Remove pwdauth.c
We don't know what it was for. If anyone cares, it's in git history. In my distro, there seem to be no traces of it: alx@debian:~$ apt-file find pwdauth alx@debian:~$ Link: <https://codesearch.debian.net/search?q=pwdauth&literal=1> Link: <https://github.com/shadow-maint/shadow/pull/612> Cc: Christian Göttsche <cgzones@googlemail.com> Cc: Iker Pedrosa <ipedrosa@redhat.com> Signed-off-by: Alejandro Colomar <alx@kernel.org>
This commit is contained in:
Alejandro Colomar
Serge Hallyn
parent
74c17c7167
commit
5fae37271e
|
|
@ -2,5 +2,5 @@
|
|||
# and also cooperate to make a distribution for `make dist'
|
||||
|
||||
EXTRA_DIST = README adduser.c adduser.sh adduser2.sh \
|
||||
atudel groupmems.shar pwdauth.c shadow-anonftp.patch \
|
||||
atudel groupmems.shar shadow-anonftp.patch \
|
||||
udbachk.tgz
|
||||
|
|
|
|||
|
|
@ -1,308 +0,0 @@
|
|||
/*
|
||||
* pwdauth.c - program to verify a given username/password pair.
|
||||
*
|
||||
* Run it with username in argv[1] (may be omitted - default is the
|
||||
* current user), and send it the password over a pipe on stdin.
|
||||
* Exit status: 0 - correct password, 1 - wrong password, >1 - other
|
||||
* errors. For use with shadow passwords, this program should be
|
||||
* installed setuid root.
|
||||
*
|
||||
* This can be used, for example, by xlock - you don't have to install
|
||||
* this large and complex (== possibly insecure) program setuid root,
|
||||
* just modify it to run this simple program to do the authentication.
|
||||
*
|
||||
* Recent versions (xlockmore-3.9) are cleaner, and drop privileges as
|
||||
* soon as possible after getting the user's encrypted password.
|
||||
* Using this program probably doesn't make it more secure, and has one
|
||||
* disadvantage: since we don't get the encrypted user's password at
|
||||
* startup (but at the time the user is authenticated), it is not clear
|
||||
* how we should handle errors (like getpwnam() returning NULL).
|
||||
* - fail the authentication? Problem: no way to unlock (other than kill
|
||||
* the process from somewhere else) if the NIS server stops responding.
|
||||
* - succeed and unlock? Problem: it's too easy to unlock by unplugging
|
||||
* the box from the network and waiting until NIS times out...
|
||||
*
|
||||
* This program is Copyright (C) 1996 Marek Michalkiewicz
|
||||
* <marekm@i17linuxb.ists.pwr.wroc.pl>.
|
||||
*
|
||||
* It may be used and distributed freely for any purposes. There is no
|
||||
* warranty - use at your own risk. I am not liable for any damages etc.
|
||||
* If you improve it, please send me your changes.
|
||||
*/
|
||||
|
||||
static char rcsid[] = "$Id$";
|
||||
|
||||
/*
|
||||
* Define USE_SYSLOG to use syslog() to log successful and failed
|
||||
* authentication. This should be safe even if your system has
|
||||
* the infamous syslog buffer overrun security problem...
|
||||
*/
|
||||
#define USE_SYSLOG
|
||||
|
||||
/*
|
||||
* Define HAVE_GETSPNAM to get shadow passwords using getspnam().
|
||||
* Some systems don't have getspnam(), but getpwnam() returns
|
||||
* encrypted passwords only if running as root.
|
||||
*
|
||||
* According to the xlock source (not tested, except Linux) -
|
||||
* define: Linux, Solaris 2.x, SVR4, ...
|
||||
* undef: HP-UX with Secured Passwords, FreeBSD, NetBSD, QNX.
|
||||
* Known not supported (yet): Ultrix, OSF/1, SCO.
|
||||
*/
|
||||
#define HAVE_GETSPNAM
|
||||
|
||||
/*
|
||||
* Define HAVE_PW_ENCRYPT to use pw_encrypt() instead of crypt().
|
||||
* pw_encrypt() is like the standard crypt(), except that it may
|
||||
* support better password hashing algorithms.
|
||||
*
|
||||
* Define if linking with libshadow.a from the shadow password
|
||||
* suite (Linux, SunOS 4.x?).
|
||||
*/
|
||||
#undef HAVE_PW_ENCRYPT
|
||||
|
||||
/*
|
||||
* Define HAVE_AUTH_METHODS to support the shadow suite specific
|
||||
* extension: the encrypted password field contains a list of
|
||||
* administrator defined authentication methods, separated by
|
||||
* semicolons. This program only supports the standard password
|
||||
* authentication method (a string that doesn't start with '@').
|
||||
*/
|
||||
#undef HAVE_AUTH_METHODS
|
||||
|
||||
/*
|
||||
* FAIL_DELAY - number of seconds to sleep before exiting if the
|
||||
* password was wrong, to slow down password guessing attempts.
|
||||
*/
|
||||
#define FAIL_DELAY 2
|
||||
|
||||
/* No user-serviceable parts below :-). */
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/wait.h>
|
||||
#include <unistd.h>
|
||||
#include <pwd.h>
|
||||
|
||||
#ifdef USE_SYSLOG
|
||||
#include <syslog.h>
|
||||
#ifndef LOG_AUTHPRIV
|
||||
#define LOG_AUTHPRIV LOG_AUTH
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_GETSPNAM
|
||||
#include <shadow.h>
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_PW_ENCRYPT
|
||||
extern char *pw_encrypt();
|
||||
#define crypt pw_encrypt
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Read the password (one line) from fp. We don't turn off echo
|
||||
* because we expect input from a pipe.
|
||||
*/
|
||||
static char *
|
||||
get_line(fp)
|
||||
FILE *fp;
|
||||
{
|
||||
static char buf[128];
|
||||
char *cp;
|
||||
int ch;
|
||||
|
||||
cp = buf;
|
||||
while ((ch = getc(fp)) != EOF && ch != '\0' && ch != '\n') {
|
||||
if (cp >= buf + sizeof buf - 1)
|
||||
break;
|
||||
*cp++ = ch;
|
||||
}
|
||||
*cp = '\0';
|
||||
return buf;
|
||||
}
|
||||
|
||||
/*
|
||||
* Get the password file entry for the current user. If the name
|
||||
* returned by getlogin() is correct (matches the current real uid),
|
||||
* return the entry for that user. Otherwise, return the entry (if
|
||||
* any) matching the current real uid. Return NULL on failure.
|
||||
*/
|
||||
static struct passwd *
|
||||
get_my_pwent()
|
||||
{
|
||||
uid_t uid = getuid();
|
||||
char *name = getlogin();
|
||||
|
||||
if (name && *name) {
|
||||
struct passwd *pw = getpwnam(name);
|
||||
|
||||
if (pw && pw->pw_uid == uid)
|
||||
return pw;
|
||||
}
|
||||
return getpwuid(uid);
|
||||
}
|
||||
|
||||
/*
|
||||
* Verify the password. The system-dependent shadow support is here.
|
||||
*/
|
||||
static int
|
||||
password_auth_ok(pw, pass)
|
||||
const struct passwd *pw;
|
||||
const char *pass;
|
||||
{
|
||||
int result;
|
||||
char *cp;
|
||||
#ifdef HAVE_AUTH_METHODS
|
||||
char *buf;
|
||||
#endif
|
||||
#ifdef HAVE_GETSPNAM
|
||||
struct spwd *sp;
|
||||
#endif
|
||||
|
||||
if (pw) {
|
||||
#ifdef HAVE_GETSPNAM
|
||||
sp = getspnam(pw->pw_name);
|
||||
if (sp)
|
||||
cp = sp->sp_pwdp;
|
||||
else
|
||||
#endif
|
||||
cp = pw->pw_passwd;
|
||||
} else
|
||||
cp = "xx";
|
||||
|
||||
#ifdef HAVE_AUTH_METHODS
|
||||
buf = strdup(cp); /* will be modified by strtok() */
|
||||
if (!buf) {
|
||||
fprintf(stderr, "Out of memory.\n");
|
||||
exit(13);
|
||||
}
|
||||
cp = strtok(buf, ";");
|
||||
while (cp && *cp == '@')
|
||||
cp = strtok(NULL, ";");
|
||||
|
||||
/* fail if no password authentication for this user */
|
||||
if (!cp)
|
||||
cp = "xx";
|
||||
#endif
|
||||
|
||||
if (*pass || *cp)
|
||||
result = (strcmp(crypt(pass, cp), cp) == 0);
|
||||
else
|
||||
result = 1; /* user with no password */
|
||||
|
||||
#ifdef HAVE_AUTH_METHODS
|
||||
free(buf);
|
||||
#endif
|
||||
return result;
|
||||
}
|
||||
|
||||
/*
|
||||
* Main program.
|
||||
*/
|
||||
int
|
||||
main(argc, argv)
|
||||
int argc;
|
||||
char **argv;
|
||||
{
|
||||
struct passwd *pw;
|
||||
char *pass, *name;
|
||||
char myname[32];
|
||||
|
||||
#ifdef USE_SYSLOG
|
||||
openlog("pwdauth", LOG_PID | LOG_CONS, LOG_AUTHPRIV);
|
||||
#endif
|
||||
pw = get_my_pwent();
|
||||
if (!pw) {
|
||||
#ifdef USE_SYSLOG
|
||||
syslog(LOG_ERR, "can't get login name for uid %d.\n",
|
||||
(int) getuid());
|
||||
#endif
|
||||
fprintf(stderr, "Who are you?\n");
|
||||
exit(2);
|
||||
}
|
||||
strncpy(myname, pw->pw_name, sizeof myname - 1);
|
||||
myname[sizeof myname - 1] = '\0';
|
||||
name = myname;
|
||||
|
||||
if (argc > 1) {
|
||||
name = argv[1];
|
||||
pw = getpwnam(name);
|
||||
}
|
||||
|
||||
pass = get_line(stdin);
|
||||
if (password_auth_ok(pw, pass)) {
|
||||
#ifdef USE_SYSLOG
|
||||
syslog(pw->pw_uid ? LOG_INFO : LOG_NOTICE,
|
||||
"user `%s' entered correct password for `%.32s'.\n",
|
||||
myname, name);
|
||||
#endif
|
||||
exit(0);
|
||||
}
|
||||
#ifdef USE_SYSLOG
|
||||
/* be careful not to overrun the syslog buffer */
|
||||
syslog((!pw || pw->pw_uid) ? LOG_NOTICE : LOG_WARNING,
|
||||
"user `%s' entered incorrect password for `%.32s'.\n",
|
||||
myname, name);
|
||||
#endif
|
||||
#ifdef FAIL_DELAY
|
||||
sleep(FAIL_DELAY);
|
||||
#endif
|
||||
fprintf(stderr, "Wrong password.\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
#if 0
|
||||
/*
|
||||
* You can use code similar to the following to run this program.
|
||||
* Return values: >=0 - program exit status (use the <sys/wait.h>
|
||||
* macros to get the exit code, it is shifted left by 8 bits),
|
||||
* -1 - check errno.
|
||||
*/
|
||||
int
|
||||
verify_password(const char *username, const char *password)
|
||||
{
|
||||
int pipe_fd[2];
|
||||
int pid, wpid, status;
|
||||
|
||||
if (pipe(pipe_fd))
|
||||
return -1;
|
||||
|
||||
if ((pid = fork()) == 0) {
|
||||
char *arg[3];
|
||||
char *env[1];
|
||||
|
||||
/* child */
|
||||
close(pipe_fd[1]);
|
||||
if (pipe_fd[0] != 0) {
|
||||
if (dup2(pipe_fd[0], 0) != 0)
|
||||
_exit(127);
|
||||
close(pipe_fd[0]);
|
||||
}
|
||||
arg[0] = "/usr/bin/pwdauth";
|
||||
arg[1] = username;
|
||||
arg[2] = NULL;
|
||||
env[0] = NULL;
|
||||
execve(arg[0], arg, env);
|
||||
_exit(127);
|
||||
} else if (pid == -1) {
|
||||
/* error */
|
||||
close(pipe_fd[0]);
|
||||
close(pipe_fd[1]);
|
||||
return -1;
|
||||
}
|
||||
/* parent */
|
||||
close(pipe_fd[0]);
|
||||
write(pipe_fd[1], password, strlen(password));
|
||||
write(pipe_fd[1], "\n", 1);
|
||||
close(pipe_fd[1]);
|
||||
|
||||
while ((wpid = wait(&status)) != pid) {
|
||||
if (wpid == -1)
|
||||
return -1;
|
||||
}
|
||||
return status;
|
||||
}
|
||||
#endif
|
||||
Loading…
Reference in New Issue