Remove S/Key. PAM can do its job. Well, not quite - there is an issue

with the conversation function and challenges which needs to be
revisited, so in the interim a hack is introduced to provide
an OPIE challenge (which is random if OPIE does not apply)
at all non-anonymnous logins.

1 files changed, 11 insertions, 23 deletions

diff --git a/libexec/ftpd/ftpd.c b/libexec/ftpd/ftpd.c
index bd57cee..be02623 100644
--- a/libexec/ftpd/ftpd.c
+++ b/libexec/ftpd/ftpd.c
@@ -78,6 +78,9 @@ static const char rcsid[] =
 #include <netdb.h>
 #include <pwd.h>
 #include <grp.h>
+#ifdef USE_PAM
+#include <opie.h>	/* XXX */
+#endif
 #include <setjmp.h>
 #include <signal.h>
 #include <stdio.h>
@@ -91,10 +94,6 @@ static const char rcsid[] =
 #include <login_cap.h>
 #endif
 
-#ifdef	SKEY
-#include <skey.h>
-#endif
-
 #ifdef USE_PAM
 #include <security/pam_appl.h>
 #endif
@@ -185,6 +184,10 @@ char	*tty = ttyline;		/* for klogin */
 #ifdef USE_PAM
 static int	auth_pam __P((struct passwd**, const char*));
 pam_handle_t *pamh = NULL;
+
+/* Kluge because the conversation mechanism has not been threshed out */
+static struct opie opiedata;
+static char opieprompt[OPIE_CHALLENGE_MAX+1];
 #endif
 
 char	*pid_file = NULL;
@@ -215,10 +218,6 @@ char	*LastArgv = NULL;	/* end of argv */
 char	proctitle[LINE_MAX];	/* initial part of title */
 #endif /* SETPROCTITLE */
 
-#ifdef SKEY
-int	pwok = 0;
-#endif
-
 #define LOGCMD(cmd, file) \
 	if (logging > 1) \
 	    syslog(LOG_INFO,"%s %s%s", cmd, \
@@ -960,9 +959,10 @@ user(name)
 	}
 	if (logging)
 		strncpy(curname, name, sizeof(curname)-1);
-#ifdef SKEY
-	pwok = skeyaccess(name, NULL, remotehost, remotehost);
-	reply(331, "%s", skey_challenge(name, pw, pwok));
+#ifdef USE_PAM
+	/* XXX Kluge! The conversation mechanism needs to be fixed. */
+	opiechallenge(&opiedata, name, opieprompt);
+	reply(331, "[ %s ] Password required for %s.", opieprompt, name);
 #else
 	reply(331, "Password required for %s.", name);
 #endif
@@ -1236,16 +1236,7 @@ pass(passwd)
 		if (rval >= 0)
 			goto skip;
 #endif
-#ifdef SKEY
-		if (pwok)
-			rval = strcmp(pw->pw_passwd,
-			    crypt(passwd, pw->pw_passwd));
-		if (rval)
-			rval = strcmp(pw->pw_passwd,
-			    skey_crypt(passwd, pw->pw_passwd, pw, pwok));
-#else
 		rval = strcmp(pw->pw_passwd, crypt(passwd, pw->pw_passwd));
-#endif
 		/* The strcmp does not catch null passwords! */
 		if (*pw->pw_passwd == '\0' ||
 		    (pw->pw_expire && time(NULL) >= pw->pw_expire))
@@ -1272,9 +1263,6 @@ skip:
 			return;
 		}
 	}
-#ifdef SKEY
-	pwok = 0;
-#endif
 	login_attempts = 0;		/* this time successful */
 	if (setegid((gid_t)pw->pw_gid) < 0) {
 		reply(550, "Can't set gid.");