Commit 23d32d02 authored by jan.koester's avatar jan.koester
Browse files

test

parent 00911fc1

commands/auth/authutil.h

+22 −0
Changes for commands/auth/authutil.h: 22 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
#include <cstdio>

#include <cstdlib>

#include <cstring>

#include <cerrno>



#include <unistd.h>

#include <termios.h>
@@ -52,6 +53,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
#include <sys/types.h>

#include <pwd.h>

#include <shadow.h>

#include <userdb.h>



#include "ids.h"
@@ -98,6 +100,26 @@ namespace fresh { namespace auth { 
        return true;

    }



    // The account's password hash -- /etc/shadow.yaml's, else the passwd

    // field -- and whether it's a user of an external source (<userdb.h>:

    // Active Directory, ...) instead: no shadow entry and "*" in the passwd

    // field, its source checks the password (verifyExternal()). A local

    // "*" account stays locked: the libc never asks a module for those.

    inline std::string accountHash(const std::string &username,const PasswdEntry &pe,bool &external){

        std::string hash;

        external=false;

        if(lookupShadowHash(username,hash)) return hash;

        external=pe.passwd=="*";

        return pe.passwd;

    }



    inline bool verifyExternal(const std::string &username,const std::string &given){

        int r=userdb_authenticate(username.c_str(),given.c_str());

        if(r!=0 && r!=EACCES)

            std::cerr << "cannot check the password of " << username << ": " << strerror(r) << std::endl;

        return r==0;

    }



    // Empty hash: passwordless account (classic Unix semantics -- login

    // allowed with no password prompt at all). "!"/"!!"/"*"-prefixed:

    // locked, always rejected regardless of what's typed.

commands/auth/login.cpp

+7 −7
Changes for commands/auth/login.cpp: 7 added lines, 7 removed lines.
Original line number Diff line number Diff line
@@ -65,17 +65,17 @@ namespace fresh { namespace cmd { 
            bool userExists=auth::lookupPasswd(username,pe);



            std::string hash;

            if(userExists){

                if(!auth::lookupShadowHash(username,hash))

                    hash=pe.passwd;

            }

            bool external=false;

            if(userExists)

                hash=auth::accountHash(username,pe,external);



            bool needsPassword=userExists && !hash.empty() && hash[0]!='!' && hash[0]!='*';

            bool locked=userExists && !hash.empty() && (hash[0]=='!' || hash[0]=='*');

            bool needsPassword=userExists && (external || (!hash.empty() && hash[0]!='!' && hash[0]!='*'));

            bool locked=userExists && !external && !hash.empty() && (hash[0]=='!' || hash[0]=='*');



            if(needsPassword){

                std::string given=auth::readPassword("Password: ");

                if(!userExists || !auth::verifyPassword(hash,given)){

                bool ok=external ? auth::verifyExternal(username,given) : auth::verifyPassword(hash,given);

                if(!ok){

                    std::cerr << "Login incorrect" << std::endl;

                    return 1;

                }

commands/auth/suimpl.h

+5 −5
Changes for commands/auth/suimpl.h: 5 added lines, 5 removed lines.
Original line number Diff line number Diff line
@@ -99,12 +99,12 @@ namespace fresh { namespace auth { 
        }



        if(!callerIsRoot){

            std::string hash;

            if(!lookupShadowHash(target,hash))

                hash=pe.passwd;

            if(!hash.empty()){

            bool external;

            std::string hash=accountHash(target,pe,external);

            if(external || !hash.empty()){

                std::string given=readPassword("Password: ");

                if(!verifyPassword(hash,given)){

                bool ok=external ? verifyExternal(target,given) : verifyPassword(hash,given);

                if(!ok){

                    std::cerr << "su: Authentication failure" << std::endl;

                    return 1;

                }