diff options
author | jdp <jdp@FreeBSD.org> | 1999-05-08 01:59:27 +0000 |
---|---|---|
committer | jdp <jdp@FreeBSD.org> | 1999-05-08 01:59:27 +0000 |
commit | 3b1a00d745517ae78fdeed8c328a173d7aa54567 (patch) | |
tree | fb6786f4e5d3887076238f27347e4a1cf640c178 /lib | |
parent | 6917b00bc8ee216542e93207dac41322d0fbbaf6 (diff) | |
download | FreeBSD-src-3b1a00d745517ae78fdeed8c328a173d7aa54567.zip FreeBSD-src-3b1a00d745517ae78fdeed8c328a173d7aa54567.tar.gz |
Revive the pam_deny and pam_permit modules from Linux-PAM. They are
simple enough to be trusted.
Add account management functionality to the pam_unix module.
These changes should make it possible to use PAM in some ports.
Submitted by: Max Khon <fjoe@iclub.nsu.ru>
Diffstat (limited to 'lib')
-rw-r--r-- | lib/libpam/libpam/Makefile | 2 | ||||
-rw-r--r-- | lib/libpam/modules/Makefile | 2 | ||||
-rw-r--r-- | lib/libpam/modules/pam_deny/Makefile | 41 | ||||
-rw-r--r-- | lib/libpam/modules/pam_permit/Makefile | 42 | ||||
-rw-r--r-- | lib/libpam/modules/pam_unix/Makefile | 4 | ||||
-rw-r--r-- | lib/libpam/modules/pam_unix/pam_unix.c | 74 |
6 files changed, 163 insertions, 2 deletions
diff --git a/lib/libpam/libpam/Makefile b/lib/libpam/libpam/Makefile index 7603a65..ddcc688 100644 --- a/lib/libpam/libpam/Makefile +++ b/lib/libpam/libpam/Makefile @@ -61,9 +61,11 @@ HDRS3= pam_mod_misc.h # Static PAM modules: STATIC_MODULES+= ${MODOBJDIR}/pam_cleartext_pass_ok/libpam_cleartext_pass_ok.a +STATIC_MODULES+= ${MODOBJDIR}/pam_deny/libpam_deny.a .if defined(MAKE_KERBEROS4) STATIC_MODULES+= ${MODOBJDIR}/pam_kerberosIV/libpam_kerberosIV.a .endif +STATIC_MODULES+= ${MODOBJDIR}/pam_permit/libpam_permit.a STATIC_MODULES+= ${MODOBJDIR}/pam_radius/libpam_radius.a STATIC_MODULES+= ${MODOBJDIR}/pam_skey/libpam_skey.a STATIC_MODULES+= ${MODOBJDIR}/pam_tacplus/libpam_tacplus.a diff --git a/lib/libpam/modules/Makefile b/lib/libpam/modules/Makefile index 5a3e3c1..74136ba 100644 --- a/lib/libpam/modules/Makefile +++ b/lib/libpam/modules/Makefile @@ -25,9 +25,11 @@ # $FreeBSD$ SUBDIR+= pam_cleartext_pass_ok +SUBDIR+= pam_deny .if defined(MAKE_KERBEROS4) SUBDIR+= pam_kerberosIV .endif +SUBDIR+= pam_permit SUBDIR+= pam_radius SUBDIR+= pam_skey SUBDIR+= pam_tacplus diff --git a/lib/libpam/modules/pam_deny/Makefile b/lib/libpam/modules/pam_deny/Makefile new file mode 100644 index 0000000..17b1447 --- /dev/null +++ b/lib/libpam/modules/pam_deny/Makefile @@ -0,0 +1,41 @@ +# Copyright 1999 Max Khon. +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +# $FreeBSD$ + +PAMDIR= ${.CURDIR}/../../../../contrib/libpam + +.PATH: ${PAMDIR}/modules/pam_deny + +LIB= pam_deny +SHLIB_NAME= pam_deny.so +SRCS= pam_deny.c +CFLAGS+= -Wall +CFLAGS+= -I${PAMDIR}/libpam/include +DPADD+= ${LIBGCC_PIC} +LDADD+= -lgcc_pic +INTERNALLIB= yes +INTERNALSTATICLIB=yes + +.include <bsd.lib.mk> diff --git a/lib/libpam/modules/pam_permit/Makefile b/lib/libpam/modules/pam_permit/Makefile new file mode 100644 index 0000000..8863ff5 --- /dev/null +++ b/lib/libpam/modules/pam_permit/Makefile @@ -0,0 +1,42 @@ +# Copyright 1999 Max Khon. +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# +# $FreeBSD$ + +PAMDIR= ${.CURDIR}/../../../../contrib/libpam + +.PATH: ${PAMDIR}/modules/pam_permit + +LIB= pam_permit +SHLIB_NAME= pam_permit.so +SRCS= pam_permit.c +CFLAGS+= -Wall +CFLAGS+= -I${PAMDIR}/libpam/include +CFLAGS+= -I${.CURDIR}/../../libpam +DPADD+= ${LIBGCC_PIC} +LDADD+= -lgcc_pic +INTERNALLIB= yes +INTERNALSTATICLIB=yes + +.include <bsd.lib.mk> diff --git a/lib/libpam/modules/pam_unix/Makefile b/lib/libpam/modules/pam_unix/Makefile index d3bb689..d049e2b 100644 --- a/lib/libpam/modules/pam_unix/Makefile +++ b/lib/libpam/modules/pam_unix/Makefile @@ -32,8 +32,8 @@ SRCS= pam_unix.c CFLAGS+= -Wall CFLAGS+= -I${PAMDIR}/libpam/include CFLAGS+= -I${.CURDIR}/../../libpam -DPADD+= ${LIBGCC_PIC} -LDADD+= -lgcc_pic +DPADD+= ${LIBUTIL} ${LIBGCC_PIC} +LDADD+= -lutil -lgcc_pic INTERNALLIB= yes INTERNALSTATICLIB=yes diff --git a/lib/libpam/modules/pam_unix/pam_unix.c b/lib/libpam/modules/pam_unix/pam_unix.c index b68a9d4..329b784 100644 --- a/lib/libpam/modules/pam_unix/pam_unix.c +++ b/lib/libpam/modules/pam_unix/pam_unix.c @@ -27,18 +27,26 @@ */ #include <sys/types.h> +#include <sys/time.h> +#include <login_cap.h> #include <pwd.h> #include <stdlib.h> #include <string.h> +#include <stdio.h> #include <unistd.h> #define PAM_SM_AUTH +#define PAM_SM_ACCOUNT #include <security/pam_modules.h> #include "pam_mod_misc.h" #define PASSWORD_PROMPT "Password:" +/* + * authentication management + */ + PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv) @@ -87,4 +95,70 @@ pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv) return PAM_SUCCESS; } +/* + * account management + * + * check pw_change and pw_expire fields + */ +PAM_EXTERN +int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags, + int argc, const char **argv) +{ + const char *user; + struct passwd *pw; + struct timeval tp; + time_t warntime; + login_cap_t *lc = NULL; + char buf[128]; + int retval; + + retval = pam_get_item(pamh, PAM_USER, (const void **)&user); + if (retval != PAM_SUCCESS || user == NULL) + /* some implementations return PAM_SUCCESS here */ + return PAM_USER_UNKNOWN; + + if ((pw = getpwnam(user)) == NULL) + return PAM_USER_UNKNOWN; + + retval = PAM_SUCCESS; + lc = login_getpwclass(pw); + + if (pw->pw_change || pw->pw_expire) + gettimeofday(&tp, NULL); + +#define DEFAULT_WARN (2L * 7L * 86400L) /* Two weeks */ + + warntime = login_getcaptime(lc, "warnpassword", DEFAULT_WARN, + DEFAULT_WARN); + + if (pw->pw_change) { + if (tp.tv_sec >= pw->pw_change) + /* some implementations return PAM_AUTHTOK_EXPIRED */ + retval = PAM_NEW_AUTHTOK_REQD; + else if (pw->pw_change - tp.tv_sec < warntime) { + snprintf(buf, sizeof(buf), + "Warning: your password expires on %s", + ctime(&pw->pw_change)); + pam_prompt(pamh, PAM_ERROR_MSG, buf, NULL); + } + } + + warntime = login_getcaptime(lc, "warnexpire", DEFAULT_WARN, + DEFAULT_WARN); + + if (pw->pw_expire) { + if (tp.tv_sec >= pw->pw_expire) + retval = PAM_ACCT_EXPIRED; + else if (pw->pw_expire - tp.tv_sec < warntime) { + snprintf(buf, sizeof(buf), + "Warning: your account expires on %s", + ctime(&pw->pw_expire)); + pam_prompt(pamh, PAM_ERROR_MSG, buf, NULL); + } + } + + login_close(lc); + return retval; +} + PAM_MODULE_ENTRY("pam_unix"); |