#define COPY_STRING(s) (s) ? strdup(s) : NULL
/*
- * Macro converted to a function to simplyify this thing
+ * PAM error handler.
*/
static BOOL pam_error_handler(pam_handle_t *pamh, int pam_error, char *msg, int dbglvl)
{
if( pam_error != PAM_SUCCESS)
{
- DEBUG(dbglvl, ("PAM %s: %s\n", pam_strerror(pamh, pam_error)));
+ DEBUG(dbglvl, ("PAM: %s : %s\n", msg, pam_strerror(pamh, pam_error)));
return False;
}
return True;
NULL
};
+/*
+ * PAM Closing out cleanup handler
+ */
static BOOL proc_pam_end(pam_handle_t *pamh)
{
int pam_error;
{
pam_error = pam_end(pamh, 0);
if(pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
+ DEBUG(4, ("PAM: PAM_END OK.\n"));
return True;
}
}
- DEBUG(2,("PAM not initialised"));
+ DEBUG(2,("PAM: not initialised"));
return False;
}
-
-static BOOL pam_auth(char *user, char *password)
+/*
+ * Start PAM authentication for specified account
+ */
+static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
{
- pam_handle_t *pamh;
- int pam_error;
+ int pam_error;
+ char * rhost;
- /*
- * Now use PAM to do authentication. Bail out if there are any
- * errors.
- */
+ DEBUG(4,("PAM: Init user: %s\n", user));
- PAM_password = password;
- PAM_username = user;
- DEBUG(4,("PAM Start for User: %s\n", user));
- pam_error = pam_start("samba", user, &PAM_conversation, &pamh);
- if(!pam_error_handler(pamh, pam_error, "start failure", 2)) {
- proc_pam_end(pamh);
- return False;
- }
+ pam_error = pam_start("samba", user, &PAM_conversation, pamh);
+ if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
+ proc_pam_end(*pamh);
+ return False;
+ }
+
+ rhost = client_name();
+ if (strcmp(rhost,"UNKNOWN") == 0)
+ rhost = client_addr();
+
+#ifdef PAM_RHOST
+ DEBUG(4,("PAM: setting rhost to: %s\n", rhost));
+ pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
+ if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
+ proc_pam_end(*pamh);
+ return False;
+ }
+#endif
+#ifdef PAM_TTY
+ pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
+ if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
+ proc_pam_end(*pamh);
+ return False;
+ }
+#endif
+ DEBUG(4,("PAM: Init passed for user: %s\n", user));
+ return True;
+}
+
+/*
+ * PAM Authentication Handler
+ */
+static BOOL pam_auth(pam_handle_t *pamh, char *user, char *password)
+{
+ int pam_error;
/*
* To enable debugging set in /etc/pam.d/samba:
* auth required /lib/security/pam_pwdb.so nullok shadow audit
*/
+ DEBUG(4,("PAM: Authenticate User: %s\n", user));
pam_error = pam_authenticate(pamh, PAM_SILENT); /* Can we authenticate user? */
switch( pam_error ){
case PAM_AUTH_ERR:
proc_pam_end(pamh);
return False;
}
+ /* If this point is reached, the user has been authenticated. */
+ return (True);
+}
- /*
- * Now do account management control and validation
- */
+/*
+ * PAM Account Handler
+ */
+static BOOL pam_account(pam_handle_t *pamh, char * user, char * password)
+{
+ int pam_error;
+
+ DEBUG(4,("PAM: Account Management for User: %s\n", user));
pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
switch( pam_error ) {
case PAM_AUTHTOK_EXPIRED:
DEBUG(0, ("PAM: User is NOT permitted to access system at this time\n"));
break;
case PAM_USER_UNKNOWN:
- DEBUG(2, ("PAM: User \"%s\" is NOT known to account management\n", user));
+ DEBUG(0, ("PAM: User \"%s\" is NOT known to account management\n", user));
break;
default:
DEBUG(4, ("PAM: Account OK for User: %s\n", user));
return False;
}
- if( !proc_pam_end(pamh))
- return False;
-
/* If this point is reached, the user has been authenticated. */
- DEBUG(4, ("PAM: pam_authentication passed for User: %s\n", user));
return (True);
}
-#if NOTBLOCKEDOUT
-/* Start PAM authentication for specified account */
-static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
-{
- int pam_error;
- char * rhost;
-
- DEBUG(4,("PAM Init for user: %s\n", user));
-
- pam_error = pam_start("samba", user, &PAM_conversation, pamh);
- if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
- proc_pam_end(*pamh);
- return False;
- }
-
- rhost = client_name();
- if (strcmp(rhost,"UNKNOWN") == 0)
- rhost = client_addr();
-
-#ifdef PAM_RHOST
- DEBUG(4,("PAM setting rhost to: %s\n", rhost));
- pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
- if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
- proc_pam_end(*pamh);
- return False;
- }
-#endif
-
-#if defined(PAM_TTY_KLUDGE) && defined(PAM_TTY)
- pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
- if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
- proc_pam_end(*pamh);
- return False;
- }
-#endif
-
- return True;
-}
-static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance)
+/*
+ * PAM Internal Session Handler
+ */
+static BOOL proc_pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL flag)
{
int pam_error;
PAM_username = user;
#ifdef PAM_TTY
- DEBUG(4,("PAM tty set to: %s\"\n", tty));
+ DEBUG(4,("PAM: tty set to: %s\n", tty));
pam_error = pam_set_item(pamh, PAM_TTY, tty);
if (!pam_error_handler(pamh, pam_error, "set tty failed", 0)) {
proc_pam_end(pamh);
}
#endif
- if (instance) {
+ if (flag) {
pam_error = pam_open_session(pamh, PAM_SILENT);
if (!pam_error_handler(pamh, pam_error, "session setup failed", 0)) {
proc_pam_end(pamh);
return (True);
}
-static BOOL pam_account(pam_handle_t *pamh, char *user)
-{
- int pam_error;
-
- PAM_password = NULL;
- PAM_username = user;
-
- DEBUG(4,("PAM starting account management for user: %s \n", user));
-
- pam_error = pam_acct_mgmt(pamh, PAM_SILENT);
- if (!pam_error_handler(pamh, pam_error, "PAM set account management failed", 0)) {
- proc_pam_end(pamh);
- return False;
- } else {
- DEBUG(4,("PAM account management passed\n"));
- }
-
- /*
- * This will allow samba to aquire a kerberos token. And, when
- * exporting an AFS cell, be able to /write/ to this cell.
- */
- pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED));
- if (!pam_error_handler(pamh, pam_error, "set credentials failed\n", 0)) {
- proc_pam_end(pamh);
- return False;
- }
-
- /* If this point is reached, the user has been authenticated. */
- return (True);
-}
-static BOOL account_pam(char *user)
-{
- /*
- * Check the account with the PAM account module:
- * - This means that accounts can be disabled
- * and or expired with avoidance of samba then just
- * bypassing the situation.
- */
-
- pam_handle_t *pamh = NULL;
- char * PAMuser;
-
- PAMuser = malloc(strlen(user)+1);
- /* This is freed by PAM */
- strncpy(PAMuser, user, strlen(user)+1);
-
- if (proc_pam_start(&pamh, PAMuser))
- {
- if (pam_account(pamh, PAMuser))
- {
- return proc_pam_end(pamh);
- }
- }
- proc_pam_end(pamh);
- return False;
-}
-
-BOOL PAM_session(BOOL instance, const connection_struct *conn, char *tty)
+/*
+ * PAM Externally accessible Session handler
+ */
+BOOL pam_session(BOOL flag, const connection_struct *conn, char *tty)
{
- pam_handle_t *pamh=NULL;
+ pam_handle_t *pamh = NULL;
char * user;
user = malloc(strlen(conn->user)+1);
+ if ( user == NULL )
+ {
+ DEBUG(0, ("PAM: PAM_session Malloc Failed!\n"));
+ return False;
+ }
/* This is freed by PAM */
- strncpy(user, conn->user, strlen(conn->user)+1);
+ StrnCpy(user, conn->user, strlen(conn->user)+1);
if (!proc_pam_start(&pamh, user))
{
return False;
}
- if (pam_session(pamh, user, tty, instance))
+ if (proc_pam_session(pamh, user, tty, flag))
{
return proc_pam_end(pamh);
}
}
}
+/*
+ * PAM Password Validation Suite
+ */
BOOL pam_passcheck(char * user, char * password)
{
pam_handle_t *pamh = NULL;
if( proc_pam_start(&pamh, user))
{
- if( pam_auth(user, password))
+ if ( pam_auth(pamh, user, password))
{
- if( account_pam(user))
+ if ( pam_account(pamh, user, password))
{
return( proc_pam_end(pamh));
}
- }
+ }
}
- proc_pam_end(pamh);
+ DEBUG(0, ("PAM: System Validation Failed - Rejecting User!\n"));
return( False );
}
-#endif /* NOTBLOCKEDOUT */
-BOOL pam_passcheck( char * user, char * password )
-{
- return( pam_auth( user, password ));
-
-}
#else
/* Do *NOT* make this function static. Doing so breaks the compile on gcc */
#define COPY_STRING(s) (s) ? strdup(s) : NULL
/*
- * Macro converted to a function to simplyify this thing
+ * PAM error handler.
*/
static BOOL pam_error_handler(pam_handle_t *pamh, int pam_error, char *msg, int dbglvl)
{
if( pam_error != PAM_SUCCESS)
{
- DEBUG(dbglvl, ("PAM %s: %s\n", pam_strerror(pamh, pam_error)));
+ DEBUG(dbglvl, ("PAM: %s : %s\n", msg, pam_strerror(pamh, pam_error)));
return False;
}
return True;
NULL
};
+/*
+ * PAM Closing out cleanup handler
+ */
static BOOL proc_pam_end(pam_handle_t *pamh)
{
int pam_error;
{
pam_error = pam_end(pamh, 0);
if(pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) {
+ DEBUG(4, ("PAM: PAM_END OK.\n"));
return True;
}
}
- DEBUG(2,("PAM not initialised"));
+ DEBUG(2,("PAM: not initialised"));
return False;
}
-
-static BOOL pam_auth(char *user, char *password)
+/*
+ * Start PAM authentication for specified account
+ */
+static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
{
- pam_handle_t *pamh;
- int pam_error;
+ int pam_error;
+ char * rhost;
- /*
- * Now use PAM to do authentication. Bail out if there are any
- * errors.
- */
+ DEBUG(4,("PAM: Init user: %s\n", user));
- PAM_password = password;
- PAM_username = user;
- DEBUG(4,("PAM Start for User: %s\n", user));
- pam_error = pam_start("samba", user, &PAM_conversation, &pamh);
- if(!pam_error_handler(pamh, pam_error, "start failure", 2)) {
- proc_pam_end(pamh);
- return False;
- }
+ pam_error = pam_start("samba", user, &PAM_conversation, pamh);
+ if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
+ proc_pam_end(*pamh);
+ return False;
+ }
+
+ rhost = client_name();
+ if (strcmp(rhost,"UNKNOWN") == 0)
+ rhost = client_addr();
+
+#ifdef PAM_RHOST
+ DEBUG(4,("PAM: setting rhost to: %s\n", rhost));
+ pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
+ if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
+ proc_pam_end(*pamh);
+ return False;
+ }
+#endif
+#ifdef PAM_TTY
+ pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
+ if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
+ proc_pam_end(*pamh);
+ return False;
+ }
+#endif
+ DEBUG(4,("PAM: Init passed for user: %s\n", user));
+ return True;
+}
+
+/*
+ * PAM Authentication Handler
+ */
+static BOOL pam_auth(pam_handle_t *pamh, char *user, char *password)
+{
+ int pam_error;
/*
* To enable debugging set in /etc/pam.d/samba:
* auth required /lib/security/pam_pwdb.so nullok shadow audit
*/
+ DEBUG(4,("PAM: Authenticate User: %s\n", user));
pam_error = pam_authenticate(pamh, PAM_SILENT); /* Can we authenticate user? */
switch( pam_error ){
case PAM_AUTH_ERR:
proc_pam_end(pamh);
return False;
}
+ /* If this point is reached, the user has been authenticated. */
+ return (True);
+}
- /*
- * Now do account management control and validation
- */
+/*
+ * PAM Account Handler
+ */
+static BOOL pam_account(pam_handle_t *pamh, char * user, char * password)
+{
+ int pam_error;
+
+ DEBUG(4,("PAM: Account Management for User: %s\n", user));
pam_error = pam_acct_mgmt(pamh, PAM_SILENT); /* Is user account enabled? */
switch( pam_error ) {
case PAM_AUTHTOK_EXPIRED:
DEBUG(0, ("PAM: User is NOT permitted to access system at this time\n"));
break;
case PAM_USER_UNKNOWN:
- DEBUG(2, ("PAM: User \"%s\" is NOT known to account management\n", user));
+ DEBUG(0, ("PAM: User \"%s\" is NOT known to account management\n", user));
break;
default:
DEBUG(4, ("PAM: Account OK for User: %s\n", user));
return False;
}
- if( !proc_pam_end(pamh))
- return False;
-
/* If this point is reached, the user has been authenticated. */
- DEBUG(4, ("PAM: pam_authentication passed for User: %s\n", user));
return (True);
}
-#if NOTBLOCKEDOUT
-/* Start PAM authentication for specified account */
-static BOOL proc_pam_start(pam_handle_t **pamh, char *user)
-{
- int pam_error;
- char * rhost;
-
- DEBUG(4,("PAM Init for user: %s\n", user));
-
- pam_error = pam_start("samba", user, &PAM_conversation, pamh);
- if( !pam_error_handler(*pamh, pam_error, "Init Failed", 0)) {
- proc_pam_end(*pamh);
- return False;
- }
-
- rhost = client_name();
- if (strcmp(rhost,"UNKNOWN") == 0)
- rhost = client_addr();
-
-#ifdef PAM_RHOST
- DEBUG(4,("PAM setting rhost to: %s\n", rhost));
- pam_error = pam_set_item(*pamh, PAM_RHOST, rhost);
- if(!pam_error_handler(*pamh, pam_error, "set rhost failed", 0)) {
- proc_pam_end(*pamh);
- return False;
- }
-#endif
-
-#if defined(PAM_TTY_KLUDGE) && defined(PAM_TTY)
- pam_error = pam_set_item(*pamh, PAM_TTY, "samba");
- if (!pam_error_handler(*pamh, pam_error, "set tty failed", 0)) {
- proc_pam_end(*pamh);
- return False;
- }
-#endif
-
- return True;
-}
-static BOOL pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL instance)
+/*
+ * PAM Internal Session Handler
+ */
+static BOOL proc_pam_session(pam_handle_t *pamh, char *user, char *tty, BOOL flag)
{
int pam_error;
PAM_username = user;
#ifdef PAM_TTY
- DEBUG(4,("PAM tty set to: %s\"\n", tty));
+ DEBUG(4,("PAM: tty set to: %s\n", tty));
pam_error = pam_set_item(pamh, PAM_TTY, tty);
if (!pam_error_handler(pamh, pam_error, "set tty failed", 0)) {
proc_pam_end(pamh);
}
#endif
- if (instance) {
+ if (flag) {
pam_error = pam_open_session(pamh, PAM_SILENT);
if (!pam_error_handler(pamh, pam_error, "session setup failed", 0)) {
proc_pam_end(pamh);
return (True);
}
-static BOOL pam_account(pam_handle_t *pamh, char *user)
-{
- int pam_error;
-
- PAM_password = NULL;
- PAM_username = user;
-
- DEBUG(4,("PAM starting account management for user: %s \n", user));
-
- pam_error = pam_acct_mgmt(pamh, PAM_SILENT);
- if (!pam_error_handler(pamh, pam_error, "PAM set account management failed", 0)) {
- proc_pam_end(pamh);
- return False;
- } else {
- DEBUG(4,("PAM account management passed\n"));
- }
-
- /*
- * This will allow samba to aquire a kerberos token. And, when
- * exporting an AFS cell, be able to /write/ to this cell.
- */
- pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED));
- if (!pam_error_handler(pamh, pam_error, "set credentials failed\n", 0)) {
- proc_pam_end(pamh);
- return False;
- }
-
- /* If this point is reached, the user has been authenticated. */
- return (True);
-}
-static BOOL account_pam(char *user)
-{
- /*
- * Check the account with the PAM account module:
- * - This means that accounts can be disabled
- * and or expired with avoidance of samba then just
- * bypassing the situation.
- */
-
- pam_handle_t *pamh = NULL;
- char * PAMuser;
-
- PAMuser = malloc(strlen(user)+1);
- /* This is freed by PAM */
- strncpy(PAMuser, user, strlen(user)+1);
-
- if (proc_pam_start(&pamh, PAMuser))
- {
- if (pam_account(pamh, PAMuser))
- {
- return proc_pam_end(pamh);
- }
- }
- proc_pam_end(pamh);
- return False;
-}
-
-BOOL PAM_session(BOOL instance, const connection_struct *conn, char *tty)
+/*
+ * PAM Externally accessible Session handler
+ */
+BOOL pam_session(BOOL flag, const connection_struct *conn, char *tty)
{
- pam_handle_t *pamh=NULL;
+ pam_handle_t *pamh = NULL;
char * user;
user = malloc(strlen(conn->user)+1);
+ if ( user == NULL )
+ {
+ DEBUG(0, ("PAM: PAM_session Malloc Failed!\n"));
+ return False;
+ }
/* This is freed by PAM */
- strncpy(user, conn->user, strlen(conn->user)+1);
+ StrnCpy(user, conn->user, strlen(conn->user)+1);
if (!proc_pam_start(&pamh, user))
{
return False;
}
- if (pam_session(pamh, user, tty, instance))
+ if (proc_pam_session(pamh, user, tty, flag))
{
return proc_pam_end(pamh);
}
}
}
+/*
+ * PAM Password Validation Suite
+ */
BOOL pam_passcheck(char * user, char * password)
{
pam_handle_t *pamh = NULL;
if( proc_pam_start(&pamh, user))
{
- if( pam_auth(user, password))
+ if ( pam_auth(pamh, user, password))
{
- if( account_pam(user))
+ if ( pam_account(pamh, user, password))
{
return( proc_pam_end(pamh));
}
- }
+ }
}
- proc_pam_end(pamh);
+ DEBUG(0, ("PAM: System Validation Failed - Rejecting User!\n"));
return( False );
}
-#endif /* NOTBLOCKEDOUT */
-BOOL pam_passcheck( char * user, char * password )
-{
- return( pam_auth( user, password ));
-
-}
#else
/* Do *NOT* make this function static. Doing so breaks the compile on gcc */
git.samba.org / kai / samba.git / commitdiff