tac_pam.c

   1 #ifdef USE_PAM
   2
   3 /* tac_pam.auth.c
   4  * A simple pam authentication  routine written by
   5  * Max Liccardo <ravel@tiscalinet.it>
   6  * PAM_RUSER=username/rem_addr.
   7  */
   8
   9  /*
  10     This program was contributed by Shane Watts
  11     [modifications by AGM]
  12
  13     You need to add the following (or equivalent) to the /etc/pam.conf file.
  14     # check authorization
  15     check_user   auth       required     /usr/lib/security/pam_unix_auth.so
  16     check_user   account    required     /usr/lib/security/pam_unix_acct.so
  17    */
  18
  19 #include <stdio.h>
  20 #include <stdlib.h>
  21 #include <string.h>
  22 #include <security/pam_appl.h>
  23 #include "tac_plus.h"
  24
  25 typedef struct
  26 {
  27         char *UserName;
  28         char *Passwd;
  29 } UserCred;
  30
  31
  32 static int fconv(int num_msg, const struct pam_message **msg,
  33                 struct pam_response **resp,void *appdata_ptr)
  34 {
  35         int             i;
  36     UserCred    *lUserCred;
  37
  38
  39         lUserCred  = appdata_ptr;
  40
  41         if(lUserCred == NULL)
  42         {
  43                 report(LOG_ERR,"argh....maybe a SunOs 5.6 ???");
  44                 return(PAM_CONV_ERR);
  45         }
  46
  47
  48         *resp = (struct pam_response *) calloc(num_msg,sizeof(struct pam_response));
  49
  50         for(i=0;i<num_msg;i++)
  51         {
  52                 switch(msg[i]->msg_style)
  53                 {
  54                         case PAM_PROMPT_ECHO_OFF:
  55                 resp[i]->resp = strdup(lUserCred->Passwd);
  56                 break;
  57
  58                         case PAM_PROMPT_ECHO_ON:
  59                 resp[i]->resp = strdup(lUserCred->UserName);
  60                 break;
  61
  62                         default:
  63                                  report(LOG_DEBUG,"conv default");
  64                         break;
  65                 }
  66                 resp[i]->resp_retcode = 0;
  67         }
  68
  69         return(PAM_SUCCESS);
  70 }
  71
  72
  73
  74
  75 int
  76 tac_pam_auth(char *aszUserName,char *aszPassword,struct authen_data *data,char *aszService)
  77 {
  78         pam_handle_t    *pamh=NULL;
  79         int                     retval;
  80         char                    *lpszRemoteUser;                                /* Username/NAC address */
  81     struct pam_conv s_conv;
  82         UserCred                s_UserCred;
  83
  84
  85         s_UserCred.UserName = aszUserName;
  86     s_UserCred.Passwd   = aszPassword;
  87
  88         s_conv.conv = fconv;
  89     s_conv.appdata_ptr = (void *) &s_UserCred;
  90
  91
  92         if((lpszRemoteUser = calloc(strlen(aszUserName)+strlen(data->NAS_id->NAC_address)+2,sizeof(char))) == NULL)
  93         {
  94         report(LOG_ERR,"cannot malloc");
  95                 return(1);
  96         }
  97
  98         retval = pam_start(aszService,aszUserName , &s_conv, &pamh);
  99
 100         if (retval != PAM_SUCCESS)
 101         {
 102             report(LOG_ERR, "cannot start pam-authentication");
 103                 pamh = NULL;
 104                 return(1);
 105     }
 106
 107     sprintf(lpszRemoteUser,"%s:%s",aszUserName,data->NAS_id->NAC_address);
 108
 109     pam_set_item(pamh,PAM_RUSER,lpszRemoteUser);
 110     pam_set_item(pamh,PAM_RHOST,data->NAS_id->NAS_name);
 111     pam_set_item(pamh,PAM_TTY,data->NAS_id->NAS_port);
 112
 113         free(lpszRemoteUser);
 114
 115     retval = pam_authenticate(pamh,0);                          /* is user really user? */
 116
 117     if(retval != PAM_SUCCESS)
 118         report(LOG_ERR, "%s",pam_strerror(pamh,retval));
 119
 120     if (pam_end(pamh,retval) != PAM_SUCCESS) {     /* close Linux-PAM */
 121                 pamh = NULL;
 122                 return(1);
 123         }
 124
 125     return ( retval == PAM_SUCCESS ? 0:1 );       /* indicate success */
 126 }
 127
 128
 129 /* PAM authorization rotine written by
 130  * Devrim SERAL <devrim@tef.gazi.edu.tr>
 131 */
 132
 133 int
 134 tac_pam_authorization (char *aszUserName,struct author_data *data,char *aszService)
 135 {
 136         pam_handle_t    *pamh=NULL;
 137         int                     retval;
 138         char                    *lpszRemoteUser;                                /* Username/NAC address */
 139         struct pam_conv s_conv;
 140         UserCred                s_UserCred;
 141
 142
 143         s_UserCred.UserName = aszUserName;
 144
 145         s_conv.conv = fconv;
 146         s_conv.appdata_ptr = (void *) &s_UserCred;
 147
 148         if (aszService== NULL)
 149         {
 150         report(LOG_ERR,"Service Name doesn't available So authorize him");
 151                 return(0);
 152         }
 153
 154
 155         if((lpszRemoteUser = calloc(strlen(aszUserName)+strlen(data->id->NAC_address)+2,sizeof(char))) == NULL)
 156         {
 157         report(LOG_ERR,"cannot malloc");
 158                 return(1);
 159         }
 160
 161         retval = pam_start(aszService,aszUserName , &s_conv, &pamh);
 162
 163         if (retval != PAM_SUCCESS)
 164         {
 165             report(LOG_ERR, "cannot start pam-authentication");
 166                 pamh = NULL;
 167                 return(1);
 168     }
 169
 170     sprintf(lpszRemoteUser,"%s:%s",aszUserName,data->id->NAC_address);
 171
 172     pam_set_item(pamh,PAM_RUSER,lpszRemoteUser);
 173     pam_set_item(pamh,PAM_RHOST,data->id->NAS_name);
 174     pam_set_item(pamh,PAM_TTY,data->id->NAS_port);
 175
 176         free(lpszRemoteUser);
 177
 178     retval = pam_acct_mgmt(pamh, 0); /* Is user permit to gain access system */
 179
 180     if(retval != PAM_SUCCESS)
 181         report(LOG_ERR, "Pam Account Managment:%s",pam_strerror(pamh,retval));
 182     else
 183         if (debug & DEBUG_AUTHOR_FLAG)
 184         report(LOG_DEBUG, "PAM authorization allow user");
 185
 186    if (pam_end(pamh,retval) != PAM_SUCCESS) {     /* close Linux-PAM */
 187                 pamh = NULL;
 188                 return(1);
 189         }
 190
 191     return ( retval == PAM_SUCCESS ? 0:1 );       /* indicate success */
 192 }
 193
 194
 195 #endif /* USE_PAM */
 196
 197
 198
 199