diff options
-rw-r--r-- | etc/inc/auth.inc | 1792 |
1 files changed, 896 insertions, 896 deletions
diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc index 9b82260..09e0273 100644 --- a/etc/inc/auth.inc +++ b/etc/inc/auth.inc @@ -1,265 +1,265 @@ -<?php
-/* $Id$ */
-/*
- Copyright (C) 2007, 2008 Scott Ullrich <sullrich@gmail.com>
- All rights reserved.
-
- Copyright (C) 2005-2006 Bill Marquette <bill.marquette@gmail.com>
- All rights reserved.
-
- Copyright (C) 2006 Paul Taylor <paultaylor@winn-dixie.com>.
- All rights reserved.
-
- Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>.
- All rights reserved.
-
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
-
- 1. Redistributions of source code must retain the above copyright notice,
- this list of conditions and the following disclaimer.
-
- 2. Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in the
- documentation and/or other materials provided with the distribution.
-
- THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
- INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
- AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
- OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- POSSIBILITY OF SUCH DAMAGE.
-
- DISABLE_PHP_LINT_CHECKING
-*/
-
-/*
- * NOTE : Portions of the mschapv2 support was based on the BSD licensed CHAP.php
- * file courtesy of Michael Retterklieber.
- */
-
-require_once("functions.inc");
-
-$groupindex = index_groups();
-$userindex = index_users();
-
-function index_groups() {
- global $g, $debug, $config, $groupindex;
-
- $groupindex = array();
-
- if (isset($config['system']['group'])) {
- $i = 0;
- foreach($config['system']['group'] as $groupent) {
- $groupindex[$groupent['name']] = $i;
- $i++;
- }
- }
-
- return ($groupindex);
-}
-
-function index_users() {
- global $g, $debug, $config;
-
- if (isset($config['system']['user'])) {
- $i = 0;
- foreach($config['system']['user'] as $userent) {
- $userindex[$userent['name']] = $i;
- $i++;
- }
- }
-
- return ($userindex);
-}
-
-function & getUserEntry($name) {
- global $debug, $config, $userindex;
- if (isset($userindex[$name]))
- return $config['system']['user'][$userindex[$name]];
-}
-
-function & getUserEntryByUID($uid) {
- global $debug, $config;
- foreach ($config['system']['user'] as & $user)
- if ($user['uid'] == $uid)
- return $user;
-
- return false;
-}
-
-function & getGroupEntry($name) {
- global $debug, $config, $groupindex;
- if (isset($groupindex[$name]))
- return $config['system']['group'][$groupindex[$name]];
-}
-
-function & getGroupEntryByGID($gid) {
- global $debug, $config;
- foreach ($config['system']['group'] as & $group)
- if ($group['gid'] == $gid)
- return $group;
-
- return false;
-}
-
-function local_backed($username, $passwd) {
-
- $user = getUserEntry($username);
- if (!$user)
- return false;
-
- if ($user['password'])
- {
- $passwd = crypt($passwd, $user['password']);
- if ($passwd == $user['password'])
- return true;
- }
-
- if ($user['md5-hash'])
- {
- $passwd = md5($passwd);
- if ($passwd == $user['md5-hash'])
- return true;
- }
-
- return false;
-}
-
-function local_sync_accounts() {
- global $debug, $config;
- conf_mount_rw();
-
- /* remove local users to avoid uid conflicts */
- $fd = popen("/usr/sbin/pw usershow -a", "r");
- if ($fd) {
- while (!feof($fd)) {
- $line = explode(":",fgets($fd));
- if (!strncmp($line[0], "_", 1))
- continue;
- if ($line[2] < 2000)
- continue;
- if ($line[2] > 65000)
- continue;
- $cmd = "/usr/sbin/pw userdel {$line[2]}";
- if($debug)
- log_error("Running: {$cmd}");
- mwexec($cmd);
- }
- pclose($fd);
- }
-
- /* remove local groups to avoid gid conflicts */
- $gids = array();
- $fd = popen("/usr/sbin/pw groupshow -a", "r");
- if ($fd) {
- while (!feof($fd)) {
- $line = explode(":",fgets($fd));
- if (!strncmp($line[0], "_", 1))
- continue;
- if ($line[2] < 2000)
- continue;
- if ($line[2] > 65000)
- continue;
- $cmd = "/usr/sbin/pw groupdel {$line[2]}";
- if($debug)
- log_error("Running: {$cmd}");
- mwexec($cmd);
- }
- pclose($fd);
- }
-
- /* make sure the all group exists */
- $allgrp = getGroupEntryByGID(1998);
- local_group_set($allgrp, true);
-
- /* sync all local users */
- if (is_array($config['system']['user']))
- foreach ($config['system']['user'] as $user)
- local_user_set($user);
-
- /* sync all local groups */
- if (is_array($config['system']['group']))
- foreach ($config['system']['group'] as $group)
- local_group_set($group);
-
- conf_mount_ro();
-
-}
-
-function local_user_set(& $user) {
- global $g, $debug;
-
- $home_base = "/home/";
- $user_uid = $user['uid'];
- $user_name = $user['name'];
- $user_home = "{$home_base}/$user_name";
- $user_shell = "/etc/rc.initial";
- $user_group = "nobody";
-
- // Ensure $home_base exists and is writable
- if (!is_dir($home_base))
- mkdir($home_base, 0755);
-
- // Ensure $user_home exists and is writable
- if(!is_dir($user_home))
- mkdir($user_home, 0755);
-
- /* configure shell type */
- if (!userHasPrivilege($user, "user-shell-access")) {
- if (!userHasPrivilege($user, "user-copy-files"))
- $user_shell = "/sbin/nologin";
- else
- $user_shell = "/usr/local/bin/scponly";
- }
-
- /* root user special handling */
- if ($user_uid == 0) {
- $cmd = "/usr/sbin/pw usermod -q -n root -s /bin/sh -H 0";
- if($debug)
- log_error("Running: {$cmd}");
- $fd = popen($cmd, "w");
- fwrite($fd, $user['password']);
- pclose($fd);
- $user_group = "wheel";
- }
-
- /* read from pw db */
- $fd = popen("/usr/sbin/pw usershow {$user_name} 2>&1", "r");
- $pwread = fgets($fd);
- pclose($fd);
-
- /* determine add or mod */
- if (!strncmp($pwread, "pw:", 3))
- $user_op = "useradd";
- else
- $user_op = "usermod";
-
- /* add or mod pw db */
- $cmd = "/usr/sbin/pw {$user_op} -q -u {$user_uid} -n {$user_name}".
- " -g {$user_group} -G all -s {$user_shell} -d {$user_home}".
- " -c ".escapeshellarg($user['fullname'])." -H 0 2>&1";
-
- if($debug)
- log_error("Running: {$cmd}");
- $fd = popen($cmd, "w");
- fwrite($fd, $user['password']);
- pclose($fd);
-
- /* create user directory if required */
- if (!is_dir($user_home)) {
- mkdir($user_home, 0700);
- mwexec("cp /root/.* {$home_base}/");
- }
- chown($user_home, $user_name);
- chgrp($user_home, $user_group);
-
- /* write out ssh authorized key file */
- if($user['authorizedkeys']) {
+<?php +/* $Id$ */ +/* + Copyright (C) 2007, 2008 Scott Ullrich <sullrich@gmail.com> + All rights reserved. + + Copyright (C) 2005-2006 Bill Marquette <bill.marquette@gmail.com> + All rights reserved. + + Copyright (C) 2006 Paul Taylor <paultaylor@winn-dixie.com>. + All rights reserved. + + Copyright (C) 2003-2006 Manuel Kasper <mk@neon1.net>. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + DISABLE_PHP_LINT_CHECKING +*/ + +/* + * NOTE : Portions of the mschapv2 support was based on the BSD licensed CHAP.php + * file courtesy of Michael Retterklieber. + */ + +require_once("functions.inc"); + +$groupindex = index_groups(); +$userindex = index_users(); + +function index_groups() { + global $g, $debug, $config, $groupindex; + + $groupindex = array(); + + if (isset($config['system']['group'])) { + $i = 0; + foreach($config['system']['group'] as $groupent) { + $groupindex[$groupent['name']] = $i; + $i++; + } + } + + return ($groupindex); +} + +function index_users() { + global $g, $debug, $config; + + if (isset($config['system']['user'])) { + $i = 0; + foreach($config['system']['user'] as $userent) { + $userindex[$userent['name']] = $i; + $i++; + } + } + + return ($userindex); +} + +function & getUserEntry($name) { + global $debug, $config, $userindex; + if (isset($userindex[$name])) + return $config['system']['user'][$userindex[$name]]; +} + +function & getUserEntryByUID($uid) { + global $debug, $config; + foreach ($config['system']['user'] as & $user) + if ($user['uid'] == $uid) + return $user; + + return false; +} + +function & getGroupEntry($name) { + global $debug, $config, $groupindex; + if (isset($groupindex[$name])) + return $config['system']['group'][$groupindex[$name]]; +} + +function & getGroupEntryByGID($gid) { + global $debug, $config; + foreach ($config['system']['group'] as & $group) + if ($group['gid'] == $gid) + return $group; + + return false; +} + +function local_backed($username, $passwd) { + + $user = getUserEntry($username); + if (!$user) + return false; + + if ($user['password']) + { + $passwd = crypt($passwd, $user['password']); + if ($passwd == $user['password']) + return true; + } + + if ($user['md5-hash']) + { + $passwd = md5($passwd); + if ($passwd == $user['md5-hash']) + return true; + } + + return false; +} + +function local_sync_accounts() { + global $debug, $config; + conf_mount_rw(); + + /* remove local users to avoid uid conflicts */ + $fd = popen("/usr/sbin/pw usershow -a", "r"); + if ($fd) { + while (!feof($fd)) { + $line = explode(":",fgets($fd)); + if (!strncmp($line[0], "_", 1)) + continue; + if ($line[2] < 2000) + continue; + if ($line[2] > 65000) + continue; + $cmd = "/usr/sbin/pw userdel {$line[2]}"; + if($debug) + log_error("Running: {$cmd}"); + mwexec($cmd); + } + pclose($fd); + } + + /* remove local groups to avoid gid conflicts */ + $gids = array(); + $fd = popen("/usr/sbin/pw groupshow -a", "r"); + if ($fd) { + while (!feof($fd)) { + $line = explode(":",fgets($fd)); + if (!strncmp($line[0], "_", 1)) + continue; + if ($line[2] < 2000) + continue; + if ($line[2] > 65000) + continue; + $cmd = "/usr/sbin/pw groupdel {$line[2]}"; + if($debug) + log_error("Running: {$cmd}"); + mwexec($cmd); + } + pclose($fd); + } + + /* make sure the all group exists */ + $allgrp = getGroupEntryByGID(1998); + local_group_set($allgrp, true); + + /* sync all local users */ + if (is_array($config['system']['user'])) + foreach ($config['system']['user'] as $user) + local_user_set($user); + + /* sync all local groups */ + if (is_array($config['system']['group'])) + foreach ($config['system']['group'] as $group) + local_group_set($group); + + conf_mount_ro(); + +} + +function local_user_set(& $user) { + global $g, $debug; + + $home_base = "/home/"; + $user_uid = $user['uid']; + $user_name = $user['name']; + $user_home = "{$home_base}/$user_name"; + $user_shell = "/etc/rc.initial"; + $user_group = "nobody"; + + // Ensure $home_base exists and is writable + if (!is_dir($home_base)) + mkdir($home_base, 0755); + + // Ensure $user_home exists and is writable + if(!is_dir($user_home)) + mkdir($user_home, 0755); + + /* configure shell type */ + if (!userHasPrivilege($user, "user-shell-access")) { + if (!userHasPrivilege($user, "user-copy-files")) + $user_shell = "/sbin/nologin"; + else + $user_shell = "/usr/local/bin/scponly"; + } + + /* root user special handling */ + if ($user_uid == 0) { + $cmd = "/usr/sbin/pw usermod -q -n root -s /bin/sh -H 0"; + if($debug) + log_error("Running: {$cmd}"); + $fd = popen($cmd, "w"); + fwrite($fd, $user['password']); + pclose($fd); + $user_group = "wheel"; + } + + /* read from pw db */ + $fd = popen("/usr/sbin/pw usershow {$user_name} 2>&1", "r"); + $pwread = fgets($fd); + pclose($fd); + + /* determine add or mod */ + if (!strncmp($pwread, "pw:", 3)) + $user_op = "useradd"; + else + $user_op = "usermod"; + + /* add or mod pw db */ + $cmd = "/usr/sbin/pw {$user_op} -q -u {$user_uid} -n {$user_name}". + " -g {$user_group} -G all -s {$user_shell} -d {$user_home}". + " -c ".escapeshellarg($user['fullname'])." -H 0 2>&1"; + + if($debug) + log_error("Running: {$cmd}"); + $fd = popen($cmd, "w"); + fwrite($fd, $user['password']); + pclose($fd); + + /* create user directory if required */ + if (!is_dir($user_home)) { + mkdir($user_home, 0700); + mwexec("cp /root/.* {$home_base}/"); + } + chown($user_home, $user_name); + chgrp($user_home, $user_group); + + /* write out ssh authorized key file */ + if($user['authorizedkeys']) { if (!is_dir("{$user_home}/.ssh")) { mkdir("{$user_home}/.ssh", 0700); chown("{$user_home}/.ssh", $user_name); @@ -267,638 +267,638 @@ function local_user_set(& $user) { $keys = base64_decode($user['authorizedkeys']); file_put_contents("{$user_home}/.ssh/authorized_keys", $keys); chown("{$user_home}/.ssh/authorized_keys", $user_name); - }
-}
-
-function local_user_del($user) {
- global $debug;
- /* remove all memberships */
- local_user_get_groups($user);
-
- /* delete from pw db */
- $cmd = "/usr/sbin/pw userdel {$user['name']}";
-
- if($debug)
- log_error("Running: {$cmd}");
- $fd = popen($cmd, "w");
- fwrite($fd, $user['password']);
- pclose($fd);
-}
-
-function local_user_set_password(& $user, $password) {
-
- $user['password'] = crypt($password);
- $user['md5-hash'] = md5($password);
-
- // Converts ascii to unicode.
- $astr = (string) $password;
- $ustr = '';
- for ($i = 0; $i < strlen($astr); $i++) {
- $a = ord($astr{$i}) << 8;
- $ustr.= sprintf("%X", $a);
- }
-
- // Generate the NT-HASH from the unicode string
- $user['nt-hash'] = bin2hex(mhash(MHASH_MD4, $ustr));
-}
-
-function local_user_get_groups($user, $all = false) {
- global $debug, $config;
-
- $groups = array();
- if (!is_array($config['system']['group']))
- return $groups;
-
- foreach ($config['system']['group'] as $group)
- if ( $all || ( !$all && ($group['name'] != "all")))
- if (is_array($group['member']))
- if (in_array($user['uid'], $group['member']))
- $groups[] = $group['name'];
-
- sort($groups);
-
- return $groups;
-
-}
-
-function local_user_set_groups($user, $new_groups = NULL ) {
- global $debug, $config, $groupindex;
-
- if (!is_array($config['system']['group']))
- return;
-
- $cur_groups = local_user_get_groups($user);
- $mod_groups = array();
-
- if (!is_array($new_groups))
- $new_groups = array();
-
- if (!is_array($cur_groups))
- $cur_groups = array();
-
- /* determine which memberships to add */
- foreach ($new_groups as $groupname) {
- if (in_array($groupname,$cur_groups))
- continue;
- $group = & $config['system']['group'][$groupindex[$groupname]];
- $group['member'][] = $user['uid'];
- $mod_groups[] = $group;
- }
-
- /* determine which memberships to remove */
- foreach ($cur_groups as $groupname) {
- if (in_array($groupname,$new_groups))
- continue;
- $group = & $config['system']['group'][$groupindex[$groupname]];
- $index = array_search($user['uid'], $group['member']);
- array_splice($group['member'], $index, 1);
- $mod_groups[] = $group;
- }
-
- /* sync all modified groups */
- foreach ($mod_groups as $group)
- local_group_set($group);
-}
-
-function local_group_set($group, $reset = false) {
- global $debug;
-
- $group_name = $group['name'];
- $group_gid = $group['gid'];
- $group_members = "''";
- if (!$reset && count($group['member']))
- $group_members = implode(",",$group['member']);
-
- /* read from group db */
- $fd = popen("/usr/sbin/pw groupshow {$group_name} 2>&1", "r");
- $pwread = fgets($fd);
- pclose($fd);
-
- /* determine add or mod */
- if (!strncmp($pwread, "pw:", 3))
- $group_op = "groupadd";
- else
- $group_op = "groupmod";
-
- /* add or mod group db */
- $cmd = "/usr/sbin/pw {$group_op} {$group_name} -g {$group_gid} -M {$group_members} 2>&1";
-
- if($debug)
- log_error("Running: {$cmd}");
- $fd = popen($cmd, "w");
- fwrite($fd, $user['password']);
- pclose($fd);
-
-}
-
-function local_group_del($group) {
- global $debug;
-
- /* delete from group db */
- $cmd = "/usr/sbin/pw groupdel {$group['name']}";
-
- if($debug)
- log_error("Running: {$cmd}");
- $fd = popen($cmd, "w");
- fwrite($fd, $user['password']);
- pclose($fd);
-
-}
-
-function ldap_test_connection() {
- global $debug, $config, $g;
-
- $ldapserver = $config['system']['webgui']['ldapserver'];
- $ldapbindun = $config['system']['webgui']['ldapbindun'];
- $ldapbindpw = $config['system']['webgui']['ldapbindpw'];
-
- if (!($ldap = ldap_connect($ldapserver)))
- return false;
-
- return true;
-}
-
-function ldap_test_bind() {
- global $debug, $config, $g;
-
- $ldapserver = $config['system']['webgui']['ldapserver'];
- $ldapbindun = $config['system']['webgui']['ldapbindun'];
- $ldapbindpw = $config['system']['webgui']['ldapbindpw'];
-
- if (!($ldap = ldap_connect($ldapserver)))
- return false;
-
- ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
- ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
-
- if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw)))
- return false;
-
- return true;
-}
-
-function ldap_get_user_ous($show_complete_ou=true) {
- global $debug, $config, $g;
-
- if(!function_exists("ldap_connect"))
- return;
-
- $ldapserver = $config['system']['webgui']['ldapserver'];
- $ldapbindun = $config['system']['webgui']['ldapbindun'];
- $ldapbindpw = $config['system']['webgui']['ldapbindpw'];
- $ldapsearchbase = "{$config['system']['webgui']['ldapsearchbase']}";
- $ldaptype = $config['system']['webgui']['backend'];
-
- $ldapfilter = "(ou=*)";
- putenv('LDAPTLS_REQCERT=never');
- if (!($ldap = ldap_connect($ldapserver))) {
- log_error("ERROR! ldap_get_groups() could not connect to server {$ldapserver}. Defaulting to built-in local_backed()");
- $status = local_backed($username, $passwd);
- return $status;
- }
-
- ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
- ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
-
- if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
- log_error("ERROR! ldap_get_groups() could not bind to {$ldapserver} - {$ldapfilter}. Defaulting to built-in local_backed()");
- $status = local_backed($username, $passwd);
- return $status;
- }
-
- $search = ldap_search($ldap, $ldapsearchbase, $ldapfilter);
-
- $info = ldap_get_entries($ldap, $search);
-
- $ous = array();
-
- if (is_array($info)) {
- foreach ($info as $inf) {
- if (!$show_complete_ou) {
- $inf_split = split(",", $inf['dn']);
- $ou = $inf_split[0];
- $ou = str_replace("OU=","", $ou);
- } else
- if($inf['dn'])
- $ou = $inf['dn'];
- if($ou)
- $ous[] = $ou;
- }
- }
-
- //Tack on the default Users container for AD since its non-standard
- if($ldaptype == 'ldap')
- $ous[] = "CN=Users,".$ldapsearchbase;
-
- return $ous;
-}
-
-function ldap_get_groups($username) {
- global $debug, $config;
-
- if(!function_exists("ldap_connect"))
- return;
-
- if(!$username)
- return false;
-
- if(stristr($username, "@")) {
- $username_split=split("\@", $username);
- $username = $username_split[0];
- }
-
- if(stristr($username, "\\")) {
- $username_split=split("\\", $username);
- $username = $username_split[0];
- }
-
- //log_error("Getting LDAP groups for {$username}.");
-
- $ldapserver = $config['system']['webgui']['ldapserver'];
- $ldapbindun = $config['system']['webgui']['ldapbindun'];
- $ldapbindpw = $config['system']['webgui']['ldapbindpw'];
- $ldapfilter = $config['system']['webgui']['ldapfilter'];
- $ldapfilter = str_replace("\$username", $username, $ldapfilter);
- $ldapgroupattribute = $config['system']['webgui']['ldapgroupattribute'];
- $ldapdn = $_SESSION['ldapdn'];
-
- /*Convert attribute to lowercase. php ldap arrays put everything in lowercase */
- $ldapgroupattribute = strtolower($ldapgroupattribute);
-
- /* connect and see if server is up */
- putenv('LDAPTLS_REQCERT=never');
- if (!($ldap = ldap_connect($ldapserver))) {
- log_error("ERROR! ldap_get_groups() could not connect to server {$ldapserver}. Defaulting to built-in local_backed()");
- $status = local_backed($username, $passwd);
- return $status;
- }
-
- ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
- ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
-
- /* bind as user that has rights to read group attributes */
- if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
- log_error("ERROR! ldap_get_groups() could not bind to {$ldapserver} - {$ldapfilter}. Defaulting to built-in local_backed()");
- $status = local_backed($username, $passwd);
- return $status;
- }
-
- /* get groups from DN found */
- /* use ldap_read instead of search so we don't have to do a bunch of extra work */
- /* since we know the DN is in $_SESSION['ldapdn'] */
- //$search = ldap_read($ldap, $ldapdn, "(objectclass=*)", array($ldapgroupattribute));
- $search = ldap_read($ldap, $ldapdn, $ldapfilter, array($ldapgroupattribute));
- $info = ldap_get_entries($ldap, $search);
-
- $countem = $info["count"];
- $memberof = array();
-
- if(is_array($info[0][$ldapgroupattribute])) {
- /* Iterate through the groups and throw them into an array */
- foreach ($info[0][$ldapgroupattribute] as $member) {
- if (stristr($member, "CN=") !== false) {
- $membersplit = split(",", $member);
- $memberof[] = preg_replace("/CN=/i", "", $membersplit[0]);
- }
- }
- }
-
- /* Time to close LDAP connection */
- ldap_close($ldap);
-
- $groups = print_r($memberof,true);
-
- //log_error("Returning groups ".$groups." for user $username");
-
- return $memberof;
-}
-
-function ldap_backed($username, $passwd) {
- global $debug, $config;
-
- if(!$username)
- return;
-
- if(!function_exists("ldap_connect"))
- return;
-
- $adbindas = $username;
-
- if(stristr($username, "@")) {
- $username_split=split("\@", $username);
- $username = $username_split[0];
- }
- if(stristr($username, "\\")) {
- $username_split=split("\\", $username);
- $username = $username_split[0];
- }
-
- $ldapserver = $config['system']['webgui']['ldapserver'];
- $ldapbindun = $config['system']['webgui']['ldapbindun'];
- $ldapbindpw = $config['system']['webgui']['ldapbindpw'];
- $ldapauthcont = $config['system']['webgui']['ldapauthcontainers'];
- $ldapnameattribute = $config['system']['webgui']['ldapnameattribute'];
- $ldapfilter = $config['system']['webgui']['ldapfilter'];
- $ldaptype = $config['system']['webgui']['backend'];
- $ldapfilter = str_replace("\$username", $username, $ldapfilter);
-
- /* first check if there is even an LDAP server populated */
- if(!$ldapserver) {
- log_error("ERROR! ldap_backed() backed selected with no LDAP authentication server defined. Defaulting to built-in local_backed(). Visit System -> User Manager -> Settings.");
- $status = local_backed($username, $passwd);
- return $status;
- }
-
- ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
- ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
-
- /* Make sure we can connect to LDAP */
- putenv('LDAPTLS_REQCERT=never');
- if (!($ldap = ldap_connect($ldapserver))) {
- log_error("ERROR! ldap_backed() could not connect to server {$ldapserver} - {$ldapfilter}. Defaulting to built-in local_backed(). Visit System -> User Manager -> Settings.");
- $status = local_backed($username, $passwd);
- return $status;
- }
- /* ok, its up. now, lets bind as the bind user so we can search it */
- if (!($res = ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
- log_error("ERROR! ldap_backed() could not bind to {$ldapserver} - {$ldapfilter}. Defaulting to built-in local_backed()");
- ldap_close($ldap);
- $status = local_backed($username, $passwd);
- return $status;
- }
-
- /* Get LDAP Authcontainers and split em up. */
- $ldac_split = split(";", $ldapauthcont);
-
- /* now count how many there are */
- $containers = count($ldac_split);
- log_error("Number of Authentication Containers to search for $username is {$containers}");
-
- /* setup the usercount so we think we havn't found anyone yet */
- $usercount = 0;
-
- /******************************/
- /* Currently LDAP Types are */
- /* LDAP = Active Directory */
- /* LDAPOTHER = eDir/Openldap */
- /******************************/
-
- /*****************************************************************/
- /* Now Active Directory We keep this seperate for future addons. */
- /*****************************************************************/
- /* Now LDAP other. eDirectory or Netscape or Sunone or OpenLDAP */
- /*****************************************************************/
- /* We First find the user based on username and filter */
- /* Then, once we find the first occurance of that person */
- /* We set seesion variables to ponit to the OU and DN of the */
- /* Person. To later be used by ldap_get_groups. */
- /* that way we don't have to search twice. */
- /*****************************************************************/
- if ($ldaptype == 'ldap'){
- log_error("Now Searching for {$username} in Active directory.");
- /* Iterate through the user containers for search */
- for ($i=0;$i<$containers;$i++){
- /* Make sure we just use the first user we find */
- log_error("Now Searching in {$ldac_split[$i]} for {$ldapfilter}.");
- $search = ldap_search($ldap,$ldac_split[$i],$ldapfilter);
- $info = ldap_get_entries($ldap,$search);
- $matches = $info['count'];
- log_error("Matches Found = {$matches}");
- if ($matches == 1){
- $_SESSION['ldapdn'] = $info[0]['dn'];
- $_SESSION['ldapou'] = $ldac_split[$i];
- $_SESSION['ldapon'] = "true";
- $ldapdn = $_SESSION['ldapdn'];
- $userou = $_SESSION['ldapou'];
- break;
- }
- }
-
- if ($matches == 1){
- $binduser = $adbindas;
- log_error("Going to login as {$username} - DN = {$_SESSION['ldapdn']}");
- }
- if ($matches != 1){
- log_error("ERROR! Either LDAP search failed, or multiple users were found");
- $status = local_backed($username, $passwd);
- $_SESSION['ldapon'] = "false";
- ldap_close($ldap);
- return $status;
- }
- }
-
- /*****************************************************************/
- /* Now LDAP other. eDirectory or Netscape or Sunone or OpenLDAP */
- /*****************************************************************/
- /* We First find the user based on username and filter */
- /* Then, once we find the first occurance of that person */
- /* We set seesion variables to ponit to the OU and DN of the */
- /* Person. To later be used by ldap_get_groups. */
- /* that way we don't have to search twice. */
- /*****************************************************************/
- if ($ldaptype == 'ldapother'){
- log_error("Now Searching for {$username} in LDAP.");
- /* Iterate through the user containers for search */
- for ($i=0;$i<$containers;$i++){
- /* Make sure we just use the first user we find */
- log_error("Now searching in {$ldac_split[$i]} for {$ldapfilter}.");
- $search = ldap_search($ldap,$ldac_split[$i],$ldapfilter);
- $info = ldap_get_entries($ldap,$search);
- $matches = $info['count'];
- log_error("Matches Found = {$matches}.");
-
- if ($matches == 1){
- $_SESSION['ldapdn'] = $info[0]['dn'];
- $_SESSION['ldapou'] = $ldac_split[$i];
- $_SESSION['ldapon'] = "true";
- $ldapdn = $_SESSION['ldapdn'];
- $userou = $_SESSION['ldapou'];
- break;
- }
- }
- if($matches == 1){
- $binduser = $ldapnameattribute."=".$username.",".$userou;
- log_error("Going to login as {$username} - DN = {$_SESSION['ldapdn']}");
- }
- if($matches != 1){
- log_error("ERROR! Either LDAP search failed, or multiple users were found");
- $status = local_backed($username, $passwd);
- ldap_close($ldap);
- $_SESSION['ldapon'] = "false";
- return $status;
- }
- }
-
- /* Now lets bind as the user we found */
- if (!($res = @ldap_bind($ldap, $binduser, $passwd))) {
- log_error("ERROR! ldap_backed() could not bind to {$ldapserver} - {$username} - {$passwd}. Defaulting to built-in local_backed(). Visit System -> User Manager -> Settings.");
- $status = local_backed($username, $passwd);
- return $status;
- }
-
- log_error("$binduser succesfully logged in via LDAP.");
-
- /* At this point we are bound to LDAP so the user was auth'd okay. */
- return true;
-}
-
-function radius_backed($username, $passwd){
- global $debug, $config, $debug;
- $ret = false;
- $radiusservers = $config['system']['radius']['servers'];
-
- $rauth = new Auth_RADIUS_PAP($username, $passwd);
- /* Add a new servers to our instance */
- foreach ($radiusservers as $radsrv)
- $rauth->addServer($radsrv['ipaddr'], $radsrv['port'], $radsrv['sharedsecret']);
-
- if (!$rauth->start()) {
- $retvalue['auth_val'] = 1;
- $retvalue['error'] = $rauth->getError();
- if ($debug)
- printf("Radius start: %s<br>\n", $retvalue['error']);
- }
-
- // XXX - billm - somewhere in here we need to handle securid challenge/response
-
- /* Send request */
- $result = $rauth->send();
- if (PEAR::isError($result)) {
- $retvalue['auth_val'] = 1;
- $retvalue['error'] = $result->getMessage();
- if ($debug)
- printf("Radius send failed: %s<br>\n", $retvalue['error']);
- } else if ($result === true) {
- $retvalue['auth_val'] = 2;
- if ($debug)
- printf(gettext("Radius Auth succeeded")."<br>\n");
- $ret = true;
- } else {
- $retvalue['auth_val'] = 3;
- if ($debug)
- printf(gettext("Radius Auth rejected")."<br>\n");
- }
-
- // close OO RADIUS_AUTHENTICATION
- $rauth->close();
-
- return $ret;
-}
-
-function session_auth($backing) {
- global $g, $debug, $HTTP_SERVER_VARS, $userindex, $config;
-
- session_start();
-
- /* Validate incoming login request */
- if (isset($_POST['login'])) {
- if ($backing($_POST['usernamefld'], $_POST['passwordfld'])) {
- $_SESSION['Logged_In'] = "True";
- $_SESSION['Username'] = $_POST['usernamefld'];
- $_SESSION['last_access'] = time();
- log_error("Successful login for user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}");
- } else {
- /* give the user a more detailed error message */
- if (isset($userindex[$_POST['usernamefld']])) {
- $_SESSION['Login_Error'] = "Username or Password incorrect";
- log_error("Wrong password entered for user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}");
- if(isAjax()) {
- echo "showajaxmessage('{$_SESSION['Login_Error']}');";
- return;
- }
- } else {
- $_SESSION['Login_Error'] = "Username or Password incorrect";
- log_error("Attempted login for invalid user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}");
- if(isAjax()) {
- echo "showajaxmessage('{$_SESSION['Login_Error']}');";
- return;
- }
- }
- }
- }
-
- /* Show login page if they aren't logged in */
- if (empty($_SESSION['Logged_In'])) {
- /* Don't display login forms to AJAX */
- if (isAjax())
- return false;
- require_once("authgui.inc");
- display_login_form();
- return false;
- }
-
- /* If session timeout isn't set, we don't mark sessions stale */
- if (!isset($config['system']['webgui']['session_timeout']) ||
- $config['system']['webgui']['session_timeout'] == 0 ||
- $config['system']['webgui']['session_timeout'] == "")
- $_SESSION['last_access'] = time();
- else {
- /* Check for stale session */
- if ($_SESSION['last_access'] < (time() - ($config['system']['webgui']['session_timeout'] * 60))) {
- $_GET['logout'] = true;
- $_SESSION['Logout'] = true;
- } else {
- /* only update if it wasn't ajax */
- if (!isAjax())
- $_SESSION['last_access'] = time();
- }
- }
-
- /* obtain user object */
- $user = getUserEntry($_SESSION['Username']);
-
- /* user hit the logout button */
- if (isset($_GET['logout'])) {
-
- if ($_SESSION['Logout'])
- log_error("Session timed out for user '{$_SESSION['Username']}' from: {$_SERVER['REMOTE_ADDR']}");
- else
- log_error("User logged out for user '{$_SESSION['Username']}' from: {$_SERVER['REMOTE_ADDR']}");
-
- /* wipe out $_SESSION */
- $_SESSION = array();
-
- if (isset($_COOKIE[session_name()]))
- setcookie(session_name(), '', time()-42000, '/');
-
- /* and destroy it */
- session_destroy();
-
- $scriptName = split("/", $_SERVER["SCRIPT_FILENAME"]);
- $scriptElms = count($scriptName);
- $scriptName = $scriptName[$scriptElms-1];
-
- if (isAjax())
- return false;
-
- /* redirect to page the user is on, it'll prompt them to login again */
- pfSenseHeader($scriptName);
-
- return false;
- }
-
- /*
- * this is for debugging purpose if you do not want to use Ajax
- * to submit a HTML form. It basically diables the observation
- * of the submit event and hence does not trigger Ajax.
- */
- if ($_GET['disable_ajax']) {
- $_SESSION['NO_AJAX'] = "True";
- $HTTP_SERVER_VARS['AUTH_USER'] = $_SESSION['Username'];
- return true;
- }
-
- /*
- * Same to re-enable Ajax.
- */
- if ($_GET['enable_ajax']) {
- unset($_SESSION['NO_AJAX']);
- $HTTP_SERVER_VARS['AUTH_USER'] = $_SESSION['Username'];
- return true;
- }
-
- $HTTP_SERVER_VARS['AUTH_USER'] = $_SESSION['Username'];
- return true;
-}
-
+ } +} + +function local_user_del($user) { + global $debug; + /* remove all memberships */ + local_user_get_groups($user); + + /* delete from pw db */ + $cmd = "/usr/sbin/pw userdel {$user['name']}"; + + if($debug) + log_error("Running: {$cmd}"); + $fd = popen($cmd, "w"); + fwrite($fd, $user['password']); + pclose($fd); +} + +function local_user_set_password(& $user, $password) { + + $user['password'] = crypt($password); + $user['md5-hash'] = md5($password); + + // Converts ascii to unicode. + $astr = (string) $password; + $ustr = ''; + for ($i = 0; $i < strlen($astr); $i++) { + $a = ord($astr{$i}) << 8; + $ustr.= sprintf("%X", $a); + } + + // Generate the NT-HASH from the unicode string + $user['nt-hash'] = bin2hex(mhash(MHASH_MD4, $ustr)); +} + +function local_user_get_groups($user, $all = false) { + global $debug, $config; + + $groups = array(); + if (!is_array($config['system']['group'])) + return $groups; + + foreach ($config['system']['group'] as $group) + if ( $all || ( !$all && ($group['name'] != "all"))) + if (is_array($group['member'])) + if (in_array($user['uid'], $group['member'])) + $groups[] = $group['name']; + + sort($groups); + + return $groups; + +} + +function local_user_set_groups($user, $new_groups = NULL ) { + global $debug, $config, $groupindex; + + if (!is_array($config['system']['group'])) + return; + + $cur_groups = local_user_get_groups($user); + $mod_groups = array(); + + if (!is_array($new_groups)) + $new_groups = array(); + + if (!is_array($cur_groups)) + $cur_groups = array(); + + /* determine which memberships to add */ + foreach ($new_groups as $groupname) { + if (in_array($groupname,$cur_groups)) + continue; + $group = & $config['system']['group'][$groupindex[$groupname]]; + $group['member'][] = $user['uid']; + $mod_groups[] = $group; + } + + /* determine which memberships to remove */ + foreach ($cur_groups as $groupname) { + if (in_array($groupname,$new_groups)) + continue; + $group = & $config['system']['group'][$groupindex[$groupname]]; + $index = array_search($user['uid'], $group['member']); + array_splice($group['member'], $index, 1); + $mod_groups[] = $group; + } + + /* sync all modified groups */ + foreach ($mod_groups as $group) + local_group_set($group); +} + +function local_group_set($group, $reset = false) { + global $debug; + + $group_name = $group['name']; + $group_gid = $group['gid']; + $group_members = "''"; + if (!$reset && count($group['member'])) + $group_members = implode(",",$group['member']); + + /* read from group db */ + $fd = popen("/usr/sbin/pw groupshow {$group_name} 2>&1", "r"); + $pwread = fgets($fd); + pclose($fd); + + /* determine add or mod */ + if (!strncmp($pwread, "pw:", 3)) + $group_op = "groupadd"; + else + $group_op = "groupmod"; + + /* add or mod group db */ + $cmd = "/usr/sbin/pw {$group_op} {$group_name} -g {$group_gid} -M {$group_members} 2>&1"; + + if($debug) + log_error("Running: {$cmd}"); + $fd = popen($cmd, "w"); + fwrite($fd, $user['password']); + pclose($fd); + +} + +function local_group_del($group) { + global $debug; + + /* delete from group db */ + $cmd = "/usr/sbin/pw groupdel {$group['name']}"; + + if($debug) + log_error("Running: {$cmd}"); + $fd = popen($cmd, "w"); + fwrite($fd, $user['password']); + pclose($fd); + +} + +function ldap_test_connection() { + global $debug, $config, $g; + + $ldapserver = $config['system']['webgui']['ldapserver']; + $ldapbindun = $config['system']['webgui']['ldapbindun']; + $ldapbindpw = $config['system']['webgui']['ldapbindpw']; + + if (!($ldap = ldap_connect($ldapserver))) + return false; + + return true; +} + +function ldap_test_bind() { + global $debug, $config, $g; + + $ldapserver = $config['system']['webgui']['ldapserver']; + $ldapbindun = $config['system']['webgui']['ldapbindun']; + $ldapbindpw = $config['system']['webgui']['ldapbindpw']; + + if (!($ldap = ldap_connect($ldapserver))) + return false; + + ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0); + ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); + + if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) + return false; + + return true; +} + +function ldap_get_user_ous($show_complete_ou=true) { + global $debug, $config, $g; + + if(!function_exists("ldap_connect")) + return; + + $ldapserver = $config['system']['webgui']['ldapserver']; + $ldapbindun = $config['system']['webgui']['ldapbindun']; + $ldapbindpw = $config['system']['webgui']['ldapbindpw']; + $ldapsearchbase = "{$config['system']['webgui']['ldapsearchbase']}"; + $ldaptype = $config['system']['webgui']['backend']; + + $ldapfilter = "(ou=*)"; + putenv('LDAPTLS_REQCERT=never'); + if (!($ldap = ldap_connect($ldapserver))) { + log_error("ERROR! ldap_get_groups() could not connect to server {$ldapserver}. Defaulting to built-in local_backed()"); + $status = local_backed($username, $passwd); + return $status; + } + + ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0); + ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); + + if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) { + log_error("ERROR! ldap_get_groups() could not bind to {$ldapserver} - {$ldapfilter}. Defaulting to built-in local_backed()"); + $status = local_backed($username, $passwd); + return $status; + } + + $search = ldap_search($ldap, $ldapsearchbase, $ldapfilter); + + $info = ldap_get_entries($ldap, $search); + + $ous = array(); + + if (is_array($info)) { + foreach ($info as $inf) { + if (!$show_complete_ou) { + $inf_split = split(",", $inf['dn']); + $ou = $inf_split[0]; + $ou = str_replace("OU=","", $ou); + } else + if($inf['dn']) + $ou = $inf['dn']; + if($ou) + $ous[] = $ou; + } + } + + //Tack on the default Users container for AD since its non-standard + if($ldaptype == 'ldap') + $ous[] = "CN=Users,".$ldapsearchbase; + + return $ous; +} + +function ldap_get_groups($username) { + global $debug, $config; + + if(!function_exists("ldap_connect")) + return; + + if(!$username) + return false; + + if(stristr($username, "@")) { + $username_split=split("\@", $username); + $username = $username_split[0]; + } + + if(stristr($username, "\\")) { + $username_split=split("\\", $username); + $username = $username_split[0]; + } + + //log_error("Getting LDAP groups for {$username}."); + + $ldapserver = $config['system']['webgui']['ldapserver']; + $ldapbindun = $config['system']['webgui']['ldapbindun']; + $ldapbindpw = $config['system']['webgui']['ldapbindpw']; + $ldapfilter = $config['system']['webgui']['ldapfilter']; + $ldapfilter = str_replace("\$username", $username, $ldapfilter); + $ldapgroupattribute = $config['system']['webgui']['ldapgroupattribute']; + $ldapdn = $_SESSION['ldapdn']; + + /*Convert attribute to lowercase. php ldap arrays put everything in lowercase */ + $ldapgroupattribute = strtolower($ldapgroupattribute); + + /* connect and see if server is up */ + putenv('LDAPTLS_REQCERT=never'); + if (!($ldap = ldap_connect($ldapserver))) { + log_error("ERROR! ldap_get_groups() could not connect to server {$ldapserver}. Defaulting to built-in local_backed()"); + $status = local_backed($username, $passwd); + return $status; + } + + ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0); + ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); + + /* bind as user that has rights to read group attributes */ + if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) { + log_error("ERROR! ldap_get_groups() could not bind to {$ldapserver} - {$ldapfilter}. Defaulting to built-in local_backed()"); + $status = local_backed($username, $passwd); + return $status; + } + + /* get groups from DN found */ + /* use ldap_read instead of search so we don't have to do a bunch of extra work */ + /* since we know the DN is in $_SESSION['ldapdn'] */ + //$search = ldap_read($ldap, $ldapdn, "(objectclass=*)", array($ldapgroupattribute)); + $search = ldap_read($ldap, $ldapdn, $ldapfilter, array($ldapgroupattribute)); + $info = ldap_get_entries($ldap, $search); + + $countem = $info["count"]; + $memberof = array(); + + if(is_array($info[0][$ldapgroupattribute])) { + /* Iterate through the groups and throw them into an array */ + foreach ($info[0][$ldapgroupattribute] as $member) { + if (stristr($member, "CN=") !== false) { + $membersplit = split(",", $member); + $memberof[] = preg_replace("/CN=/i", "", $membersplit[0]); + } + } + } + + /* Time to close LDAP connection */ + ldap_close($ldap); + + $groups = print_r($memberof,true); + + //log_error("Returning groups ".$groups." for user $username"); + + return $memberof; +} + +function ldap_backed($username, $passwd) { + global $debug, $config; + + if(!$username) + return; + + if(!function_exists("ldap_connect")) + return; + + $adbindas = $username; + + if(stristr($username, "@")) { + $username_split=split("\@", $username); + $username = $username_split[0]; + } + if(stristr($username, "\\")) { + $username_split=split("\\", $username); + $username = $username_split[0]; + } + + $ldapserver = $config['system']['webgui']['ldapserver']; + $ldapbindun = $config['system']['webgui']['ldapbindun']; + $ldapbindpw = $config['system']['webgui']['ldapbindpw']; + $ldapauthcont = $config['system']['webgui']['ldapauthcontainers']; + $ldapnameattribute = $config['system']['webgui']['ldapnameattribute']; + $ldapfilter = $config['system']['webgui']['ldapfilter']; + $ldaptype = $config['system']['webgui']['backend']; + $ldapfilter = str_replace("\$username", $username, $ldapfilter); + + /* first check if there is even an LDAP server populated */ + if(!$ldapserver) { + log_error("ERROR! ldap_backed() backed selected with no LDAP authentication server defined. Defaulting to built-in local_backed(). Visit System -> User Manager -> Settings."); + $status = local_backed($username, $passwd); + return $status; + } + + ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0); + ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); + + /* Make sure we can connect to LDAP */ + putenv('LDAPTLS_REQCERT=never'); + if (!($ldap = ldap_connect($ldapserver))) { + log_error("ERROR! ldap_backed() could not connect to server {$ldapserver} - {$ldapfilter}. Defaulting to built-in local_backed(). Visit System -> User Manager -> Settings."); + $status = local_backed($username, $passwd); + return $status; + } + /* ok, its up. now, lets bind as the bind user so we can search it */ + if (!($res = ldap_bind($ldap, $ldapbindun, $ldapbindpw))) { + log_error("ERROR! ldap_backed() could not bind to {$ldapserver} - {$ldapfilter}. Defaulting to built-in local_backed()"); + ldap_close($ldap); + $status = local_backed($username, $passwd); + return $status; + } + + /* Get LDAP Authcontainers and split em up. */ + $ldac_split = split(";", $ldapauthcont); + + /* now count how many there are */ + $containers = count($ldac_split); + log_error("Number of Authentication Containers to search for $username is {$containers}"); + + /* setup the usercount so we think we havn't found anyone yet */ + $usercount = 0; + + /******************************/ + /* Currently LDAP Types are */ + /* LDAP = Active Directory */ + /* LDAPOTHER = eDir/Openldap */ + /******************************/ + + /*****************************************************************/ + /* Now Active Directory We keep this seperate for future addons. */ + /*****************************************************************/ + /* Now LDAP other. eDirectory or Netscape or Sunone or OpenLDAP */ + /*****************************************************************/ + /* We First find the user based on username and filter */ + /* Then, once we find the first occurance of that person */ + /* We set seesion variables to ponit to the OU and DN of the */ + /* Person. To later be used by ldap_get_groups. */ + /* that way we don't have to search twice. */ + /*****************************************************************/ + if ($ldaptype == 'ldap'){ + log_error("Now Searching for {$username} in Active directory."); + /* Iterate through the user containers for search */ + for ($i=0;$i<$containers;$i++){ + /* Make sure we just use the first user we find */ + log_error("Now Searching in {$ldac_split[$i]} for {$ldapfilter}."); + $search = ldap_search($ldap,$ldac_split[$i],$ldapfilter); + $info = ldap_get_entries($ldap,$search); + $matches = $info['count']; + log_error("Matches Found = {$matches}"); + if ($matches == 1){ + $_SESSION['ldapdn'] = $info[0]['dn']; + $_SESSION['ldapou'] = $ldac_split[$i]; + $_SESSION['ldapon'] = "true"; + $ldapdn = $_SESSION['ldapdn']; + $userou = $_SESSION['ldapou']; + break; + } + } + + if ($matches == 1){ + $binduser = $adbindas; + log_error("Going to login as {$username} - DN = {$_SESSION['ldapdn']}"); + } + if ($matches != 1){ + log_error("ERROR! Either LDAP search failed, or multiple users were found"); + $status = local_backed($username, $passwd); + $_SESSION['ldapon'] = "false"; + ldap_close($ldap); + return $status; + } + } + + /*****************************************************************/ + /* Now LDAP other. eDirectory or Netscape or Sunone or OpenLDAP */ + /*****************************************************************/ + /* We First find the user based on username and filter */ + /* Then, once we find the first occurance of that person */ + /* We set seesion variables to ponit to the OU and DN of the */ + /* Person. To later be used by ldap_get_groups. */ + /* that way we don't have to search twice. */ + /*****************************************************************/ + if ($ldaptype == 'ldapother'){ + log_error("Now Searching for {$username} in LDAP."); + /* Iterate through the user containers for search */ + for ($i=0;$i<$containers;$i++){ + /* Make sure we just use the first user we find */ + log_error("Now searching in {$ldac_split[$i]} for {$ldapfilter}."); + $search = ldap_search($ldap,$ldac_split[$i],$ldapfilter); + $info = ldap_get_entries($ldap,$search); + $matches = $info['count']; + log_error("Matches Found = {$matches}."); + + if ($matches == 1){ + $_SESSION['ldapdn'] = $info[0]['dn']; + $_SESSION['ldapou'] = $ldac_split[$i]; + $_SESSION['ldapon'] = "true"; + $ldapdn = $_SESSION['ldapdn']; + $userou = $_SESSION['ldapou']; + break; + } + } + if($matches == 1){ + $binduser = $ldapnameattribute."=".$username.",".$userou; + log_error("Going to login as {$username} - DN = {$_SESSION['ldapdn']}"); + } + if($matches != 1){ + log_error("ERROR! Either LDAP search failed, or multiple users were found"); + $status = local_backed($username, $passwd); + ldap_close($ldap); + $_SESSION['ldapon'] = "false"; + return $status; + } + } + + /* Now lets bind as the user we found */ + if (!($res = @ldap_bind($ldap, $binduser, $passwd))) { + log_error("ERROR! ldap_backed() could not bind to {$ldapserver} - {$username} - {$passwd}. Defaulting to built-in local_backed(). Visit System -> User Manager -> Settings."); + $status = local_backed($username, $passwd); + return $status; + } + + log_error("$binduser succesfully logged in via LDAP."); + + /* At this point we are bound to LDAP so the user was auth'd okay. */ + return true; +} + +function radius_backed($username, $passwd){ + global $debug, $config, $debug; + $ret = false; + $radiusservers = $config['system']['radius']['servers']; + + $rauth = new Auth_RADIUS_PAP($username, $passwd); + /* Add a new servers to our instance */ + foreach ($radiusservers as $radsrv) + $rauth->addServer($radsrv['ipaddr'], $radsrv['port'], $radsrv['sharedsecret']); + + if (!$rauth->start()) { + $retvalue['auth_val'] = 1; + $retvalue['error'] = $rauth->getError(); + if ($debug) + printf("Radius start: %s<br>\n", $retvalue['error']); + } + + // XXX - billm - somewhere in here we need to handle securid challenge/response + + /* Send request */ + $result = $rauth->send(); + if (PEAR::isError($result)) { + $retvalue['auth_val'] = 1; + $retvalue['error'] = $result->getMessage(); + if ($debug) + printf("Radius send failed: %s<br>\n", $retvalue['error']); + } else if ($result === true) { + $retvalue['auth_val'] = 2; + if ($debug) + printf(gettext("Radius Auth succeeded")."<br>\n"); + $ret = true; + } else { + $retvalue['auth_val'] = 3; + if ($debug) + printf(gettext("Radius Auth rejected")."<br>\n"); + } + + // close OO RADIUS_AUTHENTICATION + $rauth->close(); + + return $ret; +} + +function session_auth($backing) { + global $g, $debug, $HTTP_SERVER_VARS, $userindex, $config; + + session_start(); + + /* Validate incoming login request */ + if (isset($_POST['login'])) { + if ($backing($_POST['usernamefld'], $_POST['passwordfld'])) { + $_SESSION['Logged_In'] = "True"; + $_SESSION['Username'] = $_POST['usernamefld']; + $_SESSION['last_access'] = time(); + log_error("Successful login for user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}"); + } else { + /* give the user a more detailed error message */ + if (isset($userindex[$_POST['usernamefld']])) { + $_SESSION['Login_Error'] = "Username or Password incorrect"; + log_error("Wrong password entered for user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}"); + if(isAjax()) { + echo "showajaxmessage('{$_SESSION['Login_Error']}');"; + return; + } + } else { + $_SESSION['Login_Error'] = "Username or Password incorrect"; + log_error("Attempted login for invalid user '{$_POST['usernamefld']}' from: {$_SERVER['REMOTE_ADDR']}"); + if(isAjax()) { + echo "showajaxmessage('{$_SESSION['Login_Error']}');"; + return; + } + } + } + } + + /* Show login page if they aren't logged in */ + if (empty($_SESSION['Logged_In'])) { + /* Don't display login forms to AJAX */ + if (isAjax()) + return false; + require_once("authgui.inc"); + display_login_form(); + return false; + } + + /* If session timeout isn't set, we don't mark sessions stale */ + if (!isset($config['system']['webgui']['session_timeout']) || + $config['system']['webgui']['session_timeout'] == 0 || + $config['system']['webgui']['session_timeout'] == "") + $_SESSION['last_access'] = time(); + else { + /* Check for stale session */ + if ($_SESSION['last_access'] < (time() - ($config['system']['webgui']['session_timeout'] * 60))) { + $_GET['logout'] = true; + $_SESSION['Logout'] = true; + } else { + /* only update if it wasn't ajax */ + if (!isAjax()) + $_SESSION['last_access'] = time(); + } + } + + /* obtain user object */ + $user = getUserEntry($_SESSION['Username']); + + /* user hit the logout button */ + if (isset($_GET['logout'])) { + + if ($_SESSION['Logout']) + log_error("Session timed out for user '{$_SESSION['Username']}' from: {$_SERVER['REMOTE_ADDR']}"); + else + log_error("User logged out for user '{$_SESSION['Username']}' from: {$_SERVER['REMOTE_ADDR']}"); + + /* wipe out $_SESSION */ + $_SESSION = array(); + + if (isset($_COOKIE[session_name()])) + setcookie(session_name(), '', time()-42000, '/'); + + /* and destroy it */ + session_destroy(); + + $scriptName = split("/", $_SERVER["SCRIPT_FILENAME"]); + $scriptElms = count($scriptName); + $scriptName = $scriptName[$scriptElms-1]; + + if (isAjax()) + return false; + + /* redirect to page the user is on, it'll prompt them to login again */ + pfSenseHeader($scriptName); + + return false; + } + + /* + * this is for debugging purpose if you do not want to use Ajax + * to submit a HTML form. It basically diables the observation + * of the submit event and hence does not trigger Ajax. + */ + if ($_GET['disable_ajax']) { + $_SESSION['NO_AJAX'] = "True"; + $HTTP_SERVER_VARS['AUTH_USER'] = $_SESSION['Username']; + return true; + } + + /* + * Same to re-enable Ajax. + */ + if ($_GET['enable_ajax']) { + unset($_SESSION['NO_AJAX']); + $HTTP_SERVER_VARS['AUTH_USER'] = $_SESSION['Username']; + return true; + } + + $HTTP_SERVER_VARS['AUTH_USER'] = $_SESSION['Username']; + return true; +} + ?> |