diff options
| -rw-r--r-- | libexec/rshd/Makefile | 7 | ||||
| -rw-r--r-- | libexec/rshd/rshd.8 | 14 | ||||
| -rw-r--r-- | libexec/rshd/rshd.c | 58 |
3 files changed, 71 insertions, 8 deletions
diff --git a/libexec/rshd/Makefile b/libexec/rshd/Makefile index 5d5cef8..c94f453 100644 --- a/libexec/rshd/Makefile +++ b/libexec/rshd/Makefile @@ -1,5 +1,5 @@ # From: @(#)Makefile 8.1 (Berkeley) 6/4/93 -# $Id$ +# $Id: Makefile,v 1.6 1997/02/22 14:22:22 peter Exp $ PROG= rshd SRCS= rshd.c @@ -13,4 +13,9 @@ LDADD= -lkrb -ldes DISTRIBUTION= krb .endif +# For login_cap handling +CFLAGS+=-DLOGIN_CAP +DPADD+= ${LIBUTIL} +LDADD+= -lutil + .include <bsd.prog.mk> diff --git a/libexec/rshd/rshd.8 b/libexec/rshd/rshd.8 index 1bb3c0a..4925a9c 100644 --- a/libexec/rshd/rshd.8 +++ b/libexec/rshd/rshd.8 @@ -30,7 +30,7 @@ .\" SUCH DAMAGE. .\" .\" @(#)rshd.8 8.1 (Berkeley) 6/4/93 -.\" $Id$ +.\" $Id: rshd.8,v 1.7 1997/02/22 14:22:22 peter Exp $ .\" .Dd June 4, 1993 .Dt RSHD 8 @@ -133,6 +133,12 @@ If the file .Pa /etc/nologin exists and the user is not the superuser, the connection is closed. +The name of the nologin file may be overridden +using the nologin= capability in login.conf +according to the local user's login class, +which may also be used to restrict rsh access by +login time (times.allow and times.deny capabilities) +and remote host (hosts.allow and hosts.deny capabilities). .It A null byte is returned on the initial socket and the command line is passed to the normal login @@ -181,6 +187,9 @@ The command to the home directory failed. .It Sy Permission denied. The authentication procedure described above failed. +.It Sy Logins not available right now. +Rsh was attempted outside the allowed hours defined in +login.conf for the local user's login class. .It Sy Can't make pipe. The pipe needed for the .Em stderr , @@ -202,12 +211,12 @@ and is not preceded by a flag byte. .Xr rcmd 3 , .Xr ruserok 3 , .Xr hosts 5 , +.Xr login.conf 5 , .Xr nologin 5 , .Xr services 5 , .Xr named 8 , .Xr rlogind 8 , .Xr syslogd 8 . - .Sh FILES .Bl -tag -width /etc/hosts -compact .It Pa /etc/hosts @@ -215,7 +224,6 @@ and is not preceded by a flag byte. .It Pa $HOME/.rhosts .It Pa /etc/nologin .El - .Sh BUGS The authentication procedure used here assumes the integrity of each client machine and the connecting medium. This is diff --git a/libexec/rshd/rshd.c b/libexec/rshd/rshd.c index b90214d..2e98c12 100644 --- a/libexec/rshd/rshd.c +++ b/libexec/rshd/rshd.c @@ -30,7 +30,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $Id: rshd.c,v 1.14 1997/03/28 15:48:17 imp Exp $ + * $Id: rshd.c,v 1.15 1997/03/29 12:35:06 peter Exp $ */ #ifndef lint @@ -72,6 +72,9 @@ static char sccsid[] = "@(#)rshd.c 8.2 (Berkeley) 4/6/94"; #include <string.h> #include <syslog.h> #include <unistd.h> +#ifdef LOGIN_CAP +#include <login_cap.h> +#endif int keepalive = 1; int check_all; @@ -205,6 +208,9 @@ doit(fromp) char cmdbuf[NCARGS+1], locuser[16], remuser[16]; char remotehost[2 * MAXHOSTNAMELEN + 1]; char fromhost[2 * MAXHOSTNAMELEN + 1]; +#ifdef LOGIN_CAP + login_cap_t *lc; +#endif #ifdef KERBEROS AUTH_DAT *kdata = (AUTH_DAT *) NULL; @@ -441,7 +447,20 @@ doit(fromp) errorstr = "Login incorrect.\n"; goto fail; } +#ifdef LOGIN_CAP + lc = login_getclass(pwd); +#endif if (chdir(pwd->pw_dir) < 0) { +#ifdef LOGIN_CAP + if (chdir("/") < 0 || + login_getcapbool(lc, "requirehome", !!pwd->pw_uid)) { + syslog(LOG_INFO|LOG_AUTH, + "%s@%s as %s: no home directory. cmd='%.80s'", + remuser, hostname, locuser, cmdbuf); + error("No remote home directory.\n"); + exit(0); + } +#else (void) chdir("/"); #ifdef notdef syslog(LOG_INFO|LOG_AUTH, @@ -450,6 +469,8 @@ doit(fromp) error("No remote directory.\n"); exit(1); #endif +#endif + pwd->pw_dir = "/"; } #ifdef KERBEROS @@ -491,6 +512,27 @@ fail: error("Logins currently disabled.\n"); exit(1); } +#ifdef LOGIN_CAP + if (lc != NULL) { + char remote_ip[MAXHOSTNAMELEN]; + + strncpy(remote_ip, inet_ntoa(fromp->sin_addr), + sizeof(remote_ip) - 1); + remote_ip[sizeof(remote_ip) - 1] = 0; + if (!auth_hostok(lc, fromhost, remote_ip)) { + syslog(LOG_INFO|LOG_AUTH, + "%s@%s as %s: permission denied (%s). cmd='%.80s'", + remuser, hostname, locuser, __rcmd_errstr, + cmdbuf); + error("Permission denied.\n"); + exit(1); + } + if (!auth_timeok(lc, time(NULL))) { + error("Logins not available right now\n"); + exit(1); + } + } +#endif /* !LOGIN_CAP */ #if BSD > 43 /* before fork, while we're session leader */ if (setlogin(pwd->pw_name) < 0) @@ -670,9 +712,6 @@ fail: } if (*pwd->pw_shell == '\0') pwd->pw_shell = _PATH_BSHELL; - (void) setgid((gid_t)pwd->pw_gid); - initgroups(pwd->pw_name, pwd->pw_gid); - (void) setuid((uid_t)pwd->pw_uid); environ = envinit; strncat(homedir, pwd->pw_dir, sizeof(homedir)-6); strcat(path, _PATH_DEFPATH); @@ -683,6 +722,17 @@ fail: cp++; else cp = pwd->pw_shell; +#ifdef LOGIN_CAP + if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETALL) != 0) { + syslog(LOG_ERR, "setusercontext: %m"); + exit(1); + } + login_close(lc); +#else + (void) setgid((gid_t)pwd->pw_gid); + initgroups(pwd->pw_name, pwd->pw_gid); + (void) setuid((uid_t)pwd->pw_uid); +#endif endpwent(); if (log_success || pwd->pw_uid == 0) { #ifdef KERBEROS |
