)
 192         report(LOG_ERR, "Pam Account Managment:%s",pam_strerror(pamh,retval));
 193     else {
 194         if (debug & DEBUG_AUTHOR_FLAG)
 195             report(LOG_DEBUG, "PAM authorization allow user");
 196     }
 197
 198    if (pam_end(pamh,retval) != PAM_SUCCESS) {           /* close Linux-PAM */
 199         pamh = NULL;
 200         return(1);
 201     }
 202
 203     return ( retval == PAM_SUCCESS ? 0:1 );             /* indicate success */
 204 }
 205
 206 #else /* USE_PAM */
 207
 208 TAC_SOURCEFILE_EMPTY
 209
 210 #endif /* USE_PAM */